Group Policy Breaks Start Menu / Modern Apps

Question

_{Friday, August 7, 2015 3:40 PM | 1 vote}

I recently upgraded a few of our PC's to windows 10 to test out the experience, however once our server (2008) applies our very basic group policy to the computer the start menu, all modern apps, as well as the notification center and volume controls stop working. Even if i login as the local user it no longer works.

I've tried running the powershell script to reset all of the modern apps and it didnt work. What else can i try? The start menu was working before i ran a gpupdate.

I've also tried DISM /Online /Cleanup-Image /RestoreHealth

Thank you.

**
**

All replies (7)

_{Thursday, August 13, 2015 12:01 AM ✅Answered | 1 vote}

Have you installed the Windows 10 ADMX templates?

Windows 10 Group Policy (.ADMX) Templates now available for download

Note there is a link in the aforementioned webpage to a spreadsheet with the new settings.

Take your time and review your gpresult output, and reference the spreadsheet.

Focus on one feature at a time that has been affected, to narrow your troubleshooting focus.

Please remember to: "Vote" if my response was helpful. "Mark As Answered" if I answered your question correctly. V/R, Darrick West - Senior Systems Engineer, ConfigMgr: OSD

_{Monday, August 10, 2015 10:06 AM | 1 vote}

Hi,

Since this problem was caused by group policy applied, please use gpresult command to check current system policy applied status.

This problem can be caused by one of these policies, please check the settings carefully.

On the other hand, Microsoft released a Cumulative Update for Windows 10, please check and install the update for test.
Access to the link below for more information:

https://support.microsoft.com/en-us/kb/3081424

Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].

_{Wednesday, August 12, 2015 6:48 PM | 1 vote}

I am on the latest patch from microsoft and that has not solved the problem. I ran the group policy report but im not sure what im looking for that could disable everything? 

I checked the event viewer and it states The server microsoftedge did not register with DCOM within the required timeout.

Thank you.

_{Wednesday, August 12, 2015 9:51 PM | 1 vote}

_{Friday, August 14, 2015 7:45 PM | 1 vote}

Adding the templates and reinstalling windows 10 seemed to do the trick. Thank you.

_{Monday, April 9, 2018 9:18 AM}

In group policy manager, for my default domain policy I had a bunch of items in Computer -> policies -> Windows settings -> Security Settings -> Registry.  

I removed every entry out of this folder.  I copied it first and put it in a new GP in case i found I needed them. Also, in the File System folder I had entries for %programfiles%, %systemDirectory%, %systemroot%, and maybe one other.  

I also copied these to the same new GP as before and then removed them all from default domain policy.  

I have not found that I had any need for the removed entries as I have not applied the new GP anywhere.   End of day, I had no entries left in the registry or file system portion on the default domain policy.

I then had the reset or reinstall Windows 10 for it to work since removing these does not allow a PC to revert back to the permissions it had prior to the GP being applied.  Been running 10 for a few days now without any issues. Hope this helps. 

_{Thursday, April 25, 2019 9:50 PM}

So, I have had this issue on a new DC, bringing our domain from previous version (2008) to (2016).  The problem ended up being with a security setting on the HKLM\SOFTWARE\Classes\AppID in the registry section of the GPO, which removed CREATE OWNER, ALL APPLICATION PACKAGES, and UNKNOWN SID (S-1-15-3-1024-.....)

Specific permissions had been applied (Government Security Setting from old versions of windows).  Well 2016 does not like this.  I had to separate out the 2008 and 2016 DCs in to sub OUs, apply the existing GPOS to the 2008 OU only, removing the links for the GPOS from the top level domain controller OU and only having them on the Domain Controller\2008DC OU.  I copied the existing GPO, REMOVED the setting for software/Classes/APPid, fixed it in the registry, since it's a registry setting, and it gets tattooed to the ACL, it's not removed when you undo the setting.

Didn't even have to reboot, it started working about 30 seconds later.  I had to compare GPO reports from broken and working systems, which didn't show this setting.  Then walked each setting in a working OU against the DC OU and the way windows 2016 handles apps, it is very finicky. 

For my fix, it was remove that setting from the GPO, then go to registry and edit permissions on the AppID key

HKLM\Software\Classes\AppID

and set it to inherit, I did not choose to propagate the permissions down.