Smoke14
Hot Shot
Hot Shot

Customize Windows 10 Start Menu Layout via UEM

This Blog is to help EUC Admin's to dynamically configure the Windows 10 Start Menu Layout for end user VDI sessions. This solution will use VMware AppVolumes and UEM to configure at user log on. This document will be configuring the Start Menu from the LOB aspect of entitlements.

Updates can be found here:

AppVolumes Configuration Settings

   

I suggest my clients to use AppStack Security Groups to make permissions and AppStack Entitlement easier to manage.  You will notice the VDI structure has an AppStack OU to support all the security groups for the AV entitlement. This portion should be able to be changed to how you have your AV entitlement and continue to follow this document.

Note: We will reference the IT LOB/Dept going forward.

Win10StartLayout_000001.png          

Assign your User Security Group(s) to the IT-DeptApps AppStack group.

Win10StartLayout_000002.png

  • AV assignment to 'Global_AppStack_ITDeptApps' security group
  • 14 applications were added to this AppStack, but not all will have a shortcut for the end user

That's all that is needed from the AV perspective.

Start Layout Modification Share Structure

This share structure will be the location you will maintain the default and all LOB/Dept Start Layout Modification files.Create a 'Start Layout' parent directory under your UEMConfig share and then your UEM Configuration Environment directory.Example: \\<DFS or Server>\uemshare\UEMConfig\UAT\_StartLayout

Win10StartLayout_000005.png

Note: I create UEM structure as: ...\UEMConfig\Environment\UEM Version\general

Win10StartLayout_000003.png

  1. Create a default LayoutModification.xml by on of the following.
    1. Spin up a clean Windows 10 VM and make all layout changes to your Start Menu to be your default layout.
      1. Then Export the layout by using this Powershell command, 'Export-StartLayout -Path C:\Users\$env:USERNAME\Desktop\LayoutModification.xml'
      2. Now copy that to your \\<DFS or Server>\uemshare\UEMConfig\UAT\_StartLayout parent directory.
    2. Create a new LayoutModification.xml file and copy my default entries in the 'StartLayout Configuration' section below.
  2. Create LOB/Dept sub-directories and make a copy of your default WSLMF to each directory.
  3. This Powershell Script has the following command 'Get-StartApps | where {$_.Name -ilike '*'}' that will list all application ID's that are installed or mounted by AV. you will see how this is used, later in the document.
  4. I use NotePad++ with verbose backup enabled to make a backup before I  make any modifications. This is optional and not required.

UEM & GPO Configuration Settings

These settings need to be followed as described here, especially the conditions for the  UEM 'ADMX-based Settings' definition. There is a '@Default' Start Layout for all users to have applied to their Windows 10 Start Menu.

Create '@Default' Win10 - Start Layout definition

You actually don't need this definition, but I am using this default Start Layout definition for two reasons.

      1. It's used as a template for the Department Layouts.
      2. If the user is not placed in one of the LOB/Dept security groups, you want a default layout to be applied. You could put it in your master images, but why not centrally manage from UEM.

Win10StartLayout_000006.png

      1. Go to 'ADMX-based Settings' under User Environment in UEM console.
      2. Create a new 'ADMX-based Settings' definition for Windows 10 Start Layout GPO.
      3. Name the definition to reference '@default' Start Layout GPO.
      4. After you have imported the Windows 10 ADMX and add /Start Menu and Taskbar/Start Layout/ policy setting.
      5. Open and enable 'Start Layout' setting and place the UNC path with full FileName.

      • Save all changes and close all dialog's back to main definition window and then select the 'Conditions' tab.
      • The following conditions need to be applied.
        1. Apply these two conditions, 'Operating System is Windows 10' and 'Company\Domain Users".
        2. Add all LOB/Dept Condition Sets or Domain Groups with the first condition, using the 'AND NOT' operator.
      • Make sure all proceeding conditions are using "OR NOT" as their combined operator, as shown in the image below.

Win10StartLayout_000007.png

Create 'LOB/Dept' Win10 - Start Layout definition

Win10StartLayout_000008.png

      1. Go to 'ADMX-based Settings' under User Environment in UEM console.
      2. Create a new 'ADMX-based Settings' definition for Windows 10 Start Layout GPO.
      3. Name the definition to reference 'LOB/Dept' Start Layout GPO.
      4. After you have imported the Windows 10 ADMX and add /Start Menu and Taskbar/Start Layout/ policy setting.
      5. Open and enable 'Start Layout' setting and place the UNC path with full FileName.

