Desktop icons in "All users" not showing up for do

[admoore]

Hello, I recently inherited a Windows 2003 domain at our public library and am having a bear of a time getting group policies to work the way I need them to. Thanks in advance if you can help.

Our public workstations are locked down using group policies. All the workstations log in on the same locked-down roaming profile, we'll call it "public".

However, not all the public machines have the same software. All of them have office standard, but a few also have Access and/or Publisher. I would rather not have to create a completely new profile just to have two icons on the desktop, so I thought I could put the shortcuts in "c:\Documents and Settings\All Users\Desktop" and they would show up regardless of who was logged in. However, when I log the machine in as "public", the icons in that folder do not show up.

I think I tracked down the GPO that is stopping this from happening, but I can't figure out which policy in the GPO is preventing it.

Here are the policies enabled in the GPO:
******************************
Add Logoff to the Start Menu
Clear history of recently opened documents on exit
Do not display any custom toolbars in the taskbar
Do not keep history of recently opened documents
Do not use the search-based method when resolving shell shortcuts
Do not use the tracking-based method when resolving shell shortcuts
Gray unavailable Windows Installer programs Start Menu shortcuts
Lock the Taskbar
Prevent changes to Taskbar and Start Menu Settings
Prevent grouping of taskbar items
Remove access to the context menus for the taskbar
Remove All Programs list from the Start menu
Remove Balloon Tips on Start Menu items
Remove common program groups from Start Menu
Remove Documents menu from Start Menu
Remove Drag-and-drop context menus on the Start Menu
Remove Favorites menu from Start Menu
Remove frequent programs list from the Start Menu
Remove Help menu from Start Menu
Remove links and access to Windows Update
Remove My Documents icon from Start Menu
Remove My Music icon from Start Menu
Remove My Network Places icon from Start Menu
Remove My Pictures icon from Start Menu
Remove Network Connections from Start Menu
Remove pinned programs list from the Start Menu
Remove programs on Settings menu
Remove Run menu from Start Menu
Remove Search menu from Start Menu
Remove Set Program Access and Defaults from Start menu
Remove the "Undock PC" button from the Start Menu
Remove user name from Start Menu
Remove user's folders from the Start Menu
Turn off notification area cleanup
Turn off personalized menus
Turn off user tracking
*********************************

Anyone have any thoughts on this?

[ipon70]

You actually have to set it to Default Users not All Users, then from that point forward anyone new will see what you want.

[AdamV]

@ ipon70
Problem with default user is that if you use roaming / redirected profiles, the user already has a profile so they won't get this.

@admoore
From what you describe, I can't immediately see why they would not get this icon. Is the All Users folder maybe locked down too tight ie auth users don't even have read access? (test by getting a user to browse to this folder on C:\)

[Hypocrisy]

@Adam

So for a terminal server setting, where you want all the users that log in to get the same shortcuts on the desktop, and they have redirected profiles, other than DEFAULT USER, how can you put those shortcuts on the desktop?

[AdamV]

We're slightly off the original topic, but to answer the last question:

1) In All Users (simplest solution)
2) In default users so any user gets thewse the first time they log on, which is fine if you don't use roaming and you have a policy to throw away profiles at logoff, so each session is back to the default
3) In a mandatory profile which all users get, which is OK to give them all the stuff they need but no help if they want to add extra stuff as well.

[PreviousPoster]

Ye post and thread are almost right on target for my problem. I could not understand why simply dragging Start menu folders into the "All User" profile did not make the programs linked by shortcuts in those folders available to all users.

The hint in your question above

Is the All Users folder maybe locked down too tight ie auth users don't even have read access? (test by getting a user to browse to this folder on C:\)

caused me to have to learn a bit about the Folder Properties > Security tab, where I found that apparently access to folders is restricted to Admin, the User creating the folder, and System.

When the start menu folder is moved from a User or Admin account into the "All User" account the security properties do not change automatically (though there may be ways to cause that to happen, in the "Advanced settings" area).

I am attempting to make these "All User" Start Menu items available to all users by changing the Advanced Security Settings for the folders in All Users > Start Menu > Programs to

• "Inherit from parent the permission entries that apply to child objects" and
  "Replace permission entries on child objects with entries shown (for each folder) that apply to child objects."

To get a finer granularity of control, I am applying the second item at the folder level below Programs, but I imagine that we could simplify matters by applying it to the Programs folder and forcing the inheritance of the permissions for that folder to all of its subfolders and objects down the line.
:?:
Google search term used to find this thread [ User "start menu" "not showing" new "all users" ]

[AdamV]

I would add "authenticated users" with Read access (not modiy) at the All Users\Start Menu folder and then use the advanced "replace permissions on child objects" to push this down to existing subfolders and shortcuts.

[PreviousPoster]

In reference to the original post on this topic, I have found the group policy that causes "all users" desktop items from showing, it is:

"Remove common program groups from start menu"

[zaragozam]

Thanks a lot PreviousPorster. For me, your solution worked perfectly.
In my case, i was using a local group policy. So i set the following local GPO as follows :

Start > Run > gpedit.msc > User Configuration > Administrative Templates > Start Menu and Taskbar > Double click : "Remove common program groups from start menu" and set it to "Not configured"