TheRobins

Certainly looks that way, Feb 26 https://learn.microsoft.com/en-us/windows/configuration/start/policy-settings?tabs=start&pivots=windows-11 But looks like it will support down to 24H2

This is the settings that I have picked. Remove Default Microsoft Store packages from the system. Enabled Removes Default Microsoft Store packages from the system. Feedback Hub Enabled Microsoft 365 Copilot Enabled Microsoft Clipchamp Enabled Microsoft Copilot Enabled Microsoft News Enabled Microsoft Photos ** Disabled Microsoft Solitaire Collection Enabled Microsoft Sticky Notes Disabled Microsoft Teams Enabled Microsoft To Do Enabled MSN Weather Enabled Outlook for Windows Enabled Paint Disabled Quick Assist Enabled Snipping Tool Disabled Windows Calculator Disabled Windows Camera ** Disabled Windows Media Player ** Disabled Windows Notepad ** Disabled Windows Sound Recorder Disabled Windows Terminal Enabled Xbox Gaming App Enabled Xbox Identity Provider * Enabled Xbox Speech To Text Overlay * Enabled Xbox TCUI * Enabled When now running get-appx I have this list, vanilla 25H2 Education latest updates. Obviously other apps installed as well. PS C:\WINDOWS\system32> Get-AppxProvisionedPackage -online DisplayName : AD2F1837.HPSystemInformation Version : 2025.910.723.0 Architecture : neutral ResourceId : ~ PackageName : AD2F1837.HPSystemInformation_2025.910.723.0_neutral_~_v10z8vjag6ke6 Regions : all DisplayName : aimgr Version : 0.20.42.0 Architecture : x64 ResourceId : PackageName : aimgr_0.20.42.0_x64__8wekyb3d8bbwe Regions : all DisplayName : AppUp.IntelArcSoftware Version : 26.4.2155.0 Architecture : x64 ResourceId : PackageName : AppUp.IntelArcSoftware_26.4.2155.0_x64__8j3eq9eme6ctt Regions : all DisplayName : Microsoft.ApplicationCompatibilityEnhancements Version : 1.2511.9.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.ApplicationCompatibilityEnhancements_1.2511.9.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.AV1VideoExtension Version : 2.0.7.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.AV1VideoExtension_2.0.7.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.AVCEncoderVideoExtension Version : 1.1.23.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.AVCEncoderVideoExtension_1.1.23.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.BingSearch Version : 2022.1.43.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.BingSearch_2022.1.43.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.DesktopAppInstaller Version : 2026.306.1850.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.DesktopAppInstaller_2026.306.1850.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.Edge.GameAssist Version : 1.0.3590.0 Architecture : x64 ResourceId : PackageName : Microsoft.Edge.GameAssist_1.0.3590.0_x64__8wekyb3d8bbwe Regions : all DisplayName : Microsoft.GetHelp Version : 10.2409.33293.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.GetHelp_10.2409.33293.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.HEIFImageExtension Version : 1.2.30.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.HEIFImageExtension_1.2.30.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.HEVCVideoExtension Version : 2.4.43.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.HEVCVideoExtension_2.4.43.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.MicrosoftEdge.Stable Version : 146.0.3856.72 Architecture : neutral ResourceId : PackageName : Microsoft.MicrosoftEdge.Stable_146.0.3856.72_neutral__8wekyb3d8bbwe Regions : all DisplayName : Microsoft.MicrosoftStickyNotes Version : 6.1.4.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.MicrosoftStickyNotes_6.1.4.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.MPEG2VideoExtension Version : 1.2.13.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.MPEG2VideoExtension_1.2.13.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.Office.ActionsServer Version : 16.0.19725.20170 Architecture : neutral ResourceId : PackageName : Microsoft.Office.ActionsServer_16.0.19725.20170_neutral__8wekyb3d8bbwe Regions : all DisplayName : Microsoft.OfficePushNotificationUtility Version : 16.0.19725.20170 Architecture : neutral ResourceId : PackageName : Microsoft.OfficePushNotificationUtility_16.0.19725.20170_neutral__8wekyb3d8bbwe Regions : all DisplayName : Microsoft.OneDriveSync Version : 26035.222.2.0 Architecture : neutral ResourceId : PackageName : Microsoft.OneDriveSync_26035.222.2.0_neutral__8wekyb3d8bbwe Regions : all DisplayName : Microsoft.Paint Version : 11.2601.401.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.Paint_11.2601.401.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.PowerAutomateDesktop Version : 11.2602.145.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.PowerAutomateDesktop_11.2602.145.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.RawImageExtension Version : 2.5.7.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.RawImageExtension_2.5.7.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.ScreenSketch Version : 2022.2601.2.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.ScreenSketch_2022.2601.2.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.SecHealthUI Version : 1000.29510.1001.0 Architecture : x64 ResourceId : PackageName : Microsoft.SecHealthUI_1000.29510.1001.0_x64__8wekyb3d8bbwe Regions : all DisplayName : Microsoft.StorePurchaseApp Version : 22601.1401.1.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.StorePurchaseApp_22601.1401.1.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.VP9VideoExtensions Version : 1.2.12.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.VP9VideoExtensions_1.2.12.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WebMediaExtensions Version : 2.1.8.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WebMediaExtensions_2.1.8.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WebpImageExtension Version : 1.2.14.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WebpImageExtension_1.2.14.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.Windows.DevHome Version : 0.1701.597.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.Windows.DevHome_0.1701.597.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.Windows.Photos Version : 2026.11020.20001.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.Windows.Photos_2026.11020.20001.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WindowsAlarms Version : 2021.2512.0.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WindowsAlarms_2021.2512.0.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WindowsCalculator Version : 2021.2508.4.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WindowsCalculator_2021.2508.4.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WindowsCamera Version : 2022.2510.2.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WindowsCamera_2022.2510.2.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WindowsNotepad Version : 11.2512.26.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WindowsNotepad_11.2512.26.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WindowsSoundRecorder Version : 2021.2512.0.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WindowsSoundRecorder_2021.2512.0.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.WindowsStore Version : 22602.1401.4.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.WindowsStore_22602.1401.4.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.XboxGamingOverlay Version : 7.326.2102.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.XboxGamingOverlay_7.326.2102.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.YourPhone Version : 1.26012.101.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.YourPhone_1.26012.101.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : Microsoft.ZuneMusic Version : 11.2601.11.0 Architecture : neutral ResourceId : ~ PackageName : Microsoft.ZuneMusic_11.2601.11.0_neutral_~_8wekyb3d8bbwe Regions : all DisplayName : MicrosoftCorporationII.WinAppRuntime.Main.1.8 Version : 8000.770.947.0 Architecture : x64 ResourceId : PackageName : MicrosoftCorporationII.WinAppRuntime.Main.1.8_8000.770.947.0_x64__8wekyb3d8bbwe Regions : all DisplayName : MicrosoftWindows.Client.WebExperience Version : 526.1202.40.0 Architecture : neutral ResourceId : ~ PackageName : MicrosoftWindows.Client.WebExperience_526.1202.40.0_neutral_~_cw5n1h2txyewy Regions : all DisplayName : MicrosoftWindows.CrossDevice Version : 1.26012.79.0 Architecture : neutral ResourceId : ~ PackageName : MicrosoftWindows.CrossDevice_1.26012.79.0_neutral_~_cw5n1h2txyewy Regions : all DisplayName : RealtekSemiconductorCorp.HPAudioControl Version : 2.53.364.0 Architecture : neutral ResourceId : ~ PackageName : RealtekSemiconductorCorp.HPAudioControl_2.53.364.0_neutral_~_dt26b99r8h8gj Regions : all DisplayName : VideoLAN.VLC Version : 3.2.1.0 Architecture : neutral ResourceId : ~ PackageName : VideoLAN.VLC_3.2.1.0_neutral_~_paz6r1rewnh0a Regions : all

