Windows 11 24H2 Update Unlocks IT Control Over Start Menu Pins—and How Users Can Customize After

Microsoft released the KB5062660 update for Windows 11 version 24H2, enabling a long-awaited Group Policy that lets IT administrators precisely define which apps and shortcuts appear as pinned items on the Start menu. The policy, “Configure Start Pins,” not only specifies the pinned list via a JSON file but also introduces a critical decision point: whether the layout resets at every sign-in or serves as a one-time baseline that employees can later personalize.

This shift moves Start menu management from a blunt force—either locking it entirely or leaving it up to users—to a nuanced spectrum. Organizations can now keep shared devices consistent without treating every employee’s laptop like a public kiosk.

The Update: A New GPO for Start Menu Pins

The Configure Start Pins policy appears under both Computer Configuration and User Configuration → Administrative Templates → Start Menu and Taskbar, but only after installing KB5062660 on a Windows 11 24H2 machine. It accepts a JSON string that lists the items to pin and their order. The same setting is also available through the Policy CSP for Intune and other modern management tools, using the path ./Device/Vendor/MSFT/Policy/Config/Start/ConfigureStartPins or ./User/Vendor/MSFT/Policy/Config/Start/ConfigureStartPins.

What sets this GPO apart from older Start layout policies is the “Apply once” toggle. This single checkbox determines the fundamental behavior:

• Apply once = Disabled (the default when you enable the policy): Windows reapplies the pinned list at every user sign-in. Any changes a user makes—pinning, unpinning, reordering—are overwritten. This is persistent mode.
• Apply once = Enabled: Windows applies the defined pins only once, during the first sign-in after the policy takes effect. Subsequently, users can add, remove, or rearrange pins, and their customizations survive sign-outs and reboots. This is one-time baseline mode.

The JSON schema is straightforward. A minimal example that pins a single managed shortcut looks like this:

{
  "pinnedList": [
    {
      "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Contoso Support Portal.lnk"
    }
  ]
}

Crucially, every referenced shortcut or application must exist on the target device at the exact path specified before the policy is evaluated. A missing shortcut means a broken pin, and the policy won’t warn you.

What This Means for IT Administrators

The real power of Configure Start Pins isn’t the ability to pin icons—it’s the choice between resetting the Start menu after every login and giving users permanent control after the first day. That distinction transforms how IT teams should think about device provisioning.

Shared and Frontline Devices: Lock It Down

For shared PCs—reception desks, training rooms, service counters, factory-floor terminals—consistent Start menus are essential. One person’s reorganization shouldn’t prevent the next person from finding the timeclock app or scanning tool. Setting Apply once to Disabled ensures the approved pins return precisely as IT intended for every session. Users can still pin temporary items during their shift, but those vanish at sign-out.

Individually Assigned Workstations: Give an Initial Handoff

Most employees use a single laptop or desktop. For them, a one-time baseline makes more sense. IT can ensure every new hire sees the company intranet, productivity suite, and key line-of-business apps right from day one. After that, the worker can swap out the browser for a preferred alternative, add project-specific tools, or remove apps they never use—without IT intervention. Set Apply once to Enabled, and the initial pins act like a welcome mat, not a cage.

Exception Groups: When Not to Manage at All

Some roles defy standardization. Developers may need a dozen IDEs in different orders; executive assistants might require quick access to travel portals and scheduling tools; users with established accessibility setups often rely on specific pinned arrangements. For these groups, leaving the Configure Start Pins policy unconfigured—or targeting it only as a suggestion through user onboarding—preserves their autonomy while still offering IT a way to deliver required apps via other means (like desktop shortcuts or taskbar pins).

The Hidden Trap: App and Shortcut Consistency

A pin policy is only as reliable as the shortcuts it references. If the JSON points to %ALLUSERSPROFILE%\...\Contoso Support Portal.lnk, that shortcut must exist at that path on every targeted device before the policy applies. One missing file, and the pin simply doesn’t appear—no error, no fallback. IT must coordinate application deployment with Start configuration. Roll out the apps, verify the shortcut paths on a representative sample of hardware, and only then deploy the GPO. Targeting group matters: a single pin list might work for a marketing team using the same creative suite, but don’t push that same list to the sales team that uses a different CRM client.

