Unable to update the password

 

This can be super annoying.  You need to change your password but when you enter a completely legitimate, compliant new password you just get:

Unable to update the password.  The value provided for the new password does not meet the length, complexity, or history requirements of the domain.

WHY!?  It's NONE of those.

There may be a policy in force that limits the number of times you can change your password within a specific time period.  If it set to 12 hours and your password was changed less than 12 hours ago you will get the above response.

PXE-T04 and PXE-E36 errors

 

This was encountered in a lab environment.  Everything looked fine.  Network ports all checked.  Another existing windows client on the same subnet could even complete the TFTP download of the target smsboot\x64\wdsnbp.com file.  Event logs indicated that the TFTP transfer began but then failed producing a an Event ID 4101 in the Deployment-Services-Diagnostics Admin log.

The Following Client failed TFTP Download:
Client IP: 10.0.3.13
Filename: smsboot\x64\wdsnbp.com
ErrorCode: 1460
File Size: 30832
Client Port: 2071
Server Port: 53574
Variable Window: false

This post suggested a block size change which resolved the issue after a WDS service restart.

https://social.technet.microsoft.com/Forums/office/en-US/a1246f62-6a8a-482b-9323-7e02dfeab196/wds-tftp-errorcode-1460

This older article also refers to block size changing
https://support.microsoft.com/en-gb/help/975710/operating-system-deployment-over-a-network-by-using-wds-fails-in-windo

Changing the block size is achieved in the registry as follows

Location:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WDSServer\Providers\WDSTFTP
Name: MaximumBlockSize
Type: (REG_DWORD)
Value range: 512–1456
Base: (Decimal)

Setting a 512 value resolved the problem.

The value can also be changed in the WDS applet in Maximum Block Size on the TFTP tab of the WDS server properties.

SCCM 2012 2002 (Microsoft Endpoint configuration manager) on Windows Server 2019

Edge Profiles - launch selected profile.

If you have multiple Edge profiles, it may be useful to launch directly into your selected profile.  To do this, set your default profile i.e. not the last used, and then create shortcuts to launch edge with your various other profiles.

By default, Edge 84.0.522.52 will launch into the last used profile.  It does not seem possible to override this behaviour and fix the default permanently.  Using this settings page to fix the default profile edge://settings/profiles/multiProfileSettings only achieves exactly what it describes. i.e. controls the profile used by links from external apps such as email.
"By default, Microsoft Edge uses the last used profile to open links in email or other applications. If you have other profiles in Microsoft Edge, you can choose which one to use."

It does not fix the default and stop it being changed by closing Edge when a different profile is active.

Edge stores the user profile in folders under %LOCALAPPDATA%\Microsoft\Edge\User Data .
Default is the first profile with additional profiles stored under folders called Profile 1, Profile 2 and so on.

It is possible to specify the profile required at launch with a command line and parameter of
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
or
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Profile 1"
etc

Edge Profile Picture.png files in the profile folder may contain a profile picture if one exists providing one method of identifying the Profile.

The Edge shortcut in the start menu will always launch with the profile that was active when Edge was last closed.  This could could be the profile in Profile 1 if that was the active profile when Edge was last closed.  The profile in the Default is not necessarily the profile that will be used when the Edge start menu shortcut is selected.

Set a file association back to Choose a default

Backup the reg key
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.<ext>]

then delete it.

The file assocation in Settings_Apps_Default Apps_Choose default applications by file type will revert to Choose a default.

Edge Microsoft Account Sign In Loop

Edge may require some Microsoft sites to be added specifically allowed to store cookies.  Addition of the sites specified in the article below may prevent a sign in looping effect where you are constantly prompted to sign in, even after submitting credentials.

https://docs.microsoft.com/en-us/microsoftteams/troubleshoot/teams-sign-in/sign-in-loop

Outlook 365 hanging/crashing shortly after launch

Outlook 365 Version 2006 Build 13001.20384 Click-to-Run
Windows 10 1903 - no feature updates available in Windows Update

Outlook profile with multiple email accounts configured. Office365, Gmail and outlook.com

Outlook 365 began hanging shortly after launch.  Outlook would launch be then quickly hang (Application not responding) usually when an email item was selected.  Message preview was configured ON in the right hand window but a message failed to display.  Application Event log ID was 1002.  Task manager was used to end task on the unresponsive outlook process.

