How Windows 10 Pro installs unwanted apps (Candy Crush) and how to stop it

Updated on 24th November 2017: This article applies to version 1607, 1703, 1709.

With the Windows 10 Pro version 1607 update – also know as the Anniversary Update – Microsoft further strips small and medium businesses from important Group Policy settings. This iteration of the operating system makes it really tedious to provide a clean desktop to my customers and their users, unless they upgrade to the Enterprise edition. This is not financially viable for the majority of them, but that is another matter …

In this article I will focus on the options you have to keep your Windows 10 Pro edition from showing or even installing unwanted apps. If you ever wondered how to keep Candy Crush and other Windows Apps out of your business, or why your methods won’t work with the Anniversary Update anymore, this article is for you.

To be more specific, the main issue in Windows 10 Pro version 1607 and upwards is, that it is no longer possible to turn off the Microsoft Consumer Features. (If you are interested about what Group Policy settings are currently reserved for the Enterprise editions, Microsoft keeps track of them here: Group Policy settings that apply only to Windows 10 Enterprise and Education Editions.)

Before the Anniversary Update, on Windows 10 Pro version 1511, it was totally possible to turn the Microsoft Consumer Features off. There are two ways to do so. Go to the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent and create a DWORD with the name DisableWindowsConsumerFeatures and assign the value 1. Or simply use the Group Policy editor, which does the exact same thing. There is a TechNet blog post Seeing extra apps? Turn them off that goes a little more into detail. Not really worth reading, now that it does no more apply to the Anniversary Update.

The mysterious workaround (that seems to work, but does not)

Now, there are a lot of web sites and blogs claiming to having found a workaround, amongst them winaero.com. Their solution is to use Windows AppLocker to block Spotlight. I will say it as clear as possible: This. Is. Bullshit.

Not only can’t it work because Windows AppLocker is an Enterprise feature available only to Enterprise and Education editions. It says right there in the docs: “AppLocker is included with enterprise-level editions of Windows.” and is therefore not available on Windows 10 Pro. What is more, the author of before-mentioned article didn’t even activate AppLocker, so it couldn’t even have worked for him if he had the Enterprise edition. Naturally, such mistakes go by unnoticed if you don’t validate your changes to configuration.

Enabling AppLocker

So why do people believe his article? Because they don’t understand how Microsoft does App advertising on Windows 10. Chances are that they already disabled app suggestions and removed all the unwanted app tiles from the start menu – thereby solving that problem – before they tried to configure AppLocker.

How Windows 10 Pro advertises and installs unwanted apps

Before I jump right in, let me quickly explain how Windows 10 advertises and sometimes silently installs apps.

Windows 10 has two ways of advertising Windows Apps and two locations where it does so, and it all happens in the Start menu. If you look at the following picture you see that the most obtrusive are the dynamically inserted app tiles (you will find a better graphical representation on the obtrusiveness on the screenshots further down). Aside from that you find the suggestion pane in the app list on the left side in the Start menu.

Start menu areas
Source: Manage Windows 10 Start and taskbar layout

It is important to note that unwanted apps like Candy Crush are not pre-installed and neither are the suggestions or the dynamically inserted app tiles. It works like this: Let’s say a new employee logs on for the first time on his computer and he sees the First Sign-In Animation saying “Hi”. In the process of creating this new user profile, Windows registers all provisioned packages (apps) for the current user profile, checks a couple of registry key properties, builds the Start menu layout based on an XML file, checks for internet connectivity and then downloads app suggestions and downloads some dynamically inserted apps.

Let’s walk through this step for step.

Provisioned Apps

Provisioned Packages contain a basic set of tools to enhance a user’s experience with Windows 10. They contain the Windows Store, the Calculator, Skype, Mail & Calendar, Contacts and many more. They are stored in a special protected directory which is different from where Windows Apps are installed if you get them from the Windows Store.

Find a full list of provisioned packages in my other article Provisioned Packages (Provisioned Apps) in Windows 10 Pro. If you want to see what packages are provisioned to a new user profile, run the following PowerShell cmdlet in an elevated prompt.

Get-AppxProvisionedPackage -Online | Select DisplayName | Sort DisplayName

Suggestions

Suggestions appear once in a while when you open the Start menu, and they are just that: a suggestion. Meaning, they don’t install themselves. However, if you click on it, the app will get downloaded and installed immediately.

Whether suggestions are shown or not is decided by a registry key DWORD-property HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SystemPaneSuggestionsEnabled which can be enabled or disabled at any time by your users. Usually via the switch Occasionally show suggestions in Start which you find in the Settings App in Personalisation/Start.

