Deploy a customized Windows 11 Taskbar that allows users to change the pinned apps

*UPDATE 2024-07-07*
New revised version please see new post

• Fixed: Reported issue in v2 where Success key was placed in HKLM\Software\WOW6432Node\*name*\Taskbar instead of HKLM\Software\*name*\Taskbar.
  Thanks Ronny.
• Some users are reporting issues with Icons being blank, please make sure the application is installed and the .lnk file is in the %AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
  
  If you are still having issues please test if rebuilding IconCache works and please report it to me.

Added a second version with a couple of changes. This version will run for all users who logs into the device setting the Taskbar once, then allowing the user to configure the taskbar themself. This uses a Scheduled-Task that checks if the Taskbar have been applied to the user profile during login. I have set this to call VBS script to make sure the process runs hidden. (This is similar to a logon script) It uses the RunOnce key for the first deployment and then the Scheduled-Task for all other users that logs on to the device.

Go to version deployed for all users at login.

*UPDATED 2023-08-16*
Updated script to also copy AppData file to resolve issue where icon might turn blank.
Changed to only import Favorites key, no other keys needed in the .reg file.
Added logging function, writes a log file to Windows\temp folder.

I have seen a lot of posts regarding this, you want to deploy a standard taskbar from the start but then allow the user to pin their own apps.

Using Intune, you can set an XML file with a customized taskbar, however this will not allow the user to pin their own apps, or it will revert back on each sync.

Microsoft documentation for creating a taskbar policy in Intune.

The old way with Windows 10 we could simply import the XML file, we could also use PowerShell to modify the taskbar. From Windows 10 21H2 you can no longer modify the taskbar using PowerShell. (Well, you can remove all the icons but not add icons back in a good way 😊)

With this post, I will go over how you can deploy your customized taskbar in Intune and still allow the user to pin their own apps afterward.

Preparing your Taskbar

How to pin apps to your desktop

• Spin up a new VM or use a device with all the apps that you want to pin already installed.
• Create your perfect taskbar on your new machine.

(If you have custom apps make sure they are installed in the same directory and during the deployment of the PC)

Exporting the registry keys for the Taskbar.

• Open the Registry Editor
• Go to: HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband

The registry keys for the taskbar contains all the pinned apps. You can get this from two places, to make this easier we will use the HKEY_CURRENT_USER however the value is also available in HKEY_USERS under the SID for your current user.

When you pin and unpin apps to the taskbar you will see these values changes.

• Right click on the folder “Taskband” and select Export.
• Save the file to your preferred location and name it TaskBar.reg

Modifying the .Reg file (TaskBar.reg)

• Open the exported .reg file (TaskBar.reg) with your favorite text editor (Notepad)

Modify the following parts only.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]

Change to:

[HKEY_USERS\UserSID\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]

Remove everything except the “Favorites” key

Example of how completed reg should look like below.

Windows Registry Editor Version 5.00

[HKEY_USERS\UserSID\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"Favorites"=hex:00,50,01,00,00,3a,00,1f,80,c8,27,34,1f,10,5c,10,42,aa,03,2e,e4,\
  52,87,d6,68,26,00,01,00,26,00,ef,be,12,00,00,00,d2,65,e6,c8,da,bb,d9,01,e8,\
  b0,3d,f0,da,bb,d9,01,80,35,b2,df,c3,c7,d9,01,14,00,56,00,31,00,00,00,00,00,\
  05,57,c6,8c,11,00,54,61,73,6b,42,61,72,00,40,00,09,00,04,00,ef,be,f5,56,e0,\
  6e,05,57,c6,8c,2e,00,00,00,12,a4,01,00,00,00,01,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,56,9c,6a,00,54,00,61,00,73,00,6b,00,42,00,61,00,72,00,00,\
  00,16,00,be,00,32,00,c7,08,00,00,05,57,fc,8c,20,00,47,4f,4f,47,4c,45,7e,31,\
  2e,4c,4e,4b,00,00,54,00,09,00,04,00,ef,be,05,57,04,8d,05,57,04,8d,2e,00,00,\
  00,0a,02,00,00,00,00,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f3,71,\
  01,01,47,00,6f,00,6f,00,67,00,6c,00,65,00,20,00,43,00,68,00,72,00,6f,00,6d,\
  00,65,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,22,00,00,00,1e,00,ef,be,02,00,\
  55,00,73,00,65,00,72,00,50,00,69,00,6e,00,6e,00,65,00,64,00,00,00,1c,00,12,\
  00,00,00,2b,00,ef,be,80,35,b2,df,c3,c7,d9,01,1c,00,1a,00,00,00,1d,00,ef,be,\
  02,00,43,00,68,00,72,00,6f,00,6d,00,65,00,00,00,1c,00,00,00,ff

Now your .Reg file is ready, this can be imported to any Windows 11 device 😁
(Not tested on Windows 10)

User Pinned .lnk files in AppData folder.