A separate existing profile with only contacts management launched without hanging.  A test profile against one of the email accounts failed in the same way as the original, multiple email profile.

Launch issues began at 17:49 after a day of normal outlook use.  Several windows updates applied during the day in the background. KB4565483 KB4565633

Outlook.exe /safe initially also hung.

Remediation attempts

1.
Ran "C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE" on OSTs and PSTs in %LOCALAPPDATA%\Microsoft\Outlook.

No Change.

2.
Removed recent updates and restarted

No Change - although Outlook.exe /safe now successfully launches and updates mailboxes

3.
Disabled all COM addins

No Change

4. Used Office 365 repair and uninstalled / installed Office 365

Slight launch behaviour change.  Outlook now crashes (Event ID 1000) instead of hangs.

5. Previously removed updates installed again. Restart.

Outlook launches successfully.

Halo MCC crashes with easy anti cheat error 00000001

Shortly after launching Halo Master Chief Collection (MCC) the program crashes requiring an end task.  Both normal and Anti-Cheat Disabled mode fail. A task end of a normal launch produces

Game Security Violation Detected (#00000001)

This was resolved by installing update KB4497165

https://support.microsoft.com/en-us/help/4497165/kb4497165-intel-microcode-updates


A previous update of some type is suspected to have caused the issue.

MCC seems to be very sensitive to updates.  Several times the game will only launch one all pending updates have been installed and the computer rebooted.

remote password changing

Occasionally you cannot RDP to a remote machine because your password has expired.  This article provides a powershell script which allows remote password changing, as long as you know the previous password.
https://evotec.xyz/how-to-change-your-own-expired-password-when-you-cant-login-to-rdp/

0 - Python in 10(minutes)

This is just a very quick guide to setup and use a python code development environment.

download PyCharm here
https://www.jetbrains.com/pycharm/

Launch Pycharm and start a new project with a relevant name.  At this point PyCharm will get ready for a new project and download and install python.

You may be prompted to exclude project directories from Windows Defender scanning.

Right click the project with the name you selected and select New_Python File.

A Python code window will open.

This installs a tool which can compile python code into an exe file.

Open a command window and change directory to %USERPROFILE%\pycharmprojects\<projectname>\venv\scripts

run the command

pip install pyinstaller


To begin code development enter the code into the python file window.  Editing is automatically saved to the .py file.

To run or test the code, open a command window and change directory to the scripts folder as above.

python <path to .py file>


Once the code is operating successfully, compile it with

pyinstaller <path to .py file>

The compiled exe file is generated in %USERPROFILE%\pycharmprojects\<projectname>\venv\scripts\dist

Select Browser when link is clicked

I use multiple browsers.  Chrome for Google stuff.  Edge for Microsoft Stuff etc. One browser is sandboxed using Sandboxie.

I want to be prompted every time I click a link in an external app, e.g. email so I can select which browser I want to use to view the website.

The key to this is a great piece of freeware called BrowserSelect by Borhan Hafez.  This works out what the available browsers are and allows you to choose one when a link is clicked.  It is a 64-bit program that installs to the user profile but can also be installed to C:\Program Files\BrowserSelect

BrowserSelect becomes the default "browser" for Windows.  Instead of opening a webpage it allows you to select the installed browser you want.  BrowserSelect determines what the available browsers are from registry keys that browsers use to identify themselves as such.

Portable browsers are browser versions that enable themselves to exist, self-contained, under one folder.  You should be able to run it from a USB key for example.  Some browser installation programs provide an option to install in portable mode.  Portable mode though, will not register the browser as a web browser option under Apps_Default Apps_ Web browser.  BrowserSelect will also not present the portable mode browser as an option because it refers to the same registry keys as windows to determine browser options.

