[1703, cu] AppLocker - Lock, log Off, Shutdown etc not working

[robyholmes]

I'm trying to setup some exam accounts to be used on our Windows 10 1703 Image. I'm using AppLocker to limit the apps running and managed to get the start menu working by allowing a modern app (UserShell). However the log off, lock button and the shutdown, sleep, restart button doesn't work. You click on it and nothing opens. I've tried looking through the AppLocker log but can't spot what it is. Anyone else found this?

[Duke5A]

I remember having a similar problem when building a Win10 Pro image last year where after messing with App Locker policies the start menu was no longer working correctly. My memory is hazy, but after making these changes to the policy it started working again:

 

 

Ended up denying access to the store and the new control panel and allowing all other signed apps.

[robyholmes]

Your right with the 'Immersivecontrolpanel'. Would you believe it, the log off and shutdown menu on the start menu is the settings app! So as we don't want them playing with settings during an exam we've kept it blocked and we'll show the invigilators how to use Ctrl+Alt+Del to log off.

[Arthur]

So as we don't want them playing with settings during an exam we've kept it blocked and we'll show the invigilators how to use Ctrl+Alt+Del to log off.

A better solution IMO would be to block the Store and restrict what is shown in the Settings app using Group Policy. Then you'll be able to remove the AppLocker policy that's breaking things and log off properly!

 

• Turn off the Store application
  
• Only display the private store within the Windows store app
  
• Settings Page Visibility
  

See also:

• www.edugeek.net/forums/windows-10/182357-hide-settings-settings-app-new-feature-1703-a.html
  
• https://docs.microsoft.com/en-us/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference
  

[robyholmes]

A better solution IMO would be to block the Store and restrict what is shown in the Settings app using Group Policy. Then you'll be able to remove the AppLocker policy that's breaking things and log off properly!

 

We do restrict what's shown in settings via the group policy setting but its machine based. So once you remove some things normal staff or student accounts can't get to them. As students don't log off anyway during an exam (Get up and leave). Its not a huge problem. Store is already restricted by group policy and AppLocker as we're not currently using it.

[Duke5A]

Last I knew there wasn't any GPO control of what is displayed in the Settings App. My info might be out of date though...

[Arthur]

Last I knew there wasn't any GPO control of what is displayed in the Settings App. My info might be out of date though...

There is from v1703 onwards, but it's currently a per-machine setting when using Group Policy. With InTune it's a per-user setting.

 

www.edugeek.net/forums/windows-10/182357-hide-settings-settings-app-new-feature-1703-a.html