This part is only required if you have installed other 3rd party application and pinned them to the taskbar. We need these files to make sure the taskbar icons do not end up without a working icon. (If you skip this part, modify the script and remove the part for copy files from AppData folder)

On your device that you used for preparing the taskbar go to the folder.

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

You should see Icons from third party applications here. We need to copy them and place them in our script folder. Create a folder named AppData in the same folder where you will place the script and your .reg file.

PowerShell Script to deploy import the .Reg file during Autopilot Deployment.

We want to have this applied before the user logs in, so we will deploy this as a Required Win32 app in Intune during deployment.

The script will loop through all users (Excluding some built in user SID’s) It will then modify the “UserSID” in the reg file to match each user SID and create a temporary .reg file and import it and then delete the temporary reg file.

(Remember when we edited the .Reg file we change it to this HKEY_USERS\UserSID\ This part is being modify by the script and setting the SID’s)

The function named Copy-TaskbarFilesToAllUsers will copy the files you place in the AppData folder, and place them in the user profile during deployment.

The Script will then create a registration key depending on if it failed or succeeded using the CleanUpAndExit function.

(This function is something I tend to re-use a lot and was created by Peter Klapwijk: https://www.inthecloud247.com/)

You need to modify this part to place the registry value of the success or failed in the location where you want it.
$StoreResults = “\Contoso\TaskBar”
This will be used to verify if the application was successfully installed later.

Download Script Import-Taskbar.ps1

<#
.SYNOPSIS
This script imports a configured taskbar and copies any required .lnk files to the AppData folder.

.DESCRIPTION
The script works by performing the following steps:
1. Imports shortcut files for new taskbar.
2. Imports registry values for taskbar icons.
3. Checks if any error occurred and writes results to registry.
4. Log created in Windows\temp
#>

# If running in a 64-bit process, relaunch as 32-bit
If ($ENV:PROCESSOR_ARCHITEW6432 -eq "AMD64") {
    Try {
        &"$ENV:WINDIR\SysNative\WindowsPowershell\v1.0\PowerShell.exe" -File $PSCOMMANDPATH
    }
    Catch {
        Throw "Failed to start $PSCOMMANDPATH"
    }
    Exit
}

# CleanUpAndExit
Function CleanUpAndExit() {
    Param(
        [Parameter()][int]$ErrorLevel = 0
    )
	
    # Write results to registry for Intune Detection
	$StoreResults = "\Contoso\Taskbar" # Change this to something that fits you.
    $Key = "HKEY_LOCAL_MACHINE\Software$StoreResults"
    $NOW = Get-Date -Format "yyyyMMdd-HHmmss"

    If ($ErrorLevel -eq 0) {
        [Microsoft.Win32.Registry]::SetValue($Key, "Success", $NOW)
    } else {
        [Microsoft.Win32.Registry]::SetValue($Key, "Failure", $NOW)
        [Microsoft.Win32.Registry]::SetValue($Key, "Error Code", $Errorlevel)
    }
    
    # Exit Script with the specified ErrorLevel
    EXIT $ErrorLevel
}

# Log File Info
$Now = Get-Date -Format "yyyyMMdd-HHmmss"
$LogPath = "$ENV:WINDIR\Temp\ImportTaskbar_$Now.log"

# Function to write log entries
function Write-LogEntry {
    param(
        [string]$Message
    )
    Write-Output "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $Message" | Out-File -FilePath $LogPath -Append
}

# Write to log file
Write-LogEntry "Start Setting Taskbar"

# Copy-TaskbarFilesToAllUsers
function Copy-TaskbarFilesToAllUsers {
    param(
        [string]$sourceDir = "$PSScriptRoot\AppData"
    )
	
	Write-LogEntry "Copying taskbar files for all users..."