Configuring a portable mode browser as an available web browser application option requires a set of additional registry keys to be created.  Christoph Kolbicz describes how to do that here  Note that any application you wanted to pass URLs to could be set up as a web browser using the additional keys.  Indeed this is what BrowserSelect is doing to take over the URL launch handling.

When a browser is configured as a web browser option, one important registry key defines what exe is actually the target of the call to the web browser.  In the case of Google Chrome it is
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
@="\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\""

The HKCU\SOFTWARE\Clients\StartMenuInternet is also in use here so be aware that that is probably where you want the configuration to apply of a particular user.

The default key that points to the browser exe can only be a single string containing the path to the target browser exe.  Any variations will not work.  If you have a shortcut to launch a sandboxed browser, it is calling something like
"C:\Program Files\Sandboxie\Start.exe" /box:DefaultBox "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

This command could NOT be used in the open command registry key.

A special exe would be required to execute the actual command we require.  It is possible to write a short python program and compile it into an exe.  The exe simply calls the above command and allows a URL argument to be included.

import os;
import sys;
# if a URL is supplied then use it as a parameter else launch without.
if len(sys.argv) > 1:
    # set variable for the argument
    URL = sys.argv[1]
    os.system(r'C:\Program" "Files\Sandboxie\Start.exe /box:DefaultBox C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ' + URL)
else:
    os.system(r'C:\Program" "Files\Sandboxie\Start.exe /box:DefaultBox C:\Program Files (x86)\Google\Chrome\Application\chrome.exe')


Once the python code is compiled into an exe file, the path to this exe can be entered into the registry key enabling a sandboxed browser to be a launch option from within BrowserSelect.

Random SSD failure with Windows 10

After migrating to Windows 10 one of the SSDs in the system would randomly fail.  This article logs the issue for reference.

Motherboard
Asus Z87M-PLUS
IDE ATA/ATAPI controller reported by Windows device manager:
Intel(R) 8 series/C220 Chipset Family SATA AHCI Controller

Samsung 850 EVO MZ-75E500RW 500Gb SSD connected to SATA port 2 disk 0
Samsung 840 EVO MZ-7TE500BW 500Gb SSD connected to SATA port 3 disk 1
Samsung HD204UI 2Tb HDD connected to SATA port 5 disk 2

Under Windows 8.1 all disks functioned normally with no special settings or drivers in use.  Where hardware works sufficiently with default drivers and settings, I will leave it alone unless there is a problem.  Initially Windows 8.1 was running on the 840 EVO SSD.  Later Windows 10 was installed on the 850 EVO and configured to dual boot.  In this way either Windows 10 could be used on 850 EVO or Windows 8.1 on the 840 EVO.

It was observed that while there were no issues accessing any disks under Windows 8.1, with Windows 10 the EVO 840 would seem to randomly deny access.  Sometimes it would work, but after a while there was no access until a full shutdown - start cycle.

Later on Windows 10 on the EVO 850 became the main operating system used and Windows 8.1 was removed from the EVO 840 drive to be used for additional storage.  The problems accessing the EVO 840 drive persisted, leading to a very long troubleshooting process.  How could simply changing the OS to Windows 10 cause such serious problems? I was fairly sure it could be rectified with the correct driver/settings configuration.  I was wrong.

To begin with, a pattern was identified of drive disconnection at exactly 11minutes 10seconds after System Event ID 12 Kernel-General "operating system started".  The disconnection was signified by a tell tail event ID 129 storahci "Reset to device, \Device\RaidPort0, was issued".  Once that occurred, the EVO 840 was useless until the shutdown - start cycle.

At this point I wondered if the drive was the problem.  In the past, it had completely filled up and data loss and other generally bad behaviour had occurred.  Although I had not used it before, I thought this would be a good time to use the Samsung Magician software to keep an eye on the Samsung drives.  The Samsung Magician confirmed that the firmware was current.  I used this software to Secure Erase the EVO 840.  No effect.

