Getting started

Run 1Start.exe. On first launch it creates a demo content folder under %ProgramData%\0101\1Start\Content with sample sections so there is something to click. Press the Win key or click Start: 1Start opens instead of Windows Start. Exit from the tray icon and Windows Start is back.

Then either edit the content folder directly, point SourceFolder at a network share, or sign up for the cloud console and give each PC its policy URL.

Content folder

RootFolder\                       (local folder, or \\server\share synced locally)
  School Website.url              → "General" section, visible to everyone
  Students\                       → one section per top-level folder
    icon.png                      → section logo
    Learning\                     → sub-folders become groups
      Khan Academy.url
    Reference\
      Library Catalog.url
  Staff\
    Staff Portal.url
    Administration\
      Gradebook.url
      Remote Desktop.rdp
  Tools\
    Notepad.lnk
  manifest.json                   (optional)
  policy.json                     (optional; see Policy file)

• Every file is launched through ShellExecute, exactly like a double-click in Explorer, so file associations apply.
• Folders the signed-in user cannot read are skipped silently. Put NTFS permissions on section folders, enable access-based enumeration on the share, and one share serves every user exactly their sections. The sync copies those permissions to the local mirror so they hold offline.
• To force a URL into a specific browser or kiosk mode, use a .lnk to chrome.exe or msedge.exe with --new-window https://… (add --kiosk) as its arguments.
• Icons: icon.png (or logo.png, .ico, .jpg) inside a section folder is its logo. Name.png next to Name.url is that item's icon. README.txt, manifest.json, policy.json, hidden and system files are never shown.

manifest.json

Optional file in the content root that overrides titles, order, icons and visibility. Keys are paths relative to the root with forward slashes.

{
  "rootTitle": "General",
  "rootIcon": "logo.png",
  "groups": {
    "Students": { "order": 1, "icon": "Students/icon.png", "useIconForItems": false },
    "Students/Learning": { "title": "Learning apps" },
    "Staff": { "order": 2, "title": "Teachers & Staff" }
  },
  "items": {
    "Students/Learning/Scratch.url": { "title": "Scratch (coding)", "order": 1 },
    "Tools/Old Link.url": { "hidden": true }
  }
}

Settings reference

Every setting lives in appsettings.json next to the EXE and can be set from the command line (--set Key=Value), the admin Settings area inside the app (power flyout → Settings, or Ctrl+Shift+Alt+X), a policy file, or the registry. Precedence, weakest to strongest: appsettings.json → %ProgramData%\0101\1Start\settings.json (admin Settings area) → per-user layout choice → policy file → HKCU policy → HKLM policy.

Branding

Content and sync

Look

Lockdown

--lockdown, the installer's /LOCKDOWN, and the "Apply school preset" button set the four Allow* keys and SeedSampleContent to false at once.

1Start cannot stop Task Manager from killing it. Pair it with the installer's logon task (relaunches within a minute) and an admin code. For a full kiosk, also restrict Task Manager, Win+R and File Explorer through Group Policy or Intune as usual.

Power and session actions

Each action in the power flyout has its own switch: AllowShutDown, AllowRestart, AllowSleep, AllowSignOut, AllowLock (all true by default; the first three also need AllowPowerActions). To remove the same actions from Windows' own screens (Ctrl+Alt+Del, Alt+F4, the Windows Start menu) set HideWindowsPowerOptions, and DisableLockWorkstation for Win+L. Those two are Windows policy values and go through the agent below.

Taskbar

All taskbar settings are per user and can be targeted with policy rules. Leave a value unset to keep the user's own choice.

The 1Start Agent. Standard users cannot write Windows policy keys, so the installer registers a second scheduled task, "1Start Agent", running as SYSTEM at every logon and once a minute. The per-user 1Start leaves a request under %ProgramData%\0101\1Start\agent\requests; the agent writes the values into that user's registry hive, removes values a policy no longer asks for, and with RestartExplorerForPolicy (default true) restarts that user's Explorer so the change shows at once. Without the agent these values apply only when 1Start runs as an administrator. TaskbarPins uses Windows' own taskbar layout policy and applies at the next sign-in; on Windows 11 24H2 the Widgets switch is a machine-wide policy and affects every user of the PC. Test on one PC with 1Start.exe --apply-taskbar and --restore-taskbar.

