Disable Microsoft Store for Standard Users in Windows 10 Pro

[Hacker26]

Hi

From Windows 10 1809 I think, Microsoft diabled the option to disable the Windows Store and the access to its apps via the group policy editor for Windows 10 Pro editions. Windows 10 Enterprise and Education still support it. Does anyone know of a solution for Windows 10 Pro 2004? Or maybe a thirdparty tool that would block the access for certain users on a Windows 10 Pro computer…

Answers are greatly appreciated!

[Hacker26]

@TechWiz , @Chocolate , @Knaper-Yaden any solution?

[Chocolate]

@Hacker26 Are you looking to disable the store or to restrict access to certain apps (Edge for example)?

[Hacker26]

@Chocolate Both…

[Chocolate]

There are 3’rd party tools to disable apps but I don’t know anything on the store

[Knaper Yaden]

I haven’t done it myself but a friend showed me once how he did it for his org.

He blocked the Store utilizing the Software Restriction Policies.

He essentially added an SRP restricting the Store’s folder, like this:

[Hacker26]

@Knaper-Yaden I know that one, but does that block it for particular users or is that on system level?

[Knaper Yaden]

@Hacker26

(If you knew this one why didn’t you mention it in your question and ask if SRPs are per user?..)

For Domain users you can certainly set it per user, for Local GPO I’m not sure but you should be able to set a Computer Configuration policy and set Enforcement to All users except local administrators

[Hacker26]

@Knaper-Yaden I do apollogize that I didn’t mention this in my post… I have only seen that solution after I wrote this post…

[Volvo]

@Hacker26 Have you found a solution?

[Hacker26]

@Volvo I made sort of my own solution, but I’m not sure if that will suit you… The solution is as follows:

1. I rceated a firewall rule in the windows firewall for in and out-bound traffic and blocked the following .exe file:
   “C:\Program Files\WindowsApps\Microsoft.WindowsStore_12007.1001.2.0_x64__8wekyb3d8bbwe\WinStore.App.exe”

2. I named both firewall rules (inbound and outbound) “Windows Store”.

3. Once those rules were in place, I tested them to see whether the microsoft store still connects to the internet. (Be aware it might open up and show you the cached pictures, but the second you will try to choose a certain app, you won’t be able to reach it if the firewall rule works correctly).

4. Then to make it for the user easy I wrote two tiny scripts:

a)

Disable-NetFirewallRule -DisplayName "Windows Store"

b)

Enable-NetFirewallRule -DisplayName "Windows Store"

Script a) disables the firewall rule that we created beforehand and allows again internet traffic to the windows store. Script b) does the opposite.

Each srcipt is placed in a .ps1 file. Now to make it user friendly I created a shortcut to the desktop. To create the shortcut follow these stepps:

1. Right click on the desktop and and select from the dropdown “New” and then “Shortcut”.
2. Paste to the shortcut target box the following:

powershell.exe -ExecutionPolicy Bypass -File "the path to the .ps1 file, for example C:\users\admin\documents\WS.ps1"

The path to the .ps1 file must be in double quotes.

So you create two shortcuts, each one to the right script and give them an icon that makes it understanable which one enables the firewall rule (and through that disables the store) and which one disables the firewall rule (and through that enables the store again).

Make sure that those shortcuts automatically run as a admin by right clicking on the shortcut>select properties>advanced> and tick run as admin as shown:

In my case I placed the scripts in a folder which wasn’t accessible for the other standard users and put the shortcuts on the Admin desktop.

Hope this helps.

LMK if you need any assistance…

[Hacker26]

@Volvo Further to the previous post, when you select the path to the WinStore.App.exe, the folder can be different in your case as it depends on the Windows Store version that you have installed on your machine. Mine is up-to-date, so that’s the current one. The firewall rule might fail once the version number changes as the path wouldn’t be correct any more. We would need to use some sort of variable there… I’ll keep you posted on that one… For now that’s how I’ve done it…

@Knaper-Yaden someone else had already this question as you can see here. Any solution for that one?

[DavidG]

If you use a Techloq as a filter on the computer there might be a way to do it thorough the filter.

[Volvo]

@DavidG said in Disable Microsoft Store for Standard Users in Windows 10 Pro:

If you use a Techloq as a filter on the computer there might be a way to do it thorough the filter.

How?

[DavidG]

@Volvo I know they have an option to set different filtration levels setup to the Windows users, so you should be able to block all traffic from the store for one user and leave it open for the others.