Apps Block Microsoft Store apps with AppLocker in Windows 11

This tutorial will show you how to use AppLocker to create a rule to block the Microsoft Store app and/or specific apps installed from the Microsoft Store from running for all or specific users and groups in Windows 10 and Windows 11.

AppLocker is included in Local Security Policy (secpol.msc) to configure Application Control Policies in the Pro, Enterprise, and Education editions of Windows 10 and Windows 11. Local Security Policy is not available in the Home edition.

Apps installed from the Microsoft Store are packaged apps.

You can use AppLocker to create rules to deny (block) specified packaged apps from running for everyone, specific user(s), and/or specific group(s).

References:

You must be signed in as an administrator to use AppLocker.

AppLocker Packaged app Rules are saved to the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Appx

EXAMPLE: "This app has been blocked by your system administrator" message when open a blocked app





Here's How:

1 Open Local Security Policy (secpol.msc).

2 Expand open Application Control Policies in the left pane of the Local Security Policy window, click/tap on AppLocker, and click/tap on the Configure rule enforcement link on the right side. (see screenshot below)


3 In the Enforcement tab under Packaged app Rules, check Configured to Enforce rules, and click/tap on OK. (see screenshot below)

This setting is what enforces any "Packaged app Rules" you create.

4 Perform the steps below to add default rules: (see screenshots below)

If this step is not done, AppLocker will block all Microsoft Store apps from running.

If you already have the "(Default Rule) All signed packaged apps" allowed for everyone like in the right screenshot below, then you can skip this step and go to step 5 instead.

1. Expand open AppLocker.
2. Right click on Packed app Rules.
3. Click/tap on Create Default Rules.

5 Right click on Packaged app Rules, and click/tap on Create New Rule. (see screenshot below)


6 Click/tap on Next. (see screenshot below)


7 Under Action, select (dot) Deny. (see screenshot below)


8 If you want to select a specific User or group instead of the default Everyone to apply this rule to, then follow the steps below:

If you want to block the app for the default Everyone, then go to step 9 instead.

9 Click/tap on Next. (see screenshot below)


10 Select (dot) Use an installed packaged app as a reference, and click/tap on Select. (see screenshot below)


11 Check the app (ex: "Microsoft Store") you want to block, and click/tap on OK. (see screenshot below)

It may take a moment for the "Select applications" window to open.

12 Click/tap on Create. (see screenshot below)


13 This new "Deny" rule will now be added for "Packaged app Rules". (see screenshot below)

To undo and remove this rule, you can right click on the rule, click/tap on Delete, and click/tap on Yes to confirm.

That's it,
Shawn Brink