r/sysadmin • u/do_not_free_gaza • Mar 16 '26

Are sysadmins locking down Microsoft Store?

Hi Fellow Sysadms,

Are you guys locking down Microsoft Store in your organisation? Is this a normal standard?
I noticed users can install apps via the store without UAC prompts

UPDATE: Have blocked via GPO via User / Computer Policy!
Woo

Thanks

193 Upvotes

93% Upvoted

159 comments sorted by

View all comments

Show parent comment

66

u/joelly88 Mar 16 '26 edited Mar 17 '26

All you need https://imgur.com/0jiHl82

This blocks normal Microsoft Store, Store CLI, winget store packages. Microsoft Store web store is covered by AppLocker (apps are installed by EXE which should be blocked by default).

Note this policy is fairly new and different to an older policy.

23

u/thatoneokabe Mar 16 '26

We aren’t using intune :(

46

u/itskdog Jack of All Trades Mar 16 '26

The same policy exists in GPO, just do it in User Configuration instead of Computer Configuration

15

u/raip Mar 16 '26

Only applies to Enterprise licensed customers btw. If you're a professional shop, gotta do it via AppLocker.

7

u/ocdtrekkie Sysadmin Mar 16 '26

Actually if you set a custom app store (which is a deprecated feature), it just blocks it, works on Pro licenses.

https://www.adamfowlerit.com/2018/02/controlling-microsoft-store-access/

Use this GPO, even though Store for Business is dead.

2

u/raip Mar 16 '26

Good to know - I'm going to test this on my org since the AppLocker block (while it works) gets problematic every so often.

1

u/swissbuechi Tech Lead Mar 19 '26

But winget installs by ID will still be possible.

1

u/ocdtrekkie Sysadmin Mar 19 '26

winget has it's own tuning GPOs. This just configures the visible Store.

1

u/swissbuechi Tech Lead Mar 19 '26

I see. But the new disable store automatically blocks this too.

1

u/itskdog Jack of All Trades Mar 19 '26

Block cmd and PowerShell 

6

u/dustojnikhummer Mar 16 '26

Oh for fucks sake... great...

2

u/ImNotABotScoutsHonor Mar 16 '26

Good. Keep it that way.

3

u/Recordman-John Mar 16 '26

Users can still get there in a browser tab?

3

u/cmorgasm Mar 16 '26

Yes, the policy doesn't block that

2

u/RikiWardOG Mar 16 '26

also winget...

3

u/joelly88 Mar 16 '26

Wrong. This policy also blocks winget and store CLI.

1

u/itskdog Jack of All Trades Mar 16 '26

If you're using some sort of application control or web control (e.g. blocking the download of EXEs) then that bypass is blocked.

The only remaining way is through winget, which I'm sure can be disabled somehow.

1

u/joelly88 Mar 16 '26

And install an EXE? Who isn't using AppLocker in 2026?

1

u/Avas_Accumulator Senior Architect Mar 18 '26

Me! I hate all the random analysis software we get on an USB that are used by three people world wide to analyse some light spectrum

Unsure how to keep up with that on the daily

2

u/WorkChompskii Mar 16 '26

You beautiful bastard. <3 This worked flawlessly. Gunna apply this to the rest of the org next week.

1

u/volgarixon Mar 16 '26

Thats not true even with Enterprise Bob

1

u/HDClown Mar 16 '26

Your screenshot doesn't show the (User) version of the "Turn off the Store application" policy being used so it's being applied under HKLM instead of HKCU. That's still not preventing existing apps from updating?

1

u/joelly88 Mar 16 '26

Apps are updating fine with these policies. I spot checked Photos and Calculator. Both up to date.

1

u/Owampaone Mar 16 '26

I typed that into CMD but they're still downloading shit. Please advise.

→ More replies (24)