25H2 - New GPO to remove MS default apps from system

[TheRobins]

Morning,

 

Not seen this mentioned on the forum after a quick nosey around. I have noticed that in the latest Windows 11 25h2 and later ADMX files they have added this new setting to use GPO (or potentially intune) to remove those apps no one wants, without having to deploy the removeapps.ps1 scripts we have all come to love over the last few years. 

 

Its located at - Computer Configuration > Administrative Templates >  Windows Components > App Package Deployment > Remove Default Microsoft Store packages from the system

 

Going to deploy it now to a machine I have not ran the removeapps on and see what happens....

 

[supportman]

Interesting they included teams. The installers for that are a mess so maybe a good thing!

Edited March 24 by supportman

[TheRobins]

I suspect its been something IT admins have been crying about for years. Interesting to see its behaviour, these scripts can take a few minutes to run so wonder if it runs once and forgets it. Would also be interesting to see if it checks to see if the app gets re-added for some reason and then removes it. 

[jthompson]

As long as it doesn't leave the shortucts in place and just show a "Your administrator has disabled this app. Ask them to enable it!" message whenever anyone clicks on one.

 

I think my comment speaks to my level of suspicion about Microsoft's apparent acquiesence in this regard.

[Davit2005]

MS finally listening, will wait and see 😏

[TheRobins]

All I can say it, "By jove it works"
 

Confirmed apps removed, not even a trace of them, ran the powershell to list apps and they have gone!!

[J-14P]

7 minutes ago, TheRobins said:

All I can say it, "By jove it works"
 

Confirmed apps removed, not even a trace of them, ran the powershell to list apps and they have gone!!

Does it allow the option of run once?

[TheRobins]

Not sure of its under pinnings, when I get more time in the week I will try adding the app back in via windows store and see if it drops it again. I will also test on 24h2 (although I will be deploying 25H2 on all devices soon) It seems to do it quickly and in the background during startup once it picks up the policy. 

[Boredguy]

Pushed it out to devices here, so will see what happens.  Will be nice to get some of the apps off the 25H2 devices, as not been doing a clean up during install since we switched over to Intune builds

[chazzy2501]

I'll have to do a test roll out pronto!

[3s-gtech]

Remember the early days of Windos 10 and our customised WIMs and scripts? This is what we were after all those years ago (like 10+).

[TheRobins]

25 minutes ago, 3s-gtech said:

Remember the early days of Windos 10 and our customised WIMs and scripts? This is what we were after all those years ago (like 10+).

Memories, 

 

Or waiting for each update version and having to re-update the powershell scripts. I also have memories when I first got dropped into the deep end and had to learn image deployment and sysprep and capture, hitting the reaseal limit and giving into the fact that days of work were ruined. I have just tested it on 3 fresh devices and all apps are gone when first user login is tried. 

[TheRobins]

53 minutes ago, Boredguy said:

Pushed it out to devices here, so will see what happens.  Will be nice to get some of the apps off the 25H2 devices, as not been doing a clean up during install since we switched over to Intune builds

This is the reason I was looking around. I am using a very basic MDT to get us to the OOBE, then hardware hash pre provisioning into autopilot followed by a hybrid join. Did mess around injecting the removal script into MDT as I did with windows 10 but had a couple of issues and it seemed to really slow down deployment. Assuming if you get the latest ADMX into intune option should also pop up. 

[J-14P]

Sadly doesn't have an option to remove the ms store.

[TheRobins]

2 minutes ago, J-14P said:

Sadly doesn't have an option to remove the ms store.

I am just reading on this actually as I was thinking "maybe it could..."

 

CoPilots response is -

 

None of the official sources list the Microsoft Store app as removable, and Microsoft has never supported removing the Store from modern Windows builds because:

• Many system components rely on Store infrastructure (app updates, codecs, frameworks).
• Removing it can break OS servicing and app provisioning.

 

I get that, I suspect the store is hard baked into Windows 11, more so than it was in 10. 