Start menu layout

The Start menu layout for any new user profile is based on an customisable XML file in the Default user profile (C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml). If you look into it, you will see that there are a lot of placeholder tiles like the following.

<start:SecondaryTile
    AppUserModelID="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App"
    TileID="PreInstalled.DefaultStartLayout2.1"
    Arguments="creative-ms:default?p=DefaultStartLayout2&launch=ms-get-started://redirect%3Fid=placeholdertiles"
    IsSuggestedApp="true"
    <!-- … -->
/>

This tells us several things which bring me to the next section.
1. It is a placeholder tile.
2. It is linked with the ContentDeliveryManager app.
3. It is a suggested app.
4. They will be replaced by unwanted Apps like Candy Crush or FarmVille when connected to the internet.

If you want to read more about Start layout customisation I suggest this TechNet blog: Windows 10 Start Layout Customization

Dynamically inserted app tiles

Dynamically inserted app tiles are where you find all that bloatware like Candy Crush and FarmVille. They are placed in the Start menu only once during profile creation.

Whether dynamically inserted app tiles are placed in the Start menu during profile creation depends on two things:
1. The DefaultLayout.xml in the Default user profile includes them.
2. A registry key DWORD-property HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\PreInstalledAppsEnabled and very likely also …\OemPreInstalledAppsEnabled.

As the previous section suggests, those unwanted apps are actually dynamically inserted app tiles or enhanced placeholder tiles, which are provided with app suggestions by the ContentDeliveryManager app as soon as you connect the computer to the internet. Meaning that a removed placeholder is never automatically added back to your Start menu.

This shows very quickly if you install Windows 10 Pro on a computer without internet connection. Have a look at the two screenshots, before and after connecting the computer to the internet. Apps can and will only be silently installed if at least one of those placeholder tiles remain in your Start menu.

Default Start menu layout without internet connectionDefault Start menu layout with internet connection

Stopping Windows 10 Pro from installing unwanted apps

Now that you know how all this works, let’s get your client happy. Those are the steps necessary to prevent Windows 10 Pro version 1607 and upwards from installing all those unwanted Apps. Since we both are professionals and I already explained most of it, I keep this section quite short. I assume you know how to read the following snippets and how to roll out the changes in a domain environment.

Oh, just one thing: The *-AppxProvisionedPackage cmdlets will not work in startup and shutdown scripts. If you know a way to get it working that way, please let me know by dropping a comment below.

Disabling Suggestions

The following snippet will disable app suggestions for new user profile. For existing user profiles apply the registry change to the respective branch in the HKCU root instead of the HKU root.

reg load HKU\Default_User C:\Users\Default\NTUSER.DAT
Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name SystemPaneSuggestionsEnabled -Value 0
reg unload HKU\Default_User

Disabling dynamically inserted app tiles (unwanted apps)

There are two ways on doing this.

By changing the registry

The following snippet will disable the installation of the dynamically inserted app tiles (or placeholder tiles, or unwanted apps) for new user profile. Applying the registry key properties to existing profiles has no effect.

reg load HKU\Default_User C:\Users\Default\NTUSER.DAT
Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name PreInstalledAppsEnabled -Value 0
Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name OemPreInstalledAppsEnabled -Value 0
reg unload HKU\Default_User

By customising the Start menu layout

Create a new user profile and remove all the placeholder tiles and customise the Start menu to the liking of your client. Then execute the following

New-Item "C:\temp" -Type Directory
Export-StartLayout -Path "C:\temp\DefaultLayout.xml"
# Delete the files manually please.

Run in an elevated prompt

Import-StartLayout -LayoutPath "C:\temp\DefaultLayout.xml" -MountPath "C:\"

Removing provisioned app packages

To round off this article this script provides an example on how to remove any unneeded provisioned app packages. What packages you remove depends on the needs of your client. Please have a look at my other article including a comprehensive list of provisioned app packages that come with Windows 10 Pro.

$appsToRemove = @(
    "Microsoft.3DBuilder",
    "Microsoft.Appconnector",
    "Microsoft.BingFinance",
    "Microsoft.BingNews",
    "Microsoft.CommsPhone",
    "Microsoft.ConnectivityStore",
    "Microsoft.DesktopAppInstaller",
    "Microsoft.Getstarted",
    "Microsoft.Messaging",
    "Microsoft.MicrosoftOfficeHub",
    "Microsoft.MicrosoftStickyNotes",
    "Microsoft.Office.OneNote",
    "Microsoft.Office.Sway",
    "Microsoft.OneConnect",
    "Microsoft.People",
    "Microsoft.SkypeApp",
    "Microsoft.StorePurchaseApp",
    "Microsoft.WindowsAlarms",
    "Microsoft.WindowsCamera",
    "microsoft.windowscommunicationsapps",
    "Microsoft.WindowsPhone",
    "Microsoft.WindowsSoundRecorder",
)

# The *-AppxProvisionedPackage cmdlet do not work as startup and shutdown scripts.
Get-AppxProvisionedPackage -Online | % { if($_.DisplayName -in $appsToRemove){ Remove-AppxProvisionedPackage } }

Conclusion

I hope to having provided you some assistance in cleaning up your digital workspace.

