Why does the Turn off the Store application policy not work on Windows Pro?

Windows Pro ignores this policy by design. Use Software Restriction Policies instead.

Block Microsoft Store Access via GPO: Group Policy Guide

Q: How do I block specific Microsoft Store apps rather than the entire Store?

Use AppLocker Packaged App Rules with a deny rule targeting the specific app.

Q: How do I block Microsoft Store on a non-domain machine?

Use Local Group Policy Editor and configure the same policies locally.

Organizations block Microsoft Store to stop users from installing apps that could be security risks, use too much bandwidth, or break software rules. Without a policy, users can install apps not seen by the IT team, leading to compliance issues and more security threats. This guide explains three GPO-based ways to block Store access for Windows Pro, Enterprise, and Education. It includes verification steps, troubleshooting tips, and common overlooked bypass methods.

Which method applies to your environment?

The right approach depends on the Windows edition in your domain. The built-in GPO policy for blocking the Store is not enforced on Windows Pro. Microsoft documents this as by-design behavior in KB3135657. Applying it to Pro machines and expecting it to work is the most common mistake with this configuration.

Windows edition	Recommended method
Windows 10/11 Enterprise	Method 1: Turn off the Store application (GPO administrative templates)
Windows 10/11 Education	Method 1: Turn off the Store application (GPO administrative templates)
Windows 10/11 Pro	Method 2: Software Restriction Policies
Mixed environment (Pro and Enterprise)	Method 2 for Pro machines, Method 1 or 3 for Enterprise and Education—separate GPOs per OU

If your environment has a mix of editions in the same OU, create separate GPOs with security group filtering to ensure the correct method reaches each machine type.

Prerequisites

Domain Administrator privileges to create and link GPOs
The Group Policy Management Console (GPMC) installed, available via Remote Server Administration Tools (RSAT) on Windows 10 and Windows 11, or installed by default on Windows Server with the Group Policy Management feature
Confirmation of which Windows edition is running on your target machines; run winver or check Settings > System > About
A test OU with representative machines to validate before deploying domain-wide

Method 1: Turn off the Store application (Enterprise and Education only)

This is the officially supported GPO method. It displays a blocked access message when users open the Store and prevents them from browsing or installing apps. It works on Windows 10 and Windows 11 Enterprise and Education editions. It does not work on Pro.

Step 1: Open the GPMC and create a new GPO

Press Win + R, type gpmc.msc, and press Enter.
In the left pane, expand the forest and domain tree. Right-click the OU containing your Enterprise or Education machines and select Create a GPO in this domain, and Link it here.
Name the GPO, for example, Block Microsoft Store - Enterprise.
Click OK.

Step 2: Enable the policy

Right-click the new GPO and select Edit.
In the Group Policy Management Editor, navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Store.
In the right pane, locate Turn off the Store application.
Double-click Turn off the Store application.
Set the policy to Enabled.
Click Apply, then OK.
Close the Group Policy Management Editor.

When this policy applies, users who open Microsoft Store see the message Microsoft Store is blocked. Contact your system administrator for more information. The Store app remains installed on the machine but is inaccessible.

Note: This policy does not stop the Store from performing background app updates. Apps already installed on the machine continue to receive updates automatically. If you also need to prevent app updates, consider using AppLocker to block the Store process entirely, as covered in Method 3 below.

Method 2: Software Restriction Policies (Windows Pro)

Software Restriction Policies (SRPs) block the Store executable by path, which works on Windows Pro where the Administrative Templates policy is ignored. SRPs were deprecated beginning with Windows 10 Build 1803, but it continues to function on current Windows 10 and Windows 11 versions and remains a practical GPO-based option for Pro machines.

Important: Test SRPs in a pilot OU before deploying domain-wide. SRP rules are broad, and a misconfigured path rule can block unintended applications. The %programfiles%\WindowsApps\Microsoft.WindowsStore* path is specific to the Store and does not affect other WindowsApps packages unless you expand the wildcard.

Step 1: Create a new GPO for Pro machines

Press Win + R, type gpmc.msc, and press Enter.
Right-click the OU containing your Pro machines and select Create a GPO in this domain, and Link it here.
Name the GPO, for example, Block Microsoft Store - Pro.
Click OK.

Step 2: Create the SRP

Right-click the new GPO and select Edit.
Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies.
Right-click Software Restriction Policies and select New Software Restriction Policies. This creates the policy container with default rules.
Expand Software Restriction Policies and click Additional Rules.
Right-click in the right pane and select New Path Rule.

