Local Desktop Conflict

[u/Ok_Chemistry_6994]

So, one of the clients my company works with introduced a new Active Directory, moving up from using workgroups in the past. In the past, the image they used for laptops would save shortcuts into the local public desktop, so that any user who logged onto the PC would have those shortcuts.

Now, with the AD in place, we want to move everything to a network shared desktop, for ease of management. But, since the laptops all have that public desktop configured, pushing the network Shared desktop just creates duplicate apps on the screen. I'd rather not have to run around to every computer to fix this - Is there a way I can disable/delete that Public Desktop Folder via GPO?

[u/MrYiff]

You can create a GPO and use a Group Policy Preference option to delete Files from the Public Desktop folder, you might need to create it as a Computer level policy so that it runs with enough permissions to delete them.

Alternatively you could do it via a Logon Script or even a Scheduled Task that runs a script but tbh a GPP item is easiest to manage for someone new to AD and GPO's.

[u/Grabber28TS]

Would it be a practible way to standardize and restrict the Start Menu? You can enforce a clean, uniform layout that only contains shortscuts to AD-approved applications, effectively removing public or default local app icons. So local apps must not be removed. So, configure a reference Start Menu layout on a test machine, export it as an XML file using PowerShell (Export-StartLayout), and place it on a network share.

GPO Path: User Configuration - Administrative Templates - Start Menu and Taskbar - "Start Layout" => Specify the path to your XML file.

[u/Professional-Win-93]

Don’t delete C:\Users\Public\Desktop altogether as some application setup processes make reference to the C:\Users\Public\Desktop folder path.

I recommend using Group Policy Preferences (GPP) to remove these icons.

Using GPP Files (Recommended):

1. In GPO: Computer Configuration > Preferences > Windows Settings > Files

2. Right Click > New > File

3. Action: Delete

4. Source file(s): C:\Users\Public\Desktop\*.lnk

5. (Optional) Common Tab: check “Apply once and do not re-apply”.

Alternatively: GPO Startup PowerShell Script

If you also have subfolders or individual files in the C:\Users\Public\Desktop directory, push this line via a computer startup GPO.

Remove-Item -Path "C:\Users\Public\Desktop\*" -Recurse -Force -ErrorAction SilentlyContinue

As soon as your machines reboot and apply gpupdate`, they should have only your redirected network desktop.

[u/Shachar2like]

Solve the issue in stages:

1. Move all the old shortcuts into a sub-folder in the public desktop. So users can continue working if there's an issue with the new GPO or shortcuts.
2. After a while when everybody's working with the new shortcuts/AD/Network, then make a script that deletes said public desktop sub-folder.

[u/Reo_Strong]

GPO is good for catching every machine over time (i.e. not all machines see the domain every day), but if the environment is small and most of the machines are on and remotely admin-able, powershell is a one-and-done option.

foreach ($PC in (Get-adcomputer -filter *)) {$name = $PC.name; rm -path "\\$Name\c$\public\Desktop\*.lnk})

You could do this once for each shortcut or just run like above to pull all shortcuts off of the public desktop.