SCCM Task Sequence vs. Removing Windows Store

[Gongalong]

Hi folks,

 

To-date we use a PowerShell command at the end of our task sequence to remove a number of apps from our Win 10 deployment.

 

We have always removed Windows Store, but also have group policy settings to deny access to students.

 

Does anyone leave Windows Store in place, and has it caused issues with student access? Is group policy trustworthy enough to prevent access?

 

Thanks

[georgeescott]

We keep Windows Store installed as you need it to keep the store apps up to date.

 

We restrict it to our private store with the ‘Only display the private store within the Microsoft Store’ GPO setting. Has worked without issues for us.

[Guest Guest]

We keep it installed. It's blocked via AppLocker though

[slugshead]

Keep the store, you need it for random things like the calculator or hte whiteboard app to work.

 

Don't do the appx remove package thing, just block access in Applocker to each app.

 

what I did was setup the store for business too and only approve things like the whiteboard and onenote. If anyone gets in there, all they can do is install those two apps.

[CHiLL]

It's recommended to keep the store in Windows, as it's quite integral to some built-in apps, plus as others said, it's required to keep the store apps up to date. It's also required if you need to push out any future store apps, like the Minecraft Education, etc. You can use AppLocker to prevent users from then accessing the store itself.

[Garacesh]

We keep Windows Store installed as you need it to keep the store apps up to date.

 

We restrict it to our private store with the ‘Only display the private store within the Microsoft Store’ GPO setting. Has worked without issues for us.

 

Yup, this too.

Our store only has, I think, one app in it, which is MS Whiteboard (Smartboard? Something with board in the name..)

 

You want to keep it in there, and just hide it as best you can if you're not using it.

[Gongalong]

Thanks all. I've not used Applocker in anger yet, but sounds like it might be worth investigating. Of all the apps we remove it's probably only Solitaire that's a timewaster. I was super wary back in the early Win 10 days of students installing apps from the store.

[CHiLL]

I don't bother removing any apps now, just use AppLocker to block access to them. The main snag is that they are still visible in the Start Menu, though the user is shown a block message if they try and open the app.

[Garacesh]

Thanks all. I've not used Applocker in anger yet, but sounds like it might be worth investigating. Of all the apps we remove it's probably only Solitaire that's a timewaster. I was super wary back in the early Win 10 days of students installing apps from the store.

 

And also that IIRC removing Solitaire broke W10 something awful in the early builds lol. Though it's been safe to remove it for a while, now.

[Gongalong]

And also that IIRC removing Solitaire broke W10 something awful in the early builds lol. Though it's been safe to remove it for a while, now.

We've been removing it from day one without issue. Odd! I'm not sure I can get that fussed about Solitaire now. If the teachers aren't supervising a class well enough to spot that then there's no hope, although could always applocker it.

[Bugzi]

We use a combination of removing some built-in win 10 apps during the task sequence with AppLocker to block apps like the feedback one.

We also have the Microsoft Store for Education setup which staff can use.

The link to the store is only in the start menu as we customise the taskbar to hide it from there.

[Gongalong]

Out of interest, what do you remove in the task sequence?

 

We currently have two Command Line steps, one to remove from new accounts, and a second to remove from existing accounts (which has always worked... so far!). Current code for the new accounts step below:

 

powershell -ExecutionPolicy Bypass -Command "Get-AppXPackage -allusers | Where-Object -Property PackageName -Match '(3dbuilder|3dviewer|wallet|MicrosoftOfficeHub|XboxGameCallableUI|XboxSpeechToTextOverlay|MicrosoftStickyNotes|BingWeather|Print3D|XboxApp|ZuneMusic|ZuneVideo|WindowsMaps|WindowsFeedbackHub|WindowsAlarms|SkypeApp|People|StorePurchaseApp|Getstarted|WindowsStore|MicrosoftSolitaireCollection|windowscommunicationsapps|Cortana|Messaging|GetHelp|WindowsSoundRecorder|MiracastView|MixedReality|OneConnect|YourPhone)' | Remove-AppXPackage"

[Garacesh]

Out of interest, what do you remove in the task sequence?

My current script is:

 

# Windows 10 Default App Removal Script
# App list retrieved from a vanilla install of Edu 21H2
#                (Get-AppXPackage).Name | Sort
#                (Get-AppXProvisionedPackage -Online).DisplayName | Sort