Step 3: Configure the path rule

In the Path field, enter %programfiles%\WindowsApps\Microsoft.WindowsStore*.
Set Security Level to Disallowed.
In the Description field, add a note explaining the rule, for example, Blocks Microsoft Store app under IT policy.
Click OK.
Close the Group Policy Management Editor.

Step 4: Apply and test

On a target Pro machine, open an elevated Command Prompt and run gpupdate /force.
Attempt to open Microsoft Store. The Store should open briefly and then close with a message that it has been blocked by your system administrator.

Note: On some Pro machines, a reboot after gpupdate /force produces more reliable results than the refresh alone. If the Store is still accessible after gpupdate /force, reboot and test again before troubleshooting further.

Method 3: AppLocker (Enterprise and Education only)

AppLocker is the replacement for SRPs on Enterprise and Education editions. It provides more granular control than the Turn off the Store application policy. You can block the Store executable specifically while allowing other Store-delivered apps to continue running, or block all Store-sourced applications by publisher rule.

AppLocker requires the Application Identity service to be running on target machines. If it is not running, AppLocker rules are not enforced.

Step 1: Enable the Application Identity service via GPO

Before creating AppLocker rules, ensure the Application Identity service starts automatically on all machines in scope.

In the Group Policy Management Editor for your Store-blocking GPO, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
Double-click Application Identity.
Check Define this policy setting and set the startup type to Automatic.
Click OK.

Step 2: Create an AppLocker packaged app rule

In the same GPO, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker.
Click Configure rule enforcement.
Under Packaged app Rules, check Configured and select Enforce rules. Click OK.
Right-click Packaged app Rules and select Create New Rule.
On the Permissions page, set Action to Deny and leave User or Group as Everyone. Click Next.
On the Publisher page, select Use an installed packaged app as a reference and choose Microsoft Store from the list.
Set the rule to match at the Publisher level only to block all versions of the Store rather than pinning the rule to a specific version.
Click Next, review the rule summary, and click Create.

Step 3: Create a default allow rule

AppLocker requires at least one Allow rule to be present, or it blocks everything. If no default rules exist yet, right-click Packaged app Rules and select Create Default Rules before adding your Deny rule. Default rules allow all signed packaged apps except those explicitly denied.

What blocking the Store does not prevent

Two gaps apply regardless of which method you use.

Background app updates can continue: Blocking Store access prevents users from browsing and installing new apps, but it does not stop the Store service from running update checks and applying updates to already installed apps in the background. If you need to prevent app updates entirely, use AppLocker to block WinStore.App.exe and the Store background service, or manage app update policies through Intune directly.

Windows Package Manager (winget) can bypass Store UI restrictions: winget is a command-line package manager built into Windows 11 and available on Windows 10 through the App Installer package. Users with access to Command Prompt or PowerShell can install Store-sourced packages via winget install without opening the Store UI. To close this gap, either restrict Command Prompt and PowerShell access for standard users or use AppLocker to block winget.exe at %programfiles%\WindowsApps\Microsoft.DesktopAppInstaller*.

How to verify the policy applied

Check 1: Confirm the GPO is in the applied list

On a target machine, run the following from an elevated Command Prompt:

Click to copy script

gpresult /r /scope computer

Your GPO name should appear under Applied Group Policy Objects. If it does not, check the OU membership of the machine and confirm the GPO is linked to the correct container.

Check 2: Confirm the Store is blocked

Open Microsoft Store on the target machine.

For Method 1 (Enterprise or Education), the Store should display the blocked access message immediately.
For Method 2 (Pro SRP), the Store window should open briefly and then close with a system administrator restriction message.
For Method 3 (AppLocker), the Store should fail to launch entirely.

Check 3: Confirm the SRP rule is applied (Method 2 only)

On a target Pro machine, open an elevated Command Prompt and run:

Click to copy script

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel

A result of 0x20000 confirms the SRP is active with a default security level of Unrestricted, with your disallowed path rule applied on top.

Check 4: Confirm the AppLocker service is running (Method 3 only)

Click to copy script

Get-Service AppIDSvc | Select-Object Status, StartType

Both Status and StartType should return Running and Automatic, respectively. If the service is stopped, AppLocker rules are not being enforced regardless of what the GPO shows.

