I am setting up a Server 2016 RDS Session Host and want to ensure it's fully locked down. I have been through various Group Policies that worked with Server 2012 but am having problems with locking down and configuring the new 2016 Start Menu.


I would like to know how other people are locking their Server 2016 RD hosts down.


One major issue I am trying to configure is regarding the Power and Settings Buttons on the Start Menu. When remote connected and I click on the Power Button the only option available is to Disconnect. I want to also have the option for users to Sign Out. I know this is available if a User clicks on their User icon, but this may confuse users. Alternatively if I can't add it to the Power Button is it possible to remove the Power Button and Add the Disconnect option to the User Button?


There is also the Settings Button on the Start Menu. Is there any way to remove that?


I have been able to customize the start menu Tiles by exporting an XML file with the custom layout and using the group policy to specify that as the layout for users, but it has removed the ability to pin and unpin tiles from the Start Menu. It's not a major as users probably don't need to do much customization, but am wondering if this is the expected behavior as it will require manually updating if any new programs are installed.


Additionally, I have created groups of tiles and find that even though I exported the layout with the tiles set to 3-wide and the groups arranged down the menu, the groups end up side-by-side going across the desktop. The tile menu can be manually resized back to a single group column, but I'm trying to get consistency with the User experience.


Appreciate any assistance or recommendations with these issues.