Using Applocker to Block Microsoft Store

[Gongalong]

Hi folks,

 

I've found plenty of guides for how to block the Microsoft Store on a specific PC with applocker, but I want to block it via GP on the domain controller. The guides I've seen want you to pick it from the installed list of apps, and of course it's not an installed app.

 

What method should I use to block the Store in this case?

 

Thanks

[georgeescott]

You can install the Remote Server Administration Tools (RSAT) on your computer https://www.prajwaldesai.com/install-rsat-tools-on-windows-10-version-1809/.

 

Manage group policy from there without needing to log in to a DC.

[Gongalong]

Thanks!

[slugshead]

Don't block the MS store. Whilst you still can, just set up the store for business and don't approve anything, or just what you need, onenote, whiteboard etc.

 

The store app is required for lots of the builtin things to update. Calculator, whiteboard etc...

 

Use applocker to restrict access to the appx packages rather than remove them too

[jthompson]

In general, if you're wanting to add AppLocker rules for packaged apps such as the MS Store app but those apps aren't present on the machine that you're working Group Policy Editor from, you can go through the motions of creating such a rule on a client machine using secpol.msc (Local Security Policy). At the point where you've selected the packaged app and the various publisher and package fields for it have been populated, you can copy and paste those values out so that you can paste them into Group Policy Editor. In GPEdit you will need to pick some other packaged app first, so that you can to get to a point where you can paste in the desired values.

[CHiLL]

I believe the store apps are all the same across Windows builds (incl workstation and server), you should be able to create a basic template from a machine that has all the store apps installed. This is done in the AppLocker section in GP and you can then modify the apps on an individual basis. I believe it will default to blocking the specific version number that was on the template machine, but you can modify it to have a wildcard for the version number, etc. So it should then block all instances of that app, regardless of the version number.