Troubleshooting common issues

1. The Turn off the Store application policy is enabled, but the Store still opens

This machine is running Windows Pro. The policy is ignored by design on Pro editions, as documented in Microsoft KB3135657. Switch to Method 2 (Software Restriction Policies) for Pro machines, or use security group filtering to ensure Method 1 only reaches Enterprise and Education machines.

2. The SRP path rule is applied, but the Store opens normally

The most common cause is that gpupdate /force applied the policy but the machine has not rebooted. Reboot and test again. If the Store still opens after a reboot, confirm that the path is entered exactly as %programfiles%\WindowsApps\Microsoft.WindowsStore* with no trailing slash or additional characters. A second possible cause is a conflicting rule with Allow precedence. Check Additional Rules for any Allow rules that match the same path.

3. AppLocker rules are not being enforced

Confirm that the Application Identity service is running with Get-Service AppIDSvc. If it is stopped, the GPO setting from step one of Method 3 has not applied or was overridden. Run gpupdate /force, then start the service manually with Start-Service AppIDSvc to test whether rules are enforced when the service is active. If rules enforce with the service running manually but not after reboot, the startup type setting in the GPO is being overridden by another policy.

4. The Store is blocked, but users are installing apps via winget

See the winget bypass section above. Block winget.exe through AppLocker or restrict Command Prompt and PowerShell access for standard users using Computer Configuration > Policies > Administrative Templates > System > Don't run specified Windows applications.

Frequently asked questions

1. How do I block specific Microsoft Store apps rather than the entire Store?

Use AppLocker Packaged App Rules (Method 3) with a Deny rule that targets a specific publisher and app name rather than just the publisher. In step six of Method 3, instead of selecting the Store itself as the reference app, select the specific app you want to block from the installed packages list, then set the rule scope to match on Publisher and Package name. This leaves the Store accessible but prevents that specific app from launching.

2. How do I block Microsoft Store on a non-domain machine?

On a stand-alone machine, open the Local Group Policy Editor by pressing Win + R and typing gpedit.msc. The same paths apply: Administrative Templates for Enterprise and Education, and Software Restriction Policies for Pro. Note that gpedit.msc is not available on Windows Home edition.

Go beyond the GPMC with ADManager Plus

Confirming that your Store-blocking GPO applied to every machine in scope and that no competing policy re-enabled access on a subset of machines takes time to track across a large domain. ManageEngine ADManager Plus provides a centralized GPO management console where you can handle that follow-up work without opening the GPMC on individual servers.

Bulk GPO linking: Link your Store-blocking GPO to multiple OUs simultaneously rather than repeating each link manually in the GPMC. This is useful when separate GPOs need to reach Enterprise and Pro machines in different containers.
Link order management: Adjust GPO precedence from the web console when a competing policy is re-enabling Store access, so the intended configuration wins without opening the GPMC on each domain controller.
On-demand policy refresh: Push an immediate GPO refresh to selected computers without logging in to each machine individually. This is useful for confirming that the Store policy has propagated after adjusting a link or scope.
Application visibility: Run GPO reports to confirm that your Store-blocking policies are configured consistently across all GPOs in the domain, and verify that the correct settings applied to specific machines after deployment.
Delegation oversight: Scope GPO refresh and reporting tasks to help desk technicians through role-based delegation, so staff can investigate GPO application issues without needing Domain Admin rights or RSAT installed on their workstations.

How to block Microsoft Store access using a GPO

Which method applies to your environment?

Prerequisites

Method 1: Turn off the Store application (Enterprise and Education only)

Step 1: Open the GPMC and create a new GPO

Step 2: Enable the policy

Method 2: Software Restriction Policies (Windows Pro)

Step 1: Create a new GPO for Pro machines

Step 2: Create the SRP

Step 3: Configure the path rule

Step 4: Apply and test

Method 3: AppLocker (Enterprise and Education only)

Step 1: Enable the Application Identity service via GPO

Step 2: Create an AppLocker packaged app rule

Step 3: Create a default allow rule

What blocking the Store does not prevent

How to verify the policy applied

Check 1: Confirm the GPO is in the applied list

Check 2: Confirm the Store is blocked

Check 3: Confirm the SRP rule is applied (Method 2 only)

Check 4: Confirm the AppLocker service is running (Method 3 only)

Troubleshooting common issues

Frequently asked questions

Go beyond the GPMC with ADManager Plus

Related Tools

Streamline AD management with ADManager Plus

ADManager Plus Trusted By

The one-stop solution to Active Directory Management and Reporting