From 459eb255a380e9ef1c7528f8250da9b2715d2655 Mon Sep 17 00:00:00 2001 From: Roy <59626501+RDMacLachlan@users.noreply.github.com> Date: Tue, 25 Aug 2026 09:14:55 -0700 Subject: [PATCH 1/2] Document Group Policy to prevent users from uninstalling apps from Start Adds guidance for ADO bug 29739936 about using the Start Menu and Taskbar Group Policy to remove the Start uninstall command, with documented scope and limitations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4b5b11f6-6bf8-4401-90b8-68f710728c8e --- msix-src/group-policy-msix.md | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/msix-src/group-policy-msix.md b/msix-src/group-policy-msix.md index 06063c0f..5d7910cf 100644 --- a/msix-src/group-policy-msix.md +++ b/msix-src/group-policy-msix.md @@ -1,7 +1,7 @@ --- title: How Group Policy works with packaged apps description: Describes how Group Policy works with apps that are converted to MSIX. -ms.date: 04/12/2019 +ms.date: 08/25/2026 ms.topic: article keywords: msix --- @@ -38,6 +38,36 @@ This policy denies or allows access to the Store application. If you enable this * **Registry:** `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStoreRemoveWindowsStore REG_DWORD` or `HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsStoreRemoveWindowsStore REG_DWORD` * **App updates:** If configured in the computer context, this policy turns off app updates. +### Prevent users from uninstalling applications from Start + +Administrators can use the **Prevent users from uninstalling applications from Start** +policy to remove the Start menu uninstall command for applications. This policy +controls the Start menu user experience. It doesn't uninstall an MSIX package and +isn't a blanket control that prevents every package-removal path. + +* **GPO:** `Computer Configuration\Administrative Templates\Start Menu and Taskbar` + or `User Configuration\Administrative Templates\Start Menu and Taskbar` +* **Registry-backed setting:** `Software\Policies\Microsoft\Windows\Explorer` + `NoUninstallFromStart` +* **Start menu uninstall:** If enabled, users can't uninstall apps from Start. If + disabled or not configured, users can access the uninstall command from Start. +* **Scope and limitations:** This policy is documented for the Start menu + uninstall command. It doesn't document a block for uninstall initiated from + **Settings**, PowerShell commands such as `Remove-AppxPackage`, or management + tools. Administrators and device management solutions can still remove MSIX + packages by using an authorized removal path. + +For more information, see [Start menu policy settings][start-menu-policy-settings] +and [ADMX_StartMenu Policy CSP][admx-startmenu-policy-csp]. + +[start-menu-policy-settings]: /windows/configuration/start/policy-settings#prevent-users-from-uninstalling-applications-from-start +[admx-startmenu-policy-csp]: /windows/client-management/mdm/policy-csp-admx-startmenu#nouninstallfromstart + + + + ### Overview of both Store signed and Trusted non-Store apps on Windows 10 2004 Enterprise The table below demonstrates what happens when *BlockNonAdminUserInstall* policy is **Enabled**, *AllowAllTrustedApps* is **Enabled** and *AllowDevelopmentWithoutDevLicense* is **Enabled** From f19296f9d6a263acb535c2954a1c2de6110cf3bd Mon Sep 17 00:00:00 2001 From: Roy <59626501+RDMacLachlan@users.noreply.github.com> Date: Wed, 26 Aug 2026 11:52:31 -0700 Subject: [PATCH 2/2] Clarify Start uninstall policy registry details Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- msix-src/group-policy-msix.md | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/msix-src/group-policy-msix.md b/msix-src/group-policy-msix.md index 5d7910cf..c7c6b2c5 100644 --- a/msix-src/group-policy-msix.md +++ b/msix-src/group-policy-msix.md @@ -1,7 +1,7 @@ --- title: How Group Policy works with packaged apps description: Describes how Group Policy works with apps that are converted to MSIX. -ms.date: 08/25/2026 +ms.date: 08/26/2026 ms.topic: article keywords: msix --- @@ -47,8 +47,15 @@ isn't a blanket control that prevents every package-removal path. * **GPO:** `Computer Configuration\Administrative Templates\Start Menu and Taskbar` or `User Configuration\Administrative Templates\Start Menu and Taskbar` -* **Registry-backed setting:** `Software\Policies\Microsoft\Windows\Explorer` - `NoUninstallFromStart` +* **Computer registry policy:** Key + `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer`; value name + `NoUninstallFromStart`; type `REG_DWORD`. +* **User registry policy:** Key + `HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer`; value name + `NoUninstallFromStart`; type `REG_DWORD`. +* **Registry value data:** When Group Policy applies this ADMX-backed setting, it + sets the value to `1` when the policy is enabled and `0` when the policy is + disabled. * **Start menu uninstall:** If enabled, users can't uninstall apps from Start. If disabled or not configured, users can access the uninstall command from Start. * **Scope and limitations:** This policy is documented for the Start menu @@ -57,16 +64,10 @@ isn't a blanket control that prevents every package-removal path. tools. Administrators and device management solutions can still remove MSIX packages by using an authorized removal path. -For more information, see [Start menu policy settings][start-menu-policy-settings] -and [ADMX_StartMenu Policy CSP][admx-startmenu-policy-csp]. - -[start-menu-policy-settings]: /windows/configuration/start/policy-settings#prevent-users-from-uninstalling-applications-from-start -[admx-startmenu-policy-csp]: /windows/client-management/mdm/policy-csp-admx-startmenu#nouninstallfromstart - - - +For more information, see +[Start menu policy settings](/windows/configuration/start/policy-settings#prevent-users-from-uninstalling-applications-from-start) +and +[ADMX_StartMenu Policy CSP](/windows/client-management/mdm/policy-csp-admx-startmenu#nouninstallfromstart). ### Overview of both Store signed and Trusted non-Store apps on Windows 10 2004 Enterprise The table below demonstrates what happens when *BlockNonAdminUserInstall* policy is **Enabled**, *AllowAllTrustedApps* is **Enabled** and *AllowDevelopmentWithoutDevLicense* is **Enabled**