How We Got Here: Windows 11’s Start Evolution

Windows 11’s Start menu has been a moving target since launch. The original release in 2021 abandoned live tiles for a grid of static icons and a “Recommended” section that many users found intrusive. IT pros, in particular, complained that Group Policy options for customizing the Start layout were limited compared to Windows 10, which offered full XML-based layout control.

Microsoft gradually added back capabilities. Early 2023 updates brought folders within the pinned area and more layout density options. The February 2024 Moment 5 update allowed hiding the Recommended section entirely. Throughout, however, the ability to centrally define a pinned-app list with granular control over persistence was missing. Administrators could use the older Policy CSP “StartLayout” for Windows 10 Enterprise-style locked-down menus, but that setting interfered with Windows 11’s updated Start experience and often caused instability.

KB5062660 represents the first Group Policy specifically designed for Windows 11’s modern Start menu that allows a managed list of pinned apps without resorting to third-party tools or scripted logon tasks that broke unpredictably. The addition of the “Apply once” toggle acknowledges a reality Microsoft’s own telemetry likely surfaced: most enterprises don’t want to lock down the Start menu completely; they want to guide users initially and then get out of the way.

What to Do Now: Deploying Configure Start Pins

Rolling this out requires more than flipping a GPO. Follow these steps to avoid common pitfalls:

1. Install the prerequisite update: Ensure every target PC is on Windows 11 24H2 and has KB5062660 installed. You can verify by checking for the policy in Group Policy Editor on a test machine.

2. Decide on persistence per device group: Map out which devices need persistent pins, which get a one-time baseline, and which should remain unmanaged. Use the table below as a starting point, but adjust for your organization’s workflows.

1. Build your JSON definition: Keep it minimal. Pin only the three to five apps that are truly essential for every user in that group. Use desktopAppLink for shortcuts you’ve placed in the All Users Start menu, or "appUserModelId" for packaged apps when you know the exact AUMID.

2. Validate shortcuts first: On a clean test device, confirm every shortcut in the JSON exists at the specified path. Open File Explorer and navigate to the path; if the shortcut isn’t there, troubleshoot your application deployment.

3. Create and link the GPO or CSP profile:
   - For on-premises Group Policy: Go to Computer Configuration (or User Configuration) → Administrative Templates → Start Menu and Taskbar, enable “Configure Start Pins,” paste the JSON, set Apply once, and link the GPO to the correct OU.
   - For Intune: Create a custom device or user configuration profile, add the OMA-URI for ConfigureStartPins with your JSON string, and set the corresponding “Apply Once” value (1 for one-time, 0 for persistent).

4. Pilot with real users: Don’t rely solely on techs. Have a member of each targeted user group sign in, note whether the pins appear correctly, then intentionally add and remove pins. Sign out and in again. If the behavior matches your intended mode, you’ve succeeded.

5. Document for your service desk: When users call asking why their Start menu keeps resetting, support staff should know whether it’s by design (persistent mode) or a bug. Provide a simple reference card.

Outlook: A More Flexible Start Is Coming

KB5062660 is part of a broader trend: Microsoft is slowly restoring enterprise management capabilities to Windows 11 without forcing the one-size-fits-all lockdowns of earlier eras. The upcoming Windows 11 24H2 features, such as the ability to hide the category view in Start (KB5067036), suggest more granular controls are on the way. Expect future Cumulative Updates to expand the JSON schema to support more pin types—perhaps direct website pins or dynamic groups—and to integrate with Windows Autopilot provisioning.

For now, the message to IT is clear: you no longer have to choose between a chaotic Start menu and a rigid one. With Configure Start Pins, you can design a friendly first-run experience that respects user autonomy while keeping shared devices reliable. Just remember that the real choice isn’t about which apps to pin; it’s about whether you want those pins to stick around forever.