Customize Windows 10 Start Menu Layout via UEM

 

This Blog is to help EUC Admin’s to dynamically configure the Windows 10 Start Menu Layout for end user VDI sessions. This solution will use VMware AppVolumes and UEM to configure at user log on. This document will be configuring the Start Menu from the LOB aspect of entitlements.

AppVolumes Configuration Settings

I suggest my clients to use AppStack Security Groups to make permissions and AppStack Entitlement easier to manage.  You will notice the VDI structure has an AppStack OU to support all the security groups for the AV entitlement. This portion should be able to be changed to how you have your AV entitlement and continue to follow this document.

Note: We will reference the IT LOB/Dept going forward.

Win10StartLayout_000001

Assign your User Security Group(s) to the IT-DeptApps AppStack group.

Win10StartLayout_000002

  • AV assignment to ‘Global_AppStack_ITDeptApps’ security group
  • 14 applications were added to this AppStack, but not all will have a shortcut for the end user

That’s all that is needed from the AV perspective.

Start Layout Modification Share Structure

This share structure will be the location you will maintain the default and all LOB/Dept Start Layout Modification files.

Create a ‘Start Layout’ parent directory under your UEMConfig share and then your UEM Configuration Environment directory.

Example: <DFS or Server>uemshareUEMConfigUAT_Start Layout

Win10StartLayout_000005

 

Note: I create UEM structure as: …UEMConfigEnvironmentUEM Versiongeneral

Win10StartLayout_000003

  1. Create a default LayoutModification.xml by on of the following.
    1. Spin up a clean Windows 10 VM and make all layout changes to your Start Menu to be your default layout.
      1. Then Export the layout by using this Powershell command, ‘Export-StartLayout -Path C:Users$env:USERNAMEDesktopLayoutModification.xml‘
      2. Now copy that to your <DFS or Server>uemshareUEMConfigUAT_StartLayout parent directory.
    2. Create a new LayoutModification.xml file and copy my default entries in the ‘StartLayout Configuration’ section below.
  2. Create LOB/Dept sub-directories and make a copy of your default WSLMF to each directory.
  3. This Powershell Script has the following command ‘Get-StartApps | where {$_.Name -ilike ‘*’}‘ that will list all application ID’s that are installed or mounted by AV. you will see how this is used, later in the document.
  4. I use NotePad++ with verbose backup enabled to make a backup before I  make any modifications. This is optional and not required.

UEM & GPO Configuration Settings

These settings need to be followed as described here, especially the conditions for the  UEM ‘ADMX-based Settings’ definition. There is a ‘@Default’ Start Layout for all users to have applied to their Windows 10 Start Menu.

Create @Default Win10 – Start Layout Definition

You actually don’t need this definition, but I am using this default Start Layout definition for two reasons.

  1. It’s used as a template for the Department Layouts.
  2. If the user is not placed in one of the LOB/Dept security groups, you want a default layout to be applied. You could put it in your master images, but why not centrally manage from UEM.

Win10StartLayout_000006

  1. Open and enable ‘Start Layout’ setting and place the UNC path with full FileName.
  2. After you have imported the Windows 10 ADMX and add /Start Menu and Taskbar/Start Layout/ policy setting.
  3. Name the definition to reference ‘@default’ Start Layout GPO.
  4. Create a new ‘ADMX-based Settings’ definition for Windows 10 Start Layout GPO.
  5. Go to ‘ADMX-based Settings’ under User Environment in UEM console.
  6. Save all changes and close all dialog’s back to main definition window and then select the ‘Conditions’ tab.
  7. The following conditions need to be applied.
    1. Apply these two conditions, ‘Operating System is Windows 10’ and ‘CompanyDomain Users”.
    2. Add all LOB/Dept Condition Sets or Domain Groups with the first condition, using the ‘AND NOT‘ operator.

Make sure all proceeding conditions are using OR NOT as their combined operator, as shown in the image below.