    $Success = $true

    $userSIDs = Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false } | ForEach-Object { $_.SID }

    foreach ($userSID in $userSIDs) {
        $userProfilePath = (New-Object System.Management.ManagementObject "Win32_UserProfile.SID='$userSID'").LocalPath

        try {
            # Define target directory for the current user
            $targetDir = "$userProfilePath\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar"

            # Ensure the target directory exists
            if (!(Test-Path -Path $targetDir)) {
                New-Item -ItemType Directory -Force -Path $targetDir
            }

            # Copy files from source to target
            Copy-Item -Path "$sourceDir\*" -Destination $targetDir -Recurse -Force
			Write-LogEntry "Files copied successfully for user $userSID."
        }
        catch {
			$ErrorMessage = "An error occurred while copying files for user ${userSID}: $($_.Exception.Message)"
			Write-LogEntry $ErrorMessage
			Write-Host $ErrorMessage -ForegroundColor Red
            $Success = $false
        }
    }

    if ($Success) {
        Write-LogEntry "Files are copied successfully for all users."
    }
    return $Success
}

# Import-RegFileToAllUsers
function Import-RegFileToAllUsers {
	
	Write-LogEntry "Importing registry values for all users..."
    $Success = $false
	$originalRegFileContent = Get-Content -Path "$PSScriptRoot\Taskbar.reg"

    foreach ($userPath in (Get-ChildItem "Registry::HKEY_USERS\" | Where-Object { $_.Name -notmatch '_Classes|S-1-5-18|S-1-5-19|S-1-5-20|\.Default' })) {
        $username = $userPath.PSChildName

        try {
            # Replace the specific user SID with the SID of the current user in the loop
            $modifiedRegFileContent = $originalRegFileContent -replace 'UserSID', $username

            # Write the modified content to a temporary .reg file
            $tempRegFilePath = Join-Path -Path $PSScriptRoot -ChildPath "TempTaskBar.reg"
            $modifiedRegFileContent | Out-File -FilePath $tempRegFilePath

            # Import the temporary .reg file
            Start-Process -FilePath "regedit.exe" -ArgumentList "/s `"$tempRegFilePath`"" -NoNewWindow -Wait

            # Delete the temporary .reg file
            Remove-Item -Path $tempRegFilePath -Force

            $Success = $true
			Write-LogEntry "Registry values imported successfully for user $username."
        }
        catch {
            $ErrorMessage = "An error occurred while importing registry values for user ${username}: $($_.Exception.Message)"
			Write-LogEntry $ErrorMessage
			Write-Host $ErrorMessage -ForegroundColor Red
            $Success = $false
            return $Success
        }
    }

    if ($Success) {
        Write-Host "Registry values are set correctly for all users."
    }
    return $Success
}

# Call the Copy-TaskbarFilesToAllUsers function
$importAppDataResult = Copy-TaskbarFilesToAllUsers

# Call the Import-RegFileToAllUsers function
$importRegFileResult = Import-RegFileToAllUsers

# If all functions ran successfully, exit with error code 0, else use error code 101
if ($importAppDataResult -and $importRegFileResult) {
    Write-LogEntry "All functions completed successfully. Cleaning up and exiting..."
	CleanUpAndExit -ErrorLevel 0
} else {
    Write-LogEntry "One or more functions encountered errors. Cleaning up and exiting..."
	CleanUpAndExit -ErrorLevel 101
}

Write-LogEntry "Script execution completed."
$LogPath = $null

Packaging the files as a Win32 application

We will use the Microsoft Win32 Content Prep Tool to package the files.

• Create a new folder where you place the script from above (Import-TaskBar.ps1) with the .Reg file you edited before (TaskBar.reg)
• Create a new folder in the root named AppData this contains all your .lnk files.
• Start the Microsoft Win32 Content Prep Tool as Administrator.
• Select the location where stored your files.
• Specify the setup file: Import-TaskBar.ps1
• Select the folder where you want the output.
• The file .intunewin will contain all the files you had in the folder.
• A file named Import-TaskBar.intunewin should now have been created.

Deploy the package using Intune

Go to Intune and select Apps, Add a new Win32-based app.

• Add the package that we just created Import-TaskBar.intunewin
• Add a name, description, Publisher, Version etc.

Program settings

Install command: powershell -executionpolicy bypass -file Import-TaskBar.ps1
Install behavior: System

Requirements

Detection rules

Here we will check after the Success or Failed reg key created by the CleanupAndExit function, if fails the key Success will not be available.

Rule format: Manually configure detection rules.
Rule type: Registry
Key path: HKLM\Software\Contoso\Taskbar
Value name: Success
Detection method: Value exists.

