The following text was created by the author of the http://msfreaks.wordpress.com/ blog. See that blog for more detail. Specifically http://msfreaks.wordpress.com/2014/04/17/step-by-step-redirecting-and-managing-the-modern-start-menu-in-windows-2012r2-rds/
Some other methods are available here also:
http://technet.microsoft.com/en-us/library/jj134269
References:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/da1b4dc6-efaf-4427-a1db-250b930e868d/2012-rds-and-publishing-full-desktop-and-lockdown?forum=winserverTS
http://msfreaks.wordpress.com/
As a starter:- redirect the startmenu for all users to a shared location
- enable access based enumeration for that share
- copy shortcuts to applications to that share (best to make a folder for each application)
- create security groups for the applications you wish to restrict to certain groups of users
- replace the security on the folder in the redirected startmenu. remove authenticated users and such, and add the correct application security group with read rightsIf you look in the startmenu now, you will not only see the application folders as "groups" in the all programs part of the startmenu, you will also only see applications for which you were granted access rights.Login with a test user, arrange your tile-menu, and then, while this test user is logged on, export the .ms file holding the tile positions and such. Add this .ms readonly file to the correct location in the default user profile and mark it read-only, and make sure (script, gpo) that this .ms is marked read-write when a new user first logs on.
Some other methods are available here also:
http://technet.microsoft.com/en-us/library/jj134269
References:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/da1b4dc6-efaf-4427-a1db-250b930e868d/2012-rds-and-publishing-full-desktop-and-lockdown?forum=winserverTS
http://msfreaks.wordpress.com/