Win10StartLayout_000007

Create LOB/Dept Win10 – Start Layout definition

Win10StartLayout_000008

  1. Go to ADMX-based Settings under User Environment in UEM console.
  2. Create a new ADMX-based Settings definition for Windows 10 Start Layout GPO.
  3. Name the definition to reference LOB/Dept Start Layout GPO.
  4. After you have imported the Windows 10 ADMX and add /Start Menu and Taskbar/Start Layout/ policy setting.
  5. Open and enable Start Layout setting and place the UNC path with full FileName.
  • Save all changes and close all dialogs back to main definition window and then select the Conditions tab.
  • The following conditions need to be applied.
    1. Apply these two conditions, Operating System is Windows 10 and, if you have a UAT pool, set a Horizon Pool condition.
    2. Add all LOB/Dept Condition Sets or Domain Groups, with the first condition using the AND operator.
  • Make sure all proceeding conditions are using OR as their combined operator, as shown in the image below.

Win10StartLayout_000009

Windows 10 WSLMF Configurations

All Start Layout XML files must be named LayoutModification.xml (Required)

Start layout for Windows 10 desktop edition Information

          Link to the full Microsoft Document

The OS reads the LayoutModification.xml file and only allows groups to be appended to Start. The groups have the following constraints:

  • 2 groups that are 6 columns wide, or equivalent to the width of 3 medium tiles.
  • 2 medium-sized tile rows in height. The OS ignores any tiles that are pinned beyond the second row.
  • No limit to the number of apps that can be pinned. There is a theoretical limit of 24 tiles per group (4 small tiles per medium square x 3 columns x 2 rows).

IT admins can provision the Start layout by creating a LayoutModification.xml file. This file supports several mechanisms to modify or replace the default Start layout and its tiles.

There is one Application ID parameter type for the start:Tile element of the XML.

  • AppUserModelID – Use to specify any of the following:
    • A Universal Windows app
    • A Windows 8 or Windows 8.1 app

There are two Application ID parameter types for the start:DesktopApplicationTile element of the XML.

  • DesktopApplicationID / DesktopApplicationLinkPath – Use to specify any of the following:
    • A Classic Windows application with a known AppUserModelID
    • An application in a known folder with a link in a legacy Start Menu folder
    • A Classic Windows application link in a legacy Start Menu folder
    • A Web link tile with an associated .url file that is in a legacy Start Menu folder

In the examples below you will notice there is GUIDs in the values of DesktopApplicationID parameters. Microsoft has associated GUIDs to Windows folders, the full list can be viewed here.

Here are a few of the top most GUIDs used from my experiences.

  • Desktop – B4BFCC3A-DB2C-424C-B029-7FE99A87C641
  • LocalAppData – F1B32785-6FBA-4FCF-9D55-7B8E7F157091
  • ProgramData – 62AB5D82-FDC1-4DC3-A9DD-070D1D495D97
  • ProgramFiles – 905E63B6-C1BF-494E-B29C-65B732D3D21A
  • ProgramFilesX64 – 6D809377-6AF0-444B-8957-A3773F02200E
  • ProgramFilesX86 – 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E
  • Programs – A77F5D77-2E2B-44C3-A6A2-ABA601054A51
  • StartMenu – 625B53C3-AB48-4EC1-BA1F-A1EF4146FC19
  • Startup – B97D20BB-F46A-4C97-BA10-5E3608430854
  • Windows – F38BF404-1D43-42F2-9305-67DE0B28FC23
  • System – 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7

For every entry in the XML file, YOU MUST HAVE A SHORTCUT CREATED IN UEM for this to work.

