Deploy a customized Windows 11 Start Menu, that allows users to change pinned apps

Microsoft documentation describes how to customize the Start menu, the only issue is that this will reset the pinned apps each time the device syncs back to Intune. For the use case where you want to set the initial start menu configuration and then allow the user to pin their own apps is not currently available. But in this blog post we will do just that, set initial start menu configuration, and allow the user to change it afterwards.

There have been multiple other blog post around this, but after testing out a lot of them I have had no success. I tried setting registry values, I tried applying the LayoutModifciation.json and I tried to copy the start.bin file, all failed in one way or another. Copying of the start.bin file failed due to the profile being created during enrollment did not use the start.bin from the default Windows profile, and when I tried to copy it to all users on the device it would simply not copy it to the current user that the device was being deployed to. I ended up using a way of copying the start.bin file with a combination of creating a schedule task, this way I always get the correct start menu instantly.

Customize the Start menu layout on Windows 11

When you customize the Start layout, you overwrite the entire full layout. A partial Start layout isn’t available. Users can pin and unpin apps, and uninstall apps from Start. When a user signs in or Explorer restarts, Windows reapplies the MDM policy. This action restores the specified layout and doesn’t retain any user changes.

Preparing your Start Menu

How to pin and unpin apps to the Start menu

Prepare the way you want your Start Menu to look like on a Windows 11 device.

Worth mentioning is that if you have devices that are being deployed on a Windows build less then 22H2 then you will need to have two versions of the start.bin file. Windows Build 22H2 uses a file named start2.bin instead of start.bin.

The way I did this was by setting up a fresh VM with Windows 11  build 21H2, I then removed the pinned apps that I did not want and added the once that I wanted.

Next, I ran Windows update and installed the Windows 11 22H2 build, this will generate the second start2.bin once restarted.

Exporting the start.bin file(s)

The start.bin files are located in your user profile.
Full location: %LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState

Copy the start.bin and start2.bin file into a folder, we will need these later on.

PowerShell Script to copy files and create scheduled task

This is the script I use to copy the correct start.bin file and deploy it during the enrollment process, you may want to modify this as I create some folder where I store the files, you may want to use the temp folder etc.

The part that will make this work is the schedule task. The GroupId I use in this task is the Default Users group in Windows. This part is what makes it able to copy the files to the current user during the enrollment process.

Save the script as install.ps1 in the same folder you placed your start.bin file(s)

If ($ENV:PROCESSOR_ARCHITEW6432 -eq "AMD64") {
    Try {
        &"$ENV:WINDIR\SysNative\WindowsPowershell\v1.0\PowerShell.exe" -File $PSCOMMANDPATH
    }
    Catch {
        Throw "Failed to start $PSCOMMANDPATH"
    }
    Exit
}

if (!(Test-Path "$env:SystemDrive\ProgramData\AutoPilotConfig\Start-Menu")) {
    New-Item -ItemType Directory -Path "$env:SystemDrive\ProgramData\AutoPilotConfig\Start-Menu"
}

$Destination = "$env:SystemDrive\ProgramData\AutoPilotConfig\Start-Menu"

# Check Windows Build to copy start.bin or Start2.bin depending in build number
$BuildNumber=[INT](Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | Select-Object -ExpandProperty CurrentBuildNumber)

If ($BuildNumber -lt 22621) {

    $Source = "$PSScriptRoot\start.bin", "$PSScriptRoot\StartMenu.ps1"
    Copy-Item -path $Source -Destination $Destination -Force

}

else {

    $Source = "$PSScriptRoot\start2.bin", "$PSScriptRoot\StartMenu.ps1"
    Copy-Item -path $Source -Destination $Destination -Force
}

# Define the principal
$principal = New-ScheduledTaskPrincipal -GroupId "S-1-5-32-545" -RunLevel Highest

# Define the task settings
$taskSettings = New-ScheduledTaskSettingsSet `
    -AllowStartIfOnBatteries `
    -DontStopIfGoingOnBatteries `
	-ExecutionTimeLimit (New-TimeSpan -Hours 72)

