Occasionally, users report issues with the Start Menu or taskbar on RDS hosts running Windows Server 2022 or 2019. When a user clicks the Start button in a terminal session, either the menu doesn’t open, or the RDP session freezes and becomes unresponsive.
The Start Menu interface and user interactions are managed by two processes: Explorer.exe and StartMenuExperienceHost.exe. Restarting them from the Task Manager may quickly resolve a one-time issue.
More often, the issue of the Start Menu button not working on hosts in an RDS farm occurs consistently. This is usually accompanied by multiple DCOM Server errors with Event ID 10001 in Event Viewer -> System log, pointing to Microsoft Store apps.
One possible solution to the issue of the Start Menu not working in the user session is to re-register the problematic Microsoft Store app package. Since the Start button is not working, open the PowerShell console using the Win+X keyboard shortcut. Run the command:
Add-AppxPackage -Register "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppxManifest.xml" -DisableDevelopmentMode
Or, re-register all the Microsoft Store apps at once:
Get-AppXPackage | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
If this doesn’t fix the problem, or only solves it temporarily, check the contents of the following registry keys:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRulesHKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules
In my case, I found that thousands of Windows Defender Firewall rules were created for Microsoft Store apps (APPX/MSIX) each time a user logged in and out, and these rules were not automatically cleared.
Every time a user launches a Microsoft Store app, new Windows Defender Firewall rules are automatically added, but the old rules are not deleted. A large number of firewall rules can cause the StartMenuExperienceHost process to freeze. This process is responsible for displaying the Start menu in the user session. To restore the functionality of the Start menu on the Windows Server host, clear these Windows Defender Firewall rules.
First, let’s back up the registry key that contains the firewall rules. This will allow us to roll back to it in case of problems.
reg export "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy" C:\Backup_Firewall_Policy_rules.reg
To clean up the MS Store apps firewall rules in the registry, run these commands:
reg delete HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System /va /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules /va /f
This will clear the custom firewall rules.
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules . There may also be a large number of duplicate firewall rules related to Microsoft Store apps. Do not delete all items from this registry key, as doing so will remove all Windows Firewall rules, including the default ones. Otherwise, you may lose remote access to the Windows host, including access to its Remote Desktop.Therefore, before clearing these rules, create a GPO with the necessary Windows Firewall rules and apply it to the host to avoid losing access
Use the following command to restore the default Windows Firewall settings and rules:
(New-Object -ComObject HNetCfg.FwPolicy2).RestoreLocalFirewallDefaults()
To have Windows automatically clear еру firewall rules created by Microsoft Store apps in each user session, create the DeleteUserAppContainersOnLogoff registry parameter on the RDS server and set its value to 1. To create a registry item using PowerShell, run:
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy" -Type DWord -Name DeleteUserAppContainersOnLogoff -Value 1
Now, when a user’s session ends, the app’s firewall rules created for that user will automatically be cleared.
All that remains is to re-register the APPX packages on a server:
Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register “$($_.InstallLocation)\AppXManifest.xml”}