Deploying a Locked Down Start Menu in Windows 10

The tiles in Windows 10’s Start Menu can be rather messy. By default, you get a lot – and they may be things you don’t want there such as News, Sports, Photos, Microsoft Store etc.

Since Windows 10 1607, there’s been a way to control this. Customize Windows 10 Start and taskbar with Group Policy covers how to do this, but there’s some errors and links that don’t work, so I thought it was worth giving a quick overview on how to do this.

Keep in mind that this process locks down the Start Menu tiles completely, users won’t be able to add, remove or change anything to do with tiles.

The first step is to configure the Start Menu tiles how you want them on a computer. You can add, remove, move, resize etc until you’re happy with how it looks.

Once that’s done, you’ll need to export the layout to an XML file. Easily done by opening PowerShell and running Export-StartLayout. This needs the -Path switch, e.g. Export-StartLayout -Path “C:\temp\startmenu.xml”

Copy the resulting startmenu.xml file into a central location that clients will be able to access, or copy it out to each machine through Group Policy Preferences. This XML file will be called in the Group Policy setting “Start Layout”.

The Group Policy setting called “Start Layout” lives in User Configuration or Computer Configuration > Policies> > Administrative Templates >Start Menu and Taskbar. You’ll probably want this at the user level rather than the computer level, but it depends at what layer you want this locked down at. 

If you can’t see this policy at all, then you may need to update your Group Policy templates. Each time a new version of Windows 10 comes out, there’s usually new or updated Group Policies to use. There’s a good step-by-step here if you need help – I’d recommend downloading the templates that match the latest version of Windows 10 you’re managing.

Start Layout in Group Policy

For this policy, you’ll be setting the radio button to Enabled, and setting the Start Layout File value to the path of the XML file that you copied out or placed centrally.

Start Layout Settings

Once that is done, the Group Policy object containing this setting needs to be pointed at the users or computers you want it to apply to, just like any other Group Policy.

The end result is the client then having the same Start Menu tiles configured in the XML file.

You may find that some of the tiles are missing. I’ve seen this happen when the shortcut the XML points to isn’t in the location expected. Here’s an example XML file with just one tile configured for Notepad:

<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
 <LayoutOptions StartTileGroupCellWidth="6" />
 <DefaultLayoutOverride>
 <StartLayoutCollection>
 <defaultlayout:StartLayout GroupCellWidth="6">
 <start:Group Name="">
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Notepad.lnk" />
 </start:Group>
 </defaultlayout:StartLayout>
 </StartLayoutCollection>
 </DefaultLayoutOverride>
</LayoutModificationTemplate>

When a Tile is added to the Start Menu, if it doesn’t exist already, it will create a .LNK file and uses that for the tile. You may need to copy these off the computer you created the tiles on the in first place too, and copy them out to the same path on the computers you’re pushing this setting to.

You can also manually update or change the XML file yourself, which can sometimes be easier than going through the whole export process again.

One last thought I have on this, is that you can have multiple XML files going to different computers or users based on their requirements – but don’t over complicate things or you’ll be constantly managing tiles!

9 thoughts on “Deploying a Locked Down Start Menu in Windows 10

  1. First of all thank you for providing detailed tutorials as such. We’ve been using XML method to deliver start screen ever since going to Windows 8.1. We are now testing Windows 10 (1709) and using the same XML method to deliver the start menu, and it’s largely working. The problem we are having is that if any application that isn’t currently installed on the station (but is referenced to in the XML) it leaves a unsightly gap in the group. Any ideas to getting around this at all? Many Thanks. Manny

    1. Hi Manny – yes this one is a bit of a problem. Some options: if it’s only one app, put it at the bottom so the blank space doesn’t matter… Or just install the software anyway everywhere if licensing doesn’t matter.

      Otherwise you.could have multiple GPOs deploying different XML files depending on different criteria. The overhead for that one isn’t great, but again if it’s only a few apps that may not be that bad.

      Another idea would be to use PowerShell at startup to generate the XML file based on the shortcuts you give it, and if they exist.

      Personally I just take the approach of giving a few key apps that all computers have, and people can create shortcuts on their desktop, pin apps or just search and their start menu most used list will do it’s job.

