Microsoft Store install for all users

[mobrien]

Hi,

Like many in these forums we are slowly managing to beat our Windows 10 deployment into something manageable, with a few bumps along the way.

 

The latest issue is the way Microsoft Store apps behave when a user first logs into a device. Specifically, if user1 logs into a device, they must visit the Microsoft Store and download our organisation owned apps. Equally, user2 on the same device must follow the same steps. The apps are installed but not available to users.

 

Details as follows:

- We use MDT to collect a sysprepped, prebuilt image in which the Store apps we want are installed (OneNote, Whiteboard, IPEVO etc.). The file-bundles for each of the apps are correctly located in C:\Program Files\WindowsApps as expected.

- These apps are part of our xml start menu as described in other threads.

- When a user first logs into a device, the apps tiles are dumb placeholders that have no effect at all.

- Visiting the store to install the app works correctly, and the app tiles then display their correct icon and name.

 

The issue is that for our 200 staff and 1800 students this process is not sustainable, particularly as users roam around multiple devices all week.

 

Question

Is it possible to develop a runonce script that will install/make available the list of apps that we need when a user first logs in?

Please bear in mind that my scripting knowledge is limited...

 

Hope you can help. Thanks in advance.

[sted]

i dont think you can because appx's install in the users profile rather than program files though i believe if user a has it instlled and updates it the pc will install it from there rather than redownload

[rosslaing]

SCCM can install/provision store apps to the machine, which will then install into all users profiles. So it is possible and i would imagine you can do it other ways.

 

From what I can remember, you can use DISM or powershell to do this, and it is just a case of actually getting a hold of the files required, which is only possible if the apps in the store allow it tbf its the same for SCCM.

Edited May 8, 2019 by rosslaing

[free780]

As @rosslaing said you need SCCM and the store setup and your users syncd to AzureAD. Also your PCs need to be hybrid joined ideally comanaged. If you push out via intune it doesn't trigger policy on login. The UWP model was developed with 1:1 devices in mind where users install apps they need.

[mobrien]

OK, that's a shame, but it matches everything that I have read about the store apps.

 

It's going to be a bumpy ride expecting all our students to manage their own apps. And staff - not a hope!

 

Good, this Windows 10 malarkey is!

[DavR]

I've done this our end with PowerShell, it's a bit of a hack, but it can be done.

 

Ideally, you'd want to inject your apps into your WIM build before deployment using DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/preinstall-apps-using-dism

 

If you're adding the apps post-install into a live environment, you'll need to have one script run on PCs using the Add-AppxProvisionedPackage command to provision the package, and then you may need another script to run at user login to install that app per user, using the Add-AppxPackage command.

[mobrien]

OK, this sounds promising.

 

During the script we use to remove some of the Windows bloatware when preparing an image we run the following lines for Whiteboard and Sway:

 

Get-AppxPackage -allusers Microsoft.Whiteboard | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

Get-AppxPackage -allusers Microsoft.Office.Sway | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

 

Do we need to change this for an Add-AppxProvisionedPackage command as you suggest?

 

Would you be able to share the syntax we should be using? This would be really helpful. Thanks in advance!

[DavR]

Yes, Add-AppxPackage only works on a per user basis. If you want to add a new package for all users, you need to provision the package using Add-AppxProvisionPackage. This will install the app for all users, and when a user first logs on it will (should) install it for them.

 

You also have to have the correct offline installer from Microsoft Store for Business.

 

The line I've used in the past is as follows. Edit locations and file strings as appropriate!

 

Add-AppxProvisionedPackage -Online -PackagePath "$PSScriptRoot\Microsoft.Office.OneNote_16001.11126.20076.0_neutral___8wekyb3d8bbwe.AppxBundle" –LicensePath "$PSScriptRoot\Microsoft.Office.OneNote_8wekyb3d8bbwe_e336bb8f-16ed-7cbe-afee-971dd3041585.xml"

[DavR]

I will say though, I have had mixed experiences with that method, I don't use it in production any more. Existing installations I've retro-fitted apps with that string, new installations I've injected the necessary apps into my Windows 10 image.

[mobrien]

Well, that solved it!

 

We added the AppxProvisionedPackage lines into a powershell script that runs during the build, and, once we figured out how to get hold of the bundles we were away! Hooray! Many thanks @DaveAshworth.

 

For those interested, whilst we are sure there are much cleaner ways to achieve the same, we collect an image with all software preinstalled into MDT. When we build a client, the AppxBundle files are copied onto the client device, and a script runs to remove all the bloatware, unpin the start apps, and then install the AppxProvisionedBundles as mentioned previously - works a treat now!

 

This marks the end of a 9 month saga trying to beat Windows 10 into submission. Just in time for 1903...

[DavR]

Great news @mobrien, happy to have helped. It is a bit confusing the difference between apps and provisioned apps, some might say unnecessarily so.

 

Interesting that you've chosen to embed the software into your image, but then deal with the appx stuff as a script in the task sequence - we did ours the other way round. But, whatever is working for you

 

Windows 10 does seem to have required a lot more beating, and cajoling, to do what Edu admins want than I remember Windows 7 needing. Could just be rose tinted specs for the past though.

[mavhc]

MS really really want you to pay for intune and azure and not buy windows servers.

[free780]

It gets very interesting when other software starts to hook into AzureAD. For licensing it may move to per user.

[DavR]

Yeah, we've already got Minecraft Education licensed through Azure AD. We're gaming it with User01, User02 etc at the moment, but if we ever had to implement that for core apps, it would be a nightmare. Not so bad if we went full Azure and abandoned local AD I suppose, but that's a paradigm shift from where we are currently.

[free780]

Read Write Gold licences via AzureAD or Gsuite. Adobe now require it for 2019 versions onwards.

[tech-man]

Great... great and great