This one has really gotten some time to sort out – here is the scenario: I am running a Windows Server 2008 R2 SP1 as Domain Controller (Host: WINDC) and a second Windows Server 2008 R2 SP1 as Terminal Server (Host: WINTS).
When my users log in to the Terminal Server, I want to present them with a common Start Menu but I do not want to maintain each user’s Start Menu individually (my working through their profiles).
Creating the “new” Start Menu
The new Start Menu structure resides on the host WINDC – that way, each Terminal Server that I might add in the future can also access it without additional work.
On this host (WINDC) I have created a directory called CommonUX, within it there are two subdirectories: StartMenus and Wallpaper (for a common Wallpaper). Within StartMenus, I have created a single directory for the (currently only) Start Menu structure I need: Terminal Server.
Finally, I have shared \\WINDC\CommonUX and granted Share and NTFS Permissions for Authenticated Users as Read.
Within the Terminal Server diractory, I have then started to build my Start Menu items, Application Group 1 and 2, Microsoft Office, and a Startup Folder.
The Group Policy
Now this one has taken me a while to figure out – especially since there are a couple of settings that “collide”. First of all, the easier one:
Under User Configuration -> Ploicies -> Windows Settings -> Folder Redirection -> Start Menu, I have chosen the Basic Redirection (everyone will receive the same Start Menu) and directed the redirection to \\WINDC\CommonUX\StartMenus\Terminal Server.
On the Settings, I have disabled all options – I do not want the user to gain exclusive rights on the Start Menu, or move contents from the current one into the central location. Also, I do not have older OS Clients so there is no need to enforce the policy on those.
I applied the new GPO to an Active Directory OU and logged on with a user belonging to this OU – and got… an empty Start Menu! WTF?!?
The Dependencies
Unfortunately, it took me a while to find out what has happened… I stumbled across some other settings, both in User COnfiguration -> Administrative Templates -> Start Menu and Task Bar:
- Remove common program groups from Start Menu
- Remove user’s folders from the Start Menu
The second one was the critical one: it looks like Windows treats the items in the Custom Start Menu on my \\WINDC Host as “user folders” – if this second item is enabled, I redirected but then immediately removed the new menu. So I set it to disabled.
The first setting is more of a clean-up one: despite the redirected Start Menu, Windows still pulled the Start Menu Items from the public Start Menu on the Terminal Server – so my Start Menu contained the items from the redirected location but also those from the public Start Menu… this settings removed the common program groups.
And the result…
…is a stunningly clean (because I have actually enabled a couple more GPO Rules) Start Menu for my users
I hope, this quick walk-through will help people to achieve this task faster than I managed to by pointing out two of the traps that I stepped in – there are more, especially when you are using a more complex GPO structure but these mentioned here had been my major issue…