This content is part of the Essential Guide: Getting up to date with Windows 8 tools and terminology

Use Group Policy to control Windows 8 Store access

The Windows 8 Store enables users to download apps, but IT may want to lock it down with the Desktop Experience in Windows Server 2012.

One Windows 8 component that can be especially problematic for IT administrators is the Windows Store. Enterprises want to maintain a consistent desktop configuration in order to reduce management and support costs. Enabling users to download and install apps from the Windows 8 Store undermines this consistency, while at the same time increasing the complexity of license tracking. So what is an admin to do?

Thankfully, Microsoft offers some Group Policy settings for locking down the Windows Store. To use these settings, you will need a domain controller that is running Windows Server 2012 or Windows Server 2012 R2.

Although Windows Server 2012 and 2012 R2 natively contain the administrative templates that are used to gain control over the Windows 8 Store, the Windows Store settings do not appear in the Group Policy Editor by default. To access these settings, you must enable the Desktop Experience feature.

You can enable the Desktop Experience feature on your domain controller by opening Server Manager and choosing the Add Roles and Features command from the Manage menu. When the Add Roles and Features Wizard appear, work your way through the wizard until you arrive at the Select Features screen.

At that point, you must expand the User Interface and Infrastructure feature and then select the Desktop Experience feature, as shown in Figure A, before completing the wizard.

Select and enable the Desktop Experience feature.You must enable the Desktop Experience feature.


After the Desktop Experience feature has been installed, return to the Server Manager and choose the Group Policy command from the Tools menu. When the Group Policy console opens, right-click on the Default Domain Policy (or whatever policy you happen to be using) and choose the Edit command from the shortcut menu.

When the Group Policy Management Editor opens, you’ll need to navigate through the console tree to access the Computer Configuration (or User Configuration) | Administrative Templates | Windows Components | Store. There are four Group Policy settings for the Windows Store, as shown in Figure B.

The Windows Store includes four Group Policy settings.There are four Group Policy settings associated with the Windows 8 Store.


The first of these policy settings is "Turn Off Automatic Download of Updates on Windows 8 Machines." Contrary to how its name sounds, this setting does not disable automatic updates. When enabled, it prevents Windows 8 machines from automatically downloading updates to Modern apps from the Windows Store. This is useful if you want to ensure that users continue to run specific versions of select apps.

The second policy setting available through the Group Policy Management Editor is the "Turn Off Automatic Download and Install of Updates" setting. This controls whether or not updates to Modern apps are automatically downloaded and installed. Again, you should enable this setting if you wish to maintain tight version control over apps.

More on the Windows Store and Group Policy

Find free enterprise-class tools at the Windows 8 app store

Standardize the Windows 8.1 Start screen with Group Policy

Group Policy settings can control the Windows 8.1 interface

FAQ: Why Group Policy matters

The third setting is one of the most important. This setting is "Turn Off the Offer to Update to the Latest Version of Windows." When you enable this Group Policy setting, it will prevent Windows from offering users the chance to update their desktops to Windows 8.1 or whatever the latest version of Windows 8 happens to be. It is critically important for admins to enable this setting. Otherwise, they risk losing control over desktop operating system consistency.

The fourth and final setting is the "Turn off the Store Applications." As the name implies, enabling this setting disables the Windows Store, thereby denying users the ability to download apps.

Although there are exceptions, it is usually advisable for admins in corporate environments to lock down the Windows 8 Store. Otherwise, it becomes nearly impossible to maintain any sort of consistency among OS versions and application sets.

Dig Deeper on Windows 8 and 8.1

Join the conversation


Send me notifications when other members comment.

Please create a username to comment.

Have you been using the Windows Store? Have you restricted access?
Just an FYI--this stuff doesn't actually require you running "domain controllers" running 2012 or R2. These are just Admin Template settings and such, have no reliance at all on the version of DC you are running. As an example, two of the 4 settings shown above actually already appear in Windows 8.1. I suspect you can get the other two by replacing the appropriate ADMX files with those from the Server 2012 version.
The author writes: "To the best of my knowledge, you are correct. However, best practices usually point to implementing settings at the domain level so that policies can be centrally managed."