Privacy & Cookies
This site uses cookies. By continuing, you agree to their use. Learn more, including how to control cookies.
When dealing with devices that have many applications and are used by many people,managing shortcuts on the Desktop and in the Start Menu is a challenge. This is especially complicated since there is no consistency with software installers as to if, how, and where shortcuts are created. I have to handle this situation in the Education sector with computer labs and classrooms and have chosen to accomplish it using Group Policy Preferences. My method, which is detailed below, nearly eliminates the concern over what the software installer does regarding shortcuts and provides a consistent experience across all managed devices.
The Basics
Heres the basic premise: I configure a Group Policy Object [GPO] with a setting that hides all items in the Desktop and Start Menu of the Public user profile. This is where 99% of shortcuts from software installers will go by default. The setting is called Remove common program groups from Start Menu.
Because I am configuring user settings in this GPO that will be linked to Organizational Units [OUs] containing workstations not users, I also must make sure to configure user Group Policy loopback processing to be enabled so the settings will apply to users of those workstations.
In this same GPO, I use the Group Policy Preferences [GPP] Shortcuts section of User Configuration to create the shortcuts I want users to see. I use Item-Level Targeting with each GPP shortcut to make sure the shortcut is only applicable if the target application is present on the device. This allows me to have a single GPO for all of my general-use devices which contains GPP shortcuts for every application in use. The shortcuts will dynamically appear and disappear for each device as software is installed or removed. The shortcuts will also automatically use the icon for the targeted application. Its possible to place the shortcuts into folders as well by simply entering the folder name in with the shortcut path.
Possible Concerns or Questions
Wont a lot of GPP shortcuts in the GPO cause it to take a long time to process?
I dont want to be the authority on what a long time means, so heres the diagnostic data I captured using Group Policy Preferences diagnostic options:
- It took 15 thousandths of a second to process an item-level targeting failure [e.g. shortcut is not applicable].
- It took 63 thousandths of a second to process an item-level targeting success and generate a shortcut.
- It took 47 thousandths of a second for subsequent processing of a previously processed item-level targeting success [e.g. A Desktop shortcut has the same item-level targeting entry as a Start Menu shortcut.]
In my computer lab with the most software installed, the GPO which contained just short of 400 shortcuts took just under 20 seconds to process where 148 of the shortcuts were applicable. If less software was installed on the device or less software existed in my environment, the process would have been faster. This also executes simultaneously while a user profile is generating for a new user so the wait time for the user profile creation may take longer than processing the shortcuts GPO.
What about default Windows shortcuts that are normally in the Start Menu?
The shortcuts that Windows normally puts in the Start Menu are a mix of items in the Public user profile and each users profile. The items in the Public profile can be added to the GPO if you want users to see those shortcuts. You can easily find them by comparing a computer configured to remove common program items with a computer not configured to do so. The image below shows the GPP shortcuts Ive added to recreate these shortcuts.
How have you organized these shortcuts?
Ive gone extremely simple in the Start Menu. The Windows 10 Start Menu already groups shortcuts by alphabetical letter so I do not create any folders for shortcuts in the Start Menu except for the built-in Windows items that are typically in folders [Windows Accessories and Windows Ease of Access]. I think most people end up using the Start Menu search and just typing the name of the application they want.
To keep the Desktop from getting cluttered, I introduced folders for all shortcuts that are not web browsers or related to device or room hardware [such as scanners, document cameras, or room AV controls]. I use two folders for our most-used software suites [Microsoft Office and Adobe Creative Cloud] and the remaining shortcuts are grouped by software purpose: Accessibility, Development and Technical, Math and Statistics, Multimedia and Design, Office Productivity, Presentation, or Science. The desktop shortcuts are a remnant of previous versions of Windows [namely 7 and 8.1] and are probably not needed anymore given the convenience of the Windows 10 Start Menu. I am planning to completely remove the desktop shortcuts that are in folders soon which will also speed up GPO processing time, as I previously detailed, by having fewer total shortcuts in the GPO.
Do you create any custom shortcuts?
I create a custom Sign Out shortcut on the Desktop so its easy for users to find and also so I can force running applications to close when someone signs out. I use a built-in Windows icon for the shortcut.
I also create a custom Sound Volume shortcut as that can be helpful with presentations or headphones.
You can also create shortcuts where the target type is URL instead of File System Object. These shortcuts will open the default web browser to the specified URL.
What if a software installer creates a shortcut in the Default User Profile?
If an application installer creates a shortcut in the Default user profile, you probably want to remove it so only the shortcuts in this GPO are applicable. You can do so within this GPO using a Delete Shortcut item [as shown in the picture below for Adobe Lightroom Classic which exhibits this behavior].
What other item-level targeting options have you used?
There are a lot of useful choices for item-level targeting that can by used for most GPP items. Ive used Computer Name, Network Address, and Group Membership in addition to File Match.
What other limitations exist with this approach?
First, you cant manage shortcuts for Windows Store apps with Group Policy Preferences. You would need to place those shortcuts in the Desktop of the Default user profile if you want them on the Desktop. Windows Store apps provisioned for each user should already appear in the Start Menu.
Second, the Start Menu search will not locate an application if there is no shortcut for it. Since were removing access to the Public shortcuts, the shortcuts in each user profile are necessary for the search to return the application by name. Be sure you add shortcuts for new software to the GPO right away.
Finally, shortcuts should be removed from the GPO when the software is no longer installed anywhere. Keeping the list of shortcuts limited to the software you have deployed will help minimize the GPO processing time. You can also remove the shortcuts from the GPO before you uninstall software to stop people from using it. While that doesnt stop them from directly launching the applications .exe file, it gets rid of the convenience of finding the application via the Start Menu or Desktop.
Final Thought
This may seem like a tedious process, but the bulk of the work is upfront when you initially populate the Group Policy Object with all of the shortcuts for your software. Once you have it set, you only need to make changes when you are upgrading or replacing software in your environment and even then only if the path to the executable changes. Its a good way to provide a controlled, consistent user experience with the Desktop and Start Menu.