Unable to disable Microsoft Store in domain environment
In AD, I create a new OU and moved my username into that OU so I can do testing with my own domain user account.
I then created a new GPO and enabled the following:
Computer Configuration > Policies > Administrative Templates > Windows Components > Store > Turn off the Store application = Enabled
I went to my local computer, connected it to the domain, logged in using my domain login details, Loaded CMD as administrator and typed
gpupdate
It displayed the following output:
C:\Windows>gpupdate
Updating policy...
Computer Policy update has completed successfully.
The following warnings were encountered during computer policy processing:
The Group Policy Client Side Extension Software Installation was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.
User Policy update has completed successfully.
For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.
C:\Windows>
I tried loading Microsoft Store, but it still loads.
I then tried the following command:
gpupdate /force
The following output was displayed:
C:\Windows>gpupdate /force
Updating policy...
Computer Policy update has completed successfully.
The following warnings were encountered during computer policy processing:
The Group Policy Client Side Extension Software Installation was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.
User Policy update has completed successfully.
For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.
Certain Computer policies are enabled that can only run during startup.
OK to restart? (Y/N)Y
Restarting the computer...
..
C:\Windows>
After the computer has restarted, it still loads Microsoft Store.
I have checked GPReport.html, and I can't see any mention of the GPO to disable the Microsoft Store.
Any ideas why this is not working?
Environment details:
Client computer on domain:
- Windows 10 Enterprise (Desktop client computers connected to the domain)
On domain servers:
- Exchange 2013
- Active Directory 6.3.9xx
In AD, I create a new OU and moved my username into that OU so I can do testing with my own domain user account.
You can't link a Computer Setting GPO to a User account, you must link it to a Computer Account.
I have checked GPReport.html, and I can't see any mention of the GPO to disable the Microsoft Store.
As a result, GPResult don't show the GPO linked, it's normal.
Make sure the GPO is enforced to the correct OU where the computer account is to have the settings applied.
For me it's a simple error from there. Why ? because if it would be a security group error or a WMI filter, the GPO would be listed inside GPResult, but with an access denied error.
I'm not sure why it is not working but my AD environment consists of Win 10 Pro machines and I wanted to accomplish the same thing. I ended up having to utilize software restriction policies.
Computer Config>Windows Settings>Software Restriction Policies>Additional Rules
then add the following:
%programfiles%\WindowsApps\Microsoft.WindowsStore*
With the security level set to Disallowed
Pic of the GPO settings blocking Store, XBOX, Skype, Windows Mail
And the end result:
Hope this helps :)