I am not going to get a chance to test it on some of our 24h2 machines for a few days, but if you could try it be interesting to see if its enabled as the policy only came with the latest 25h2 ADMX templates.

I have been importing updated ADMX templates these last few weeks, but would assume that InTune is updated by default without end user having to import the latest ADMX.

😀

Worth checking your AV solution, Sophos will allow you to block running unknown exe files, or known exe's based on classification. I think most of them offer a form of app control which is built in.

Confirm just tried the same in Store and get the same message

For us the GPO to block it seems to be good enough for the users, it means that SYSTEM and IT account logins will trigger any store updates to things such as snipping tool, even see calculator was updated the other day. I just looked back at an old Windows 10 policy I even setup Sophos to block the app for students for double security. Not looked into AppLocker yet, maybe worth a second layer of protection, I think back in the days I trust Sophos more to block the apps as it would update its block lists as new software emerged.

I am just reading on this actually as I was thinking "maybe it could..." CoPilots response is - None of the official sources list the Microsoft Store app as removable, and Microsoft has never supported removing the Store from modern Windows builds because: Many system components rely on Store infrastructure (app updates, codecs, frameworks). Removing it can break OS servicing and app provisioning. I get that, I suspect the store is hard baked into Windows 11, more so than it was in 10.

This is the reason I was looking around. I am using a very basic MDT to get us to the OOBE, then hardware hash pre provisioning into autopilot followed by a hybrid join. Did mess around injecting the removal script into MDT as I did with windows 10 but had a couple of issues and it seemed to really slow down deployment. Assuming if you get the latest ADMX into intune option should also pop up.

Memories, Or waiting for each update version and having to re-update the powershell scripts. I also have memories when I first got dropped into the deep end and had to learn image deployment and sysprep and capture, hitting the reaseal limit and giving into the fact that days of work were ruined. I have just tested it on 3 fresh devices and all apps are gone when first user login is tried.

Not sure of its under pinnings, when I get more time in the week I will try adding the app back in via windows store and see if it drops it again. I will also test on 24h2 (although I will be deploying 25H2 on all devices soon) It seems to do it quickly and in the background during startup once it picks up the policy.

All I can say it, "By jove it works" Confirmed apps removed, not even a trace of them, ran the powershell to list apps and they have gone!!