If you have any suggestions for improvements, please let me know in the comments.

  • Daniel

34 Replies to “How Windows 10 Pro installs unwanted apps (Candy Crush) and how to stop it”

  1. Hi Daniel

    Thanks for putting your research out here for us. I’m lucky enough to work for an org with Enterprise licenses. Do you know whether or not the methods you’ve shown here will adapt to the Enterprise version? If it does adapt, I imagine there’s probably some smaller details (that I’ll be happy to post in a comment if successful), but I was wondering if you were aware of any fundamental differences in the way Microsoft delivers app advertising for Enterprise editions. Thanks again. -G

    1. Hi Garistotle,

      thanks for your comment. I am not familiar with the enterprise version. But as far as I know it does not come with those dynamically inserted app tiles you know from the Pro edition. And you are able to fully use the existing Group Policies to disable app suggestions and a whole lot of other advertisement. I don’t know the GPOs from memory, but you should easily be able to find them.

  2. The command to disable dynamically inserted app tiles (i.e. reg save HKU\Default_User C:\Users\Default\NTUSER.DAT) cannot be executed on my machine. When I try to dave NTUSER.DAT, PowerShell says another process is accessing it and the file cannot be saved.

  3. Does this all still apply to 1709? Seems that as soon as we get comfortable with a new Windows 10 release a new one comes out and breaks everything we worked so hard to get in-place. I’m referring to the fact that if you removed provisioned packages in 1703, going to 1709 puts them all back.

    1. I have yet to check the details, but it should still apply on the whole. Yes, the re-provisioning of removed packages during the upgrade routine is very annoying.

  4. reg load HKU\Default_User C:\Users\Default\NTUSER.DAT
    Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name PreInstalledAppsEnabled -Value 0
    Set-ItemProperty -Path Registry::HKU\Default_User\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager -Name OemPreInstalledAppsEnabled -Value 0
    reg save HKU\Default_User C:\Users\Default\NTUSER.DAT
    reg unload HKU\Default_User

    Where would you run this?
    Would you run in all in Powershell? I was thinking of sticking it all in a PowerShell Script file and running it in SCCM.

    Any suggestions?

  5. Thanks for this. When I started googling this stuff so many of the top hits are for things that obviously make no sense (like the one example you outlined). I was starting to piece together that alot of this crap was coming from the ContentDeliveryManager reg key but there are so many things in there its hard to know what does what.

    If you start poking around in there, there’s actually another registry key under ContentDeliveryManager called SuggestedApps that contains a whole list of these crapware apps (like candycrush, asphalt, facebook, etc.). It’s basically a list of package ID’s for all these apps. On top of disabling the registry keys you were mentioning I went in there and deleted all those as well. This is on 1709 so I’m not sure if its a new thing (we jumped from 1607 to 1709 so i don’t have a lot of experience messing with 1703).

  6. About the registry key DWORD-property
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\OemPreInstalledAppsEnabled, to be used with caution.

    For new users, it seems that there will no apps in their new session, and that includes Microsoft apps : Bing Weather, Skype… AND Windows 10 new Settings panel !

    My tests.

    I use the following DOS command in batch file (.bat), but you can use translate to Powerwell.

    reg load HKU\Default_User “C:\Users\Default\NTUSER.DAT”
    reg add “HKU\Default_User\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager” /v “PreInstalledAppsEnabled” /t REG_DWORD /d 0x00000000 /f
    reg add “HKU\Default_User\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager” /v “OemPreInstalledAppsEnabled” /t REG_DWORD /d 0x00000000 /f
    reg unload HKU\Default_User

    I switch OemPreInstalledAppsEnabled with 0x00000000 or 0x00000001.
    I execute the batch file.
    I create new user, or I delete a user profile datas.

    I open the new (or empty) user windows session.

  7. Hi! great post thank you!
    i have a question regarding the modifying the stat menu part, you say to run: Import-StartLayout -LayoutPath “C:\temp\DefaultLayout.xml” -MountPath “C:\”
    do i run this on the mounted wim file and then save it back or on my testing machine that i will sysprep?
    thanks,
    Sean

  8. Tell you what its not much better on Enterprise edition. Although the consumer apps can be turned off you’re still stuck with bloatware like the “Mail” app which insists as being the default mail app and presents itself in the task bar.

