CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

Audit:

Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore:DisableStoreApps

Remediation:

To establish the recommended configuration via GP, set the following UI path to Disabled :

Computer Configuration\Policies\Administrative Templates\Windows Components\Store\Disable all apps from Microsoft Store

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template WindowsStore.admx/adml that is included with the Microsoft Windows 10 Release 1511 Administrative Templates (or newer). Note #2: In older Microsoft Windows Administrative Templates, this setting was initially named Disable all apps from Windows Store , but it was renamed starting with the Windows 10 Release 1803 Administrative Templates.

Impact:

All apps from the Microsoft Store that came pre-installed or were downloaded are prevented from launching. Existing Microsoft Store apps will not be updated. Microsoft Store is disabled.

Default Value:

Enabled. (Microsoft Store apps are permitted to be launched and updated. Microsoft Store is enabled.)

CIS Controls:

Version 6

2 Inventory of Authorized and Unauthorized Software Inventory of Authorized and Unauthorized Software

Version 7

2.6 Address unapproved software Ensure that unauthorized software is either removed or the inventory is updated in a timely manner

1064 | P a g e