Start2Tool

I've recently had my pinned apps in my start menu be nuked and reset by Windows. I'm seriously at my limit 🫩

A PowerShell tool for backing up, inspecting, and restoring the pinned tile state of the Windows 11 Start Menu (start2.bin). Useful when Windows Settings Sync, an update, or a profile resets your Start Menu pins back to the default layout.

Windows stores your pinned Start Menu layout as an AES-256-CBC encrypted blob with a random key derived per-file from an embedded MT19937 PRNG. There's no supported API to read or write it directly, so this tool implements that format from scratch (see Credits) so you can back it up, decrypt it to inspect the pins, and restore from an earlier version.

ℹ️ NOTE: This tool modifies live Windows state. It overwrites your real start2.bin and can delete a CloudStore registry key. Every restore automatically backs up your current live state first (see Safety), but you should still run backup yourself before experimenting.

---

Index

• Technical Notes
• What does it do?
• Requirements
• Installation
• Usage
• Save Files
• Safety
• Multi User & Elevation
• Testing Status
• Credits

---

Technical notes

start2.bin is a small binary frame: a magic GUID, a fixed header constant, a FILETIME, a total length, then a ciphertext region padded with random bytes on both sides (512 bytes of padding total, split at a random point derived from the same seed as the file). The AES-256 key and IV are themselves generated from an embedded MT19937 Mersenne Twister PRNG, seeded from the file's own FILETIME XORed with two constants baked into the OS's encryption provider, so every start2.bin decrypts with a key unique to that file, deterministically, with no external key storage needed. The decrypted payload is UTF-8 JSON describing the pinned tile layout.

What does Start2Tool do?

• backup: copies your current live start2.bin, exports the associated CloudStore tile cache registry key, and saves a decrypted JSON preview, all timestamped in the directory where the script is ran under start2-backups/.
• decrypt: decrypts any start2.bin/.bak file to readable JSON so you can see what's actually pinned before you commit to restoring it.
• restore: previews the pins in a file, asks for confirmation, then installs it as your live Start Menu state (auto backs up the start2.bin there first).
• restore --versions: looks for Windows Previous Versions (Volume Shadow Copy snapshot) of your live start2.bin, lists what it finds, and lets you restore an older snapshot directly. Useful if you don't already have a backup from when before things broke.. Like me..

Requirements

• Windows 11: targets StartMenuExperienceHost's known start2.bin format
• PowerShell 5.1+: (built into Windows)
• Administrator: required to read/write the Start Menu's app package folder and to touch the CloudStore registry hive. The script enforces this itself (#requires -RunAsAdministrator).
• For restore --versions: Volume Shadow Copy must actually have snapshots to find (created by System Restore / File History). If none exist, you're out of luck, and will point you to backups instead.

Installation

Clone or download this repo, then keep Start2Tool.ps1 and Start2Tool.cmd together in the same folder. The .cmd wrapper expects the .ps1 to sit together.

git clone https://github.com/wwobbiee/Start2Tool.git
cd Start2Tool

No other setup is needed, nothing is installed system wide. You can see for yourself.

Usage

• Wrapper: right click Start2Tool.cmd -> Run as administrator, or run it from an elevated cmd/Powershell prompt:

Start2Tool.cmd backup
Start2Tool.cmd backups
Start2Tool.cmd decrypt "C:\path\to\start2.bin"
Start2Tool.cmd restore "C:\path\to\start2.bin"
Start2Tool.cmd restore --versions
Start2Tool.cmd help

Or call the PowerShell script directly (same args) from an elevated shell:

powershell -ExecutionPolicy Bypass -File .\Start2Tool.ps1 backup

Flags

Flag	Description
-Force	Skip the y/N confirmation prompt on restore
-User "DOMAIN\username"	Explicitly define a logged on user's Start Menu (skips interactive picker see Multi User / elevation below)

Flow

:: Take a known good snapshot before you change anything
Start2Tool.cmd backup

:: ...pins get nuked by who knows what

:: Check backups
Start2Tool.cmd backups

:: Restore most recent
Start2Tool.cmd restore "start2-backups\20260909-142301\start2.bin"

If you didn't run a backup beforehand, try retrieval through the shadow-copy route first for a known good state:

Start2Tool.cmd restore --versions

Where do things get saved?

