Category: Apps

Adding SYSTEM to Administrators group causes modern apps to fail in Windows 8.1

After extensive troubleshooting, hours after hours, I have finally located a certainly interesting problem with the install routine of modern apps, including the immersive control panel in Windows 8.1 (with Update).

Problem description

Whenever a user logs into a domain joined Windows 8.1 machine all modern apps included in the image have “x” / crosses on them and they cannot be started. Also the immersive control panel an all its settings are unavailable. A few of the error messages and codes:

Trying to start a modern app:

This app can’t open. There’s a problem with <app name>. Contact your system administrator about repairing or reinstalling it

or

This app does not support the contract specified or is not installed.

and in Swedish:

Den här appen stöder inte det angivna avtalet eller så har det inte installerats.

Trying to install an app using Add-AppxPackage PowerShell cmdlet:

Add-AppxPackage : Deployment failed with HRESULT: 0x80073CF6, Package could not be registered. error 0x8007064A: Cannot register the request because the following error was encountered while initializing the windows.repositoryExtension extension: The configuration data for this product is corrupt. Contact your support personnel.

 

Cause

After going through a bunch of GPOs and hundreds of settings and excluding the most likely settings I finally reached out to what turned out to be the cause. Simply the use of “restricted groups” in group policies to add NT AUTHORITY\SYSTEM to the local Administrators group on the Windows 8.1 machines is what is the cause. The problem can easily be reproduced by adding SYSTEM to the Administrators group on domain or non-domain joined machines.

BE AWARE: SYSTEM has more privileges on a Windows box than an Administrator. Adding SYSTEM to the local administrators group effectively lowers the privileges of the SYSTEM account which apart from apparently causing modern apps to fail have a bunch of other unpredicted results on a Windows machine.

Solution

The solution is to remove SYSTEM from the local Administrators group from being applied via restricted groups. Adding the group SYSTEM to the local Administrators group is not necessary as SYSTEM is a member of the Administrators group per default, although it is not visible in the GUI (Computer Management).

Taming the user interface in Windows 8.1 for enterprise users

It is no secret that there are challenges related to the user interface in Windows 8.1. It is no secret that it has raised a lot of feelings – both good and bad. It is no secret that Microsoft is aware of the issues and they are bit by bit working on addressing them.

Windows 8.1 is without doubt the greatest and best operating system from Microsoft to date in terms of features and when it comes to security, performance, stability and responsiveness. Add to that an active development and continious distribution of fixes makes which Windows 8.1 the most dynamic Windows release to date.

However, not many enterprises use modern apps on their desktop/laptop machines and will not do so for quite some time. This blog post is intended to show you how you can make Windows 8.1 behave well in enterprises if you want your users to recognize themselves in the new user interface in Windows 8.1.

Boot to Desktop

The option for the user to instantly get to the desktop is imperative when matching the user experience to what they are used to. This means that instead of landing on the start panel after login, the user is taken straight to the desktop. Another issue with the user interface in Windows 8.1 is that if the user for instance open a PDF file from a desktop application, the PDF file will open in the Reader app (that is if Adobe Reader or another PDF reader has been installed). However, after closing the modern app the user is not brought back to the desktop application, instead lands on the Start panel. The below group policy setting solves these two “issues”.

In the Group policy Editor, locate the setting “Go to the desktop instead of Start when signing in or when or when all the apps on a screen are closed” located in User Configuration > (Policies) > Administrative Templates > Start Menu and Taskbar and set it to Enabled.

Desktop background on start panel

A small but never the less important setting that will make your users recognize the desktop is the setting to make the desktop background image being present in the start panel.

Activate this setting by creating a User Group Policy Preference registry item with the following information:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent
Value name: MotionAccentId_v1.00
Value type: REG_DWORD (32-bit)
Value data:  000000DB (Hexadecimal)

File extensions for modern apps

In Windows 8.1 images there are a bunch of modern apps included, which are installed the first time a user log in to a Windows 8.1 machine. You can when building your Windows 8.1 image remove all provisioned modern apps which will not only speed up the first login to a machine but also prevent users from opening for instance pictures in the modern app picture viewer and instead open them in “Windows Photo Viewer” on the desktop.

Solution 1: Remove all provisioned apps by using Ben Hunter’s excellent script for this, see http://blogs.technet.com/b/deploymentguys/archive/2013/10/21/removing-windows-8-1-built-in-applications.aspx. In the scripts you see the relevant commands which can also be run manually, removing one modern app at a time. See the PowerShell cmdlets Get-AppxProvisionedPackage and Remove-AppxProvisionedPackage.

Solution 2: If you do not want to remove the provisioned apps, you can use Michael Niehaus’s great guide to remove the file associations from the modern apps. Michael also show how to deal with this dynamically at deployment time as you probably want to have this configuration dynamic if you are using Windows 8.1 on touch enabled devices. The blog post is located at http://blogs.technet.com/b/mniehaus/archive/2014/01/10/configuring-file-associations-in-windows-8-1.aspx

Customizing the start panel

Well, there are PowerShell scripts which you can use to export a start panel layout and then send it out to multiple users using group policy settings. However, your users will not be able to actually modify it which kind of make this feature useless to say the least. What you can do to customize the start panel, awaiting better and more dynamic means to centrally manage the layout, is image customizing the layout of the start panel in your Windows 8.1 image, and then use the CopyProfile=true method to make that start panel layout the default for all new user profiles. This will present a default layout of your choice which the end users will be able to modify to their liking.

Remove the (annoying) help guidance arrows

The help arrows that appear the first time a user sign in to a Windows 8.1 machine are important for the users to learn how to reach the charms menu and navigate in the new user interface, when they actively or mistakenly end up there. However these little helper arrows tend to become rather annoying after time and you will be glad to see that there are ways to turn them off.

Create a User Group Policy Preference that adds the following registry:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\EdgeUI
Value name: DisableHelpSticker
Value type: REG_DWORD (32-bit)
Value data: 1

The power of search

I have been involved in many deployment projects with Windows 7 and my simple conclusion is that users tend to love not to use the built in search box in the start menu in Windows 7. Moving to Windows 8.1 is not going to change that and especially not as the users have no idea that they can just type anything while on the start panel and a search will be performed. I’m still waiting for a group policy setting that will make users use search instead of clicking and clicking and clicking but until that arrives instruct your Windows 7 and Windows 8.1 to use the built in search feature.

Summary

Well, by taming how the user interface behaves and my modifying or totally removing the modern apps the start panel goes back to just being the search feature and the new user interface is acting pretty much as it always have traditionally in Windows. And at the time of this writing we know that there will be an update in April 2014 that will present even further improvements to the UI. Things are improving but rest assured, the good old start menu as we know it since Windows 95 will not be back.