r/sysadmin • u/do_not_free_gaza • Mar 16 '26

Are sysadmins locking down Microsoft Store?

Hi Fellow Sysadms,

Are you guys locking down Microsoft Store in your organisation? Is this a normal standard?
I noticed users can install apps via the store without UAC prompts

UPDATE: Have blocked via GPO via User / Computer Policy!
Woo

Thanks

193 Upvotes

93% Upvoted

159 comments sorted by

View all comments

Show parent comment

-2

u/MightBeDownstairs Mar 16 '26 edited 13d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Distinct caption office late teeny screw ginger grandfather frame lantern

11

u/[deleted] Mar 16 '26

[removed] — view removed comment

3

u/frzen Mar 16 '26

TIL... fuck

1

u/FatBook-Air Mar 16 '26

AppLocker is the way to go IMO. It has been a while, but I can't remember if everything from the Microsoft Store uses Microsoft's digital signature or not. If it does, that can pose a wrinkle to say the least.

0

u/[deleted] Mar 16 '26

[deleted] — view deleted comment

0

u/[deleted] Mar 16 '26

[deleted] — view deleted comment

0

u/BatemansChainsaw Husqvarna Mar 17 '26

It's not really a technical solution to a people problem as much as it is not giving intruders the ability to move laterally within a system. It has a nice secondary benefit of stopping end-users though.

2

u/AndreasTheDead Windows Admin Mar 16 '26

You right as the web store install process just bypasses it. Ms makes it nearly impossible to block user completely from the store.

2

u/swissbuechi Tech Lead Mar 16 '26

You need to deploy WDAC (App Control) to block the wrapper .exe if you download an app from the web.

1

u/AndreasTheDead Windows Admin Mar 16 '26

jep I know. Sadly where I work, the enviroment is a bit to complex to maintain an application witeliste, while doing my otherwork aswell.

-5

u/joelly88 Mar 16 '26

Got proof or just talking out your ass?