    I’ve tried using login scripts to remove the APPX apps however I find if I call as script (any script) during the first user login (RunOnce) it breaks the profile setup and none of the Appx apps are installed at all.

    As for the “*-AppxProvisionedPackage” not working it may be because the modules for them aren’t loaded. have you tried starting a transcript and logging it to see what errors are thrown?

    1. I figured a way to remove the unwanted apps now. It ended up being a simple solution in the end.

      checking out the registry I found HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx

      within that there is two reg keys Applications & InboxApplications

      Applications – are the Provisioned Packages
      InboxApplications – are those other ones

      each reg key contains an xml with a location for the package. (Normally %Programfiles%WindowsApps)

      During first logon each package is installed from this path so if you remove the key you remove the install

      What I did was use a script to move the unwanted keys from Applications and placed them in different path for safe keeping.

      I’ve added the script to run as part of OS deployment before anyone logs.

      Rough but works sample script.

      Use any of this info at your own risk of course 😉

      #Remove Appx packages from first user login 
      #Remove first run Appx
      
      $AppxDir = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications"
      
      $AppxDirBackup = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\APP_Backup"
      
      If ((Test-path $AppxDirBackup ) -eq $false){
      
      New-Item $AppxDirBackup
      
      }
      
      #List the Apps you want to remove
      $App = @(
      'Microsoft.OneConnect'
      'Microsoft.Messaging'
      'Microsoft.MicrosoftOfficeHub'
      'Microsoft.MicrosoftSolitaireCollection'
      'Microsoft.Office.OneNote'
      'Microsoft.People'
      'Microsoft.SkypeApp'
      'Microsoft.StorePurchaseApp'
      'microsoft.windowscommunicationsapps'
      'Microsoft.WindowsFeedbackHub'
      'Microsoft.XboxApp'
      'Microsoft.XboxGameOverlay'
      'Microsoft.XboxIdentityProvider'
      'Microsoft.XboxSpeechToTextOverlay'
      'Microsoft.ZuneMusic'
      'Microsoft.ZuneVideo'
      )
      
      #Both aren't happy with being removed.
      #Windows.ContactSupport
      #Microsoft.XboxGameCallableUI
      
      $ReportPath = "C:\logs\AppxRemover" 
      $ReportName = "WindowsAppx-"+(Get-date -format dd-MM-yyyy) + ".csv"
      $Report = $ReportPath + $ReportName
      
      If((Test-path $Report) -eq $false){
      
      New-Item $Report -ItemType File -Force
      
      }
      
      $reportObj =@()
      foreach($a in $App){
      
      $success = $null
      $aPath = Get-ChildItem $AppxDir | Where {$_.Name -like ("*" + $a + "*")} | Get-ItemProperty
      
      Try{
      Copy-Item -Path $aPath.pspath -Destination $AppxDirBackup
      
      IF ((Test-path "$AppxDirBackup\$($apath.PSChildName)") -eq $true){
      
      Remove-Item $aPath.pspath -Force -Recurse
      
      $success = "1"
      }
      
      }CATCH{"Oops"}
      
      $ReportObj += New-Object psobject -Property @{
      
      Entry = $a
      Package = $apath.PSChildName
      Result = $success
      }
      }
      
      $ReportObj | Export-csv $ReportPath -Force
      
    2. Windows always shipped with a mailing application. So does every other operating system, so I don’t really see your point.

      I did start a transscript, but I couldn’t get much of the error. It’s also a long time ago, so I don’t remember very much, but yeah, it was that some module wasn’t loaded and couldn’t be laoded manually at that point.

      1. Sorry Daniel.

        I mean to say the Mail Appx package was setting itself as the default mail app even though Office was installed.

        Most likely because Office was installed as part of the OSD and the Mail package is installed when the user log ins

    3. Just fyi WP: I believe you can disable the default “Mail” app by uninstalling one of the Provisioned packages – WindowsCommunicationsApp, or something similar. Try running this command from Powershell: Get-AppxProvisionedPackage -Online | Out-Gridview -PassThru | Remove-AppxProvisionedPackage -Online (this will let you pick through a list of apps with check boxes to uninstall each)

      1. Hi Ryan, you may remove the Mail package. I even recommend it in a business environment, where users are provided with Outlook. In my experience, the Mail app confuses people with little computer knowledge resulting in more support requests. Check out my other article about provisioned apps in Windows 10

  9. For some reason, I am able to run this as a startup script:

    Get-AppXProvisionedPackage -LogLevel WarningsInfo -LogPath c:\Temp\psPv2.txt -online | WHere-Object {$_.DisplayName -in $appsToRemove} | Remove-AppxProvisionedPackage -online

    I added:
    Set-ExecutionPolicy Bypass
    as the first line of Daniel’s script, before declaring the variable.