Assign the newly created app to your User or Device group as Required.
(This will overwrite any current user settings they have, so you can assign it to only new users/devices if you like, it only overwrites it once the user can then pin or remove apps in the Taskbar themself)

You are done, now when a new device is deployed the user will have your perfect Taskbar from start and they can later pin or unpin apps to the taskbar however they like.

Worth mentioning, this is not an official way, however as of today 2023-07-21 this works and most likely it will continue to work unless Microsoft makes some major changes again like they did with the Start-Menu.

Below section is only applicable to version deployed for all users.

Version “Run for all logged in users”

Please make sure you follow the steps above as this is the same, the only difference is the script itself.

Difference between the scripts.

This version handles things a bit differently, this is to accommodate for the request to have a version to run not only for the first deployed user but for all users that log on to the device after the deployment.

The VBS script used is only to make sure it runs hidden, this means no PowerShell window showing up etc.

• Uses RunOnce key for the first deployed user to call a VBS script. (The VBS script then runs the PowerShell script hidden.
• Introduced a registry key to check if the user have already been applied the Taskbar, this makes sure the Taskbar settings is not overwritten when the user makes changes.
• Creates a Schedule-Task to call the same script the RunOnce key does, it will run at every logon, it checks if the Taskbar have been applied to the user, if not it will apply it once.
• To achieve that the new Taskbar is instantly applied I had to restart Explorer, added function for this.
• Not required to modify Registry file during deployment.

Instead of rewriting everything I will link to the steps that are the same and add the changes below only.

Download the new version.

Download Import-Taskbar.zip

The zip file contains the following

Import-Taskbar.ps1
Set-Taskbar.ps1
RunHidden.vbs

Setup Guide

• Preparing your taskbar
• Exporting the registry keys for the Taskbar
• Edit exported registry file
• User Pinned .lnk files in AppData folder
• Packaging the files as a Win32 application
• Deploy the package using Intune

Edit your exported Taskbar registry file

• Open the exported .reg file (TaskBar.reg) with your favorite text editor (Notepad)
• Remove everything except the “Favorites” key and save it.
• Example of completed registry file

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]
"Favorites"=hex:00,50,01,00,00,3a,00,1f,80,c8,27,34,1f,10,5c,10,42,aa,03,2e,e4,\
  52,87,d6,68,26,00,01,00,26,00,ef,be,12,00,00,00,d2,65,e6,c8,da,bb,d9,01,e8,\
  b0,3d,f0,da,bb,d9,01,80,35,b2,df,c3,c7,d9,01,14,00,56,00,31,00,00,00,00,00,\
  05,57,c6,8c,11,00,54,61,73,6b,42,61,72,00,40,00,09,00,04,00,ef,be,f5,56,e0,\
  6e,05,57,c6,8c,2e,00,00,00,12,a4,01,00,00,00,01,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,56,9c,6a,00,54,00,61,00,73,00,6b,00,42,00,61,00,72,00,00,\
  00,16,00,be,00,32,00,c7,08,00,00,05,57,fc,8c,20,00,47,4f,4f,47,4c,45,7e,31,\
  2e,4c,4e,4b,00,00,54,00,09,00,04,00,ef,be,05,57,04,8d,05,57,04,8d,2e,00,00,\
  00,0a,02,00,00,00,00,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f3,71,\
  01,01,47,00,6f,00,6f,00,67,00,6c,00,65,00,20,00,43,00,68,00,72,00,6f,00,6d,\
  00,65,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,22,00,00,00,1e,00,ef,be,02,00,\
  55,00,73,00,65,00,72,00,50,00,69,00,6e,00,6e,00,65,00,64,00,00,00,1c,00,12,\
  00,00,00,2b,00,ef,be,80,35,b2,df,c3,c7,d9,01,1c,00,1a,00,00,00,1d,00,ef,be,\
  02,00,43,00,68,00,72,00,6f,00,6d,00,65,00,00,00,1c,00,00,00,ff

Packaging the files as a Win32 application (New)

We will use the Microsoft Win32 Content Prep Tool to package the files.

• Create a new folder where you place the script files from the Download section (Import-Taskbar.ps1, RunHidden.vbs, Set-Taskbar.ps1) and your Taskbar.reg file.
• Create a new folder in the root named AppData this contains all your .lnk files.
• Start the Microsoft Win32 Content Prep Tool as Administrator.
• Select the location where stored your files.
• Specify the setup file: Import-TaskBar.ps1
• Select the folder where you want the output.
• The file .intunewin will contain all the files you had in the folder.
• A file named Import-TaskBar.intunewin should now have been created.