Examples Explained:

@Default – LayoutModification.xml

<LayoutModificationTemplate Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
  <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride>
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">
        <start:Group Name="Company Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:Tile                                         Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}Internet Exploreriexplore.exe" />
        </start:Group>
        <start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINWORD.EXE" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15EXCEL.EXE" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15POWERPNT.EXE" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15OUTLOOK.EXE" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15VISIO.EXE" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINPROJ.EXE" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15MSACCESS.EXE" />
        </start:Group>
        <start:Group Name="Company Self Support" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany Desktop ServiceUEM Refresh.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}ImmidioFlex ProfilesFlex+ Self-Support.exe" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany Desktop ServiceDevices and
           Printers.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

Win10StartLayout_000010

As you can see from the image above, my Start Menu displays all the shortcuts that are found in the @Default Stat Layout Modification XML and the title groups are not labeled by a department.

ADDING CORE APPSTACK TO USER START MENU

Win10StartLayout_000011

Added ‘Global_Users_UEM-IT_Prod’ security group to ‘Global_AppStack_CoreApps’

Win10StartLayout_000012

As you notice in the above image, by adding the CoreApps AppStack the End-User still uses the @Default Layout XML file and displays the ‘VLC Player’ tile in Company Apps.

Now let’s look into the LOB/Dept Layout Modification Settings for the IT LOB/Dept.

This example will show you how to create a Start Layout for any LOB/Dept,  but you can also added Sub-Dept groups, like Networking, Support, Security, and Server just to name a few.

I prefer to break my Start Layout XML file into LOB/Dept XML files, because I would rather have a little back-end management, then to have one Start Layout XML file that could cause a company-wide loss of the Start Menu from syntax or typo that someone makes while applying during production. You will see in the example below that you could in fact, with a little effort, put all your LOB/Dept/Sub-Dept/Groups all in one XML and manage them from UEM and AD permissions.

Note: This works for Windows 10 version 1511, but I hear their most likely will be a change in the August 2016 update from Microsoft. If there is a update to the way we can manage the Start Menu, you will need to make sure this process does not break with the new update.

Here are the IT-Dept and Sub-Group settings that will be used to show how this will work. I will be adding and removing permissions from the user via AD security groups. Skip down past thisLayoutModification.xml example to see how you’re Start Menu will be viewed by an End-User when you apply the AD permissions.

LOB/DEPT – LAYOUTMODIFICATION.XML (EXAMPLE: IT-DEPT)

<LayoutModificationTemplate Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
 <LayoutOptions StartTileGroupCellWidth="6" />
  <DefaultLayoutOverride>
   <StartLayoutCollection>
    <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">
    <start:Group Name="Company IT Dept Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
     <start:Tile                   Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}Internet Exploreriexplore.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}notepad.exe" />
     <start:Tile                   Size="2x2" Column="0" Row="2" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}VideoLANVLCvlc.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}CommFortCommFort.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}FileZilla FTP Clientfilezilla.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Notepad++notepad++.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}PuTTYputty.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="6" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}TechSmithSnagit 12Snagit32.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="6" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany IT AppsKeePass.lnk" />
    </start:Group>
    <start:Group Name="Company Network Team Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany Network Team AppsCisco ASDM-IDM Launcher.lnk" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}InterMapper RemoteAccessInterMapper_RemoteAccess.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}KleverNothingsPumpKIN.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}VanDyke SoftwareClientsSecureCRT.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}WiresharkWireshark.exe" />
    </start:Group>
    <start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINWORD.EXE" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15EXCEL.EXE" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15POWERPNT.EXE" />
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15OUTLOOK.EXE" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15VISIO.EXE" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINPROJ.EXE" />
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15MSACCESS.EXE" />
    </start:Group>
    <start:Group Name="Company OnBase Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany OnBase AppsOnBase Client.lnk" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany OnBase AppsUnity Client.lnk" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany OnBase AppsOnBase Studio Client.lnk" />
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany OnBase AppsOnBase Configuration Client.lnk" />
    </start:Group>
    <start:Group Name="Company Self Support" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
     <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany Desktop ServiceUEM Refresh.lnk" />
     <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}ImmidioFlex ProfilesFlex+ Self-Support.exe" />
     <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany Desktop ServiceDevices and Printers.lnk" />
    </start:Group>
   </defaultlayout:StartLayout>
  </StartLayoutCollection>
 </DefaultLayoutOverride>
</LayoutModificationTemplate>

