Locking down the Win+X menu

Whilst the Win+X menu is really useful for sys admins, there's quite a lot of items on there that I'd rather not have pupils clicking on (even if they'd not get anywhere due to not having access rights). It's possible to customise this menu and remove items you don't want from it.

The shortcuts are stored (per user) in %LOCALAPPDATA%\Microsoft\Windows\WinX in three folders - Group1, Group2 and Group3. I don't think it's possible to add custom shortcuts however deleting them will remove the corresponding item from the WinX menu.

If you are using a central Default User profile (see my article on speeding up Windows 10 domain logons) you can create the file structure within the default profile - copy it from a Windows 10 PC and remove the items you don't want. This will apply to new logons only, users with existing local profiles will already have the full set of shortcuts in place.

Removing items for users with existing local profiles, or if you don't use a central Default User profile, can be done using Group Policy Preferences. Create a GPO (or edit your existing User Settings GPO) and have a look at User Configuration\Preferences\Windows Settings\Files. For each item you want removing, add a "Delete" entry. I find it best to do this method even with the central default user profile - when testing, the menu appears to sometimes be regenerated and sometimes not - deleting the shortcuts via GPP files will make sure it stays away.

As usual with Group Policy Preferences, you can use item level targeting if you only want to target specific users.

You can also remove a few other bits in the start menu this way - targeting things like %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows System\Run.lnk.

Update: Windows 11 Support

Windows 11 works slightly differently - it checks the %LOCALAPPDATA% path as above for shortcuts, and then checks C:\users\default\AppData\Local\Microsoft\Windows\WinX and if they are different, merges the two together. So you'll need to delete items from the default profile path as well as the user's local profile path.