[1709, fcu] Stopping Apps with Windows Store in Group Policy

[speckytecky]

New to deploying W10 in a school domain and I'm trying to restrict the likes of X-Box running. I've seen and tried the very helpful suggestions elsewhere on this Forum about using Powershell and scripts to remove the Apps but haven't had a lot of success doing that. I saw on another Forum a post saying using:

 

'Computer Configuration\Policies\Administrative Templates\Windows Components\Store

 

1. Disable all apps from Windows Store - This turns off the launch of all apps from the Windows Store that came pre-installed or were downloaded. Apps will not be updated.

2. Turn off the Store application - If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates.'

 

would achieve the lock-down.

 

I duly pasted that admx file into our Policy folder but when I subsequently tried editing the Group Policy an Administrative Template Warning box popped up telling me that Encountered an error whilst parsing. Resource '$(string.RequirePrivateStoreOnly)' referenced in attribute displayName could not be found.

 

Subsequently, I restored the original Store ADMX template in the Policy Store and now Group Policy seems happy again.

 

Any thoughts please on if using the lock down described above would actually stop the students using X-Box etc.? and why would the 1709 version of the Store ADMX template create the error it did?

Edited November 29, 2017 by speckytecky

[ADMaster]

I've had the store blocked for several versions, so I don't think that is just a 1709 thing. Try installing the full set up 1709 templates.

 

What errors did you get when trying to remove the apps?

When do you try to remove them? I've found during OSD is best, after the fact gives mixed results.

 

To answer the question though.

If you are running ent/edu sku applocker will be able to block these store apps.

[speckytecky]

Thank you @ADMaster

 

I've got a mix of machines that I've in place upgraded to 1709 plus out of the box Dell laptops pre-installed with W10 Pro.

 

It's not really an error thing but trying to achieve a global lock-down on all of them with the least input. Using the excellent script files provided on Edugeek works for my own login on single machines but then logging on as a student the X-box etc remains in place.

 

We tried globally inserting a previous set of ADMX templates but reverted them as the whole lot sitting in the Policy folder seemed to be creating slow logins.

 

I've not tried SCSCM - maybe I need to man up and get my head around it?

 

I've had the store blocked for several versions, so I don't think that is just a 1709 thing. Try installing the full set up 1709 templates.

 

What errors did you get when trying to remove the apps?

When do you try to remove them? I've found during OSD is best, after the fact gives mixed results.

 

To answer the question though.

If you are running ent/edu sku applocker will be able to block these store apps.

[KK20]

There are many ways you can do this and it depends where you are starting from and what you want to do.

 

Firstly, if you don't care that the start menu has the icons for all the apps and simply want to stop them opening, use applocker *and* a GPO to stop the store (otherwise there are ways around the applocker block for the store). This will not remove start menu items, it will not remove them from your installation but will stop the apps from opening. Applocker can be customised to let certain apps through for certain usergroups too (such as paint, calculator etc)

 

If you are at "below" 1703, currently have the apps unprovisioned and uninstalled then be aware that 1703/1709 will put them back. This means you need to use a %systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini to spawn your powershell removal script following a WSUS feature update. This works well and ensures you still have the same unprovisioned and uninstalled appx

 

If you have no W10 installed or are planning a fresh install then depending on how you install you can run the powershell in OOBE setupcomlete.cmd etc

 

1709 has changed the name of some APPX - for example, the "connect" is no longer miracast but is PPIProjection, XBOX has ballooned to a few entries too. Windows.Holographic.FirstRun is the mixed reality.

[ADMaster]

Cool I've never seen that setupconfig.ini may have to look into that, but I use SCCM not really relevant.

 

In my testing in the past, if the script was run on a machine with existing users it would not effect them, but would effect new users of the machine.

 

I'd never deploy something out of the box anyway too much bloat, I'd do a fresh image.

The in place upgrade can be addressed with SCCM as we have talked about before.

 

I'll have to spin up a WDS / MDT lab to see how it compares to SCCM.

[KK20]

How to run a post script after a Windows 10 feature upgrade with SetupConfig.ini - Jose Espitia was what put me onto the setupconfig.ini Great for running scripts post-WSUS feature updates.

 

Get-AppxPackage -Name $app -AllUsers | Remove-AppxPackage will remove for users that already exist on the machine.

Get-AppXProvisionedPackage -Online | where DisplayName -EQ $app | Remove-AppxProvisionedPackage -Online will remove from the system for future users.

[ADMaster]

I setup a lab today with MDT and my app removal script worked as it should.

I've not tested any of my other customizations.

 

I'm not sure if you have said, what are you using for imaging?

[speckytecky]

Thanks, @ADMaster sadly I'm not Imaging currently - it's not in my current skill set but something I'd love to master. Server 2012 Domain so hopefully achievable?

[KK20]

MDT is available to all in a domain environment. It is quite a simple setup to get going. I suggest spooling a few virtual machines as test-beds.

 

https://docs.microsoft.com/en-us/windows/deployment/windows-10-poc-mdt

https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt

 

I use snappydriver-origin, it is a nice lazy way to get drivers sorted.

Edited December 1, 2017 by KK20