Create Desktop Shortcuts for Domain Users Using Group Policy (GPO)

First, ensure GPMC is installed on your domain controller or management workstation. On Windows Server 2025, GPMC is available through the Remote Server Administration Tools.

Get-WindowsFeature -Name GPMC

If not installed, add it through Server Manager:

Install-WindowsFeature -Name GPMC -IncludeManagementTools

Open Group Policy Management Console and create a dedicated GPO for desktop shortcuts. This keeps your shortcut policies organized and separate from other configurations.

gpmc.msc

In the GPMC console, expand your forest and domain. Right-click on "Group Policy Objects" and select "New". Name your GPO something descriptive like "Desktop Shortcuts - Company Apps" or "User Desktop Shortcuts".

In the Group Policy Management Editor, navigate to the correct location based on your deployment needs. For user-specific shortcuts that appear on individual user desktops:

User Configuration > Preferences > Windows Settings > Shortcuts

For computer-wide shortcuts that appear for all users on a machine:

Computer Configuration > Preferences > Windows Settings > Shortcuts

Most scenarios use User Configuration since you typically want shortcuts to follow users across different computers in your domain.

Right-click on "Shortcuts" and select "New > Shortcut". Configure an application shortcut with these settings:

For network applications, use UNC paths:

\\fileserver\apps\MyApp\MyApp.exe

Set the icon file path to the same executable or specify a custom icon:

C:\Program Files\Notepad++\notepad++.exe

Create a second shortcut for web resources. Right-click "Shortcuts" again and select "New > Shortcut" with these settings:

For network shares, create a File System Object shortcut:

Target path: \\fileserver\shared\documents
Name: Shared Documents

For RDP connections, use .rdp files:

Target path: \\server\share\connections\terminal-server.rdp
Name: Terminal Server

Use item-level targeting to deploy shortcuts only to specific users or groups. Select a shortcut you created, then click the "Common" tab in the properties dialog.

Check "Item-level targeting" and click "Targeting...". Add targeting criteria:

Security Group: Domain\IT-Staff
OR
Organizational Unit: OU=Sales,DC=company,DC=com

Common targeting options include:

• Security Group: Deploy to specific AD groups
• Organizational Unit: Target users in specific OUs
• Operating System: Windows 10 vs Windows 11
• Computer Name: Specific machines

Use logical operators (AND, OR, NOT) for complex targeting:

Security Group: Domain\Managers AND NOT Security Group: Domain\Executives

Return to Group Policy Management Console and link your GPO to the appropriate organizational units. Right-click the target OU and select "Link an Existing GPO".

Select your desktop shortcuts GPO from the list. The GPO will now apply to all users or computers in that OU, depending on whether you configured User or Computer settings.

Check the link order and precedence:

Get-GPInheritance -Target "OU=Users,DC=company,DC=com"

Verify security filtering allows the intended users:

1. Select your GPO in GPMC
2. Click the "Scope" tab
3. Ensure "Authenticated Users" has Read and Apply Group Policy permissions

Test your GPO on a single client computer before full deployment. On a domain-joined Windows 11 machine, force a Group Policy update:

gpupdate /force

Check if the policy applied successfully:

gpresult /r /scope:user

Look for your GPO name in the "Applied Group Policy Objects" section. For detailed troubleshooting:

gpresult /h c:\temp\gpresult.html

Log off and log back on to see the desktop shortcuts appear. They should match your configured names and target the correct applications or URLs.

Test each shortcut type:

• Double-click application shortcuts to verify they launch correctly
• Test URL shortcuts open in the default browser
• Verify network resource shortcuts connect properly