Change the Start Menu with Group Policy

As you've just seen, you can easily customize almost all menus and submenus of the Start Menu. There are a few exceptions: The Turn Off Computer, Help And Support, Search, and Control Panel items cannot be removed or reorganized. Actually, you can govern the display of items such as the Control Panel or the Turn Off Computer option through Group Policies in a Windows 2000 or Server 2003 domain, but that is a topic for another book.

OK, OK, just so you don't have to go out and get that other book… If your XP clients are part of a Windows 2000 or Server 2003 Active Directory domain, you can administer Desktop settings centrally by applying a Group Policy Object (GPO). A GPO is a collection of settings that can potentially affect almost every aspect of user and computer interaction, from setting the minimum length for a password to pushing out new software to client machines. These settings are stored in a single location (the GPO) and then are applied to the user session at either computer startup time (Computer Settings) or at logon time (User Settings). Group Policy settings are managed with the Group Policy Object Editor (GPOE), a Microsoft Management Console (MMC) snap-in tool.

When configured, Group Policy Objects can be linked (i.e., have their settings apply) to objects in an Active Directory domain: on local machines, sites, domains, and organizational units. Furthermore, a single GPO can even be linked to multiple objects.

The GPOs are also processed in the order listed in the preceding paragraph, and if any conflicts between policy settings arise, the last policy setting applied becomes the effective setting.

Here's an example: suppose a policy setting has been applied to the Domain object such that the Internet Explorer icon is removed from the Desktop. However, the user account that logs into the domain exists in an organizational unit, and the policy settings on the organizational unit are such that the IE icon appears. In this case, the user gets the IE icon on his or her desktop at logon time. This is because the organizational unit policy is applied after the domain policy and therefore trumps any settings configured at the domain level.

Naturally, though, this default GPO behavior is modifiable; domain administrators can configure domain-level GPO so that they can't be overridden, but… well, now, that really is a topic for another book.