      • Save all changes and close all dialogs back to main definition window and then select the 'Conditions' tab.
      • The following conditions need to be applied.
        1. Apply these two conditions, 'Operating System is Windows 10' and, if you have a UAT pool, set a 'Horizon Pool condition".
        2. Add all LOB/Dept Condition Sets or Domain Groups, with the first condition using the 'AND' operator.

      • Make sure all proceeding conditions are using "OR" as their combined operator, as shown in the image below.

Win10StartLayout_000009.png

Windows 10 WSLMF Configurations

     All Start Layout XML files must be named LayoutModification.xml (Required)

Start layout for Windows 10 desktop edition Information

         Link to the full Microsoft DocumentThe OS reads the LayoutModification.xml file and only allows groups to be appended to Start. The groups have the following constraints:

      • 2 groups that are 6 columns wide, or equivalent to the width of 3 medium tiles.
      • 2 medium-sized tile rows in height. The OS ignores any tiles that are pinned beyond the second row.
      • No limit to the number of apps that can be pinned. There is a theoretical limit of 24 tiles per group (4 small tiles per medium square x 3 columns x 2 rows).

IT admins can provision the Start layout by creating a LayoutModification.xml file. This file supports several mechanisms to modify or replace the default Start layout and its tiles.There is one

Application ID parameter type for the 'start:Tile ' element of the XML.

      • AppUserModelID - Use to specify any of the following:

        • A Universal Windows app
        • A Windows 8 or Windows 8.1 app

There are two Application ID parameter types for the 'start:DesktopApplicationTile' element of the XML.

    • DesktopApplicationID / DesktopApplicationLinkPath - Use to specify any of the following:
      • A Classic Windows application with a known AppUserModelID
      • An application in a known folder with a link in a legacy Start Menu folder
      • A Classic Windows application link in a legacy Start Menu folder
      • A Web link tile with an associated .url file that is in a legacy Start Menu folder

In the examples below you will notice there is GUIDs in the values of DesktopApplicationID parameters. Microsoft has associated GUIDs to Windows folders, the full list can be viewed here.Here are a few of the top most GUIDs used from my experiences.

      • Desktop - B4BFCC3A-DB2C-424C-B029-7FE99A87C641
      • LocalAppData - F1B32785-6FBA-4FCF-9D55-7B8E7F157091
      • ProgramData - 62AB5D82-FDC1-4DC3-A9DD-070D1D495D97
      • ProgramFiles - 905E63B6-C1BF-494E-B29C-65B732D3D21A
      • ProgramFilesX64 - 6D809377-6AF0-444B-8957-A3773F02200E
      • ProgramFilesX86 - 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E
      • Programs - A77F5D77-2E2B-44C3-A6A2-ABA601054A51
      • StartMenu - 625B53C3-AB48-4EC1-BA1F-A1EF4146FC19
      • Startup - B97D20BB-F46A-4C97-BA10-5E3608430854
      • Windows - F38BF404-1D43-42F2-9305-67DE0B28FC23
      • System - 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7
For every entry in the XML file, YOU MUST HAVE A SHORTCUT CREATED IN UEM for this to work.

Examples Explained:

@Default - LayoutModification.xml

<LayoutModificationTemplate Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">

  <LayoutOptions StartTileGroupCellWidth="6" />

   <DefaultLayoutOverride>

    <StartLayoutCollection>

      <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">

       <start:Group Name="Company Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:Tile                   Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Internet Explorer\iexplore.exe" />

        </start:Group>

        <start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINWORD.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\EXCEL.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\POWERPNT.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\OUTLOOK.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\VISIO.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINPROJ.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\MSACCESS.EXE" />

        </start:Group>

        <start:Group Name="Company Self Support" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company Desktop Service\UEM Refresh.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Immidio\Flex Profiles\Flex+ Self-Support.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company Desktop Service\Devices and Printers.lnk" />

        </start:Group>

      </defaultlayout:StartLayout>

    </StartLayoutCollection>

  </DefaultLayoutOverride>

</LayoutModificationTemplate>

Win10StartLayout_000010.png

As you can see from the image above, my Start Menu displays all the shortcuts that are found in the @Default Stat Layout Modification XML and the title groups are not labeled by a department.