Attention then turned to the controller drivers especially as the Magician software flagged the driver as
"Under the current system environment, some functions in Magician CANNOT be run.  To enable these Magician functions and ensure optimal performance it is recommended to: Visit website below and updated driver to the latest version."  Always good advice - maybe.  This was the intel site for the Intel Rapid Storage Technology (RST) interface and driver.  I was not convinced this was really the best place get a driver for the controller in the motherboard especially as the latest version did not include my motherboard chipset in the supported devices list.  Next stop, the motherboard manufacturer support website, and sure enough, there was the SATA driver for Windows 10.

This installed the motherboard manufacturer recommended version of Intel RST for Windows 10 and it stopped the 11minute 10second disconnection problem.  Unfortunately it did not resolve the issue completely.  Once the EVO 840 was bought into use sooner or later it would disconnect.  Initially I configured a swap file on it which had the amusing effect of BSODing the whole system when the EVO 840 disconnected and the OS couldn't see its swap file anymore.  The Event ID source was now iaStorA because the driver had changed.

BIOS version ? OK worth a try. So that was upgraded to the latest version. No effect.

At this point the BIOS, SSD firmware, and controller drivers were all correct so configuration became the next focus.  This article looked like a winner.  Deep dive troubleshooting of the "Reset to device, \Device\RaidPort0, Event 129" problem.  Power management is always a suspect.  Nothing here solved the problem.

While the EVO 840 drive was not used it would happily remain available.  Once it was asked to do any real work it would fall quickly on its bum.

Another big indicator that this was a Windows driver problem, emerged from the behaviour of Acronis backup/restore software.  If a restore was attempted to the EVO 840 drive with bootable  WinPE based software, it would always randomly fail.  The same attempts under a linux based version would have no problems.

This article looked interesting
https://docs.microsoft.com/en-gb/archive/blogs/ntdebugging/understanding-storage-timeouts-and-event-129-errors
As it indicated this registry value could have an effect HKLM\System\CurrentControlSet\Services\Disk\TimeOutValue I doubled the value from 41 to 82 but this did not solve the problem.

Finally because there were no problems when running from Windows 8.1, I restored it back to the EVO 840 drive and booted back into that to extract the original Windows 8.1 storahci driver.  I then forced this driver into Windows 10 but sadly it did not resolve it.

I have to conclude, that with this particular setup, it is not possible to resolve this issue.

A 1Tb EVO 860 was bought and installed.  The Windows 10 partitions were restored to it from a backup of the Windows 10 install on the EVO 850.  The EVO 850 was then used as additional storage and the paging file moved to it.  Result: Windows 10 nice and quick.

Perhaps the EVO 840 will live again in the future connected to an updated motherboard / disk controller.


Links to related and similar reports:

https://answers.microsoft.com/en-us/windows/forum/windows_10-hardware-winpc/event-id-129-storahci-resetting-raidport0/7b30c512-6597-438b-80cb-22fb2f85d62e?page=3

https://answers.microsoft.com/en-us/windows/forum/windows_10-hardware/ssd-samsung-850-pro-512gb-freezes-randomly-with/9a8178d0-c72d-49f1-9ea7-da01a24eea41?page=2

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/random-freeze-event-129-iastora/142abe12-3eaf-4e51-8d50-22e28a48e186

Restoring UEFI OS to a second HDD and dual booting

The starting configuration is a UEFI booting OS on say, disk 0.  The requirement is to restore a backedup UEFI OS on a separate HDD/SSD say disk 1 and enable dual booting.

Restore the backup to disk 1.

You've gone into Advanced Start up of the OS on disk 0 (Troubleshoot_Advanced Options_Command Prompt) and used bootrec /scanos to locate the restored OS on disk 1.  You've tried bootrec /rebuildbcd to add the newly restored OS to the boot configuration database (BCD).

bootrec /rebuildbcd  locates the OS on disk 1 and offers to sort it out.

Successfully scanned Windows installations.
Total identified windows installations: 1
[1]   D:\Windows
Add installation to boot list? Yes(Y)/No(No)/All(A):

You select Y thinking your task is nearly complete but instead of success you get

The system cannot find the path specified.

Exit and reboot normally back into the OS on disk 0.

Instead, you will need to manually add the entry to the BCD using bcdedit in an elevated command window.

