Updated on 24th November 2017: This article applies to version 1607, 1703, 1709.
With the Windows 10 Pro version 1607 update – also know as the Anniversary Update – Microsoft further strips small and medium businesses from important Group Policy settings. This iteration of the operating system makes it really tedious to provide a clean desktop to my customers and their users, unless they upgrade to the Enterprise edition. This is not financially viable for the majority of them, but that is another matter …
In this article I will focus on the options you have to keep your Windows 10 Pro edition from showing or even installing unwanted apps. If you ever wondered how to keep Candy Crush and other Windows Apps out of your business, or why your methods won’t work with the Anniversary Update anymore, this article is for you.
To be more specific, the main issue in Windows 10 Pro version 1607 and upwards is, that it is no longer possible to turn off the Microsoft Consumer Features. (If you are interested about what Group Policy settings are currently reserved for the Enterprise editions, Microsoft keeps track of them here: Group Policy settings that apply only to Windows 10 Enterprise and Education Editions.)
Before the Anniversary Update, on Windows 10 Pro version 1511, it was totally possible to turn the Microsoft Consumer Features off. There are two ways to do so. Go to the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent and create a DWORD with the name DisableWindowsConsumerFeatures and assign the value 1. Or simply use the Group Policy editor, which does the exact same thing. There is a TechNet blog post Seeing extra apps? Turn them off that goes a little more into detail. Not really worth reading, now that it does no more apply to the Anniversary Update.
The mysterious workaround (that seems to work, but does not)
Now, there are a lot of web sites and blogs claiming to having found a workaround, amongst them winaero.com. Their solution is to use Windows AppLocker to block Spotlight. I will say it as clear as possible: This. Is. Bullshit.
Not only can’t it work because Windows AppLocker is an Enterprise feature available only to Enterprise and Education editions. It says right there in the docs: “AppLocker is included with enterprise-level editions of Windows.” and is therefore not available on Windows 10 Pro. What is more, the author of before-mentioned article didn’t even activate AppLocker, so it couldn’t even have worked for him if he had the Enterprise edition. Naturally, such mistakes go by unnoticed if you don’t validate your changes to configuration.
So why do people believe his article? Because they don’t understand how Microsoft does App advertising on Windows 10. Chances are that they already disabled app suggestions and removed all the unwanted app tiles from the start menu – thereby solving that problem – before they tried to configure AppLocker.
How Windows 10 Pro advertises and installs unwanted apps
Before I jump right in, let me quickly explain how Windows 10 advertises and sometimes silently installs apps.
Windows 10 has two ways of advertising Windows Apps and two locations where it does so, and it all happens in the Start menu. If you look at the following picture you see that the most obtrusive are the dynamically inserted app tiles (you will find a better graphical representation on the obtrusiveness on the screenshots further down). Aside from that you find the suggestion pane in the app list on the left side in the Start menu.
Source: Manage Windows 10 Start and taskbar layout
It is important to note that unwanted apps like Candy Crush are not pre-installed and neither are the suggestions or the dynamically inserted app tiles. It works like this: Let’s say a new employee logs on for the first time on his computer and he sees the First Sign-In Animation saying “Hi”. In the process of creating this new user profile, Windows registers all provisioned packages (apps) for the current user profile, checks a couple of registry key properties, builds the Start menu layout based on an XML file, checks for internet connectivity and then downloads app suggestions and downloads some dynamically inserted apps.
Let’s walk through this step for step.
Provisioned Apps
Provisioned Packages contain a basic set of tools to enhance a user’s experience with Windows 10. They contain the Windows Store, the Calculator, Skype, Mail & Calendar, Contacts and many more. They are stored in a special protected directory which is different from where Windows Apps are installed if you get them from the Windows Store.
Find a full list of provisioned packages in my other article Provisioned Packages (Provisioned Apps) in Windows 10 Pro. If you want to see what packages are provisioned to a new user profile, run the following PowerShell cmdlet in an elevated prompt.
Get-AppxProvisionedPackage -Online | Select DisplayName | Sort DisplayName
Suggestions
Suggestions appear once in a while when you open the Start menu, and they are just that: a suggestion. Meaning, they don’t install themselves. However, if you click on it, the app will get downloaded and installed immediately.
Whether suggestions are shown or not is decided by a registry key DWORD-property HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SystemPaneSuggestionsEnabled which can be enabled or disabled at any time by your users. Usually via the switch Occasionally show suggestions in Start which you find in the Settings App in Personalisation/Start.
Start menu layout
The Start menu layout for any new user profile is based on an customisable XML file in the Default user profile (C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml). If you look into it, you will see that there are a lot of placeholder tiles like the following.
<start:SecondaryTile
AppUserModelID="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App"
TileID="PreInstalled.DefaultStartLayout2.1"
Arguments="creative-ms:default?p=DefaultStartLayout2&launch=ms-get-started://redirect%3Fid=placeholdertiles"
IsSuggestedApp="true"
<!-- … -->
/>
Code language: PHP (php)This tells us several things which bring me to the next section.
