About: The purpose of this document is to detail a method by which one can control the default/initial Desktop shortcuts of a non domain-joined Windows Server's users - this is apparently done via GPO on domain-joined systems, but in the case of an workgroup-based system an alternative method of achieving this goal becomes necessary; one is proposed below.

How-to:

• create a folder called shortcuts under your own user profile (C:\Users\%username%)

• copy/create there the shortcuts that you want to provide to all of the system's users

• in order to prevent the possibility that the users would not be able to delete (some of) the shortcuts, the permissions of the shortcuts folder need to be modified as follows:

  • go to the Security tab of the folder's Properties, then click on Advanced
  • Disable inheritance and then Convert inherited permissions into explicit permissions on this object.
  • Remove all permissions with the exception of those for SYSTEM and Administrators, which should have Full Control
  • Add a Modify permission for the Users principal in the Permission Entry for shortcuts dialog box (select the Allow checkbox for Full Control, then uncheck it and the Delete subfolders and files, Change permissions and Take ownership checkboxes - the resulting selection of special permissions will translate to an overall Modify folder permission)
  • Then Replace all child object permission entries with inheritable permission entries from this object and save the modifications



• copying the prepared shortcuts out to the users' Desktops will require that you run the below commands from an elevated Powershell console:

  get-childItem C:\Users | forEach-object -begin { $userList = @() } -process { if ($_.name -ne "Public") { $userList += $_.name } }

  $userList | forEach-object -process { copy-item C:\Users\$env:username\shortcuts\* C:\Users\$_\Desktop\ }

• you should be done at this point and might want to verify the outcome

If the same shortcut configuration needs to be applied to new user accounts as well (appear on their initial Desktop), run the below command (again from an elevated Powershell console):

copy-item C:\Users\$env:username\shortcuts\* C:\Users\Default\Desktop\