BACKGROUND IMAGE: iSTOCK/GETTY IMAGES
One Windows 8 component that can be especially problematic for IT administrators is the Windows Store. Enterprises want to maintain a consistent desktop configuration in order to reduce management and support costs. Enabling users to download and install apps from the Windows 8 Store undermines this consistency, while at the same time increasing the complexity of license tracking. So what is an admin to do?
Thankfully, Microsoft offers some Group Policy settings for locking down the Windows Store. To use these settings, you will need a domain controller that is running Windows Server 2012 or Windows Server 2012 R2.
Although Windows Server 2012 and 2012 R2 natively contain the administrative templates that are used to gain control over the Windows 8 Store, the Windows Store settings do not appear in the Group Policy Editor by default. To access these settings, you must enable the Desktop Experience feature.
You can enable the Desktop Experience feature on your domain controller by opening Server Manager and choosing the Add Roles and Features command from the Manage menu. When the Add Roles and Features Wizard appear, work your way through the wizard until you arrive at the Select Features screen.
At that point, you must expand the User Interface and Infrastructure feature and then select the Desktop Experience feature, as shown in Figure A, before completing the wizard.
After the Desktop Experience feature has been installed, return to the Server Manager and choose the Group Policy command from the Tools menu. When the Group Policy console opens, right-click on the Default Domain Policy (or whatever policy you happen to be using) and choose the Edit command from the shortcut menu.
When the Group Policy Management Editor opens, you’ll need to navigate through the console tree to access the Computer Configuration (or User Configuration) | Administrative Templates | Windows Components | Store. There are four Group Policy settings for the Windows Store, as shown in Figure B.
The first of these policy settings is "Turn Off Automatic Download of Updates on Windows 8 Machines." Contrary to how its name sounds, this setting does not disable automatic updates. When enabled, it prevents Windows 8 machines from automatically downloading updates to Modern apps from the Windows Store. This is useful if you want to ensure that users continue to run specific versions of select apps.
The second policy setting available through the Group Policy Management Editor is the "Turn Off Automatic Download and Install of Updates" setting. This controls whether or not updates to Modern apps are automatically downloaded and installed. Again, you should enable this setting if you wish to maintain tight version control over apps.
More on the Windows Store and Group Policy
Find free enterprise-class tools at the Windows 8 app store
Standardize the Windows 8.1 Start screen with Group Policy
Group Policy settings can control the Windows 8.1 interface
FAQ: Why Group Policy matters
The third setting is one of the most important. This setting is "Turn Off the Offer to Update to the Latest Version of Windows." When you enable this Group Policy setting, it will prevent Windows from offering users the chance to update their desktops to Windows 8.1 or whatever the latest version of Windows 8 happens to be. It is critically important for admins to enable this setting. Otherwise, they risk losing control over desktop operating system consistency.
The fourth and final setting is the "Turn off the Store Applications." As the name implies, enabling this setting disables the Windows Store, thereby denying users the ability to download apps.
Although there are exceptions, it is usually advisable for admins in corporate environments to lock down the Windows 8 Store. Otherwise, it becomes nearly impossible to maintain any sort of consistency among OS versions and application sets.