tomgrindle Posted January 22, 2016 Posted January 22, 2016 Hey Everyone! I am really hoping that somebody can help me. I think I am almost on the verge of tears, it's annoying me that much! A few months ago I created a Windows 10 Image by loading a reference machine, removing apps, performing updates etc before sysprepping it. I then deployed to numerous machines and it worked fine. Since the November (1115) Update I have decided that I would like to create an up-to-date image. So, I installed a reference machine with the newest version, removed apps, performed updates etc ... When I finally got around to deploying it, it kindly reinstalled all of the apps that I had removed ... I was less that impressed! Originally, when creating my first image, I used the DISM command in Powershell to remove the apps. This worked a treat! DISM /Online /Remove-ProvisionedAppxPackage /PackageName:**PACKAGENAME** When creating an image of the November Update I used a different command, this one: Get-AppxPackage -allusers *PackageFullName* | Remove-AppxPackage This removed the apps on the reference machine fine but as I have said, seemed to reinstall them when loading a machine with my captured image. I then decided to try creating a new image from scratch but this time used the DISM command (above) to remove the apps instead. This doesn't remove the apps, even though it states 'Completed Successfully'. After a reboot the apps are still present. Has Microsoft done something to the latest release to make this a ball ache on purpose??!! Could anybody offer some help or provide any alternative, but idiot proof, ways of doing it?! It is muchly appreciated! Have a good weekend everybody!
DJ-1701 Posted January 22, 2016 Posted January 22, 2016 Have you tried using AppLocker post imaging? I have used the AppLocker GPO settings to disable to Apps that I don't want used, seems to work fine as long as you remember to set the Application Identity service to run at startup.
sparkeh Posted January 22, 2016 Posted January 22, 2016 I used this powershell script to remove apps from the wim: https://gallery.technet.microsoft.com/Removing-Built-in-apps-65dc387b I ran it in the interactive mode so I could choose what to remove and what to keep.
tomgrindle Posted January 22, 2016 Author Posted January 22, 2016 Oohh I looked at that one @sparkeh ... It confused me slightly! I'll have to have a look at it with fresh eyes! When I tried it last night I was just getting an error Does it remove Candy Crush etc as well? I will never know why Microsoft decided to include it in the Education version! [emoji35]
tomgrindle Posted January 22, 2016 Author Posted January 22, 2016 I presume that it is safer to do it on the install.wim straight from the disc? I tried it on a WIM that I had already captured back but wasn't sure if I had to modify the script for the name to match. I usually like to patch the WIM as much as possible and make a few modifications before deploying.
sparkeh Posted January 22, 2016 Posted January 22, 2016 I used the wim from the disk but honestly don't know if it's safer. IIRC candy crush is a link to install rather than the actual app so it doesn't get removed. But there are posts on here on how to remove those links as well. Post back if you need any help.
tomgrindle Posted January 22, 2016 Author Posted January 22, 2016 I'll have a look for those! Would rather get rid of them before I deploy I have given it a go but it is complaining about the script not being Digitally Signed. Maybe this is because I am running it on a server? I Unblocked the file beforehand.
sparkeh Posted January 22, 2016 Posted January 22, 2016 You'll need to tell powershell to allow unsigned scripts with: Set-ExecutionPolicy Unrestricted You can change it back afterward if it bothers you to have it left like that.
tomgrindle Posted January 22, 2016 Author Posted January 22, 2016 Oh yes! Thank you! Sorry, I could have Googled that!
Garacesh Posted January 25, 2016 Posted January 25, 2016 Can you not just run it the once via command line? Powershell.exe \\Path\to\script.ps1 -ExecutionPolicy Bypass
Michael Posted January 25, 2016 Posted January 25, 2016 Is there any reason why you don't just use AppLocker to block/restrict Apps instead of trying to remove them? It works well and is a lot less hassle. Also (in the networks I support), using Classic Shell, end users can't even see the Apps to click on as the Start Menu itself is replaced with something a lot more functional.
Garacesh Posted January 25, 2016 Posted January 25, 2016 (edited) Is there any reason why you don't just use AppLocker to block/restrict Apps instead of trying to remove them? It works well and is a lot less hassle. They still show up in the Start Menu. I do understand the eagerness to use Classic Shell but I really loathe to implement a 3rd party addon as a core part of the OS. I've personally set myself a Summer break deadline for W10, so I have plenty of time to find alternate solutions. Edited January 25, 2016 by Garacesh
DJ-1701 Posted January 25, 2016 Posted January 25, 2016 They still show up in the Start Menu. Shouldn't do if it is the first time the account has logged on.
Garacesh Posted January 25, 2016 Posted January 25, 2016 Shouldn't do if it is the first time the account has logged on. Hm. Oh really? I'll have to double-check that then. I must not have logged in as a student when I tried it. Local Admin account must have had them because it logs in as part of the task sequence before joining the domain and getting applocker applied.. Right now I've just tested the image with the .wim modified as per @sparkeh's post and that works fine. Though I do wonder what instability it might bring from not having them there..
