Removing Windows 10 Apps and Advertising

You’ve found yourself in the same situation as most other sysadmins in the world. Now, you’ve been tasked to clean up Windows 10 for your organization. You’ve searched the internet and found blogs and forum posts with random bits of PowerShell, most of which only run within the current user context.  Not to fear, this blog will cover exactly what you need to do in removing Windows 10 apps. Brigg, Jordan and I spent way too many hours digging through the same articles and testing what we discovered. This blog will cover the way we recommend going about this process, and what has worked for us. This blog will cover three main points:

  1. Using Group Policy to control telemetry and analytical data.
  2. Using PowerShell to install and remove Appx Packages, as well as Provisioned Appx Packages (Windows Store apps).
  3. Using PowerShell to maintain a white-list of Appx packages you want, and automatically removing the apps you don’t.

Group Policy And Removing Windows 10 Apps

Group Policy is an awesome tool that is historically underused. A lot of admins don’t always want to take the time to see what controls are available to them, nor do they keep their central store updated. For this blog, we’ll assume that you have updated your central store with the latest ADMX templates. If you haven’t done this, or don’t know how there is a really good write-up you can look at here.

We’re not going to spend a ton of time going over all the specific settings, as these will vary depending on what you are trying to accomplish and the target OS licensing level you have. There are quite a few settings that only apply to Education and Enterprise SKUs.  If only you had an application that could quickly identify what you have….

Check out this really great resource online to help navigate the plethora of available settings that is much easier to read than using the Group Policy editor directly. This site not only contains Windows ADMX templates but a HUGE amount of other applications. Give it a quick peek and identify what settings you want to change. When we were generating our GPO’s we had enough Chrome tabs open to consume many GB of RAM. 

This is what we ended up using on our webcast, this is very similar to the GPO’s we use internally:

Start a trial of PDQ Deploy

Managing Windows Store Apps

Next up on our list is managing those Windows store apps. A couple things to note before we continue. In WMF versions prior to 5.1 the -allusers parameter did not function correctly. This parameter now correctly behaves. We’ll assume you used your favorite patch management software to Deploy WMF 5.1 to your workstations.

Next up we’ll use our favorite patch management tool and PowerShell to remove appx packages. The basic format for the script is below:

##Remove All Packages 
$appname = @(
"*BingWeather*"
"*ZuneMusic*"
"*ZuneVideo*"
"*King*"
)
ForEach($app in $appname){
Get-AppxPackage -AllUsers -Name $app | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue
}

The script above uses wildcards (*) so that we don’t have to know the EXACT name of the appx package we want to remove.

That’s it, we’ve removed those packages and we’re done… or so you thought. What if you accidentally removed some appx packages you need, you know something like the calculator, or more importantly, Candy Crush.  Not to worry, we can put them back just as easily as we removed them. The script below will put Candy Crush back so you have something to do while you tell your boss you’re slaving away removing all those apps like they wanted.

######################################################### ##THIS WILL INSTALL ALL CANDY CRUSH GAMES! DO NOT RUN! ## ##IT IS REALLY JUST AN EXAMPLE OF HOW TO REINSTALL APPX## ######################################################### 
$path = Get-ChildItem -Path “C:\Program Files\WindowsApps” | Where-Object {$_.BaseName -like “*Candy*”} | select fullname
$registerpath = $path.FullName + “\appxmanifest.xml”
Add-AppxPackage -DisableDevelopmentMode -Register $registerpath

Windows 10 is a little sneaky on upgrade. All those apps we just removed, they’ll come back sometimes on cumulative updates, and almost always on build upgrades (1803 > 1809).  Not only that, those appx packages, don’t install like “normal applications.”

How Appx Packages Work

Let’s take a second to talk about how appx packages work. Thus far we’ve been using the term “appx package” this is a bit nebulous. All appx packages are different per-user, they are installed in the user context, and they can vary wildly between two users. Chances are on your workstation you’ve removed a bunch of stuff you don’t want to see.  Now, go grab one of your users, have them login to your workstation. Behold Candy Crush and Zune Music in all their glory! They’re back! But we just removed them right?

