Oct 08 2019 10:44 AM - edited Oct 08 2019 10:52 AM
What I'm trying to figure out is if it is possible to disable the Microsoft Store while still allowing apps like the calculator that are managed by it to be updated. I've figured out how to disable the store but it's the updates that are tripping me up. After a bit of research I've seen some options that required Windows 10 Enterprise and/or Azure (found here: https://docs.microsoft.com/en-us/windows/configuration/stop-employees-from-using-microsoft-store), but we don't currently use those and would prefer to avoid the additional expense if possible. All PCs on the domain are Windows 10 Pro.
Does anyone have any ideas as to how I can get this to work, or if it's even possible?
Oct 09 2019 02:00 AM
I've been able to replicate your scenario and I cant get it working either :crying_face:
After a bit of digging this is by design :sad_but_relieved_face:.
Here is Microsoft's KB on this - https://support.microsoft.com/en-gb/help/3135657/can-t-disable-windows-store-in-windows-10-pro-throu...
Oct 09 2019 04:30 AM
Oct 09 2019 06:41 AM
Thanks for the info! I was able to effectively disable it via Ivanti, but the issue now is that apparently the apps won't be able to update (per @HotCakeX)
Really what I'm looking to accomplish in the end is to make it so users can't use the Microsoft store to download apps for personal use. Maybe there is another way to accomplish this?
Oct 09 2019 06:42 AM
That makes sense that the Windows Store is necessary for the app updates. The main reason we wanted to disable it is so that users won't be able to use it to download apps for personal use. Maybe that can be accomplished in a different way?
Oct 09 2019 06:48 AM
Oct 09 2019 06:55 AM
That is the correct way to restrict them, however this is only possible on Enterprise versions of W10, and not Pro versions..
Windows 10 Pro from 1511 build upward, you notice that the Group Policy settings to disable Microsoft Store are not applied, and you cannot disable Microsoft Store .
This behavior is by design. In Windows 10, version 1511, Windows 10, version 1809, and Windows 10, version 1903, these policies are applicable to users of the Enterprise and Education editions only.
Oct 17 2019 06:45 AM
Correct. If you have Enterprise or Education you can configure Group Policy to block the Store. If you block it in the USER policy, users will not be able to access the Store, but the computers will still have access to update apps. If you block it in the COMPUTER policy, the user nor the computer can access it and apps will not update.
Mar 15 2020 08:19 AM
This is useful information to update existing built-in apps between Windows 10 releases. We currently set Turn off Store application group policy under Computer Configuration. So if we set in group under User Configuration, will it update already provisioned UWP built-in apps (ex. Calculator) under existing user profiles? Also will it allow other UWP apps bundled with drivers (ex. Canon Office Printer Utility) to install in user profiles? Appreciate your help, just looking to see if you found any limitations. Also surprised it is not documented anywhere by Microsoft since it seems like a better workaround then using the Store for Business which is reportedly deprecated now. @Eddie Leonard
Mar 15 2020 09:39 AM
Assuming you devices can connect to the Store through your firewalls/proxies, then yes it should update your Inbox apps and other apps from the Store. As for other apps not installed from the Store, I don't believe it will, but I'm not 100% sure there.
-Eddie
Oct 09 2020 01:03 AM
Blocking store at user policy and allowing it at computer policy does not prevent users to use store app.
Computer policy seems to be more effective than same setting at user policy.
Oct 09 2020 06:47 AM
@Tuomo_Koskimaki The question from the OP was is it possible to block the Store for users but still allow the apps to be updated. The correct way to achieve this is by blocking it in the User Policy. This allows the computer to update already installed Store apps while preventing users from installing new ones.
This policy is not designed to prevent them from using apps that are already installed. If you block the store from the computer policy any Store apps, including inbox apps will not be updated and will eventually cause those apps to potentially stop working.
If you want to ensure the store doesn't even launch, I would suggest using AppLocker.
-Eddie
Oct 12 2020 04:14 AM
Well, at our environment GPO:s do not function as desired. If Store is allowed at computer policy, it is also allowed for users. That is not desired result. Suitable setting was to set "Only display the private store within the Microsoft Store". Business store/Private store is not configured so, no access nor downloads for users. Computers still get updates from store. I tried applocker policy as well. I denied winstore app at Domain Users". It did not function either.