Michael Posted January 25, 2016 Posted January 25, 2016 They still show up in the Start Menu. I do understand the eagerness to use Classic Shell but I really loathe to implement a 3rd party addon as a core part of the OS. I've personally set myself a Summer break deadline for W10, so I have plenty of time to find alternate solutions. I agree and I was very much in the same mind set as yourself until I gave up after the hours of testing and trying to implement a consistent working Start Menu. Since I've deployed it to the many sites I support, problems have gone right down. Staff feel more comfortable as do Pupils - feedback has only been positive. Staff wise, I probably support somewhere in the region of 1000 (I've never counted properly), but's got to be somewhere in that region. If you include Pupils, it would be thousands. Classic Shell (how I've implemented it) also resolves the context menu when right clicking Start. Despite restricting everything on the context menu, Staff/Pupils could still see it (if they knew about it), but implementing Classic Shell, they see a cut down version of its context menu, yet when I logon as admin, I see the standard Windows 10 context menu. There is no other solution out there that does this. There are still big question marks over whether changing the Start Menu layout is possible once it's been implemented - either via GPO or script. Just think (hypothetically), Microsoft release Microsoft Office 2018 for example and you want to update shortcuts from Microsoft Office 2016. With Classic Shell as it uses/supports Folder Redirection, you can do this in real time just as you can in Windows 7. It does tick a lot of boxes and problems have reduced considerably, freeing up my time to focus on other issues.
Garacesh Posted January 25, 2016 Posted January 25, 2016 Oh, yeah. I fully expect it's a very powerful solution to a rather large problem. But, with no rush on me to have the image working just yet, and you guys guinea pigging it for me, I see no need to implement it just yet I'm still building test beds to make sure it runs fine on all of our hardware. I reckon I've got deployment down to a T now so I'm playing with policy, OS tweaks, etc. I guess it's better put that I'm not completely disregarding Classic Shell, but since I'm in no rush, I'm willing to give Microsoft (or everyone else ) more time to devise a solution. There's other bits of W10 I can be getting on with testing, for now.
Michael Posted January 25, 2016 Posted January 25, 2016 That's certainly something else for you to try, seeing you're at the testing stage. Try updating/changing the Start Menu via a script or GPO once it's been implemented when first joined to the domain. I'd also try patching/updating Windows 10 via WSUS or manually and see if it breaks Windows with the Apps removed. I can confirm that on my 10240 image and deploying the January 2016 update via WSUS, this hasn't caused any issues and I use AppLocker along with Classic Shell of course
sparkeh Posted January 25, 2016 Posted January 25, 2016 Is there any reason why you don't just use AppLocker to block/restrict Apps instead of trying to remove them? It works well and is a lot less hassle. Also (in the networks I support), using Classic Shell, end users can't even see the Apps to click on as the Start Menu itself is replaced with something a lot more functional. Personally I think that running one powershell command on a wim is less hassle than configuring app locker with the names of the apps you want to restrict. Totally onboard with classic shell. Our students now get a menu that's built in the 'pinned apps' area of the start menu and the 'all programs' link removed. I used gpps to determine what is installed and place shortcuts accordingy. You can even make folders to group apps together. Its so easy to add a link to a newly installed app compared to the native start menu.
Garacesh Posted January 25, 2016 Posted January 25, 2016 (edited) They still show up in the Start Menu. Shouldn't do if it is the first time the account has logged on. This looks to not be the case. I just reimaged with the full image. The Applocker policy is applying. Administrator has them, as expected, since it logs in before the machine is domain joined. I login as our test account.. (that won't have touched the machine yet) All the Applocker blocked apps show up, but when you click them, the loading bar doesn't do anything. Edit: Also worth noting that the Turn off Microsoft Consumer Experience setting is enabled via GPO here. Edited January 25, 2016 by Garacesh
sparkeh Posted January 25, 2016 Posted January 25, 2016 Totally onboard with classic shell. Our students now get a menu that's built in the 'pinned apps' area of the start menu and the 'all programs' link removed. I used gpps to determine what is installed and place shortcuts accordingy. You can even make folders to group apps together. Its so easy to add a link to a newly installed app compared to the native start menu. If anyone is interested, this is a snip of one my test machines, ignore the stuff on the right of the menu, most of it is removed for production machines. What I wanted to demonstrate is the menu built from gpps using Classic Shell.
Michael Posted January 25, 2016 Posted January 25, 2016 (edited) =sparkeh;1413883]Personally I think that running one powershell command on a wim is less hassle than configuring app locker with the names of the apps you want to restrict. Each to their own I guess - but once you have a list in XML, you can easily import/export into the required GPOs via Windows 10 RSAT and takes minutes to do. I'm pleased Classic Shell's working well for you too. I totally agree it's much easier to manage when correctly setup Edited January 25, 2016 by Michael
Michael Posted January 25, 2016 Posted January 25, 2016 If anyone is interested, this is a snip of one my test machines, ignore the stuff on the right of the menu, most of it is removed for production machines. What I wanted to demonstrate is the menu built from gpps using Classic Shell. [ATTACH=CONFIG]34577[/ATTACH] Could you update the thread I started on how you did this for others to see?
sparkeh Posted January 25, 2016 Posted January 25, 2016 Could you update the thread I started on how you did this for others to see? Done: http://www.edugeek.net/forums/windows-10/163286-windows-10-start-menu-working-solution-7.html#post1413938 1
Garacesh Posted January 25, 2016 Posted January 25, 2016 (edited) Anyone had any luck getting rid of Contact Support and Windows Feedback? Preferably without Powershell? Edited January 25, 2016 by Garacesh
DJ-1701 Posted January 25, 2016 Posted January 25, 2016 Anyone had any luck getting rid of Contact Support and Windows Feedback? Preferably without Powershell? AppLocker... but seriously I know you don't want to use that. I did notice previously that renaming the ContactSupport and WindowsFeedback folders in C:\Windows\SystemApps remove this from new logins. Though I haven't tried since the November release of Windows 10.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now