I suspect its been something IT admins have been crying about for years. Interesting to see its behaviour, these scripts can take a few minutes to run so wonder if it runs once and forgets it. Would also be interesting to see if it checks to see if the app gets re-added for some reason and then removes it.

Morning, Not seen this mentioned on the forum after a quick nosey around. I have noticed that in the latest Windows 11 25h2 and later ADMX files they have added this new setting to use GPO (or potentially intune) to remove those apps no one wants, without having to deploy the removeapps.ps1 scripts we have all come to love over the last few years. Its located at - Computer Configuration > Administrative Templates > Windows Components > App Package Deployment > Remove Default Microsoft Store packages from the system Going to deploy it now to a machine I have not ran the removeapps on and see what happens....

Further, a new update on 365 Admin page. "We've determined that the aforementioned fix isn't a viable option due to impact occurring due to outdated versions causing the incompatibility and recommend if you're affected by this event that you update to the latest Classic OutlookWin32 version. However, please reach out to your support representatives to request a temporary reversion if you require additional time to upgrade your Outlook version." Worth triggering a click to run update on the affected machines?

All good this morning for us, wasnt working last thing on Friday when I checked. I didnt do anything or have any updates to apply, possibly it was infrastructrure side they rolled the update out. to?>

I have just been looking at my T46U with firmware 108.87.0.16 and looking forward to my early finish

I did think about that, but if you fresh start a device, it alway re-creates a new object in both Entra and AD, just one to watch when fresh starting that I remove stale devices and licences from SENSO and Sophos. But with any luck its rare we have to fresh start a device anyway.

Looks like Microsoft have recently released some guidance on doing this. I have managed to get together a small script to sucessfully do this even after the device is hybrid joined. How it works is. In the AD Group, you need to delegate the machine (SELF) to be able to read and write computer name in each OU that your hybrid devices will be joined into. Run the script which asks for the machine name you want to rename to. Script then checks DC connectivity, if all good the machine will rename itself locally, rename itself in AD (and re-gen a certifcate) Once the AD rename is complete, machine will reboot and the naming will be complete. Entra Connect will then rename the device in Entra once the next sync takes place. Seems to work well so far, You can manipulate the script to run as a scheduled task and do many other things, I just want to keep it simple.

Sadly not, they have done a good job on breaking it. Even removing teams and the add-in will not work as the damage is already done.

Just FYI, we are using 2021 LTSC here and no one can open outlook at all. Some users may be unable to use classic Outlook when the Teams Meeting Add-in is enabled Issue ID: EX1254044 Affected services: Exchange Online Status: Service degradation Issue type: Incident Start time: 12 Mar 2026, 12:36 GMT User impact Users may be unable to use classic Outlook when the Teams Meeting Add-in is enabled. More info Specifically, impacted users may experience crashes while using the classic Outlook on any client, or be unable to launch the service. While we work on the permanent fix, we recommend impacted users upgrade to the latest Outlook version. Scope of impact Some users that are attempting to use classic Outlook with the Microsoft Teams Meeting Add-in version 26043.2016.4478.2773 enabled may be impacted. This information may be updated as our investigation continues. Root cause A code issue within a recent Microsoft Teams Meeting Add-in update under version 26043.2016.4478.2773 is causing a compatibility issue with classic Outlook and resulting in functionality issues. Current status 17 Mar 2026, 08:54 GMT We've identified a code issue within a recent Microsoft Teams Meeting Add-in update under version 26043.2016.4478.2773, which is causing a compatibility issue with classic Outlook, and resulting in functionality issues. We've confirmed that the previous Microsoft Teams version 26032.208.4399.5 works successfully with classic Outlook, though we recommend affected users that are on the latest updated Microsoft Teams version to also upgrade to the latest Outlook version to avoid further complications. We're working on deploying a fix to resolve the compatibility issue, and we anticipate being able to provide a remediation timeline by our next scheduled update. Next update by: Thursday, 19 March 2026 at 10:30 GMT

Thanks Paddy, I did try the Client filter, it wasnt great gave us some random certificate errors and then when the device came back on site it would pass any traffic at all. Suspect the MST file / settings we were given has issues so passed it back to the ISP. I think the split tunnel is confusing it as well looking at some of the logs from the client filter, but fingers crossed they can spot a simple error somewhere.

Morning, I wonder if anyone has had a play around with netsweeper workstation agent being used across a microsoft device tunnel VPN. I am testing ready for a summer roll out and have got the Workstation Agent to auth correctly but with a split tunnel it still seems to send traffic direct to the web when using the VPN (sadly device tunnel can only support split tunnelling) Not sure if there is a cloud based filter around or any methods people have used in this situation before.

They have made changes over the last week for the new Student App. I would also check your student app's, as they have now broken timetabling on the web based student portal as it shows the teachers full names. This has been reported on the community forums, we have disabled all student modules apart from home learning as it was riddled with errors such as the teachers name. I have also seen that students are able to browse teacher timetables, not the worst thing to happen but still not right. Gareth re the above, it maybe someone has disabled all of your modules for this reason,.