Windows 10 - App Removal - Pre-Image

[Garacesh]

AppLocker... but seriously I know you don't want to use that. I did notice previously that renaming the ContactSupport and WindowsFeedback folders in C:\Windows\SystemApps remove this from new logins. Though I haven't tried since the November release of Windows 10.

No, but seriously, I am using AppLocker. It's a pain to have to use it, but I'd rather use Group Policy related things rather than third-party programs.

 

AppLocker is not removing shortcuts from the Start Menu. Even with network users that have never logged on before.

See my post earlier in this thread. I don't know why, it isn't. Maybe because Administrator logs in before AppLocker is applied (thus, installing the program, which adds the entry to the Start Menu database, which means it shows up for users)? But that's just a guess.

Edited January 25, 2016 by Garacesh

[DJ-1701]

No, but seriously, I am using AppLocker. It's a pain to have to use it, but I'd rather use Group Policy related things rather than third-party programs.

 

AppLocker is not removing shortcuts from the Start Menu. Even with network users that have never logged on before.

See my post earlier in this thread. I don't know why, it isn't. Maybe because Administrator logs in before AppLocker is applied (thus, installing the program, which adds the entry to the Start Menu database, which means it shows up for users)? But that's just a guess.

 

Odd... just asking, but have you made sure to set the Application Identity service to run at startup?

 

Have you tried using AppLocker post imaging? I have used the AppLocker GPO settings to disable to Apps that I don't want used, seems to work fine as long as you remember to set the Application Identity service to run at startup.

[Garacesh]

AppLocker GPO is set at the root of the W10 machines OU.

(Ignore the abundance of GPO's.. They'll be consolidated further on down the line)

 

It is definitely being applied because if I click the Support or Feedback links I get the 'Disabled by your Administrator' message. It's just annoying to have them in the start menu.

 

Application Identity is set.

 

Rules are as follows:

[b]Policy				 Setting [/b]
Enforce rules of this type	 True 

[b]Action 	User 		Name[/b]
Deny 	Everyone 	Packaged app: Microsoft.XboxIdentityProvider signed by Microsoft Corporation
Deny 	Everyone 	Microsoft.Office.Sway, version 17.6216.0.0 and above, from Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.WindowsAlarms signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.WindowsStore signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.Windows.ShellExperienceHost signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: microsoft.windowscommunicationsapps signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.Windows.ParentalControls signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.Windows.CloudExperienceHost signed by Outlook.com, Hotmail, Live.com, MSN
Deny 	Everyone 	Microsoft.BingSports, version 4.6.0.0 and above, from Microsoft Corporation
Deny 	Everyone 	Microsoft.Getstarted, version 2.3.0.0 and above, from Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.Windows.AssignedAccessLockApp signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.LockApp signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.XboxApp signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Windows.PurchaseDialog signed by Microsoft Corporation
Deny 	Everyone 	Microsoft.MicrosoftSolitaireCollection, version 3.3.0.0 and above, from Microsoft Studios
Allow 	Everyone 	Packaged app: Microsoft.WindowsMaps signed by Microsoft Corporation
Deny 	Everyone 	Microsoft.3DBuilder, version 10.9.0.0 and above, from Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.BingWeather signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.Messaging signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.AAD.BrokerPlugin signed by Assigned by your organization
Deny 	Everyone 	Packaged app: Microsoft.BioEnrollment signed by Microsoft Corporation
Deny 	Everyone 	Microsoft.People, version 10.0.0.0 and above, from Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.WindowsFeedback signed by Microsoft Corporation
Deny 	Everyone 	Microsoft.BingFinance, version 4.6.169.0 and above, from Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.XboxGameCallableUI signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Windows.ContactSupport signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.SkypeApp signed by Skype
Allow 	Everyone 	Packaged app: Microsoft.Windows.Cortana signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.Office.OneNote signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.ConnectivityStore signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Windows.MiracastView signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.AccountsControl signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.MicrosoftEdge signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Windows.PrintDialog signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: windows.devicesflow signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.ZuneVideo signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.WindowsSoundRecorder signed by Microsoft Corporation
Deny 	Everyone 	Microsoft.CommsPhone, version 1.10.0.0 and above, from Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.People signed by Microsoft Corporation
Deny 	Everyone 	Microsoft.Appconnector, version 1.3.0.0 and above, from Microsoft Corporation
Deny 	Everyone 	Microsoft.MicrosoftOfficeHub, version 17.6306.0.0 and above, from Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.WindowsPhone signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.Windows.SecondaryTileExperience signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.Windows.ContentDeliveryManager signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.ZuneMusic signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.WindowsCamera signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.BingNews signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: windows.immersivecontrolpanel signed by Microsoft Corporation
Allow 	Everyone 	Packaged app: Microsoft.WindowsCalculator signed by Microsoft Corporation
Deny 	Everyone 	Packaged app: Microsoft.Windows.Photos signed by Microsoft Corporation

 

Seeing anything wrong there? Looks fine, to me, but I might have missed something.

[DJ-1701]

Looks perfect

Perplexed DJ is perplexed...

[Michael]

The App Identity service can require 2/3 reboots before it becomes properly active in my experience.