Configure a dynamic Start Menu layout for Windows 10 during OSD with ConfigMgr

NOTE: This doesn’t work on Windows 10 version 1903 and onward unfortunately as the API’s used in this method is not available any longer.

While many are of the opinion that organizations should not customize the start menu during Windows 10 deployments, it’s happening almost in every Windows 10 project anyway. There are several blog posts created by the community and documentation from Microsoft outlining the different methods how to accomplish a customized start menu and even task bar configuration during deployment of Windows 10.

Using the method to define a partially locked start menu is what I usually recommend my customers, but to keep it to a minimum where it mainly contains applications or tools that can be references by the help desk for easy access during a support case. A partially locked start menu basically means that certain defined part of the start layout area of the start menu is locked down and doesn’t the end user to unpin what’s defined by the administrator.

Read more about using a partially locked start menu from the documentation below:

Something that may not be spoken about too often is the fact that when customizing Windows 10, an organization may want to make the start menu more visually appealing for the end user upon the first logon. A scenario here could be that an organization would want to leverage the partially locked section of the start layout, but provide a set of pinned items that the end user can decide themselves if they want to remove them or not.  This is however not possible today with the built-in functions and tools provided by Microsoft.

Let me try and explain what I’m talking about with an example.

We have an organization that are currently using group policies to configure a partially locked start menu. This section is controlled by the organization and the end user cannot modify what has been added here. The organization would also want the end user to have Outlook, Word and Excel pinned right below the locked section of the start menu, but the end user should be able to remove these pinned items.

So how can we accomplish this scenario – continue to read for a solution on how to configure a what I call a user-defined or dynamic start menu customization that can be deployed with ConfigMgr during operating system deployment of Windows 10.

Pinning applications in user context

The problem we have to overcome here is that the start menu is designed to be customized by the end user. A user pins tiles, re-arranges them and so on from time to time. We as administrators can make customizations that are either set in stone or partially locked. Moral of the story here is, in order to pin applications to the start menu for the user without using any of the built-in tools like a group policy, it has to be invoked in the context of the user.

While researching this, I stumbled upon a way to invoke the actual pin and unpin methods utilized when a user for instance right clicks on an application in the start menu list of applications. Below is a simplistic way to pin an application in the context of the user using PowerShell:

((New-Object -ComObject Shell.Application).NameSpace("shell:::{4234d49b-0245-4df3-b780-3893943456e1}").Items() | Where-Object { $_.Name -like "Command prompt" }).verbs() | Where-Object { $_.Name.replace('&', '') -match 'Pin to Start' } | ForEach-Object { $_.DoIt() }

What happens here when this is invoked in the context of a user currently logged on, is that the Command prompt is added to the start menu. With this information I put together a script that extends the functionality to check if the application is already pinned, or if it’s an approved application, meaning that the application is capable of being pinned.

So which applications can be pinned using this method? A good rule of thumb is anything you see in the start menu, and the name it has should be the one you use like with the example above where we used Command prompt.

This script can be found on our SCConfigMgr github repository here:

Extending the solution to operating system deployment

Now comes the tricky part, how should we run a script to add a set of applications to the start menu of the user that logs on. What about multiple users logging on to the same device?

This is not a new problem frankly, and you have probably heard of the solution already, Active Setup. For this solution, we don’t want to use other methods such a user logon scripts. We want to ensure that our script to pin the desired applications to the start menu of the user is only executed once per user that logs on. For this requirement, Active Setup is the prime candidate.

What I’m sharing in this blog post is a single script that can be executed during operating system deployment using ConfigMgr. The script is designed to perform the following actions when executed during operating system deployment:

  • Stage itself into the C:\Windows folder
  • Prepare the required Active Setup registry keys

At this point the script all about done. The task sequence will continue and complete eventually. When the first user then successfully has entered the credentials and the user logon sequence begins, the script then invoked again by Active Setup and the following happens:

  • Create a new PowerShell process that invokes itself again, this time in another process that’s not causing Active Setup to wait until the initial process it launched has completed
  • Main logic for adding pinned applications, taken from the original script mentioned above, is executed and the applications are pinned for the user that is logging in

Let’s take a look at how this is configured in a task sequence in ConfigMgr.

Implement the solution in your task sequence

First you’ll need to download the script from the following location:

  • Edit the Set-StartMenuUserTiles.ps1 and locate row 154-155.
  • Amend the $AppList string array with the application you would want the end user to have pinned.

  • Create a regular package without a program and distribute it to your distribution points.
  • Edit your task sequence and locate a suitable place after the Setup Windows and ConfigMgr step.
  • Add a new Run PowerShell Script step in this location.
  • Configure the step accordingly to the image below:

  • Apply the changes made to your task sequence.

End user experience

Once the deployment of a new machine has completed and the user has logged on for the first time, the applications defined in the Set-StartMenuUserTiles.ps1 script will be pinned to the start menu for that user like shown in the picture below.

Additionally, we can see that the end user can manage these pinned applications, but not the ones added in the locked down section of the start menu.


