Windows 11 24H2 Cannot block Microsoft Store - Ignoring GPO

Question

Finding that with the update to 24H2 the Microsoft Store is no longer being blocked via GPO or Intune policies. Has anyone else had this problem? How do we fix this?

Answer 1

not possible to create it like this when the AppStore is not present on the server where the GPO management runs.

Answer 2

Hello Natalie, I am Henry and I want to share my insight about your issue.

The traditional Group Policy setting "Turn off the Store application" (located under Computer Configuration > Administrative Templates > Windows Components > Store) has been deprecated by Microsoft and is no longer honored in version 24H2 and later. You can refer this document You will see that the documentation confirms it is no longer effective starting in Windows 11, version 24H2, and it explicitly recommends using AppLocker or Windows Defender Application Control as the replacement. So my recommended method is to use an AppLocker "Deny" rule for o blocking the Microsoft Store in 24H2.

Prerequisite: AppLocker is available on Enterprise and Education editions of Windows.

1. Create/Edit a GPO and link it to your target computer OU.
2. Navigate to AppLocker: Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker
3. Enable Default Rules: If you are new to AppLocker, you must first create the default rules to prevent blocking essential system files. Right-click on Executable Rules and Packaged app Rules and select "Create Default Rules" for each.
4. Create the Deny Rule for the Store:
   • Right-click Packaged app Rules -> Create New Rule....
   • On the "Permissions" page, select Deny.
   • On the "Publisher" page, select "Use an installed packaged app as a reference", then click Select.
   • Choose the Microsoft Store (Microsoft.WindowsStore) from the application list and click OK.
   • Click Create.
5. Enable the Application Identity Service:
   • In the same GPO, go to ... > Security Settings > System Services.
   • Find Application Identity, and set its startup mode to Automatic.
6. After configuring the deny rule and the service, you can run gpupdate /force on a client machine and restart it to apply the policy

Official Documentation

• AppLocker Rule Creation: Create a rule for packaged apps
• Application Identity Service: Configure the Application Identity service

I hope you’ll give my recommendation a try and let me know how it goes and if this answer helps, feel free to hit “Accept Answer” so others can benefit too