Updated 1/23/2023 @ 1:10pm PST
On January 13th, Windows Security and Microsoft Defender for Endpoint customers may have experienced a series of false positive detections for the Attack Surface ...
This thread came perfectly on time, and most of the comments are relevant, especially the one from lat-lukepollard.
If I may add my own 2 cents, not on the recovery of the shortcuts, but for whoever (like me) manage multiple clients with limited admin resources: a way I've dealt with shortcuts problems in the past (and now with all my clients who recently accepted to "Block Win32 Macro from Office"..) was to use Microsoft MDM (Intune) with a Configuration Profile - Device restrictions:
Choose the "Start" option for customizing the Start and Taskbar shortcuts
This is what I've done for all my clients Tenants
By asking many users on their shortcuts pattern, I could split them in two main groups: Powerusers and classic.
Powerusers are the group of users who want to manage the shortcuts the way they want, and are so picky that you should not try to customize anything for them. They will need all the time and effort to attempt all the solutions mentionned above to recover them.
The Classic user group is the majority of users I've seen. They need what the company provide to them + Office/Web Browsers. For these users, I suggest to create the Device restrictions Configuration Profile that will automatically re-create the shortcuts for them. The way to customize everything is done through XML such as the one I created bellow:
To understand and create your own one today, please use the https://learn.microsoft.com/en-us/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management
Mine is going maybe a bit too far, I create three groups in the Start menu (Office, Internet and Cloud) with all the required applications for all users, and I force the placement of all the shortcuts mentioned in the <taskbar> (which means this policy takes control of the way shortcuts are displayed). In the documentation, you have plenty of options that are well explained today, so you can create something bespoke for each Tenants.
This is a unique opportunity to dive deep in those policies, so when the problem comes back (I'm sure it will) we will limit the damage by focusing more on the Powerusers than the majority of Classic users.
I'll assess Tuesday if that policy solved the shortucts for the Classic user group by itslef.