{"id":103709,"date":"2020-04-28T07:00:00","date_gmt":"2020-04-28T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=103709"},"modified":"2020-04-28T09:44:43","modified_gmt":"2020-04-28T16:44:43","slug":"20200428-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20200428-00\/?p=103709","title":{"rendered":"When you set Windows 10 to allow only Windows Store apps, it allows them to be installed by anyone, not just the Store app"},"content":{"rendered":"

In Windows 10 Settings, on the For developers<\/i> page, you have a choice for which programs can be installed:<\/p>\n

\n\n\n\n\n\n\n\n\n
\u25c9<\/td>\nWindows Store apps<\/td>\n<\/tr>\n
 <\/td>\nOnly install apps from the Windows Store.<\/td>\n<\/tr>\n
\u2b58<\/td>\nSideload apps<\/td>\n<\/tr>\n
 <\/td>\nOnly install apps from other sources that you trust, like your workplace.<\/td>\n<\/tr>\n
\u2b58<\/td>\nDeveloper mode<\/td>\n<\/tr>\n
 <\/td>\nInstall any signed app and use advanced development features.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

I’ve seen confusion over the first choice: Windows Store apps. Setting this option allows the installation of apps that came from the Windows Store.<\/p>\n

However, it doesn’t mean that they must be installed by the Windows<\/span> Microsoft Store app.<\/p>\n

Selecting Windows Store apps<\/i> allows any app that has been signed by the Microsoft Store, which typically happens when a developer submits the program to the Store.<\/p>\n

While it’s common for the installation to be done by the Store app itself, it doesn’t have to be.<\/p>\n

For example, Windows Setup itself installs a number of apps, like the Mail app, and it does so from files that come with the Windows installation media. Since Windows can be installed without an Internet connection, there needs to be a way to get these apps installed without involving the Windows Store app.<\/p>\n

You can do this installation yourself from PowerShell with the Add-AppxPackage<\/code> cmdlet. You can install it even though it’s not the Store app that’s doing the installation.<\/p>\n

Sideload apps<\/i> permits the installation of apps that are signed by a workplace whose certificate has been installed onto your system, typically when you join your computer to your workplace. This makes it possible for you to install line of business apps onto your system.\u00b9<\/p>\n

Note further than these limitations apply only to apps that are installed using the Appx\/MSIX installation process. It has no effect on classic MSI packages, or Win32 apps that use custom installers. Nor will it prevent you from just plugging in a USB thumb drive and running a Win32 app directly from it.<\/p>\n

The above Settings page is already out of date. Starting in Windows 10 build 18956, sideloading is enabled by default<\/a>, but there is a policy to disable it. All that’s left behind a toggle named Install apps from any source, including loose files<\/i>. Enabling this gets you what was previously called Developer mode<\/i>.<\/p>\n

The key word in all of this is from<\/i>. This policy checks where you got the app from<\/i>, not who it was installed by<\/i>.<\/p>\n

Bonus chatter<\/b>: The grammarian in me disapproves of the phrasing of the two choices, since the placement of the word only<\/i> is misleading. “Only install apps from the Windows Store” means “You can install apps from the Windows Store, but you can’t run them or anything else. The only thing you can do is install them.” I would have moved the word only<\/i> to the place where the restriction applies: “Install apps only from the Windows Store.”<\/p>\n

Bonus bonus chatter<\/b>: The second option has another problem: It combines only<\/i> (restrictive) with other<\/i> (additive). Even if you ignore the misplaced only<\/i>, the instructions “Only install apps from other sources that you trust, like your workplace” says that the only valid installation sources are the other ones. The default trusted sources are not allowed. I would have rephrased it as “Also install apps from other sources that you trust, like your workplace.” This highlights that this option is additive.<\/p>\n

\u00b9 The confusion likely stems from the vague term sideload<\/i>, which has two different meanings in common use.<\/p>\n

    \n
  1. To install software obtained from a third-party source.<\/li>\n
  2. To install software from existing files, rather than via streaming download.<\/li>\n<\/ol>\n

    The dialog above is using the first definition. It’s referring to the source of the app, not to the means of installation.<\/p>\n","protected":false},"excerpt":{"rendered":"

    It’s about the source of the program, not the delivery mechanism.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[104],"class_list":["post-103709","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-tipssupport"],"acf":[],"blog_post_summary":"

    It’s about the source of the program, not the delivery mechanism.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/103709","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=103709"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/103709\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=103709"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=103709"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=103709"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}