Manage Learn to apply best practices and optimize your operations.

Control Windows 8 apps with more registry tweaks

You may have good reasons to want to control user access to Windows 8 apps. Here's how to disable Windows Store apps with Group Policy Objects.

There are a number of ways for IT professionals to alter the default behavior of Windows 8 systems to control user access and facilitate Windows troubleshooting. In my previous article, we looked at how to enable the local administrator account and how to set up the file delete confirmation dialog box.

In addition, you might want to block users from uninstalling the applications that admins have installed from the Windows Store. Let's see how to prevent app uninstallation and how to disable the Windows Store.

Disable the ability to uninstall apps from the Start screen

The Modern user interface in Windows 8.1 allows any user to uninstall applications from the Windows Store. Such apps can only be accessed from the Start screen. The Start screen also provides several options, including the ability to uninstall an application.

If you need to prevent users from uninstalling applications from the Start screen, you can either use a Group Policy Object (GPO) setting or configure the "NoUninstallFromStart" registry entry on the local computer.

To prevent uninstallation of Windows Store Apps using the Local Group Policy Editor, navigate to "User Configuration\Administrative Templates\Start Menu and Taskbar" node, and double click on the "Prevent Users from Uninstalling the Applications from Start" setting to show the GPO setting window.

Next, click on the "Enabled" radio button. Enabling this GPO setting will disable uninstallation of Windows Store apps. You can also implement this GPO setting from an Active Directory domain controller if you need to control this behavior for multiple domain-joined PCs.

Be aware, however, that the above GPO setting using the Local Group Policy Editor will affect all users including the local administrator accounts. If you need to limit the application of this GPO setting to a few users, then you must configure the GPO at an Active Directory domain controller.

In fact, when the above GPO setting is applied either from the Local Group Policy Editor or a GPO configured at an Active Directory domain controller, a registry entry called "NoUninstallFromStart" is created on the local computer, as shown below:

Either a Local Group Policy Editor or a GPO will yield a similar registry entry.
Figure 1a: Use a GPO to prevent uninstallation of Windows apps.

In case you need to configure this GPO setting on multiple computers, you can always create the "NoUninstallFromStart" registry entry by using a FOR loop. The "NoUninstallFromStart" registry entry must be created under the HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer registry location. It is important to note that you might need to create the "Explorer" sub-key if it does not exist on the PCs. Note that this setting applies to both Windows 8 and Windows 8.1.

Disabling Windows Store for users

By default, a user can install applications from the Windows Store. In a controlled environment, you might want to disable the ability to install unapproved apps or disallow the use of Windows Store. To prevent users from using the Windows Store, you can use either a GPO setting or create a Windows registry entry called "RemoveWindowsStore" on the local computer.

Using Local Group Policy Editor, navigate to the "User Configuration\Administrative Templates\Windows Components\Store" and then double-click on the "Turn Off Store Applications" setting to see the GPO setting window. In the GPO setting window, click the "Disable" radio button to disable the Windows Store.

The above GPO setting, which is also be configurable from an Active Directory domain controller, creates a registry entry called "RemoveWindowsStore" at the HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsStore registry location on the local computer, as shown in the screenshot below.

Change the registry to disallow downloads from the Windows Store.
Figure 2a: This registry entry shows the GPO setting for disabling Windows Store.

Administrator control over Windows 8 and Windows 8.1 machines is as much a matter of restricting access as it is of allowing end users to download and use apps. Security, application compatibility and data privacy regulations are all good reasons to be aware of how to use GPOs and Active Directory.

Next Steps

Make sure that Windows Store apps are Windows 8-compatible

Two ways to remotely refresh Windows 8 Group Policy settings

Control Windows 8 Store access with Group Policy

DevCraft application development tool for Windows 8 gets updated

Windows 8 app store offers free, enterprise-class tools

Admins should know these Windows tools and terms

Dig Deeper on Windows 8 and 8.1

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Have you restricted Windows Store access? How did you do it, and why?