Run CMD.EXE as admin and enter bcdedit to see the existing entries.  You probably have a Windows Boot Manager and Windows Boot Loader section which controls booting into the OS on disk 0. 

You need to add another Windows Boot Loader entry for the restored OS on disk 1.

The existing entry in the list is referred to as {current}

Make a copy of it using this command.  This using the /d switch to label the entry for it's appearance on the dual boot screen.  Below I have used Windows 8.1

bcdedit /copy {current} /d "Windows 8.1"

Now run bcdedit again to see the result.  You have a another Windows Boot Loader entry with a description of Windows 8.1.  Notice that an arbitary GUID identifier has automatically been generated and applied to it.  You need to copy the GUID into the commands below to identify the Windows Boot Loader entry you are modifying

Now customise it for the OS on disk 1

Bcdedit /set {copiedGUID} device partition=d:

Bcdedit /set {copiedGUID} osdevice partition=d:

Finally modify the Windows Boot Manager settings so that the dual boot selection screen appears when the computer is booted.

Bcdedit /set {bootmgr} Displaybootmenu yes

Bcdedit /set {bootmgr} timeout 20

Run bcdedit again to review how the settings have been updated.

Now reboot and select the restored OS in the list to boot into the restored OS on disk 1.

Online Virus Scanner

https://www.virustotal.com/

Windows Feature Upgrade History

The history of Windows feature upgrades eg 1903 to 1909 is recorded in the registry at

HKEY_LOCAL_MACHINE\SYSTEM\Setup

Outlook connection issue after password change

Scenario:  User changes password but is then unable to connect to O365 Outlook mailbox and encounters sign in issues with O365 desktop apps.  A third party single sign on service is also used to assist authentication.

Workaround was to create and then delete a mailbox profile in the control panel mail applet.  Solve O365 desktop app sign in problems by a signout / signin and a windows logon / logoff.

Underlying cause: unknown
Suspicions: SSL inspection on perimeter firewalls

Skype for Business unable to set Call Forwarding

Scenario: Call forwarding used to work fine.

Fault:  Attempting to set the call forwarding fails.  The Skype client briefly flashes but does not explain the reason for the failure.

Solution:  User was logged into two workstations with two Skype for Business apps running.  Exiting the second Skype for Business instance allowed the first one to correctly accept a call forwarding state.

Addin LoadBehavior values

https://docs.microsoft.com/en-us/visualstudio/vsto/registry-entries-for-vsto-add-ins?view=vs-2019

LoadBehavior values
The LoadBehavior entry under the Root\Software\Microsoft\Office\application name\Addins\add-in ID key contains a bitwise combination of values that specify the run time behavior of the VSTO Add-in. The lowest order bit (values 0 and 1) indicates whether the VSTO Add-in is currently unloaded or loaded. Other bits indicate when the application attempts to load the VSTO Add-in.

Typically, the LoadBehavior entry is intended to be set to 0, 3, or 16 (in decimal) when the VSTO Add-in is installed on end-user computers. By default, Visual Studio sets the LoadBehavior entry of your VSTO Add-in to 3 when you build or publish it.

The following table lists all the possible values of the LoadBehavior entry. Some descriptions in this table refer to loading a VSTO Add-in manually or programmatically. To load a VSTO Add-in manually, select the check box next to the VSTO Add-in in the COM Add-Ins dialog box in the application. To load a VSTO Add-in programmatically, set the Connect property of the Microsoft.Office.Core.COMAddIn object that represents the VSTO Add-in to true.

Value (in decimal) VSTO Add-in status VSTO Add-in load behavior Description
0 Unloaded Do not load automatically The application never tries to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

If the VSTO Add-in is successfully loaded, the LoadBehavior value remains 0, but the status of the VSTO Add-in in the COM Add-ins dialog box is updated to indicate that the VSTO Add-in is loaded.
1 Loaded Do not load automatically The application never tries to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

Although the COM Add-ins dialog box indicates that the VSTO Add-in is loaded after the application starts, the VSTO Add-in isn't loaded until it is loaded manually or programmatically.

