Our environment has Group Policy Objects (GPOs) that restrict normal users from installing software without admin credentials. Typically, users can download any executable files, but installations always prompt for those credentials. We've noticed that the Microsoft Store sometimes behaves inconsistently regarding when it asks for admin credentials. Generally, we only need a few apps like Notepad, Snipping Tool, or Calculator if they're missing from users' workstations. Has anyone else experienced this? Are there specific GPOs we could implement to ensure the User Access Control (UAC) prompt always appears?
2 Answers
It seems like using AppLocker or a similar tool might be the way to go here. The apps from the Store, Winget, and many MSIX packages install and run in the user's context, giving them rights to install. You could consider limiting the built-in Store app to a 'private store' to avoid average users downloading unnecessary games or apps.
Another option could be to pre-install the necessary apps into your system image and then restrict access to the Microsoft Store altogether. This way, you control what’s available to users.
I appreciate that suggestion! However, we are hesitant to ban the Microsoft Store completely because there might be apps developed by Microsoft that we might need in the future. Plus, we’re concerned if those apps would need the Store for updates.