Application Identity Service - Can't set to Auto

[FragglePete]

Looking at Win10 now, working my way through new GPO's, etc but running into an issue.

 

From what I'm reading here, looks like we're needed AppLocker to block certain Win10 features so started to look into this and couldn't get it to work. Then I noticed that the Application Identity Service is not running. So I make a GPO to set this to start and set it to Auto Start - but it still doesn't want to run but this was having no effect. Oddly, I can manually start it on the client using services.msc but if I attempt to change the startup type to Auto I get an access denied message. This behaviour is happening on two physical machines I've got running and one VM.

 

Any ideas?

 

Pete

[Steve21]

What version of 10 are you trying it on?

 

Steve

[FragglePete]

What version of 10 are you trying it on?

 

Steve

 

Ah! As soon as I saw this, the thought did occur to me last night while mulling it over - running Pro but is it the case that this is available for Enterprise only?

 

Pete

[Steve21]

Ent or Edu yep

 

Steve

[FragglePete]

Just downloaded the fresh ISO of the education version, installed and still no joy! Just getting Access Denied when trying to set the service startup type. Any more thoughts?

 

Pete

[Boredguy]

Just looked on our W10 laptop (the one with GPO issues over wifi!) and the Application Identity service has a Automatic (Trigger Start) set.

However we have defined this setting via our Applocker GPO (Computer Config -> Policies -> Windows Settings -> Security Settings -> System Settings -> Application Identity)

[FragglePete]

Just looked on our W10 laptop (the one with GPO issues over wifi!) and the Application Identity service has a Automatic (Trigger Start) set.

However we have defined this setting via our Applocker GPO (Computer Config -> Policies -> Windows Settings -> Security Settings -> System Settings -> Application Identity)

 

That is indeed how I have it set in a GPO presently (I assuming you mean Computer Config -> Policies -> Windows Settings -> Security Settings-> System Services -> Application Identity), but it doesn't start. I know the GPO is applying as we also use the same GPO to start the Remote Registry service which is needed for Sophos so we can remote install from the console.

 

I have found various posts with others having the same issue and the only solution so far is to tweak the registry HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvc and set the Start to 2 which now has the service running after a reboot. I guess I could create another GPO that tweaks this setting for me but seems a bit odd.

 

Pete

[Boredguy]

Yes I did mean System Services.. that's what happens when your looking at three different windows.

 

I've checked our other Windows 10 station policies, and we do not have anything setting that registry value, even though it is currently set as that... strange

[FragglePete]

I'm taking a step back and starting again on Windows 10 GPO's. I may have set something that has upset things overall. I've got all sorts of weirdness going on so it maybe something else. Not giving up just yet!

 

Pete

[Steve21]

Strange, can't do it via Services.msc even without GPOs applied

 

Yet "sc config appidsvc start= auto" also works fine.

 

Steve

[whartomt01]

I can get the service to start the same way as Steve21

but once I've forced the service to startup type 'Automatic' it breaks the start menu. Can click the icon but nothing happens. I can still right click to get to computer management etc. but not left click.

Anyone had the same issue. I'm using Win 10 Edu