Control the Windows 8.1 Start Screen Layout with Group Policy

If you had the opportunity to attend TechEd North America 2013, one of the new Windows 8.1 features that was showed off was the ability to set the layout of the Start screen in Group Policy. (In the event you didn’t attend, you can watch a replay of the keynote here; skip to 13:30 to see the demo of customizing the Start screen.)

Before you get started, the Start Screen control feature is only available in Windows 8.1 Enterprise.  If you’re running Windows 8 [any edition] or Windows 8.1 Pro, you’ll need to switch to 8.1 Enterprise.

First, start on a Windows 8.1 Enterprise computer that is representative of what your end users will have. Organize the Start screen including resizing any tiles, creating groups, naming groups, etc.

01As you can see, I’ve removed a number of the default tiles and added a new group named Microsoft Office. Now that I’m done, I can export the layout with the PowerShell cmdlet Export-StartLayout:

02One of the key points to remember with the Export-StartLayout cmdlet is that the default output is binary. If you don’t include -As XML, you’ll end up with a binary file that can’t be used with Group Policy.

Once you’ve generated the XML file, you’ll need a file share to store the file. This file share (and the underlying file permissions) will need to be accessible by any user receiving the policy. Even if you’re assigning the policy to the Computer side, the user that is logging in will need Read access to the XML file. In most situations, you can give Domain Users Read access to the share and file system and you should be ready to go unless your environment requires locking things down a little tighter.

If you decide to inspect the XML file, this is what you’ll see (after inserting a few carriage returns):

03Fire up the Group Policy Management Console and go to:

Computer side:
Computer Configuration > Policies > Administrative Templates > Start Menu and Taskbar > Start Screen Layout

User side:
User Configuration > Policies > Administrative Templates > Start Menu and Taskbar > Start Screen Layout

04Fairly easy so far… Now I’ll head over to a client and log in as a test user after Group Policy has refreshed:

05The one thing I missed when I originally configured the policy was the sentence, “Users cannot customize their Start screen while this settings is enabled.”

06Sure enough… my test user right-clicks on a tile and isn’t able to change any settings associate with the tile (or anything else associated with the Start screen layout).

x86/x64 Portability

The short version… don’t count on it. In my testing, Start screen layouts created on one bitness level typically transferred to the other with very inconsistent results. For example, I used a reference system with Windows 8.1 Enterprise x64 and Office 2013 x64 to generate the screenshots used earlier in this post. Below is a screenshot of that layout used on a system with Windows 8.1 Enterprise x86 and Office 2013 x86.

07Interestingly, if I used Office 2013 x86 on both systems, the tiles were correct on both x86 and x64.

What happens if…

The end user has never logged into the PC.
Assuming you’re getting your Group Policy in place before a Windows 8.1 deployment, this will probably be the most common scenario. In this scenario, the user that logs in will get your configured settings from the XML file.

The end user has logged in and customized his/her Start screen and you’ve configured a new XML file in policy.
In this scenario, the user’s Start screen will change to your configured XML file. So, you may want to warn end users that the change is coming.

The XML file used in Group Policy is changed or a different file is used.
The user’s Start screen will be updated at their next logon.

An app (either Metro/Modern or Desktop) is configured in the XML file for the Start screen, but isn’t installed?
In this scenario, the tile will not show up on the Start screen. If the app does get installed on the computer, it will show up immediately after the install completes on the Start screen.

Do local non-domain users receive the Computer side policy?
Yes. As long as the user account can access the XML file, it will receive the policy.

Kyle Beckman

Kyle Beckman

Kyle is a Systems Administrator with 15+ years of experience. He currently works in Higher Education supporting everything from smartphones to desktop PC's to Hyper-V Failover Clusters. (If it has a IP address, he probably supports it!) He has also worked in Small Business IT consulting supporting a wide variety of businesses and non-profit organizations.

Kyle is also the Vice President of the Atlanta Windows Infrastructure and Virtualization User Group (WINVUG).You can find additional articles he's written on 4sysops.com.
Kyle Beckman

42 Comments

Add a Comment
  1. Is it possible to export/import any pinned website tiles in the XML file as well? They appear in the XML file but not on the PC I import the file to possibly because they reference an APPID which is a long int number and not the URL

    1. Ooo… Good one! Let me play with that in my lab some and I’ll see what I can find out.

  2. Cloud this work in win2008r2 GPO environment and Windows 8.0 clients?

    1. Unfortunately, no… You’ll need Windows 8.1 clients to take advantage of this. Your AD version doesn’t matter as long as you have either a Windows 8.1 or Server 2012 R2 box to manage Group Policy.

  3. Kyle, will we need to install Win8.1 ADMX files in order to deploy these settings from a Win2008R2 server? If so, where can we find those ADMX files? I’ve already installed the Win8 ADMX files (http://www.microsoft.com/en-us/download/details.aspx?id=36991).

