Windows Store - Do not rely on the GPO to block access

Morning all,

Lovely sixth form student came to me this morning with a "Sir I've found a way into the Windows store and to install apps". My reaction prior to my first coffee of the day "Fcuk my life...".

So here's how it works, please feel free to test this yourselves and let me know.

Firstly before listing the processes to gain access yes the standard block Windows Store GPO is in place and working.

1. Student logs on to a normal Windows 10 PC (Anniversary 1607 update).

2. Student launches Windows Store and receives the "This is blocked by your System Administrator" message (YAY! Great! Working!).

3. Student then leaves the Store open on the blocked message and scrolls down the start menu to a Windows App such as Sticky Notes or Contact Support (yes contact support, that lovely app you cannot remove!)

*NOTE:- You cannot search for these on the Start Menu as the next step will not work, you must scroll down the Start Menu manually to find them.

4. Student then right clicks one of these apps and chooses "More" then "Rate and Review".

5. Up pops a Window asking you to sign in with a Microsoft Account (Yes I have this blocked via GPO also as well and cannot be done in Windows but in this case is ignored...) and then in the background you see the Windows Store window refresh from the Blocked error message to the full blown Windows Store where they can then install apps...

I'm now blocking Store via AppLocker as well now as the GPO clearly is not working properly and going over all the GPO's again to make sure nothing is out of place but at first glance this looks to be a legit loophole.

If anyone can confirm...

i believe the gpo setting is depreciated and isnt supposed to work anymore ms dont want store access being removed

Huh? The GPO does work and blocks access but there is a work around to get around the GPO...

i believe the gpo setting is depreciated and isnt supposed to work anymore ms dont want store access being removed

Thats only in Pro. https://mspoweruser.com/microsoft-admins-cant-disable-windows-store-windows-10-pro-group-policy/

Education version here so yes the GPO's do work.

Here's the GPO's setup, standard blocking ones...

Update in testing.

Once you have done the above process in order to gain access to the Store if you then log off and back on (still as the student) and then open Microsoft Edge browser and wait for it to load the default blank page it shows recommendation of Apps from the Store which then below each icon of the app has an Install button whereas before it had a Get button which then wouldn't work because you needed to logon in the store and couldn't because of the GPO but now will let the user install the App due to them logging in through the Contact Support.

@Tefters is right. You also need to block Microsoft accounts (in addition to only allowing the Business Store)...

Windows Store User Experience in the Enterprise in Windows 10

Bypassing the Business Store

It’s not all roses though – users can still directly access applications from the public Store via direct links to those apps. Direct links are available from a couple of places – suggestions shown by default on the Start menu and on the web. If you want to control the app suggestions on the Start menu, PCs will need to be running Windows 10 Enterprise or Education editions.

 

To see bypassing the Business Store, search the web for an example app, e.g. the Windows 10 Facebook app. A user can click on the ‘Get the app’ button on that page which will launch the Store:

 

A user can click on ‘Free’ button. If the user can add a Microsoft account to Windows, they can install the app. To prevent that, you’ll want to block Microsoft accounts.

Showing Only the Business Store

Now that the Business Store is enabled and available on user devices, we can start to take some control over what users see in the Store. By default, this will be the Business Store as well as the public links as seen in the screenshot above. To disable the public links we can enable the RequirePrivateStoreOnly policy.

 

This is actually an MDM policy that’s not available in Group Policy, so unless you managing devices with an MDM solution, you’ll need to configure this with a direct Registry edit via PowerShell, as below, or other means such as Group Policy Preferences.

 

# Hide the public links in the Windows Store
$RegPath = "Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\ApplicationManagement\RequirePrivateStoreOnly"
New-ItemProperty -Path $RegPath -Name "value" -Value 1 -Force

Can AppLocker not help here? Can you block the Store App itself? Or whitelist all the apps you want so it blocks the rest.

It can and have done that but it was more just the point that the GPO Microsoft gave us is pretty useless in the first place if direct linking to apps gets around the policy and we end up having to AppLocker it anyway.

It can and have done that but it was more just the point that the GPO Microsoft gave us is pretty useless in the first place if direct linking to apps gets around the policy and we end up having to AppLocker it anyway.

Yer, should work but with Microsoft moving away from GPO its going to keep us on our toes for sure!

Yer, should work but with Microsoft moving away from GPO its going to keep us on our toes for sure!

I just can't work out how Microsoft think we are going to manage environments moving forward? There are very few schools where you can be trusting enough to leave these technologies open without abuse and businesses for that matter... So WTF are we supposed to do if the bloody GPO's don't work properly in the first place...

I just can't work out how Microsoft think we are going to manage environments moving forward? There are very few schools where you can be trusting enough to leave these technologies open without abuse and businesses for that matter... So WTF are we supposed to do if the bloody GPO's don't work properly in the first place...

they dont they expect you to provide infrastructure and wither use azure/rdp for anything that cant be supplied to them via the store / office 365