    I know it is running because I am dumping info and errors to a log and it is definitively getting processed.

    Some of the MANY things I still don’t understand are:

    The log shows that provisioned app has been removed. When I run get-AppxProvisionedPackage, the app is not listed. BUT it still shows up in the All Applications menu. When I click on it, I am in some cases taken to the store to “Get” the app (for instance Microsoft Wallet). In other cases it seems to open just fine (for instance Sway). I am totally puzzled by that.
    Out of pure frustration I reset my test workstation back to default Win10. Before adding it to a domain or doing anything else, I logged in as the default administrator account. I ran powershell to show me what Provisioned Apps were available. There were only 8 of them. And running Get-AppxPackage -AllUsers is also giving me a much shorted list than expected. There is no Sway, Wallet, Duolingo, Solitaire, none of that. So where are they, or when will they show up?

    I was hoping we could run a script on each new workstation that would remove all unwanted apps before we even create the first domain profile. But they are not there.

    What am I missing here???

    Thanks,

    Pavla

    Clean workstation – provisioned apps (DisplayName)

    Microsoft.GetHelp
    Microsoft.Microsoft3DViewer
    Microsoft.MSPaint
    Microsoft.Windows.Photos
    Microsoft.WindowsCalculator
    Microsoft.WindowsFeedbackHub
    Microsoft.WindowsStore
    Microsoft.XboxSpeechToTextOverlay

    Clean workstation – Appx apps for All Users minus .Net packages (Name):

    InputApp
    Microsoft.AAD.BrokerPlugin
    Microsoft.AccountsControl
    Microsoft.BioEnrollment
    Microsoft.CredDialogHost
    Microsoft.ECApp
    Microsoft.LockApp
    Microsoft.MicrosoftEdge
    Microsoft.PPIProjection
    Microsoft.Windows.Apprep.ChxApp
    Microsoft.Windows.AssignedAccessLockApp
    Microsoft.Windows.CloudExperienceHost
    Microsoft.Windows.ContentDeliveryManager
    Microsoft.Windows.Cortana
    Microsoft.Windows.HolographicFirstRun
    Microsoft.Windows.OOBENetworkCaptivePortal
    Microsoft.Windows.OOBENetworkConnectionFlow
    Microsoft.Windows.ParentalControls
    Microsoft.Windows.PeopleExperienceHost
    Microsoft.Windows.PinningConfirmationDialog
    Microsoft.Windows.SecHealthUI
    Microsoft.Windows.SecondaryTileExperience
    Microsoft.Windows.SecureAssessmentBrowser
    Microsoft.Windows.ShellExperienceHost
    Microsoft.XboxGameCallableUI
    windows.immersivecontrolpanel
    Windows.PrintDialog
    Microsoft.Advertising.Xaml
    Microsoft.Advertising.Xaml
    Microsoft.GetHelp
    Microsoft.Microsoft3DViewer
    Microsoft.MSPaint
    Microsoft.Services.Store.Engagement
    Microsoft.Services.Store.Engagement
    Microsoft.Windows.Photos
    Microsoft.WindowsCalculator
    Microsoft.WindowsFeedbackHub
    Microsoft.WindowsStore
    Microsoft.XboxSpeechToTextOverlay

  10. Are you planning to update this blog post to include the changes made when Windows Released the 1709 creator’s update? Some of these apps do not remove and now it also installs Photoshop, Duolingo, Eclipse Manager, Speed Test, Power BI, etc in addition to the super annoying games whenever a new profile is made. I’ve been scouring the internet and have yet to find a solution to removing all of this from the provisioned packages. Any ideas?

      1. I’m not sure what they changed, but those show up every time a new profile is made and I’ve been unable to remove them from the provisioned packages. (It is with Windows 10 Pro 1709).

  11. Hi
    I tried to just copy the commands into cmd or powershell cause i dont know how to do all of this and it does not work. Probably because i have a existing user profile and i also cant delete it. I´m sorry to bother you but i have no clue of this. May someone could send me the exact commands i have to copy in cause i probably wont get it done otherwise.

  12. Is the save command in the first script unnecessary? It returns:

    ERROR: The process cannot access the file because it is being used by another process.

    But it seems to be working – I ran the other commands and then created a new user and the change propagated to their currentuser hive when they logged in.

Leave a Reply