    1. As far as I’m aware, the updated ADMX files haven’t been released. The Preview bits are out there, but GA isn’t.

      1. The Windows 8.1 and Server 2012 R2 ADMX files have been released. I’ve updated the Group Policy download page with the links: http://trekker.net/archives/group-policy-downloads/

    2. You can simply run below script on Windows 8.1 machine and then copy PolicyDefinitions folder to \\FQDN\SysVol\FQDN\Policies\PolicyDefinitions
      There is only one problem with SearchOCR.admx mentioned here: http://social.technet.microsoft.com/Forums/en-US/8030e704-bc17-41cb-804d-567bd43eee39/searchocradmx-is-corrupt-on-812012r2-installation-media

      @echo off

      cd /d %windir%\WinSxS
      dir *.admx /s /b > %USERPROFILE%\Desktop\admx.txt
      dir *.adml /s /b | find /i “en-us” > %USERPROFILE%\Desktop\adml_en-us.txt
      dir *.adml /s /b | find /i “pl-pl” > %USERPROFILE%\Desktop\adml_pl-pl.txt

      md %USERPROFILE%\Desktop\PolicyDefinitions\en-US
      md %USERPROFILE%\Desktop\PolicyDefinitions\pl-PL
      for /f %%i in (%USERPROFILE%\Desktop\admx.txt) do copy /y %%i %USERPROFILE%\Desktop\PolicyDefinitions\
      for /f %%i in (%USERPROFILE%\Desktop\adml_en-us.txt) do copy /y %%i %USERPROFILE%\Desktop\PolicyDefinitions\en-US\
      for /f %%i in (%USERPROFILE%\Desktop\adml_pl-pl.txt) do copy /y %%i %USERPROFILE%\Desktop\PolicyDefinitions\pl-PL\

      del %USERPROFILE%\Desktop\admx.txt
      del %USERPROFILE%\Desktop\adml_en-us.txt
      del %USERPROFILE%\Desktop\adml_pl-pl.txt

  4. Kyle 1st great write up! i tried what you shows and i get the following Error (Export-Startlayout : The Term Export-Startlayout is not recognized as the name of a cmdlet, function,

    1. Make sure you’re using Windows 8.1. The most common problem I’ve seen is people trying to do this on Windows 8.0 which is not supported.

      1. yes its 8.1 Pro i just updated a few days ago, but still no luck. Is Pro supported?

        1. Sorry, only Windows 8.1 Enterprise is supported. I’ll update the article to reflect that.

  5. Any ideas when the 8.1 ADMX files will be released?

    1. As a standalone download, sorry… I don’t.

  6. I have 8.1 and server 2008 R2 Can it Work??

    1. Edit the policy on the 8.1 box and you’ll be good to go.

      1. On all the computers or just one of them??

  7. How do I get hold of the files as non-standalone then?

  8. Thx – worked perfect on first try.
    Only one further question. What would be the best practise to make Network-link-tiles-with-unc-path and HTAs stored in %logonserver%\netlogon to show up. Eventually they do not, and i guess that is beacause they are not “installed”. Would it be enough to copy them to Allusers–>%appdata% –> startmenu or do they need to be in the ProgramData location? OR what makes the starmenu Prozess indetify them as installed? Is there a way to accomplish this per GPO (post deployment)?

    1. All I can say is to try experimenting with different locations and see what works.

  9. You can pin a tile which points to a UNC path by first creating a GPO which creates the shortcut in the %commonProgramsDir%. Then GPupdate your test PC. When the test PC has applied the policy and created the shortcut, browse to %programdata%\Microsoft\windows\start menu\Programs. Pin the shortcut to the start menu and then use the export-startlayout powershell command to export the XML as described in this post. The two policies will work together to enable you to deploy the start layout to any computer and customise easily in the future.

  10. Hi Kyle, Is it possible to export/import any pinned website tiles in the XML file as well?

    1. I’ve not personally done it, but I’m sure it is possible. My guess is that you probably have to have the URL shortcuts somewhere on the system. If you figure out how to do it, write it up and I’ll be glad to post it as a guest post here.

      1. I have tried over and over to get IE pinned URL shortcuts but I haven’t been able to find anyone that has the answer to this. Did anyone figure it out?

  11. What i want to Edit existing start layout xml. like If i have a setup, i want to create my product group & add into existing layout thus not manipulating or changing users layout. And once its uninstalled, the group will be deleted from the XML. Please assist kyle. I have windows 8 pro.
    suggest if any up-gradation. I will do it & try it.

    1. Covered in the second paragraph: this is only supported in Windows 8.1 Enterprise.

  12. Hi,
    great tutorial but I didn’t get any joy. I created an xml on a Win8.1Ent machine. Exported the XML created a GPO user policy for a user using Group Policy Manager installed on a Win8.1Pro machine. Logged in as the user on the Win8.1Ent machine, a gpresult says the GPO was applied successfully but the only tiles displayed are browser choice & IE ? I’m a little confused.

    1. Lots of Group Policy settings can apply, but not work properly if the requisite setup hasn’t been performed or has problems. Check that the user has read permissions on the file path and UNC path (if on a network share). You also said the magic word: Pro. Pro isn’t supported. If you’re bouncing back and forth between Pro and Enterprise, you’re going to start running into issues like this where different editions support different features.

