Windows 10: Device Guard blocking Windows Store Apps from running

Hello everyone,


I'm a PC enthusiast, running Windows 10 Pro on my home computer, and I've been exploring the possibilities of the built-in security features as an alternative to buying an antivirus license from other established vendors.


I've been experimenting with Device Guard on my PC, had it enabled and running, and then two things popped up:


First, there were some devices with incompatible drivers that wouldn't function after enabling DG, and from elsewhere I've come to understand that this is due to the hardware vendors not writing drivers that would be compliant to a set of driver compatibility requirements:

• Opt-in to NX by default
• Use NX APIs/flags for memory allocation - NonPagedPoolNx
• Don’t use sections that are both writable and executable
• Don’t attempt to directly modify executable system memory
• Don’t use dynamic code in kernel
• Don’t load data files as executable
• Section Alignment must be a multiple of 0x1000 (PAGE_SIZE). E.g. DRIVER_ALIGNMENT=0x1000

Source: https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/


No way around it, so I accepted it as it is.


The second thing upsets me more, Device Guard keeps my Windows Store Apps from running at all, it doesn't interfere with any other software I have installed. I like the MSN Weather app and Netflix and MS News and Google News, but after starting them they instantly crash back down. I've tried to do the re-registering of the apps via the Get-AppXpackage cmdlet as described in online tutorials, even did a WSReset, to no avail, until I discovered that it was indeed DG blocking them, so I disabled it again.


Now there's a ton of articles about Windows Defender Application Control policies, but when I try to run the New-CIPolicy cmdlet, it exits with an error about an unsupported Windows edition, I presume this is possible only on Windows 10 Enterprise:
New-CIPolicy : Device Guard is not available in this edition of Windows.


Is there any way for me to unblock Windows Store apps from running, or do I have to live with them being unavailable, or would anyone suggest posting this as a kind of bug report/feature request to Microsoft? Device Guard along with Windows Defender looks very promising to me, wouldn't want to ditch it altogether.

Thanks alot for any answers

:)

 

Your Organization used Device Guard to block this app - contact your support person for more info

Does the computer-in-question belong to you or your employer?

Cite:

• Windows Defender Device Guard deployment guide
  
  ["Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that
  run on Windows 10 Enterprise edition and Windows Server. When these features are configured together, Windows Defender Device Guard will lock a device down so that it can only run trusted applications that you define in your code integrity
  policies. If the app isn’t trusted, it can’t run, period."]
  
  https://docs.microsoft.com/en-us/windows/device-security/device-guard/device-guard-deployment-guide
  
• Introduction to Windows Defender Device Guard - virtualization-based security and code integrity policies
  
  https://docs.microsoft.com/en-us/wi...on-based-security-and-code-integrity-policies
  

 

Your Organization used Device Guard to block this app - contact your support person for more info

Followed the steps and disabled it and restarted laptop - still cant download off internet same message pops up

Your Organization used Device Guard to block this app - contact your support person for more info

 

Windows Firewall blocks App Store from downloading new apps

Hi,

Let's try to check if the app store you're referring to if it's really blocked by Windows Firewall. See these steps:

• Open Windows Firewall from the taskbar >
  Firewall & network protection > Allow an app through firewall.
• A new window will show up containing the list of the apps that ca be allowed through Firewall.
• Look for the app you want to be accessed, and make sure that the Domain, Private and Public are ticked. That would allow the app store to be accessed.

Let us know what happens after doing the suggestion.