Short-Answer: Sort of.  

Long Answer: There are two “types” of appx packages:

Appx Packages – These are what you see as a user, they are what are installed and available to you.

Provisioned Appx Packages – These (for lack of a better word) are the “package cache.” These are the manifest of what packages to install for each NEW user when they login. This is why every time your OS upgrades, you have to remove those apps again.  This is part of what is going on behind the scenes of the fabulous message “hang tight, we’re getting things ready for you” when you login to a new (or freshly upgraded) Windows 10 machines.

How are we going to handle this?  Well, let’s just remove packages from the manifest.  Let’s go remove some of those provisioned packages:

##Remove Provisioned Packages 
$appname = @(
"*BingWeather*"
"*ZuneMusic*"
"*ZuneVideo*" "*king*"
)
ForEach($app in $appname){
Get-AppxProvisionedPackage -Online | where {$_.PackageName -like $app} | Remove-AppxProvisionedPackage -AllUsers -Online -ErrorAction SilentlyContinue }

Wrapping it Up

Ok, now we’re done. At this point, we’ve removed the appx packages that already exist, and we’ve also removed them from the provisioned package manifest.  Both of these scripts need to run to remove the current and prevent new packages each time you get a new machine, or they upgrade.

I lied, we’re not done. There are always many ways to do things right?! Here’s another method:

This one is a tag team between PowerShell and Group Policy. This will take care of all of the above, it’s a little “messier” but a whole lot easier. Who doesn’t like easy?  This part has no dependencies. Any version of WMF will work, and guess what, you don’t even need those fancy ADMX templates if all you are trying to do is remove apps. This script functions in the polar opposite of anything above. Here we’re building a whitelist and removing everything else with holy cleansing fire.

Obligatory word of caution, TEST this. Please. Unless you want to go back through everything above and start re-installing appx packages per user, in which case. go crazy remove it all, even the calculator. (Really, please don’t. It will cause you some unneeded whiskey consumption, your liver can only handle so much.  Unless you’re Lex, and in that case “Shut up liver! You’re fine!).

##Get Online Provisioned Packages 
$Packages = Get-AppxProvisionedPackage -Online | Select Packagename ##Create Your Whitelist - These are the things you want to keep $Whitelist = @(
   '*WindowsCalculator*',    
'*MSPaint*',    
'*Office.OneNote*'
)
##Remove all not whitelisted Applications
ForEach($App in $Packages){    
$Matched = $false    
Foreach($Item in $Whitelist){        
If($App -like $Item){            
$Matched = $true           
break        
}    
}    
if($matched -eq $false){        
Write-Host $app.PackageName is uninstalled        
Remove-AppxProvisionedPackage -PackageName $app.PackageName -Online    
}
}

Now to make it “automagic” Take the above .ps1 and create yourself a GPO.  In that GPO at each user login, run this script. That’s it. Easy. No worrying about provisioned vs. installed, we just remove everything not on our whitelist every single login. Good luck with your environment and removing Windows 10 apps. Don’t forget to leave us a comment if you were successful with what we’ve recommended.

2 responses

  • I was testing out your last script on this blog and it does not seem to be working.

    ##Get Online Provisioned Packages
    $Packages = Get-AppxProvisionedPackage -Online | Select Packagename ##Create Your Whitelist – These are the things you want to keep $Whitelist = @( <– move $Whitelist to next line
    '*WindowsCalculator*',
    '*MSPaint*',
    '*Office.OneNote*'

    If you move $Whitelist = @( to next line the script will run without errors but still does not remove any of the apps. Running PS as administrator and set PS to run scripts: set-executionpolicy remotesigned

    Would love to see this working.. maybe you could take another look at it. Thanks

Your email address will not be published.

Your Name

This site uses Akismet to reduce spam. Learn how your comment data is processed.