# Commented app ID's will not be removed

$apps=@(
# "1527c705-839a-4832-9118-54d4Bd6a0c89" - File Picker
# "c5e2524a-ea46-4f67-841f-6a9465d9d515" - File Explorer
# "E2A4F912-2574-4A75-9BB0-0D023378592B" - App Resolver UX
# "F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE" - Add Suggested Folders to Library
"Microsoft.549981C3F5F10" # Cortana
# "Microsoft.AAD.BrokerPlugin"
# "Microsoft.AccountsControl"
# "Microsoft.AsyncTextService"
"Microsoft.BingWeather"
# "Microsoft.BioEnrollment" - Cannot be removed
# "Microsoft.CredDialogHost" - Cannot be removed, part of Hello UI Setup
# "Microsoft.DesktopAppInstaller" - Cannot be removed
# "Microsoft.ECApp" - Cannot be removed, part of Hello UI Setup
"Microsoft.GetHelp" # Help and Feedback
"Microsoft.Getstarted" # Microsoft Tips
# "Microsoft.HEIFImageExtension"
# "Microsoft.LockApp"
"Microsoft.Microsoft3DViewer"
# "Microsoft.MicrosoftEdge"
# "Microsoft.MicrosoftEdge.Stable"
# "Microsoft.MicrosoftEdgeDevToolsClient" - Cannot be removed
"Microsoft.MicrosoftOfficeHub" # Preinstalled 'Get MS Office' app
"Microsoft.MicrosoftSolitaireCollection" # Solitaire game
# "Microsoft.MicrosoftStickyNotes"
"Microsoft.MixedReality.Portal"
# "Microsoft.MSPaint"
# "Microsoft.NET.Native.Framework.1.7"
# "Microsoft.NET.Native.Framework.2.2"
# "Microsoft.NET.Native.Runtime.1.7"
# "Microsoft.NET.Native.Runtime.2.2"
"Microsoft.Office.OneNote" # Preinstalled OneNote
"Microsoft.People"
# "Microsoft.ScreenSketch" # New Snip & Sketch app, replaces Snipping Tool
"Microsoft.SkypeApp" # Preinstalled Skype
# "Microsoft.StorePurchaseApp" # Required for Windows Store functionality
# "Microsoft.UI.Xaml.2.0"
# "Microsoft.VCLibs.140.00"
# "Microsoft.VCLibs.140.00.UWPDesktop"
# "Microsoft.VP9VideoExtensions"
# "Microsoft.Wallet" - Required for Windows Store function
# "Microsoft.WebMediaExtensions"
# "Microsoft.WebpImageExtension"
# "Microsoft.Win32WebViewHost"
# "Microsoft.Windows.Apprep.ChxApp"
# "Microsoft.Windows.AssignedAccessLockApp"
# "Microsoft.Windows.CallingShellApp" - Cannot be removed
# "Microsoft.Windows.CapturePicker"
# "Microsoft.Windows.CloudExperienceHost"
# "Microsoft.Windows.ContentDeliveryManager"
# "Microsoft.Windows.NarratorQuickStart"
# "Microsoft.Windows.OOBENetworkCaptivePortal" - Cannot be removed
# "Microsoft.Windows.OOBENetworkConnectionFlow" - Cannot be removed
# "Microsoft.Windows.ParentalControls" - Cannot be removed
# "Microsoft.Windows.PeopleExperienceHost" - Cannot be removed
# "Microsoft.Windows.Photos"
# "Microsoft.Windows.PinningConfirmationDialog" - Cannot be removed
# "Microsoft.Windows.Search"
# "Microsoft.Windows.SecHealthUI"
# "Microsoft.Windows.SecureAssessmentBrowser"
# "Microsoft.Windows.ShellExperienceHost"
# "Microsoft.Windows.StartMenuExperienceHost"
# "Microsoft.Windows.XGpuEjectDialog"
"Microsoft.WindowsAlarms"
# "Microsoft.WindowsCalculator"
# "Microsoft.WindowsCamera"
"microsoft.windowscommunicationsapps"
"Microsoft.WindowsFeedbackHub"
"Microsoft.WindowsMaps"
# "Microsoft.WindowsSoundRecorder"
# "Microsoft.WindowsStore"
"Microsoft.Xbox.TCUI"
"Microsoft.XboxApp"
# "Microsoft.XboxGameCallableUI" - Cannot be removed
"Microsoft.XboxGameOverlay"
"Microsoft.XboxGamingOverlay"
"Microsoft.XboxIdentityProvider"
"Microsoft.XboxSpeechToTextOverlay"
"Microsoft.YourPhone"
"Microsoft.ZuneMusic"
"Microsoft.ZuneVideo"
# "MicrosoftWindows.Client.CBS" - Cannot be removed
# "MicrosoftWindows.UndockedDevKit" - Cannot be removed
   # "NcsiUwpApp" - Network Connectivity Status Indicator Universal Windows Platform App
   # "Windows.CBSPreview" - Cannot be removed. Part of Windows Feedback
   # "windows.immersivecontrolpanel"
   # "Windows.PrintDialog"
"Microsoft.Advertising.Xaml" # Microsoft.BingWeather and microsoft.windowscommunicationsapps  dependency prevents removal, last in list to compensate.
)

foreach ($app in $apps) {    
Write-Output $app
Get-AppxPackage -Name $app -AllUsers -ErrorAction Continue | Remove-AppxPackage -ErrorAction Continue
Get-AppXProvisionedPackage -Online | where DisplayName -EQ $app -ErrorAction Continue | Remove-AppxProvisionedPackage -Online -ErrorAction Continue

$appPath="$Env:LOCALAPPDATA\Packages\$app*"
Remove-Item $appPath -Recurse -Force -ErrorAction Continue
}

 

Edit: Oops, originally it said # App list retrieved from a vanilla install of Edu 20H2 but it's not, it's from 21H2

Edited July 7, 2022 by Garacesh