Problem with allowing access to Microsoft Store

[JordanT91]

I have Windows 10 locked down pretty tight with GPOs, one of which denies access to lots of Windows Apps, including Microsoft Store. I should mention that when my image is deployed, lots of built-in features are disabled. This PC has has Microsoft Store package reinstalled.

 

On one particular PC I need to allow access to Microsoft Store as it's going to be used with an app that is available through it.

 

When I attempt to start it, I get "This app has been blocked by your system administrator". In Event Viewer, it says:

 

Unable to start a DCOM Server: Microsoft.WindowsStore_11712.1001.16.0_x64__8wekyb3d8bbwe!App as Unavailable/Unavailable. The error:"1260"Happened while starting this command:"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11712.1001.16.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca

 

 

 

I have the following policies in place:

 

Application Control - Appx Rules - Allowed all signed packaged apps, Deny Windows.ContactSupport, Deny Microsoft.MicrosoftEdge and Deny Microsoft.Windows.Cortana.

Windows Components/Store - I previously had 'Disable all apps from Windows Store' and 'Turn off the Store application' enabled, they are both now Not Configured.

 

For the PC in question, I have an enforced GPO that includes 'Disable all apps from Windows Store' and 'Turn off the Store application' as Disabled.

 

Has anyone got any ideas?

[free780]

Sounds like Applocker. Could try the Applocker powershell cmdlet that tells you which rule triggered it.

[JordanT91]

I used Test-AppLockerPolicy and it reported that all packages except Edge are allowed.

[LemonEntry]

I've never liked enforced policies... Having conflicting policies of any sort have always caused headaches. Can you exclude this PC via a security group, i.e. Set up Security Filtering for your Disable Microsoft Store GPO and include all but this one client from a new DisableStore security group?