Set default Start Menu with Microsoft Intune

In Windows 10 the Start Menu layout looks horrible to me after the first sign-in to a new Windows 10 device. That`s not only the case with a Windows 10 Home edition, but even when using Windows 10 Pro or Enterprise.

Ok, that finally changes in the latest Windows 10 1903 build, only showing the Office app, Edge and the Microsoft Store app by default. But still as an admin you maybe want to add some common used tiles to the Start menu to make the life of the end-user a little easier. Or you`re not already deploying 1903 and need to provide your users a more clean Start Menu.

With Microsoft Intune we can use a policy to set a customized Start Menu for our users, but because this is not a preference the user isn`t able to customize the Start Menu itself. I don`t prefer this option of blocking the user to configure his own Start Menu.
Another option is to define a default Start Menu which is only used to create the default Start Menu for the end-user at first logon, with the user still able to customize the Start Menu to his needs.

Such a default Start Menu can be set by using the PowerShell commands Export-StartLayout and Import-StartLayout. The layout configuration file which we get by running the Export command, can also be placed (manually) in the Default user profile. No matter which of these two options we choose to import the default Start Menu, a default Start Menu needs to by applied before the end-user first logs on to the device.

With the general availability of the Enrollment Status Page as part of Windows AutoPilot, we have the option to apply policies and software packages in the device setup stage before the end-user is logged on for the first time. As we are able to package (PowerShell) scripts in a WIN32 package, which can be deployed during ESP, that`s the easiest way to set our default start menu in my opinion.
The steps involved in this configuration are:

• Create and export a default Start Menu
• Create a PowerShell script
• Wrap the script and export in a WIN32 package
• Deploy the WIN32 package with Microsoft Intune
• Configure the Enrollment Status Page

Create and export a default Start Menu

The first thing we need to do is creating a Start Menu which we like to deploy to our Windows 10 devices. When finished customizing the Start Menu, we need to export the Start Menu with the Export-StartLayout command: Export-StartLayout -Path .\LayoutModification.xml -UseDesktopApplicationID
Have a look at the Microsoft docs for information about the Export command.

To prevent issues with pinned tiles I have used the switch -UseDesktopApplicationID

The export we get is in a XML format and contains a configuration like below. My file contains a few lines for Office ProPlus application tiles and two browsers.

Besides setting a default start menu, you can also add a section to the XML file to control the shortcuts on the taskbar. You can use the same DesktopApplicationIDs for this. More on that is found on Microsoft Docs.

Create a PowerShell script

To import the XML file we can use a one-line PowerShell command as you can read in the docs:
Import-StartLayout -LayoutPath “Layout.xml” -MountPath “C:\”

In our PowerShell script this looks likes:
Import-StartLayout -LayoutPath “$PSScriptRoot\LayoutModification.xml” -MountPath $env:SystemDrive\

Where I use $PSScriptRoot for the location where the script and XML are (temporary) stored.

An example script is provided below. It might be a bit overkill in your environment, as it contains a section for error handling. It also contains a part to run the script in the right context, which I got from fellow MVP Peter van der Woude. And it writes the result in the registry which I use in Intune to detect if the script runs successfully.

#Run PS in x64 context on x64 platform
If ($ENV:PROCESSOR_ARCHITEW6432 -eq "AMD64") {
    Try {
        &"$ENV:WINDIR\SysNative\WindowsPowershell\v1.0\PowerShell.exe" -File $PSCOMMANDPATH
    }
    Catch {
        Throw "Failed to start $PSCOMMANDPATH"
    }
    Exit
}

Function CleanUpAndExit() {
    Param(
        [Parameter(Mandatory=$True)][String]$ErrorLevel
    )

    # Write results to registry for Intune Detection
    $Key = "HKEY_LOCAL_MACHINE\Software\InTheCloud247\StartMenu\v1.0"
    $NOW = Get-Date -Format "yyyyMMdd-hhmmss"

    If ($ErrorLevel -eq "0") {
        [microsoft.win32.registry]::SetValue($Key, "Success", $NOW)
    } else {
        [microsoft.win32.registry]::SetValue($Key, "Failure", $NOW)
        [microsoft.win32.registry]::SetValue($Key, "Error Code", $Errorlevel)
    }
    
    # Exit Script with the specified ErrorLevel
    EXIT $ErrorLevel
}


# Set the initial Windows 10 Start Menu Layout
$Error.Clear()
Import-StartLayout -LayoutPath "$PSScriptRoot\LayoutModification.xml" -MountPath $env:SystemDrive\
If ($Error.Count -gt 0) {

    CleanUpAndExit -ErrorLevel 101
} else {

}

CleanUpAndExit -ErrorLevel 0

Create the WIN32 package

Now that we have our XML file and PowerShell script, it needs to be wrapped to a WIN32 package which we can deploy using Intune.

The tool which we need to wrap the script can be downloaded from GitHub where you can also find instructions how to use it.

Make sure the XML file and PowerShell script are saved in the same folder, without any other files.

• Start PowerShell as admin and start IntuneWinAppUtil.exe.
• Enter the location of the files as source folder.
• Enter the name of the PowerShell script as setup file.
• Enter an output folder.
• Choose N to not specify a catalog folder

The output is an intunewin file which is a container file containing our XML and PS script which we deploy with Intune.

Deploy the WIN32 package with Intune

Next step is to deploy the WIN32 package with Microsoft Intune.

• Sign-in to the Endpoint Manager admin center
• Browse to Apps – Windows
• Click Add

• Choose Windows app (WIN32)
• Click Select

• Click Select app package file
• Browse to the intunewin file and select the file
• Click OK

• Enter a Name
• Enter a Description
• Enter the Publisher name
• Enter all other information (Optional)
• Click Next

• Enter the install command: PowerShell.exe -NoProfile -ExecutionPolicy Bypass -file .\DefaultStartmenu.ps1
• Enter the uninstall command (we don`t have an uninstall option, so I filled in the same command)
• Leave everything as default
• Click Next

• On the Requirements tab make your choices
• Click Next
• Choose Manually configure detection rule on the Detection rules tab
• Click Add
• Choose Registry as Rule type
• Enter the key path which is set by the script
• Enter the Value name
• Choose Value exists As detection method
• Click OK
• Click Next

Make sure to assign the application as required to a device group.

Configure the Enrollment Status Page

I assume the Enrollment Status Page is already enabled for your (test) users and we only need to add the Default Start Menu app as required app during the enrollment. If you require all apps to be installed during enrollment, you can skip this step.

1. Browse to Devices – Windows
2. Click Windows Enrollment
3. Click Enrollment Status Page
4. Click the Enrollment Profile
5. Click Properties
6. Click Edit next to Settings
7. Click Select apps
8. Check the Default Start Menu app
9. Click Select
10. Click Review + save – Click Save

End-User experience

When everything is set, turn on a Windows 10 device which is registered as AutoPilot device in Intune.
Authenticate with a user which is targeted by the Enrollment Status Page.

During the second stage, the Device setup stage, device targeted applications are installed. During this stage the Default Start Menu application is installed and the LayoutModification.xml file is copied in the default user profile. This all happens before the end-user profile is created.

When the deployment is finished and the user is logged on for the first time to the device, the user is presented a nice and clean Start Menu. As you can see, the user is still able to (un)pin tiles.

Interested in configuring the Windows 11 start menu? Also read this article.

Thank you for reading this article. Feel free to contact me when you have questions or comments. You can do that by leaving a comment below or send me an email.