ADDING IT-DEPT, APPLICATION TILES TO THE USER START MENU:

Win10StartLayout_000013

Added ‘Global_Users_UEM-IT_Prod‘ security group to ‘Global_AppStack_IT-DeptApps‘

<start:Group Name="Company IT Dept Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
 <start:Tile                   Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}Internet Exploreriexplore.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}notepad.exe" />
 <start:Tile                   Size="2x2" Column="0" Row="2" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}VideoLANVLCvlc.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}CommFortCommFort.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}FileZilla FTP Clientfilezilla.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Notepad++notepad++.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}PuTTYputty.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="6" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}TechSmithSnagit 12Snagit32.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="6" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany IT AppsKeePass.lnk" />

Win10StartLayout_000014

ADDING IT-DEPT/NETWORK TEAM, APPLICATION TILES TO THE USER START MENU:

Win10StartLayout_000015

Added ‘Global_Users_UEM-IT_Prod‘ security group to ‘Global_AppStack_NetworkTeamApps‘

<start:Group Name="Company Network Team Apps" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%AppData%MicrosoftWindowsStart MenuProgramsCompany Network Team AppsCisco ASDM-IDM Launcher.lnk" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}InterMapper RemoteAccessInterMapper_RemoteAccess.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}KleverNothingsPumpKIN.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}VanDyke SoftwareClientsSecureCRT.exe" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{6D809377-6AF0-444B-8957-A3773F02200E}WiresharkWireshark.exe" />

Win10StartLayout_000016

  1. This tile is left blank, because the End-User does not have permission to use ‘SecureCRT’ application.
  2.  In this case, there are no application settings to apply a tile for the application, in this location.
ADDING OFFICE VISIO TILE THAT IS LEVERAGING UEM APP-BLOCKING DEFINITION, APPLICATION TILES TO THE USER START MENU:

Win10StartLayout_000017

Added ‘Global_Users_UEM-IT_Prod‘ security group to ‘AppBlockGlobal_Users_Microsoft_Visio‘

<start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINWORD.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15EXCEL.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15POWERPNT.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15OUTLOOK.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15VISIO.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINPROJ.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15MSACCESS.EXE" />

Win10StartLayout_000018

Notice the elements exist in the XML, since they don’t have permissions to those applications which in turn, won’t be visible on the Start Menu.

ADDING OFFICE ACCESS TILE THAT IS LEVERAGING UEM APP-BLOCKING DEFINITION, APPLICATION TILES TO THE USER START MENU:

Win10StartLayout_000019

Added ‘Global_Users_UEM-IT_Prod‘ security group to ‘AppBlockGlobal_Users_Microsoft_Access‘

<start:Group Name="Company Office 2013" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINWORD.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15EXCEL.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15POWERPNT.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15OUTLOOK.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15VISIO.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15WINPROJ.EXE" />
 <start:DesktopApplicationTile Size="2x2" Column="0" Row="4" DesktopApplicationID="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}Microsoft OfficeOffice15MSACCESS.EXE" />

Win10StartLayout_000020

Notice the elements exist in the XML, since they don’t have permissions to those applications, which in turn won’t show on the Start Menu.

There are two issues that I have seen while setting these Custom Start Menu configurations.

  1. UEM Refresh will not add or remove any tiles from the Start Menu. The reason for this is, the Start Menu is created at logon and becomes a static entry.
  2. I have seen tiles missing, intermittently, when users logon after a change to their permissions and/or the Start Layout XML file. The End-User still has the shortcut visible in the ‘All apps’ drop down.

One thought on “Customize Windows 10 Start Menu Layout via UEM

Leave a Reply

Your email address will not be published. Required fields are marked *