Adding Core AppStack to User Start Menu

Win10StartLayout_000011.png

Added 'Global_Users_UEM-IT_Prod' security group to 'Global_AppStack_CoreApps'

Win10StartLayout_000012.png

As you notice in the above image, by adding the CoreApps AppStack the End-User still uses the @Default Layout XML file and displays the 'VLC Player' tile in Company Apps.

Now let’s look into the LOB/Dept Layout Modification Settings for the IT LOB/Dept.

This example will show you how to create a Start Layout for any LOB/Dept,  but you can also added Sub-Dept groups, like Networking, Support, Security, and Server just to name a few.

I prefer to break my Start Layout XML file into LOB/Dept XML files, because I would rather have a little back-end management, then to have one Start Layout XML file that could cause a company-wide loss of the Start Menu from syntax or typo that someone makes while applying during production. You will see in the example below that you could in fact, with a little effort, put all your LOB/Dept/Sub-Dept/Groups all in one XML and manage them from UEM and AD permissions.

Note: This works for Windows 10 version 1511, but I hear their most likely will be a change in the August 2016 update from Microsoft. If there is a update to the way we can manage the Start Menu, you will need to make sure this process does not break with the new update.

Here are the IT-Dept and Sub-Group settings that will be used to show how this will work. I will be adding and removing permissions from the user via AD security groups. Skip down past this LayoutModification.xml example to see how you’re Start Menu will be viewed by an End-User when you apply the AD permissions.

LOB/Dept - LayoutModification.xml (Example: IT-Dept)

<LayoutModificationTemplate Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">

  <LayoutOptions StartTileGroupCellWidth="6" />

  <DefaultLayoutOverride>

    <StartLayoutCollection>

      <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">

        <start:Group Name="Company IT Dept Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:Tile                                Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Internet Explorer\iexplore.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\notepad.exe" />

          <start:Tile                                Size="2x2" Column="0" Row="2" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VideoLAN\VLC\vlc.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\CommFort\CommFort.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\FileZilla FTP Client\filezilla.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Notepad++\notepad++.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PuTTY\putty.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="6" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\TechSmith\Snagit 12\Snagit32.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="6" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company IT Apps\KeePass.lnk" />

        </start:Group>

        <start:Group Name="Company Network Team Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company Network Team Apps\CiscoASDM-IDMLauncher.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\InterMapper RemoteAccess\InterMapper_RemoteAccess.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Klever\Nothings\PumpKIN.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VanDyke Software\Clients\SecureCRT.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Wireshark\Wireshark.exe" />

        </start:Group>

        <start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINWORD.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\EXCEL.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\POWERPNT.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\OUTLOOK.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\VISIO.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINPROJ.EXE" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\MSACCESS.EXE" />

        </start:Group>

        <start:Group Name="Company OnBase Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company OnBase Apps\OnBase Client.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company OnBase Apps\Unity Client.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company OnBase Apps\OnBase Studio Client.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company OnBase Apps\OnBase Configuration Client.lnk" />

        </start:Group>

        <start:Group Name="Company Self Support" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company Desktop Service\UEM Refresh.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Immidio\Flex Profiles\Flex+ Self-Support.exe" />

          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company Desktop Service\Devices and Printers.lnk" />

        </start:Group>

      </defaultlayout:StartLayout>

    </StartLayoutCollection>

  </DefaultLayoutOverride>

</LayoutModificationTemplate>

Adding IT-Dept, Application Tiles to the User Start Menu:

Win10StartLayout_000013.png

Added 'Global_Users_UEM-IT_Prod' security group to 'Global_AppStack_IT-DeptApps'

<start:Group Name="Company IT Dept Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

   <start:Tile                                    Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />

   <start:DesktopApplicationTile     Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Internet Explorer\iexplore.exe" />

   <start:DesktopApplicationTile     Size="2x2" Column="4" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\notepad.exe" />

   <start:Tile                                    Size="2x2" Column="0" Row="2" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />

   <start:DesktopApplicationTile     Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VideoLAN\VLC\vlc.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\CommFort\CommFort.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\FileZilla FTP Client\filezilla.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="2" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Notepad++\notepad++.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="4" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PuTTY\putty.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="0" Row="6" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\TechSmith\Snagit 12\Snagit32.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="2" Row="6" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company IT Apps\KeePass.lnk" />