Policy file and rules

A policy.json reachable by every PC. Set PolicyUrl to an https URL or a share path, or drop the file in the root of the network source folder. It is re-read every PolicyRefreshMinutes and on Refresh; changes apply live. The last good copy is cached in %ProgramData%\0101\1Start\policy.cache.json, so it applies offline and at the next sign-in. An unreachable or invalid file keeps the previous policy in force.

{
  "OrganizationName": "Lincoln Elementary",
  "AllowWindowsStart": false,
  "AllowPowerActions": false,
  "AllowOpenContentFolder": false,
  "rules": [
    { "when": { "groups": ["SCHOOL\\Staff"] },              "set": { "AllowPowerActions": true, "AllowOpenContentFolder": true } },
    { "when": { "computers": ["LIB-KIOSK-*"] },             "set": { "Layout": "Modern", "ShowTrayIcon": false } },
    { "when": { "computers": ["LAB-*"], "users": ["s-*"] }, "set": { "SectionsLabel": "Classes" } }
  ]
}

• Top-level keys apply to everyone. rules apply on top, in order, to users matched by when.
• users match the sign-in name or DOMAIN\name; computers the computer name; groups DOMAIN\Group or the bare group name from the logon token (works offline).
• Conditions inside one when are ANDed; entries inside a list are ORed; * and ? wildcards.
• The policy file cannot set PolicyUrl or the share password. Settings a policy controls show as "Managed by policy" in the Settings area. 1Start.exe --show-config lists them.

Cloud console

1start.0101inc.com/console hosts the policy for you. Create an organisation (name, email, password) and you get a policy URL like https://1start.0101inc.com/p/<key>/policy.json. Give it to each PC with the installer's /POLICY=, Group Policy, or --set PolicyUrl=. New organisations start with the school preset already on.

The console offers the same form, rules editor, JSON view, admin-code hash tool and version history as the on-premises console, plus a Devices page: every PC that follows the URL checks in when it refreshes with computer, user, version, layout, app count, sync state, policy hash, last seen and address. Shortcuts still come from your own share or each PC's local folder; the cloud manages settings, lockdown and branding.

Group Policy and Intune

1Start.admx and en-US/1Start.adml add a 0101 › 1Start folder under Computer and User Configuration › Administrative Templates. Copy them to %SystemRoot%\PolicyDefinitions or the domain Central Store. The template writes values named after the settings to HKLM\Software\Policies\0101\1Start (computer) or HKCU\… (user): REG_SZ for text, REG_DWORD 1/0 for booleans. Intune can set the same values through a custom OMA-URI or an ADMX import. Computer policy wins over user policy; both win over the policy file. A typical setup is one registry value, PolicyUrl, pushed by Group Policy, with everything else in the policy file.

Installer and switches

1Start-Setup.exe /VERYSILENT /ORG="Lincoln Elementary" /LOGO="C:\deploy\lincoln.png" /ACCENT=#2E7D32 /ROOT="\\fs01\StartMenu" /POLICY="https://1start.0101inc.com/p/KEY/policy.json" /EXITCODE=3735 /LOCKDOWN

The installer runs the EXE's own switches, so anything it does a script can do:

Generate an admin-code hash by hand:

powershell -c "[BitConverter]::ToString([Security.Cryptography.SHA256]::HashData([Text.Encoding]::UTF8.GetBytes('1234'))).Replace('-','')"

On-premises console

1StartConsole.exe is a self-hosted web app for IT: run it on the file server or any always-on PC, open http://<that-pc>:5150/, set the admin password, and point it at the share the menus sync from. It manages the content folder in a browser (sections, groups, links, uploads, icons, drag-and-drop, manifest titles and order, live preview), edits and publishes policy.json, serves it at /policy.json, and lists devices that check in. Register it as a service with 1StartConsole.exe --install. For https, put it behind IIS or a reverse proxy.

How it takes over Start

Log file: %LOCALAPPDATA%\0101\1Start\1Start.log.

Limitations

• Mixed-DPI multi-monitor positioning is tuned for the primary monitor.
• Start button location relies on the taskbar's UI Automation tree; a Windows update could rename the button.
• Touch taps on the Start button reach the mouse hook as emulated clicks; untested.
• 1Start hides the Windows Start menu; it does not remove Windows search, the taskbar or shortcuts such as Win+R. Use Group Policy for those.