Disabling a few things

[angrycomputingteacher]

This summer we are upgrading all of our computers in the school to Win 10. But whilst testing this out, I noticed quite a few things that need locked down like:

Settings, Tiles, Store etc. But how can I lock down things like that in a registry edit. Not a Group Policy. Thanks

[Liam]

Why not group policy. Your best best is yo search for this on Google eg disable store win 10 registry

[sted]

for a lot of it the simplest way is applocker. There is a gpo for store access but it no longer works on 1511 and above same as the block onedrive gpo (i stopped the sync client installing by denying users read access to the installer lol)

[3s-gtech]

AFAIK some of those features (such as the Settings app) can only be blocked by Applocker at present. There may be registry hacks, but that would be a proper bodge.

[Arthur]

https://deploymentbunny.com/2016/07/12/osd-customizing-images-and-deployment-think-about-that-for-a-second/

[angrycomputingteacher]

I don't have Windows server. That's why I need regular edits. I just have everything locked down on individual pcs and they map drives to file nasty with software there too. So I don't have GP. I just need a registry edit that I can use for the image.

[jmak]

I don't have Windows server. That's why I need regular edits. I just have everything locked down on individual pcs and they map drives to file nasty with software there too. So I don't have GP. I just need a registry edit that I can use for the image.

It might be worth looking at this thread:

 

http://www.edugeek.net/showthread.php?t=171158

 

MS have provided a new way for schools to deploy Windows builds specifically for computers not on a domain.

 

You should be able to use the local group policy console to control the same settings as would be available on group policy deployed from a server.

 

Long story short, you build a computer using their tool, take a copy of the settings on a USB (again using the MS tool) and then use the USB to copy the settings to as many other computers as you need. You can make more than one copy of the USB to speed the process up.

 

I haven't looked in detail as my computer's are on a domain, so it doesn't apply here.

[pete]

for a lot of it the simplest way is applocker. There is a gpo for store access but it no longer works on 1511 and above same as the block onedrive gpo (i stopped the sync client installing by denying users read access to the installer lol)

 

Even after applying the 1511 .admx files from here: https://www.microsoft.com/en-us/download/details.aspx?id=48257&WT.mc_id=rss_alldownloads_all ?

 

Honest question, poking around with a 1511 Win10 build and there appeared to be a new windowsstore.admx included.

 

Edit: I'm using Win10 Enterprise for my testing.

Edited July 12, 2016 by pete

[sted]

Even after applying the 1511 .admx files from here: https://www.microsoft.com/en-us/download/details.aspx?id=48257&WT.mc_id=rss_alldownloads_all ?

 

Honest question, poking around with a 1511 Win10 build and there appeared to be a new windowsstore.admx included.

 

Edit: I'm using Win10 Enterprise for my testing.

yes the settings are there they just dont apply and from what i saw at the time that is by design ms dont want the store/one drive disabling

[pete]

yes the settings are there they just dont apply and from what i saw at the time that is by design ms dont want the store/one drive disabling

 

I've just poked around a bit more and the policy settings are currently working for me deployed as a computer policy. This is using the windowstore.admx dated 14/11/2015 in a standard Central Store (\\domain\sysvol\domain\policies\PolicyDefinitions) setup. See attached:

 

 

That's Windows 10 enterprise 1511 using a test machine with a computer configuration GPO at the closest OU level and it appears to be working for me™.

 

 

The settings are a bit inconsistent because we're doing the "what Store apps do we want to keep, if any?" discussion and how blocking the store affects updating said apps etc.

Edited July 12, 2016 by pete

[angrycomputingteacher]

Is applocker only for win server or is it in win Pro?

[3s-gtech]

Works on Enterprise or Education clients only.

[angrycomputingteacher]

Ah, I don't have that. Just Pro with machines connected via workgroup. I always rather registry edits.

[Garacesh]

Registry edits are setting yourself up for a whole world of pain, simple things like updates can change where relevant registry settings are stored and break all sorts. Plus, half the edits you'll want probably exist in HKCU rather than HKLM. Edited July 13, 2016 by Garacesh

[angrycomputingteacher]

Registry edits are setting yourself up for a whole world of pain, simple things like updates can change where relevant registry settings are stored and break all sorts. Plus, half the edits you'll want probably exist in HKCU rather than HKLM.

 

We don't have the money for servers just individual workstations. Everytime I make a registry edit I create a file that can also from run, can execute the edit.

[Garacesh]

Do you have a server you could host a share on? Or even just a workstation that's left on all the time? You could use gpedit.msc to set local policy on one of the machines, then copy the folders from %systemroot%\system32\grouppolicy to a share, and use a ROBOCOPY startup script to sync the folders up (apparently, copying those files from one workstation to another works). If you're using Win10Pro, this might be a better option, the only difference in policy AFAIK is you can't disable the Store on Pro.

[angrycomputingteacher]

Do you have a server you could host a share on? Or even just a workstation that's left on all the time? You could use gpedit.msc to set local policy on one of the machines, then copy the folders from %systemroot%\system32\grouppolicy to a share, and use a ROBOCOPY startup script to sync the folders up (apparently, copying those files from one workstation to another works). If you're using Win10Pro, this might be a better option, the only difference in policy AFAIK is you can't disable the Store on Pro.

 

I'll think about it but I would still rather a registry edit.

[sted]

We don't have the money for servers just individual workstations. Everytime I make a registry edit I create a file that can also from run, can execute the edit.

 

if its just for policy and maybe a bit of file storage get a cheap hp microserver and shove windows server essentials on there it shouldnt cost that much and just for authentication/policies you dont need a huge server esp with few pcs