[J-14P]

Just now, TheRobins said:

I am just reading on this actually as I was thinking "maybe it could..."

 

CoPilots response is -

 

None of the official sources list the Microsoft Store app as removable, and Microsoft has never supported removing the Store from modern Windows builds because:

• Many system components rely on Store infrastructure (app updates, codecs, frameworks).
• Removing it can break OS servicing and app provisioning.

 

I get that, I suspect the store is hard baked into Windows 11, more so than it was in 10. 

You can gut it out of Windows 11, like Windows 10. It is how we do it now rather than setup private store policies, still allows you to install apps from Intune. Was just hoping could get rid of the entire script. Guess I will just have to keep a small one for just the store.

[3s-gtech]

Yeah we've been avoiding removing the store since the early days of 10. It works fine for staff and we Applocker it for students.

[J-14P]

1 minute ago, 3s-gtech said:

Yeah we've been avoiding removing the store since the early days of 10. It works fine for staff and we Applocker it for students.

Would love to configure Applocker but just don't have the resources. Last time I tried to restrict stuff down computing couldn't do their coding lessons. I also dont want staff or student even attempting to go into the store.

[TheRobins]

For us the GPO to block it seems to be good enough for the users, it means that SYSTEM and IT account logins will trigger any store updates to things such as snipping tool, even see calculator was updated the other day. I just looked back at an old Windows 10 policy I even setup Sophos to block the app for students for double security. Not looked into AppLocker yet, maybe worth a second layer of protection, I think back in the days I trust Sophos more to block the apps as it would update its block lists as new software emerged. 

[Fazza]

Just updated our 'Golden Image' to Windows 11 25h2 the other week and the first thing I did was configure and test this GPO and it does exactly what is says on the tin, the apps are uninstalled!  I then opened the App Store to see if they could be reinstalled but when I tried it wouldn't install them and it said the Install (was) blocked by policy 😎

 

[altecsole]

9 minutes ago, J-14P said:

Would love to configure Applocker but just don't have the resources. Last time I tried to restrict stuff down computing couldn't do their coding lessons. I also dont want staff or student even attempting to go into the store.

I recommend separate AppLocker policies, rather than bundling everything into one. Start with Audit and monitor. I have a server setup with a subscription for event log forwarding for AppLocker events. This makes it easy to identify something that's failing, and needs adding, and also to spot students (and sometimes staff) who are trying to install things they shouldn't. 

[J-14P]

Just now, altecsole said:

I recommend separate AppLocker policies, rather than bundling everything into one. Start with Audit and monitor. I have a server setup with a subscription for event log forwarding for AppLocker events. This makes it easy to identify something that's failing, and needs adding, and also to spot students (and sometimes staff) who are trying to install things they shouldn't. 

I have tried to push for it but there isn't much buy in from the top.

[altecsole]

2 minutes ago, J-14P said:

I have tried to push for it but there isn't much buy in from the top.

If users have a synced OneDrive, that's a big security hole for running executables. If you set default rules, and start off in Audit mode, you're already a good way along the path to securing your environment. 

[TheRobins]

11 minutes ago, Fazza said:

Just updated our 'Golden Image' to Windows 11 25h2 the other week and the first thing I did was configure and test this GPO and it does exactly what is says on the tin, the apps are uninstalled!  I then opened the App Store to see if they could be reinstalled but when I tried it wouldn't install them and it said the Install (was) blocked by policy 😎

 

 

Confirm just tried the same in Store and get the same message

[J-14P]

Just now, altecsole said:

If users have a synced OneDrive, that's a big security hole for running executables. If you set default rules, and start off in Audit mode, you're already a good way along the path to securing your environment. 

Trust me I have tried 😅 We don't have synced OneDrive, we're mostly on-prem still. As far as I understand the OneDrive apps requires C:\ drive access, which we don't allow. I think we also have a legacy GPO laying around blocking it for regular users.