      1. Hi Adam, thank for getting back to me. Unfortunately we look after 4 secondary schools in the UK and as you can imagine the number of (and different) applications that we have to deliver and make sure only the correct ones are installed on each site (for the purpose of licensing and relevance).

        The PowerShell method you mentioned, is there a working script that we could try please? Thank you again.

  2. Jesus christ Microsoft sucks. What a monstrous waste of time and of a life,doing shit like this every fucking time they fuck up the operating system and the User interface, which is once a week. Fighting Microsoft is a job for not one person alone with his/ her machine, but an army … a mass multinational corporation of anti microsoft defenders. A home appliance has become an entire life enveloping waste of human potentialities. It’s a tragedy beyond my powers of expression. Can you imagine if human beings spent all this time writing, reading, painting, making music, creating caring environments for others, rather than masturbating the digits of Microsoft’s latest unleashing of life controlling debacle on millions and millions of user/ victims? Melt the ice caps expending energy for this… Really humanity is over, and it is this sort of garbage that has ended it.
    I do thank this blogger for your valiant efforts to help us all. It’s a good fight in a way, trying to undo the weekly life damage of Microsoft to millions of persons who just want to enjoy their time, get their work done, and don’t need even a small fraction of the garbage that this corporation inflicts upon them.

  3. Hello Adam,

    We are using this method to clear out all start menu items. Our XML is pretty empty as we want no tiles in the start menu. Once the user signs in for the first time one single tile is being placed on the start menu. If we remove the user from the OU to one with no policy’s applied, gpupdate /force , reboot and log in the junk tile is removed. Move the user back, gpupdate /force reboot and it stays gone. Any ideas on what to look at for something like this.

    Thanks,
    Brandon

    1. Hi Brandon,
      I’ve seen issues with trying to deploy no tiles before, but it was more that an XML with no tiles was just ignored rather than deploying a single one. Also seen issues in different versions of Windows 10 handling it differently – so it could be worth testing this on 1903 in case it’s different again, or actually fixed. Beyond that, log a case and make Microsoft work it out, but they might come back just saying that’s how it works :| If you do find anything please let us know!

  4. Hi,

    This works fine! (we are using partial Start Screen layout) BUT if we do any changes to the XML later, it breaks\destroyeres the Start Menu for existing users\profiles. Only the personal pinned programs are left.. The locked down part is gone!

    For new user\profiles the changed XML works fine.

    Any suggestions?

    1. I’m dealing with this same issue similar as Fredrik as we speak. Machines are 1809 Enterprise, GPO manage with partial locked Groups/Tiles. Seems simple, we needed to update ADP Time Workforce shortcut to use Google Chrome. Currently the tile is launching a shortcut using IE. So, we created the new shortcut using GPP first, thinking it would take care of it. Used Shell Object, All Users Program/StartMenu and Target is path to chrome.exe and Argument is the website. Deployed fine for the left side of the StartMenu but doesn’t update the Title. Next we decided to do a GPP File, The shortcut was created, placed on the file share, set source path, then destination was to ProgramData\StartMenu for all users directory. That make it worst, either didn’t replace, blank tile or mixed results of the W~AutoGenerated.123456789 broken link shows up. So we decided, ok let unlock the StartMenu (unlinking the GPO rather), so my tiles can be unpin/re-pinned of my new “Updated” shortcut. Ran Exported-StartMenu blah blah, took the line item from the new XML and copied it to the existing XML which is on all systems. And guess what, link is fixed, but now IE tile is gone and Calculator is broken…1 step forward, 5 steps back now. so this sound stupid but could one replace the LayoutStartMenu.XML located in appdata\Local\Microsoft\Windows\Shell or does that not work? Or is there something in the registry hive to be deleted that it is the cache icon that can be reset?

      Now changes we modified, as Fredrik says, this doesn’t affect new users. All expected tiles are there, strange I know. I figured if new user login works then my existing XML for my existing users should work…but no. Only changes to existing deployed GPO XML does this create weird issues. I want to know who has figure this one out? Anyone? Or is it just me?

      Next thought, I am reimagining a VM with no applied StartMenu.XML GPO, login into new profile, arrange the titles, re-export XML, change the naming convention on the XML, re-create a new GPO and deploy. My only thought, otherwise I’m at a lost why this is so difficult…wasted 2 days, 2 VMs is all a mixed bag of results.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.