Everything lives in the working directory that the script lives in.

start2-backups\<timestamp>\start2.bin               raw backup
start2-backups\<timestamp>\start2.json              decrypted pins JSON
start2-backups\<timestamp>\cloudstore-tiles.reg     registry export
start2-tool-work\decrypted\start2.json              output of `decrypt`
start2-tool-work\start2-from-vss-<timestamp>.bin    staged VSS restores

Safety / What gets backed up?

• restore always copies the current live start2.bin to start2.pre-restore-<timestamp>.bin right next to the original, before overwriting it so a bad restore is reversible.
• The tool decrypts and shows you a preview of the pins in the file (folder names, app IDs) and prompts for y/N confirmation before installing anything as the live state, unless you pass in -Force.
• If a source file is corrupt or not a real start2.bin, decryption fails before anything is touched, the live file and registry are only modified after a file has been successfully parsed, decrypted, and confirmed.
• restore also clears the associated CloudStore tile cache registry key so the new pins actually take effect (Explorer/Start menu otherwise caches the old state).

⚠️ Known limitation: If the pins keep resetting immediately after a restore, that's usually due to Windows Settings Sync repushing an empty or old state from the cloud so disable Settings Sync and restore again.

Multi User / Elevation

If you elevate using a separate administrator account (rather than right click -> Run as administrator on your own account), Windows' %LOCALAPPDATA% and HKCU inside that elevated process point at the admin account's own profile not yours. So naively using those paths will target the wrong start2.bin and the wrong registry hive.

Start2Tool detects this and instead:

1. Finds the actual interactive user(s) through their explorer.exe session(s).
2. If only one user is logged in, uses their profile automatically.
3. If multiple users are logged in, prefers whoever is on the physical console. If that's ambiguous, it will prompt you to pick (or pass -User "DOMAIN\username" to skip the prompt, implemented for scripting).
4. Resolves that user's real profile path and registry hive (HKEY_USERS\<user's SID>) instead of the elevated token's own.

you'll see which account is being targeted at the start of every run:

Targeting user: DESKTOP\alice   (elevated as different account. Using their profile)

If that user's registry hive isn't currently loaded under HKEY_USERS (for ex. if they're not actually logged in), it will warn you rather than silently skipping the CloudStore cleanup step.

Testing Status

This table highlights what has been implemented but has not been thoroughly tested on a real machine.

Descriptor	Status	Expected Behavior
restore on a corrupt or truncated file	⚠️Untested	Should fail during decrypt/parse before touching the live file (magic/header/length checks run first) but the exact error message hasn't been verified against real corrupt files
restore on an empty (0-byte) file	⚠️Untested	Should hit the file too short check and exit
restore on a random non-start2.bin file	⚠️Untested	Should hit the magic-GUID check and exit
restore --versions with real VSS shadow copies present	⚠️Untested	Should list snapshots and restore the picked one; VSS enumeration/session behavior can vary by Windows edition and thus hasn't been confirmed with live testing
%LOCALAPPDATA% on a non-C: drive prefix	⚠️Untested	Drive prefix logic utilizes [System.IO.Path]::GetPathRoot() so it should work, but hasn't been ran on such a machine
Two users logged in simultaneously (fast user switching)	⚠️Untested	Should prefer the console session, or prompt/accept -User when ambiguous cases. Picker logic hasn't been exercised with a real second session
Long usernames in quser output	⚠️Untested	Console session parsing reads from the SESSIONNAME header position rather than a fixed column, so it should tolerate long names, but hasn't been confirmed
User's registry hive not loaded user HKEY_USERS	⚠️Untested	Should warn explicitly rather than silently skipping CloudStore cleanup

If you hit an issue in an "Untested" case, it would be nice to know about. Feel free to open an issue with what happened, be descriptive as possible, otherwise there are no promises that it will be remediated.

Credits

Format and cryptographic derivation reverse-engineered and documented by the Internet community at MyDigitalLife Forums - Windows 11 Start Menu start2.bin File Format and Read Procedure. This tool is a PowerShell implementation of the documented technical aspects and script algorithm with added backup/restore/multi user tooling atop.

Disclaimer

This is an unofficial, tool that reads and writes an undocumented Windows file format and registry key. It is not affiliated with or endorsed by Microsoft. Back up before you restore, and use at your own risk.