1. It is a placeholder tile.
2. It is linked with the ContentDeliveryManager app.
3. It is a suggested app.
4. They will be replaced by unwanted Apps like Candy Crush or FarmVille when connected to the internet.
If you want to read more about Start layout customisation I suggest this TechNet blog: Windows 10 Start Layout Customization
Dynamically inserted app tiles
Dynamically inserted app tiles are where you find all that bloatware like Candy Crush and FarmVille. They are placed in the Start menu only once during profile creation.
Whether dynamically inserted app tiles are placed in the Start menu during profile creation depends on two things:
1. The DefaultLayout.xml in the Default user profile includes them.
2. A registry key DWORD-property HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\PreInstalledAppsEnabled and very likely also …\OemPreInstalledAppsEnabled.
As the previous section suggests, those unwanted apps are actually dynamically inserted app tiles or enhanced placeholder tiles, which are provided with app suggestions by the ContentDeliveryManager app as soon as you connect the computer to the internet. Meaning that a removed placeholder is never automatically added back to your Start menu.
This shows very quickly if you install Windows 10 Pro on a computer without internet connection. Have a look at the two screenshots, before and after connecting the computer to the internet. Apps can and will only be silently installed if at least one of those placeholder tiles remain in your Start menu.
Stopping Windows 10 Pro from installing unwanted apps
Now that you know how all this works, let’s get your client happy. Those are the steps necessary to prevent Windows 10 Pro version 1607 and upwards from installing all those unwanted Apps. Since we both are professionals and I already explained most of it, I keep this section quite short. I assume you know how to read the following snippets and how to roll out the changes in a domain environment.
Oh, just one thing: The *-AppxProvisionedPackage cmdlets will not work in startup and shutdown scripts. If you know a way to get it working that way, please let me know by dropping a comment below.
Disabling Suggestions
The following snippet will disable app suggestions for new user profile. For existing user profiles apply the registry change to the respective branch in the HKCU root instead of the HKU root.
reg load HKU\Default_User C:\Users\Default\NTUSER.DAT
Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name SystemPaneSuggestionsEnabled -Value 0
reg unload HKU\Default_User
Code language: CSS (css)Disabling dynamically inserted app tiles (unwanted apps)
There are two ways on doing this.
By changing the registry
The following snippet will disable the installation of the dynamically inserted app tiles (or placeholder tiles, or unwanted apps) for new user profile. Applying the registry key properties to existing profiles has no effect.
reg load HKU\Default_User C:\Users\Default\NTUSER.DAT
Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name PreInstalledAppsEnabled -Value 0
Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name OemPreInstalledAppsEnabled -Value 0
reg unload HKU\Default_User
Code language: CSS (css)By customising the Start menu layout
Create a new user profile and remove all the placeholder tiles and customise the Start menu to the liking of your client. Then execute the following
New-Item "C:\temp" -Type Directory
Export-StartLayout -Path "C:\temp\DefaultLayout.xml"
# Delete the files manually please.
Code language: PHP (php)Run in an elevated prompt
Import-StartLayout -LayoutPath "C:\temp\DefaultLayout.xml" -MountPath "C:\"
Code language: CSS (css)Removing provisioned app packages
To round off this article this script provides an example on how to remove any unneeded provisioned app packages. What packages you remove depends on the needs of your client. Please have a look at my other article including a comprehensive list of provisioned app packages that come with Windows 10 Pro.
$appsToRemove = @(
"Microsoft.3DBuilder",
"Microsoft.Appconnector",
"Microsoft.BingFinance",
"Microsoft.BingNews",
"Microsoft.CommsPhone",
"Microsoft.ConnectivityStore",
"Microsoft.DesktopAppInstaller",
"Microsoft.Getstarted",
"Microsoft.Messaging",
"Microsoft.MicrosoftOfficeHub",
"Microsoft.MicrosoftStickyNotes",
"Microsoft.Office.OneNote",
"Microsoft.Office.Sway",
"Microsoft.OneConnect",
"Microsoft.People",
"Microsoft.SkypeApp",
"Microsoft.StorePurchaseApp",
"Microsoft.WindowsAlarms",
"Microsoft.WindowsCamera",
"microsoft.windowscommunicationsapps",
"Microsoft.WindowsPhone",
"Microsoft.WindowsSoundRecorder",
)
# The *-AppxProvisionedPackage cmdlet do not work as startup and shutdown scripts.
Get-AppxProvisionedPackage -Online | % { if($_.DisplayName -in $appsToRemove){ Remove-AppxProvisionedPackage } }
Code language: PHP (php)Conclusion
I hope to having provided you some assistance in cleaning up your digital workspace.
If you have any suggestions for improvements, please let me know in the comments.
- Daniel
Leave a Reply