Win10StartLayout_000014.png

Adding IT-Dept/Network Team, Application Tiles to the User Start Menu:

Win10StartLayout_000015.png

Added 'Global_Users_UEM-IT_Prod' security group to 'Global_AppStack_NetworkTeamApps'

<start:Group Name="Company Network Team Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

  <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%\Microsoft\Windows\Start Menu\Programs\Company Network Team Apps\CiscoASDM-IDMLauncher.lnk" />

  <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\InterMapper RemoteAccess\InterMapper_RemoteAccess.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Klever\Nothings\PumpKIN.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VanDyke Software\Clients\SecureCRT.exe" />

  <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}\Wireshark\Wireshark.exe" />

Win10StartLayout_000016.png

      1. This tile is left blank, because the End-User does not have permission to use 'SecureCRT' application.
      2. In this case, there are no application settings to apply a tile for the application, in this location.

Adding Office Visio tile that is leveraging UEM App-Blocking definition, Application Tiles to the User Start Menu:

Win10StartLayout_000017.png

Added 'Global_Users_UEM-IT_Prod' security group to 'AppBlock\Global_Users_Microsoft_Visio'

<start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

   <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINWORD.EXE" />

   <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\EXCEL.EXE" />

   <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\POWERPNT.EXE" />

   <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\OUTLOOK.EXE" />

   <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\VISIO.EXE" />

   <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINPROJ.EXE" />

   <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\MSACCESS.EXE" />

Win10StartLayout_000018.png

Notice the elements exist in the XML, since they don't have permissions to those applications which in turn, won't be visible on the Start Menu.

Adding Office Access tile that is leveraging UEM App-Blocking definition, Application Tiles to the User Start Menu:

Win10StartLayout_000019.png

Added 'Global_Users_UEM-IT_Prod' security group to 'AppBlock\Global_Users_Microsoft_Access'

<start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

  <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINWORD.EXE" />

  <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\EXCEL.EXE" />

  <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\POWERPNT.EXE" />

  <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\OUTLOOK.EXE" />

  <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\VISIO.EXE" />

  <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\WINPROJ.EXE" />

  <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Microsoft Office\Office15\MSACCESS.EXE" />

Win10StartLayout_000020.png

Notice the elements exist in the XML, since they don't have permissions to those applications, which in turn won't show on the Start Menu.

There are two issues that I have seen while setting these Custom Start Menu configurations.

  1. UEM Refresh will not add or remove any tiles from the Start Menu. The reason for this is, the Start Menu is created at logon and becomes a static entry.
  2. I have seen tiles missing, intermittently, when users logon after a change to their permissions and/or the Start Layout XML file. The End-User still has the shortcut visible in the 'All apps' drop down.
Mike_A
19 Replies
chulerico
Enthusiast
Enthusiast

Mike,

Thanks

Sam

0 Kudos
LeeUSMC88
VMware Employee
VMware Employee

Great write up, but let me ask one thing.  These are mandatory start menu tiles correct?  This does not give end users the ability to update tiles themselves and have that retained, correct?

I think this is a great write again and hopefully many people use this to help in solving their Start Menu nightmares.

0 Kudos
larsonm
Expert
Expert

What would need to be done to retain user-created tiles?

0 Kudos
Smoke14
Hot Shot
Hot Shot

That's a great question. You can't do that as of build 1511, now with the new update that Microsoft just released this month Microsoft supposedly has fixed the Start Layout issues and should have more flex ability. I have not had the chance to test yet, to see if that is true.

If anyone gets to it before I do, let us know here.

Mike_A
0 Kudos
VDIMega
Enthusiast
Enthusiast

Do you know if its possible to retain the users' "Most Used" applications list in the start menu?  It was very easy in Windows 7, but the same import/export settings do not work in Windows 10.  If it is possible, do you know how?

0 Kudos
Smoke14
Hot Shot
Hot Shot

It is not possible as of this release of Windows 10 v1511. I have not looked to see v1607, that was just released, has any improvements in this area.

Mike_A
0 Kudos
LeeUSMC88
VMware Employee
VMware Employee

I will make some updates, we have done this with version 1511 in the military.  To do this we need to use some Microsoft tools, this will not be a UEM only process.

