MS, Win10 Pro, musical chairs

[jinjuku]

I push Windows 10 Pro for customers because I have way more control via local machine policy.

For the longest time one of the nice things with 10 Pro is the ability to turn off the Microsoft Consumer 'Experience'. This is where MS installs a bunch of games like Candy Crush Saga etc....

It's one of the main reasons I spend the extra $$ for Pro.

So what does M$ do in the latest update? They restrict what was previously available and make it only now for Ultimate and Enterprise Editions!

BobSagat!

 

[BoredSysAdmin]

Does this help you?
http://winaero.com/blog/stop-windows-10-anniversary-update-from-installing-candy-crush-and-other-unwanted-apps/

 

[jinjuku]

No, because what the article doesn't state is that you can't apply applocker to anything other than Ent/Ult editions.

And for you users of Win10 home, secpol.msc isn't available to you from MS.

You can CREATE policies that you want to roll out on Pro, but you can only roll them to the aforementioned builds.

And that's besides the point. MS had a feature in Pro, a reason that I pay for the upgrade, and they pull it at whim.

 

[BoredSysAdmin]

No, because what the article doesn't state is that you can't apply applocker to anything other than Ent/Ult editions.

And for you users of Win10 home, secpol.msc isn't available to you from MS.

You can CREATE policies that you want to roll out on Pro, but you can only roll them to the aforementioned builds.

And that's besides the point. MS had a feature in Pro, a reason that I pay for the upgrade, and they pull it at whim.

Ah, I see what you mean:
https://docs.microsoft.com/en-us/windows/device-security/applocker/requirements-to-use-applocker

You can use the AppLocker CSP to configure AppLocker policies on any edition of Windows 10. You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016.

Oh, Well. Sun shines, Earth is round and Microsoft are being dicks yet again.

 

[jinjuku]

Ah, I see what you mean:
https://docs.microsoft.com/en-us/windows/device-security/applocker/requirements-to-use-applocker


Oh, Well. Sun shines, Earth is round and Microsoft are being dicks yet again.

You figure that the ability to WHITELIST applications for the machine would be something they make available for all builds.

It's a KILLER security feature. By only allowing certain executables to run you deny EVERYTHING else. Including ransomware.