Using this solution we can now control exactly what’s pinned to the start menu for the end user after operating system deployment and we’re not bound to a set of rules that comes with the different methods currently available. You could practically extend this solution to dynamically pin any set of available applications on the machine, depending various variables or group memberships and so on, the choice is yours.

Nickolaj Andersen

Chief Technical Architect and Enterprise Mobility MVP since 2016. Nickolaj has been in the IT industry for the past 10 years specializing in Enterprise Mobility and Security, Windows devices and deployments including automation. Awarded as PowerShell Hero in 2015 by the community for his script and tools contributions. Creator of ConfigMgr Prerequisites Tool, ConfigMgr OSD FrontEnd, ConfigMgr WebService to name a few. Frequent speaker at conferences such as Microsoft Ignite, NIC Conference and IT/Dev Connections including nordic user groups.


  • do you know a way to add shortcuts ? I do not see how you get the application list or shortcut list

  • This script is great! Surprised I am only just now coming across it. Have you been able to target a specific group that already exists?

    • Hi Nick,

      That’s definitely possible, you’d just need to query the group memberships of the current logged on user to determine if it’s a member of your desired group. I don’t have any example code for this, unfortunately.


  • Hi Nicolaj

    I use partial lock .xml via gpo, can I still use your script?

    I have tried to setup your script, but no icons are showing, only my partial locked icon are showing.

    • Hi Murat,

      Yes, that’s the whole point. I’d try to add some logging to the script to see where it’s failing. This version doesn’t include any logging by default, so you’d have to add it yourself.


  • Hi Nikolaj.

    Thanks for posting the script.

    I tested the script but seems like nothing happens when I log on (-RunMode Stage – W10 Task Sequence). The script is copied to C:\Windows and the Active Setup registry settings are created. Is Active Setup or the script logging somewhere ?

    When you add the applications to the $AppList do you add them in English or local W10 language


    • Hi Trond,

      No logging as of now. It’d have to be with what’s visible in the start menu for the localization of the device. I’ve only tested this with an English US version of Windows 10 so far.


      • The issue was related to the windows Language, so we had to re-Write the script to support the Norwegian Language. Now it’s working for us 🙂

        Wishlist for next version :
        – Possibility to add TileGroup names
        – Possibility to configure the tile size



  • Hi Nickolaj

    In my humble opinion that is “like passing over the stream to get water” (danish saying) 🙂

    Can you elaborate in what way the above is easier or more functional than just:
    powershell -executionpolicy bypass Import-StartLayout -LayoutPath ‘.\StartmenuLayout\LayoutModification.xml’ -MountPath c:\ -verbose

    With kind regards

    • Hi Thomas,

      I tend not to agree with you here. Have a read at the post again, because I get the feeling that you’re not understanding the scenario. But let me try to explain:

      Imagine a scenario where you already have a GPO for instance in place that’s already applying a start layout exported from a reference machine. With this, depending on how it’s configured, you might have a partially locked down start layout being applied through GPO (at least that’s what I’d recommend you to have). Let’s say that you want to add additionally tiles to the start menu for users that login to a new machine for the first time, or perhaps an existing machine but it’s still the first time they login to that machine. This doesn’t work with any currently implementation today, being GPO or doing it through PowerShell during OSD for instance. With the method mentioned in this post, it now works.

      Makes sense?


      • Our custom overlay tiles are moving around nicely with U-EV.

        We set up a standard customOverlay tile for new users as described above, and when the user changes it, U-EV picks it up and carries it along to any PC the user logs into..

        That to me is simpler (especially because I do not do the AD U-EV work. That’s another guy 😀 )

      • I like the command to pin an item to the start menu. I wonder how long before Microsoft “patches” Windows to again prevent it like they have for other scripted Start Menu modifications. It’s too bad there doesn’t appear to be any way to define the group/location.

        Another option to set the default start menu for newly logging in users is to create/modify the start layout .XML and then just set a task sequence to copy that .xml file into “C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\LayoutModification.xml”.

        It doesn’t change the start menu for existing profiles, but then again, neither does Active Setup. However, you do then have the ability to define the group and placement location.

      • I’d never attempt to replace any files etc, that’s more likely, although probably unlikely, to be “patched”. This method simply calls the “right-click” API’s built into Windows and performs the pin for you, like you’d do manually.


  • Hey Nickolaj,

    this is a nice solution. i will try it in my next windows 10 migration project in october.
    Do you know if this als can be adapted to the task bar?
    if you configure the task bar during the os deployment with the default way the user is also unable to unpin the predefined items.


    • Hi Janek,

      It probably could, but I’ve not tested it. Obviously you’d need to modify the script to find a way of adding the tiles to the taskbar instead.


  • Hi – The script at GitHub – is it a complete script? When I open the script it has 97 lines in total. On the contrary you say to edit the script from line 154-155. Maybe I am missing something or the script at GitHub is incomplete. Appreciate your response.

    I would like to test the script during this weekend on Win 10 TS.

    Thanks for sharing the script.



Categories use cookies to ensure that we give you the best experience on our website.