[20H2] Removing driver apps links from a redirected start menu

[Garacesh]

I'm in the middle of testing a 20H2 build for rollout over the Summer, but these driver apps seem to appear of their own volition (I assume Windows Updates) and I can't find a way of removing them.

• HP Audio Control
  
• HP System Event Utility
  
• Intel Graphics Command Center
  
• Synaptics Touchpad
  

Though no doubt we'll have other ones on other machines with different hardware/driver combos.

 

Redirecting the start menu the regular way, via User Configuration / Policies / Windows Settings / Folder Redirection

User Configuration / Policies / Administrative Templates / Start Menu and Taskbar / Remove common program groups from Start Menu is set to Enabled, and gpresult confirms it's being applied

There's no shortcut to these in %PROGRAMDATA%\Microsoft\Windows\Start Menu, and even if there were, the previous GPO should take care of that.

 

I'm not seeing any other GPO's that might apply to these apps, but for obvious reasons, allowing kids to access the graphics settings or touchpad is a terrible idea.

The touchpad app straight-up has a 'disable' button there which requires no administrative permissions to use

 

Edit: I'm wondering if 'run test builds on all hardware, figure out the appx id's, remove them in the task sequence' is my only solution here?

Edited July 8, 2021 by Garacesh

[BOOT]

You can de-provision them via Remove-AppxProvisionedPackage and\or block them with AppLocker.

[Garacesh]

Hmm.. Trying to block them with AppLocker and it (Applocker itself) just doesn't seem to be working..

I've confirmed via gpresult that the user has no SRP applied to it, and the computer does have the AppLocker policy applied, but.. nada.

Application Identity service is enabled and running.

 

Is there something wrong with my policies?

Does an Allow take precedence over a Deny?

Am I using wildcards wrong?

 

[3s-gtech]

Hmmm. I've found odd behaviour with using system paths. Can you add a duplicate entry with the absolute path too? You may also be able to change the ACLs for the exe and Deny Read and Execute for your student group.

[Garacesh]

Nope, duplicating the variable paths with explicit paths doesn't work either.

 

It just doesn't seem to be actually doing anything, despite GPResult saying the policy is applied.

 

For example, I've changed C:\Users\*\AppData\* to C:\Users\* (I'm pretty sure C:\Users\*\AppData\* is acceptable, but anyway, just to be safe..)

If I make a copy of calc.exe and dump it into my test staff's %LOCALAPPDATA%, I can execute it, despite the C:\Users\* block.

Same applies if I copy a non-UWP app, such as a portable copy of KeePass 2

 

Edit: The only thing I've ever known to bugger up AppLocker is if a PC has AppLocker set and a user has Software Restriction Policy set, but I've confirmed this user has no SRP.

Edited July 12, 2021 by Garacesh

[Garacesh]

I think I've figured it out..

 

Level: Warning

Date and Time: 12/07/2021 14:46:52

Source: AppLocker

Event ID: 8008

Task Category: None

Event Details: appidsvc.dll: AppLocker component not available on this SKU.

 

Wait.. Surely it can't be...?

 

WinVer shows me as using Windows 10 Pro Education.

 

There's apparently 2 flavours of Edu now. And I was applying the J447Y key instead of the VCFB2 one.

WTH, Microsoft?

Edited July 12, 2021 by Garacesh

[3s-gtech]

Oh no, you're using Pro? Why on Earth they split that SKU I don't know - I guess it's to do with the licensing model for regular Edu.

[Garacesh]

Oh no, you're using Pro? Why on Earth they split that SKU I don't know - I guess it's to do with the licensing model for regular Edu.

 

Yeah.. I must've grabbed the wrong KMS Client Setup key by accident. DUURRR.

My TS was applying the right image (Edu, not Pro Edu), but I had the Pro Edu key in the Apply Windows Settings step.

[3s-gtech]

Do you need it in your TS? It’s blank in any of mine - they use the KMS key and activate when they are joined to AD.

[Garacesh]

I dunno, do you not?

I was under the impression that you needed to feed it a GVLK so that it knew to look for KMS/ADBA, else it would just sit there crying it wasn't genuine...

[Steve21]

I dunno, do you not?

I was under the impression that you needed to feed it a GVLK so that it knew to look for KMS/ADBA, else it would just sit there crying it wasn't genuine...

 

The GVLKs are built into the default WIMs on VL images (not sure about others), so generally unless you want a specific version etc can ignore them and they'll just default to checking for a KMS/AD server etc

 

Steve