0 Kudos
VDIMega
Enthusiast
Enthusiast

I'm anxious to see this in action.  Thanks!

0 Kudos
Sravan_k
Expert
Expert

Hi Mike,

How can we persist user based start menu customization across the sessions in floating pools desktop?

for example: user-1 is interested to place his/her interested application short-cut in start menu

I am using UEM 9.1

App volumes 2.11

Windows-10 1607

floating pools

0 Kudos
jmatz135
Hot Shot
Hot Shot

This can be done, but not the way this post is describing.  At least I believe.

There are two options for doing this as far as I know:

Option 1: Managing Windows 10 with VMware User Environment Manager

My only issue with this option is Edge wants to be placed on the taskbar at every login (on a non-persistent desktop) whether you remove it or not as the user.  If anyone knows a workaround for that issue let me know.

Option 2: Have UEM copy the actual database for the Windows 10 start menu and have this as part of the user's profile. 

<LocalAppData>\TileDataLayer

<LocalAppData\Microsoft\Windows Explorer

This sounds easy in theory, but there are two services that need to be stopped before the database files can be copied off.  They are the staterepository and the tiledatamodelsvc.  You may be able to get by with only stopping the tiledatamodelsvc service.  To do this though requires some workarounds as UEM can't stop the service because the service is run as system, so either in the gold image you need to change the permissions on the service so that the users can stop it or you need to find some other way to stop it before UEM goes to export the profile or it will fail to export the database. 

Sravan_k
Expert
Expert

Hi Jmatz,

"My only issue with this option is Edge wants to be placed on the taskbar at every login (on a non-persistent desktop) whether you remove it or not as the user.  If anyone knows a workaround for that issue let me know"

Just pin the short-cut of Edge on taskbar in Parent image and take snapshot of it and use it 

0 Kudos
VDIMega
Enthusiast
Enthusiast

In order to prevent Edge from being pinned on non-persistent desktops, and also preserve user taskbar pinned items, I had to create logoff tasks to save the users "Quick Launch" and regs for the taskbar, as well as a run-once PS script to import them after explorer.exe loads:

  1. logoff task (before export):  powershell copy-item -path $env:UserProfile'\appdata\roaming\microsoft\internet explorer\quick launch' -destination $env:UserProfile -force -recurse
  2. logoff task (before export):  reg export HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband %userprofile%\exportedtaskbar.reg /y
  3. create c:\windows\taskbar\taskbar_default.ps1 with the following content:
**this requires having a matching "quick launch" folder and regs from your test/staging profile with the default pinned items that you want users to have**

$arguments = "import $PSScriptRoot\taskbar_default.reg"

start-process $env:windir\system32\reg.exe -argumentlist $arguments -windowstyle hidden

Copy-Item -Path $PSScriptRoot\Quicklaunch\* -Destination $env:UserProfile'\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch' -Recurse -Force

Stop-Process -ProcessName explorer -Force

   4.  create c:\windows\taskbar\taskbar.ps1 with the following content:

$arguments = "import $env:UserProfile\exportedtaskbar.reg"

start-process $env:windir\system32\reg.exe -argumentlist $arguments -windowstyle hidden

Copy-Item -Path $env:UserProfile'\Quick launch\*' -Destination $env:UserProfile'\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch' -Recurse -Force

Stop-Process -ProcessName explorer -Force

   5.  taskbar UEM ini file:

[IncludeFiles]

<UserProfile>\exportedtaskbar.reg

[IncludeFolderTrees]

<UserProfile>\Quick Launch

**PREDEFINED DEFAULT SETTING**

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]

"taskbar"="Powershell.exe -NoProfile -ExecutionPolicy ByPass -WindowStyle Hidden -file C:\\\\Windows\\\\taskbar\\\\taskbar_default.ps1"

**PREDEFINED PARTIALLY-ENFORCED SETTING**

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]

"taskbar"="Powershell.exe -NoProfile -ExecutionPolicy ByPass -WindowStyle Hidden -file C:\\\\Windows\\\\taskbar\\\\taskbar.ps1"

jmatz135
Hot Shot
Hot Shot

Kumar,

How would this stop the Edge short-cut from being created by the Windows process that creates the start menu on login?  The reason why in non-persistent desktops this is an issue is because you need to exclude the HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuInit registry value which means that the start menu will be created by Windows at login using the values in your LayoutModification.xml file.  The problem is that as part of that process it also creates the Edge shortcut on the taskbar as far as I can tell.  Removing it in the gold image, or mandatory profile or trying to replace it in any of those places doesn't seem to do anything.

