How to secure Start Menu in Windows 10 Anniversary (1607)

I have several Kiosk pc's that we have secured using  Microsoft Management Console adding the Group Policy Object editing it to point to a specific user and then disable and enable what we choose. I am trying this on a Win10 Anniversary and I have been unable to secure the start menu. Anybody know how to do this. On Win7 we would end up with an icon or two that we need to run but I have not been able to shut down this menu.

Note: I tried to add Policy, GPO etc to topics but they weren't there
jbcbussoftAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Cliff GaliherConnect With a Mentor Commented:
If you are running enterprise or education, you can do this via group policy in 1607 (but not older.)

https://technet.microsoft.com/en-us/itpro/windows/manage/customize-windows-10-start-screens-by-using-group-policy

If you are running home or pro on your kiosk, there is no native built in way to lock it down. You'll need to hack it together with scripts (easily bypassed) or 3rd party tools.
0
 
jbcbussoftAuthor Commented:
I'm running pro so no straight forward way.
0
 
Cliff GaliherCommented:
Correct
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
McKnifeCommented:
Not so fast. Though we cannot enforce a layout of the start menu (is that even what you asked for?) on the pro edition, we can of course unpin all apps scripted (see https://gallery.technet.microsoft.com/scriptcenter/Script-to-pin-items-to-51be533c ) but the one or two that are needed and then lock the start menu by setting certain GPOs (that work on pro as well) from user config - administrative templates  - start menu and taskbar, namely
" Prevent users from customizing their Start Screen" which reads
"This policy setting allows you to prevent users from changing their Start screen layout. If you enable this setting, you will prevent a user from selecting an app, resizing a tile, pinning/unpinning a tile or a secondary tile, entering the customize mode and rearranging tiles within Start and Apps. If you disable or do not configure this setting, you will allow a user to select an app, resize a tile, pin/unpin a tile or a secondary tile, enter the customize mode and rearrange tiles within Start and Apps."
0
 
Cliff GaliherCommented:
Only applies to enterprise as of 1607. Documented here:

https://technet.microsoft.com/en-us/itpro/windows/manage/windows-10-start-layout-options-and-policies

First paragraph clearly says enterprise/education.  The policy you listed is included in that table. Yes, 1607 took away functionality from pro that worked in 1511. A lot of IT pro's have slammed into this and forums have their complaints.
0
 
McKnifeCommented:
Cliff, I know, but Microsoft wouldn't be Microsoft if they didn't make mistakes all the time. Try it on pro. Setting that policy does work, at least for my 1607 pro.
0
 
McKnifeCommented:
Wait... LOL! Setting this policy partly only works on Win10 pro 1607... we cannot pin anything to start, but we can unpin.

Ok, the author needs to say if preventing from pinning is enough.
0
 
Cliff GaliherCommented:
I *just* did. Enabled the setting. Did a gpupdate. And then rearranged and added a tile effortless. On my surface book, 1607, running pro (surface book doesn't come with home.)
0
 
McKnifeCommented:
Ah... it's the same for enterprise, by the way, unpinning works. All broken.
0
 
Cliff GaliherCommented:
My enterprise VM (also running on my book) worked flawlessly. Could not pin, unpin, rearrange, or resize. You have another unrelated issue.
0
 
McKnifeCommented:
Read your comment. I have no idea what is up with your machine, here, the pro ones act like the enterprise ones - setting the policy makes a difference, immediately. We cannot pin afterwards (but still unpin). 1607 pro, tried two machines by now.

Edit: maybe the big difference is that my machines (the enterprise and the pro ones) where all 1511 once and have been upgraded to 1607? Will try a clean 1607 pro now.
0
 
Cliff GaliherCommented:
I got the book launch week (November of last year.) So it is indeed an upgraded OS. As is my VM (mostly because, at the moment, I am developing training material for MDT and covering windows 10 upgrade scenarios.)

I do not have a clean 1607 to test. But all works as expected here, so I don't see that as an issue. Maybe your 1511 image had an issue already, so it has carried forward. My machine is OEM, and my lab is stock VL media from production MDT shares.
0
 
McKnifeCommented:
Ok, tested with a machine that was installed with 1607 pro (never been on any earlier build) and the policy works, after logoff/logon even unpinning is prevented. I have no idea, I only know that something is fishy, but don't blame it on me.
0
 
McKnifeCommented:
Cliff, I just took 10 minutes to install another clean win10 1607 pro (clean unmodified ISO), no policies, no domain membership even and the policy works as expected: you cannot make any changes to the start menu. Tried to pin notepad - no context menu entry there to do it. Tried to unpin built-in apps like 3d builder: again, no context menu entry for it.
Go figure.

Next, I will retry if the other policy works, the one with the exported layout.
0
 
McKnifeCommented:
Works as well. I can enforce a start menu layout on pro.
0
 
Cliff GaliherCommented:
*shrug* my labs work as documented. At best, I would still never recommend the op do something that doesn't work as documented. Any bugs, changes, inaccurate behavior can get fixed by an update at any time, and thus time invested on an unauthorized solution is lost. Microsoft clearly has this feature set specified for enterprise only (link already provided above) and that'd be the only in-box solution I'd comfortably recommend. Anything else is an academic debate at best.
0
 
McKnifeCommented:
I completely agree. Just recommended it since I knew it works on pro (and I forgot it shouldn't work).
0
 
jbcbussoftAuthor Commented:
So, I can use Windows as Microsoft intended or see if the changes will work as they shouldn't hoping a fix won't be implemented.

I must say the two of you were much more productive during the past few hours than I was. In my time zone I was catching zzz's
0
 
McKnifeCommented:
Well, at least I am in a different time zone (MEZ) and awake since 6 hours or so :-)
0
 
jbcbussoftAuthor Commented:
Well is it possible to only allow the apps I choose? I wasn't looking for this but this would also solve the problem.
0
 
McKnifeConnect With a Mentor Commented:
"Allowing apps" is either done using file system permissions or using application whitelisting. The latter is done through applocker (no part of the pro edition) or software restriction policies (part of pro).
Look into those - I could offer more help.
0
 
jbcbussoftAuthor Commented:
Thanks for the help
0
 
jbcbussoftAuthor Commented:
I enjoyed the late night/early morning conversation
0
All Courses

From novice to tech pro — start learning today.