Add Website Shortcut(S) to the Desktop and/Or Start Menu

What the web shortcut deployer does

This Automox Worklet™ deploys branded web application shortcuts to Windows endpoints. The Worklet creates .lnk shortcut files that open a specified URL when clicked, using a custom .ico icon supplied as a Worklet attachment so the shortcut shows the application's logo rather than a generic browser glyph. The .lnk files are written to every configured desktop and Start menu path that exists on the endpoint, so users see the application alongside their other installed software.

The Worklet uses the WScript.Shell COM object to write standards-compliant Windows shortcut files, so the OS treats them like any other shortcut: they pin to the taskbar, surface in Start menu search, and survive Windows feature updates. The uploaded .ico file is copied to %WinDir%\Temp on the endpoint and referenced by the shortcut's IconLocation property as "%WinDir%\Temp\{icon}, 0" so the icon resolves cleanly on every login.

The script accepts an array of shortcut paths so a single policy covers mixed desktop configurations. The current user's local Desktop, the OneDrive-synced Desktop folder, the Public desktop visible to all users, per-user Start menu folders, and the All Users Start menu are all valid targets. The Worklet detects the logged-in user by querying the owner of explorer.exe via Get-CimInstance, then writes to every path in the array that actually exists – endpoints without OneDrive simply skip the OneDrive path instead of erroring.

Why deploy web shortcuts through Automox

Internal web applications, single sign-on portals, knowledge bases, and SaaS tools are how most work gets done on a managed endpoint. Users find their way to those tools through bookmarks, the help desk, and word-of-mouth. A new hire on day one does not know the URL of the corporate ticketing system. A user whose default browser changes after a Windows update loses the bookmarks they had pinned. Help-desk tickets that start with "how do I get to X" are a steady tax on operations time.

A consistent launch surface only works if every user gets the same icons at the same path with the same target URL. Schedule this Worklet on the workstation policy that covers your onboarding group so the .lnk files land in the All Users Desktop the first time the Automox agent checks in after imaging. Keep it on a weekly cadence to catch re-imaged endpoints, profile resets, and any user who manually deleted the shortcut. Pair the deployment with a curated list of approved web applications so the icons users see match the tools your organization actually licenses.

How web shortcut deployment works

1. Evaluation phase: The Worklet iterates the $shortcutPaths array, runs Test-Path against each entry, and increments $foundPath for every path that exists. For each path, it also runs Test-Path against {path}\{$shortcutName} and increments $foundIcon when the .lnk is already present. If $foundPath equals $foundIcon, every existing target already has the shortcut and the script exits 0 (compliant); otherwise it exits 1 and the endpoint is flagged for remediation.

2. Remediation phase: The Worklet copies the uploaded .ico file to %WinDir%\Temp using Copy-Item with -Force. For each existing path in $shortcutPaths, it instantiates a WScript.Shell COM object, calls CreateShortcut on the joined path, sets TargetPath to the $webLink URL and IconLocation to "%WinDir%\Temp\$icon, 0", and calls the COM object's Save method to write the .lnk. Non-existent paths are skipped silently so the script does not fail on endpoints that lack OneDrive Desktop.

Web shortcut deployment requirements

• Windows 8, Windows 10, Windows 11, or Windows Server 2016 and later with PowerShell 3.0 or later

• Upload a custom .ico file to the Automox console as a Worklet attachment so the script can copy it to %WinDir%\Temp

• Set the $icon variable to the uploaded filename (for example, favicon.ico)

• Set the $webLink variable to the destination URL (for example, https://console.automox.com/login)

• Set the $shortcutName variable to the .lnk display name, including the .lnk extension (for example, Automox Login.lnk)

• Set the $shortcutPaths array to the locations where the .lnk should land; use $currentUser to expand per-user paths like C:\Users\$currentUser\Desktop and $env:PUBLIC or $env:ALLUSERSPROFILE for all-users targets

• Keep $shortcutName and $shortcutPaths identical between the evaluation and remediation scripts, otherwise compliance flips back to non-compliant on the next evaluation

Expected shortcut state after deployment

After successful remediation, the $shortcutName .lnk file exists at every existing path in $shortcutPaths. Double-clicking the shortcut opens $webLink in the user's default browser. The custom icon shows in File Explorer, on the desktop, and in Start menu tiles. The .ico source file lives at %WinDir%\Temp\$icon and persists across reboots, so the IconLocation reference resolves on every subsequent login.

Validate on a single endpoint by browsing to each $shortcutPaths location after the policy runs, confirming the .lnk is present, and double-clicking it to verify the configured URL opens with the expected icon. For audit evidence, capture the activity log entry showing which paths were written and store it with the policy run identifier. If a shortcut appears with a broken icon, the cause is almost always that the .ico file was not uploaded to the console or the attachment filename does not match the $icon variable; fix the attachment, then rerun the Worklet.