VDIMega
Enthusiast
Enthusiast

You're right!  My setup does not stop the Edge shortcut from being created when the user profile is created.  What it does is removes the pinned Edge icon after Windows pins it.  It does this by overwriting the HKCU tree and the "Quick Launch" folder that contains the Edge shortcut assets with ones that do not.  Then, it restarts explorer.exe so that the change is apparent.

jmatz135
Hot Shot
Hot Shot

VDIMega,

Yeah, I figured I could do scripts to capture and replace the taskbar.  I was kind of wanting to avoid using a powershell script that runs at every login, but I guess I may just resort to that. 

On another note, you can actually use a different method to import the default taskbar settings instead of using this section:

**PREDEFINED DEFAULT SETTING**

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]

"taskbar"="Powershell.exe -NoProfile -ExecutionPolicy ByPass -WindowStyle Hidden -file C:\\\\Windows\\\\taskbar\\\\taskbar_default.ps1"

You can make the original default LayoutModification.xml file like this (with the layout you desire of course):

<LayoutModificationTemplate

    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"

    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"

    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"

    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"

    Version="1">

  <LayoutOptions StartTileGroupCellWidth="6" />

  <DefaultLayoutOverride>

    <StartLayoutCollection>

      <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">

        <start:Group Name="Internet and Networking" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />

        </start:Group>

        <start:Group Name="Microsoft Office" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Outlook 2010.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft PowerPoint 2010.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk" />

          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Excel 2010.lnk" />

        </start:Group>

      </defaultlayout:StartLayout>

    </StartLayoutCollection>

  </DefaultLayoutOverride>

  <CustomTaskbarLayoutCollection PinListPlacement="Replace">

    <defaultlayout:TaskbarLayout>

      <taskbar:TaskbarPinList>

        <taskbar:DesktopApp DesktopApplicationLinkPath="%appdata%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />

        <taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />

      </taskbar:TaskbarPinList>

    </defaultlayout:TaskbarLayout>

</CustomTaskbarLayoutCollection>

</LayoutModificationTemplate>

This on first launch will actually create the start menu AND taskbar however you would like it to be set up.  The problem is the Export-StartLayout powershell command won't export the taskbar settings into the xml file for later use (as far as I can tell) so after first login when you use the command to export the user's layout this one will be overwritten in the user's profile with one that does not have any taskbar layout customizations and thus Edge shows up again. 

VDIMega
Enthusiast
Enthusiast

I tried using export/import-startmenulayout, but it was causing significant logon/logoff delays, so I had to stop doing that.

0 Kudos
jmatz135
Hot Shot
Hot Shot

I haven't seen any delays.  Maybe a little on logout, but I'm not too concerned about that.  On login though you don't actually do any Import-StartMenuLayout.  You just have UEM capture the user's LayoutModification.xml file:

[IncludeFiles]

<LocalAppData>\Microsoft\Windows\Shell\LayoutModification.xml

When windows calls the start menu initialization (which it does because you don't capture StartMenuInit registry value) it checks for that file and creates the start menu based upon that.  No need for any powershell script to import the layout.  My logins for Windows 10 on a non-persistent desktop with customized start menu layouts is around 20-25 seconds.  I just have that Edge shortcut on the taskbar.

VDIMega
Enthusiast
Enthusiast

I tried doing export-startlayout into %localappdata%\Microsoft\Windows\Shell\LayoutModification.xml as a logoff task but it would take upto 40 seconds to logoff.  Sometimes it would take so long that the VM would start refreshing before it could even finish running.

Even then, letting Windows organically grab the layoutmodification.xml added 10-15 seconds to the login time here.  That would have been fine, but App Volumes adds another 30, and GPO with adds 10.  So we were at over a minute for login times, which was not accepted by management.  20-25 seconds without two appstacks sounds feasible though.

The Edge icon on the taskbar also isn't accepted here, so I had to come up with this long-winded way to get rid of it.

0 Kudos
iforbes
Hot Shot
Hot Shot

This worked perfectly for my non-persistent Windows 10 desktops:

Managing Windows 10 with VMware User Environment Manager

0 Kudos