      1. I’m using Win 8.1 Pro, too and it works just fine for me.
        Apart from the fact that I also get the Browser Choice tile displayed although it is not present in the Layout.XML.

        How can I get rid of it?

  13. I’m using 8.1Pro to set the GPO, would I be better installing Windows 2012 R2?

  14. I was wondering if there is a way to set up a default metro screen but allow user customization?

  15. It will not work!!!

    1. Works for me, but without anything more than, “It will not work,” I can’t really do anything to help.

      1. Hi Kyle,

        I’m using Mandatory profiles with folder redirection in an RDS environment. I’ve exported a golden Start Layout and the majority of icons load without issue using GPO to deploy the start layout. There are 2 custom .NET applications that are purely copied onto a drive other than the system drive during deployments. I’ve had a look at Get-StartApps on relevant machines and the AppID’s are different for each.

        I’ve added the AppID’s as part of the Pin these Apps to the Start Menu GPO but with no luck. Attempts to copy the exe files to the Program Files folders and new shortcuts haven’t helped either haven’t particularly helped either.

        Interestingly, if the shortcuts are copied to the Apps menu, they appear ok and an right clicking asks if the icons want to be unpinned from Start suggesting they’re present just hidden?

        Users can access the share and can access the location containing the exe, is there something I’m missing?

        Cheers

        Dave

        1. Urg… mandatory profiles… That’s a wildcard with the Start Screen layout control. I’ve talked to a few people that were trying to use mandatory profiles and control the Start Screen that were having issues. If you can get the config into your mandatory profile, that would probably be simpler.

          Our Windows 8.1 deploy has several URL’s pinned to the Start Screen that are shortcuts in the regular Start Menu folder structure. We needed to update one of the URL’s and the Group Policy Preference I used changed the AppID and killed the tile on the Start Screen. The AppID’s being off or (my personal opinion) looking at the computer wrong can cause issues with the Group Policy enforcement of the Start Screen. It’s partially trial and error and, worst case, call Microsoft support and see if they have advice.

  16. Hello, great write up.

    Our users like to use spotify but with it being in the appdata \ romaing folder it’s specific to that user. c:\user\%userprofile%\appdata\roaming\spotify\spotify.exe doesnt seem to be pinning where as everything else does.

    Anything you can recommend?

    1. Everything I’ve tried pinning was in Program Files. I haven’t used Spotify, but if there is a way to install it as Admin for all users on the machine, that may resolve the problem.

  17. Its very unpredictable I have noticed that a user must have logged into an enterprise pc before the tilescreen actually appears on a pro machine. Also certain shortcuts like file explorer might appear but it appears to be totally random. Custom shortcuts wont appear unless the user is an administrator which is also slightly odd.

    1. I’ve never had any issues with this being unpredictable. First off, this is only supported on Enterprise. It sounds like what you’re seeing is a user logs into Enterprise, that configuration is synced to their OneDrive, then the user sees the customized Start Screen on a Pro system.

      If you’re having issues with shortcuts appearing, you may need to check that you’re deploying all your systems identically and possibly have one config for your x86 machines and one for your x64 machines. I’ve seen tiles show up for one bitness, but not the other.

      Last, check the location you’re using for the shortcuts and the permissions of that folder. If the user had to be an Admin to create the shortcut, you’re doing something wrong. By some chance are you using the All Users Desktop to create the shortcut instead of the user’s Desktop? That’s typically where most people have issues.

  18. Hi Kyle,

    Great to find someone who really knows their stuff. I’ve got a question hopefully you might have some insight.

    Windows 8.1. Local user can access and run all Start menu tiles and apps. That machine now joins the domain. My domain user logs on, and non of the Start menu tiles/apps work. Click on them and then right back to the Start Screen. Little circle with an x in the lower right corner of all the tiles.

    It has to be a domain policy blocked access to these. Any idea where I might look? Or a fix for this?

    Much appreciated if you do have something. So far I’ve struck out.

    Sonny

    1. It sounds like it may be Group Policy based on the symptoms. I would try putting the computer into a OU that doesn’t have any Group Policy applied and log in with a local user or a domain user that also has no policy to see if the problem still exists. If you’re no longer having the problem after removing the Group Policy, you’ve got a Group Policy problem. You can run gpresult.exe /h report.html to get a list of the Group Policy that is applying to the user. Run it with Admin rights and get the policy for the computer.

  19. Hi , great article! I have implemented this in a 2012R2 Terminal server (aka windows 8.1 interface) .. .works great, only issue is that users can’t modify it at all, your article seemed to indicate there was a switch that would allow them to?

    You make mention that there’s an option for ““Users cannot customize their Start screen while this settings is enabled.”
    I cant see this option anywhere in my GPO?
    Im curious though, even if we do allow it, won’t it get over-written every time they logon (i keep the GPO active).

    Would love an email if you have the time!

    Cheers,
    brad.

Leave a Reply

Your email address will not be published. Required fields are marked *

© trekker.net