If the application successfully loads the VSTO Add-in, the LoadBehavior value changes to 0, and remains at 0 after the application closes.
2 Unloaded Load at startup The application does not try to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

If the application successfully loads the VSTO Add-in, the LoadBehavior value changes to 3, and remains at 3 after the application closes.
3 Loaded Load at startup The application tries to load the VSTO Add-in when the application starts. This is the default value when you build or publish a VSTO Add-in in Visual Studio.

If the application successfully loads the VSTO Add-in, the LoadBehavior value remains 3. If an error occurs when loading the VSTO Add-in, the LoadBehavior value changes to 2, and remains at 2 after the application closes.
8 Unloaded Load on demand The application does not try to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

If the application successfully loads the VSTO Add-in, the LoadBehavior value changes to 9.
9 Loaded Load on demand The VSTO Add-in will be loaded only when the application requires it, such as when a user clicks a UI element that uses functionality in the VSTO Add-in (for example, a custom button in the Ribbon).

If the application successfully loads the VSTO Add-in, the LoadBehavior value remains 9, but the status of the VSTO Add-in in the COM Add-ins dialog box is updated to indicate that the VSTO Add-in is currently loaded. If an error occurs when loading the VSTO Add-in, the LoadBehavior value changes to 8.
16 Loaded Load first time, then load on demand Set this value if you want your VSTO Add-in to be loaded on demand. The application loads the VSTO Add-in when the user runs the application for the first time. The next time the user runs the application, the application loads any UI elements that are defined by the VSTO Add-in, but the VSTO Add-in is not loaded until the user clicks a UI element that is associated with the VSTO Add-in.

When the application successfully loads the VSTO Add-in for the first time, the LoadBehavior value remains 16 while the VSTO Add-in is loaded. After the application closes, the LoadBehavior value changes to 9.

Viewing Group Policy Templates

The Group Policy Management Console reads ADMX files from the central store typically
 \\<domain.com>\sysvol\<domain.com>\Policies\PolicyDefinitions

which on a DC is

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions

If you want to view ADMX files before placing them in the central store, copy them to C:\Windows\PolicyDefinitions.  Copy the language files ADML files to the suitable subfolder.

Change this key to 1 then launch GPMC.  Editing a policy will read from the local ADMX files not the central store.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\EnableLocalStoreOverrideType: REG_DWORD
Values:
0 - Use PolicyDefinitions on Sysvol if present (Default)
1 - Use local PolicyDefinitions always

Updating central store

Install a downloaded MSI containing the ADMX/ADML files which may install to 

e.g. C:\Program Files (x86)\Windows Server 2022 August 2021 Update\Policy Definitions

On the DC

Copy the required ADMX policy template files to 

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions

Copy the the required ADML policy template files from the language specific folder e.g.

C:\Program Files (x86)\Microsoft Group Policy\Windows Server 2022 August 2021 Update\PolicyDefinitions\en-US

to 

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions\en-US

The Policy options provided by the templates will now be visible in Group Policy Management Editor

Mapping to Sharepoint folders

Useful article about mapping File Explorer and/or OneDrive to Sharepoint Folders

https://docs.microsoft.com/en-us/sharepoint/support/administration/troubleshoot-mapped-network-drives

Start Menu Locked grrrrrr

Why some sysadmins lock the start menu I don't know.  It just reduces productivity when users are unable to customize the area designed to allow quick launching of favourite apps.

So if you suspect there is a group policy locking this down try this.

1. Set this key to 0
   
   HKCU\Software\Policies\Microsoft\Windows\Explorer
   LockedStartLayout   REG_DWORD    0
   
   As a user you probably won't have permissions.  Elevate then edit the user key below the appropriate SID in HKEY_USERS
   
2. Use the task manager to End Process on explorer.exe
   
3. Then in task manager use File_Run New Task to re-launch explorer

You can now "Pin to Start" for as long as the GPO has not affected the current explorer session.  You would likely have to carry out the procedure again before you could "Pin to Start", after a reboot for example.

administrator has blocked you from running this app

Oh no! That's terrible.  It looks very serious.

I doubt just running it in an elevated command window would make much difference. Oh, it does!