Rolled out good old NAL (Application Window) on all clients here and give users their program icons just via NAL. So we don't install (or delete after installation) all of the desktop icons for installed software (e. g. Firefox, VLC, TeamViewer ...).

Now, after patching installed software on clients (Firefox, VLC, Teamviewer ...), the desktop icons comes back (%Public%\Desktop\... .lnk). What's the best way to prevent this?
Don't want to see any icons outside the NAL...