[AppControl Manager] Installed Edge from MS Store but after a reboot, it was removed. What setting\rule causes this?

[pcloadletterinSD]

Hello there! Just want to say that I love your AppControl Manager tool. It has been incredibly helpful in testing out WDAC. Yesterday I was testing the Default Windows Policy and the Allow Microsoft policy and was succesfull in downloading Edge from the MS App store. It would download and install without issue.

After a reboot though, Edge would seemingly be removed from the system. I apologize in advanced but I can't see which setting or rule would perform this function.

I would also remove the policy, perform the same steps to download Edge from the app store, then apply the policy, and the application would stay installed.

Can you point me in the right direction on how this happens?

[HotCakeX]

Hi, Thank you,

I don't think the problem you're describing is related to AppControl Manager. The policies allow store apps, and App Control policies don't "uninstall" programs, only can allow/block execution. I think you should be looking into other possible reasons for what you're experiencing.

Also, Edge is pre-installed default browser in the OS in all markets.

[pcloadletterinSD]

Thank you for the reply! I believe I had some goofiness going on with HyperV checkpoints and that was causing my changes to be reverted. Regarding Edge, yes, it's bundled but I was using Rudy Ooms script to remove items and test adding them back in with different configs of WDAC.

Regarding WDAC, can you advise on how to remove the ability for users to install apps from the app store but still allow Intune to update MS Store apps that I publish to users in Company Portal? I work at a school and kids installing games from app store is problematic. It seems like all the default templates allow installs from the store. Would a better technique to use a device config profile to remove access?

Thanks again for the great set of tools. Have a great week.

[HotCakeX]

Thanks ^^

In the template policies, this is the Signer that allows store apps

    <Signer ID="ID_SIGNER_A_0196C2FB45C971448F44DBF408A496FF" Name="Microsoft MarketPlace PCA 2011">
      <CertRoot Type="TBS" Value="FC9EDE3DCCA09186B2D3BF9B738A2050CB1A554DA2DCADB55F3F72EE17721378" />
      <CertEKU ID="ID_EKU_E_0196C2FB45C973BBA6A3F98B08A4D23D" />
    </Signer>

You can easily remove it from a policy using the Policy Editor feature. I'm planning on adding new templates that don't allow store apps by default.