# Define the task trigger
$taskTrigger = New-ScheduledTaskTrigger -Once `
    -At (Get-Date).AddSeconds(5)

# Define the task action
$taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File $Destination\StartMenu.ps1"



# Register the scheduled task
Register-ScheduledTask -TaskName "StartMenu" `
    -TaskPath "\" `
    -Principal $principal `
    -Settings $taskSettings `
    -Trigger $taskTrigger `
    -Action $taskAction `
    -Force
       

As you can see the script refers to a StartMenu.ps1 and we will create this next. This is used to trigger the copy of the file to the current user during the enrollment.

StartMenu.ps1 (The file the scheduled task runs)

StartMenu.ps1 copy’s the file to the current user profile. I’m using Stop-Process to restart the StartMenuExperienceHost.exe, if this is not done then the user will have to restart the device one time before seeing the new Start Menu layout.

Save the StartMenu.ps1 file in the same folder you placed your start.bin file(s)

If ($ENV:PROCESSOR_ARCHITEW6432 -eq "AMD64") {
    Try {
        &"$ENV:WINDIR\SysNative\WindowsPowershell\v1.0\PowerShell.exe" -File $PSCOMMANDPATH
    }
    Catch {
        Throw "Failed to start $PSCOMMANDPATH"
    }
    Exit
}

#Copy Start.bin file(s) to folder
Copy-Item -Path "$env:SystemDrive\ProgramData\AutoPilotConfig\Start-Menu\*.bin" -Destination "$env:UserProfile\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\" -Force -Verbose

#Delay
Start-Sleep -Seconds 10

#Restart Start Menu Experince
Stop-Process -Name StartMenuExperienceHost -Force

Packaging the files as a Win32 application

You should now have a folder with two start.bin files (start.bin and start2.bin), the folder should also contain the install.ps1 and the StartMenu.ps1 file.

We will use the Microsoft Win32 Content Prep Tool to package the files.

• Start the Microsoft Win32 Content Prep Tool as Administrator
• Select the location where stored your files.
• Specify the setup file: install.ps1
• Select the folder where you want the output.
• The file .intunewin will contain all the files you had in the folder.
• A file named install.intunewin should now have been created.

Deploy the package using Intune

Go to Intune and select Apps, Add a new Win32-based app.

Add the package that we just created install.intunewin
Add a name, description, Publisher, Version etc.

Program settings

Install command: powershell -executionpolicy bypass -file install.ps1
Install behavior: System

Requirements

Detection rules

For this I just made it simple, it only verifies that the files being copied are in the location we wanted them to be. If you modify the script, make sure you modify the detection rules. (I know this is not really checking if the full process was completed, but you can modify this or add create register files depending on success or failure.)

Rule type: File
Path: %SystemDrive%\ProgramData\AutoPilotConfig\Start-Menu
File or folder: start.bin
Detection method: File or folder exist

Assign the newly created app to “All users” as Required (This will overwrite any current user settings they have, so you can assign it to only new users if you like)

Custom Detection script, checks the file and task (UPDATE)

Instead of using the detection rules mentioned above you can use this detection script, this is going to verify that the files are create and the scheduled task is also created.

If you edited anything in the script, please edit the detection script to fit your need.

Add the app as Required to the Enrollment Status page profile

Go to your enrollment status page and make sure you add the app to the required apps, this will make sure it will be deployed during the enrollment.

You are done.
When a new device is deployed, the start menu layout will be instantly applied for the end-user and they can then pin their own apps.

Extra

In my script I do not delete the task, you could call it at a later stage if needed. If you want it to be deleted, you can always add something like the below, this would delete the task.

# Wait for the task to finish running
Start-Sleep -Seconds 180

# Delete the scheduled task
Unregister-ScheduledTask -TaskName "StartMenu" -TaskPath "\" -Confirm:$false