[1809, ou] Block store apps from running,

[chazzy2501]

I'm running Win10 Education (the enterprise version) I have a set of laptops I wan't the store and its apps disabled on. I've set the "Computer Configuration > Administrative Templates > Windows Components > Store" disable the store and apps unfortunately the store is disabled but the apps still work.

 

are these appx programs not considered store apps? (I've tried app locker but it keeps crashing when I use it)

 

I want to disable the windows remote desktop (NOT mstsc, but the appx version with the same name) and windows mail specifically.

[CHiLL]

That GPO setting will only prevent the Store from launching, AppX packages are dealt with separately.

 

My GPO for the store is configured as:

Computer Configuration > Policies > Administrative Templates > Windows Components > Store > Disable all apps from the Microsoft Store: Enabled

Computer Configuration > Policies > Administrative Templates > Windows Components > Store > Turn off the offer to update to the latest version of Windows: Enabled

Computer Configuration > Policies > Administrative Templates > Windows Components > Store > Turn off the Store application: Enabled

 

For disabling AppX packages, I've disabled all but the essential ones. I can allow specific ones if necessary in the future. I automatically generated a list of AppX packages from my test workstation that had the same version of Windows that these restrictions will be enforced against (because different versions of Windows have more/less/different versions of the AppX packages). To do this;

 

1) Create a GPO and naviagte to: Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker > Packaged app Rules

2) Right click Packaged app Rules and select 'Automatically Generate Rules...'

3) Complete the wizard, using the user or security group you wish to deny access to and select Deny as the action (you can select all or specific packages from the list)

4) Once the rules appear in the list, they should all be marked as Deny against your selected user/group

5) Important #1 - Ensure the Start Menu works: You change the encry for Microsoft.Windows.Cortana to Allow, otherwise the Start Menu won't work.

6) Important #2 - Allow others to use AppX Packages: I found that I needed to create a new custom rule to allow everyone to run AppX packages, otherwise it would block it for staff and admins, despite it only being targetted to your specified user/goup. (Action: Allow, User: Everyone, Name: *)

 

When a user in the Deny group attempts to launch a Denied AppX package, they're presented with a blue diaglogue box stating that they cannot run as it has been prevented by the administrator.

 

Note: I've noticed that our students will be automatically presented with the dialogue box, even though they haven't done anything to trigger it. It appears that the Xbox Gaming Overlay (Microsoft.XboxGamingOverlay) is the culprit and has some form of auto-trigger that I can't find. I'm still working on that.

Edited September 24, 2019 by CHiLL

[chazzy2501]

Yeap, I had the first 3 checked, my current issue is with applocker, under no login on any PC can I get the AppLocker to open as the MMC crashes, when I tell it to list installed packaged app as reference it crashes. tried 2 servers and 2 accounts?

[mrcrazy04]

That seems weird, I haven’t encountered that before. It shouldn’t matter when configuring the policy, but to be sure, is the AppLocker service running?

 

Also, what version of Windows 10 are you running?

[chazzy2501]

I have this running now, I upgraded my windows from 1803 to 1903 and installed the RATS stuff from the software on demand instead.