This article focuses on understanding and implementing the Turn off Push To Install service Policy Using Intune. We will explore how to apply this policy using Intune’s Configuration Profiles. The main goal is to acquire understanding and hands-on experience in effectively turning off the Push To Install service Policy Using Intune.
Enabling the Turn off Push To Install service Policy Using Intune setting will result in the restriction of users from pushing apps to the device from the Microsoft Store on other devices or through the web. This means that users will no longer have the capability to install apps on the device remotely using the Microsoft Store.
By enabling this setting, organizations can exercise control over app installations and limit the sources from which apps can be pushed to the device. This can be useful in situations where strict control over app deployment is required, ensuring that only authorized methods or devices are used for installing apps on the device.
Enabling this setting can help prevent unauthorized or unapproved app installations on the device, ensuring that only trusted and vetted apps are installed through designated channels. It allows organizations to maintain a more controlled and secure app environment, reducing the potential risks associated with unverified or unapproved app sources.
By managing app installations in this manner, organizations can enforce consistent app deployment practices, maintain compliance with corporate policies, and mitigate the potential introduction of malicious or unverified apps onto devices within their network.
- Set Local Admin Password Management Policy using Intune
- How to Disallow Online Tips Policy Using Intune
Windows CSP Details DisablePushToInstall
We will see Windows CSP Details for this Policy setting DisablePushToInstall. When this setting is enabled, it introduces a restriction on the ability of users to push apps to the device from the Microsoft Store. Specifically, users will no longer have the option to remotely install apps onto the device either from other devices or through the web-based version of the Microsoft Store.
CSP URI – ./Device/Vendor/MSFT/Policy/Config/ADMX_PushToInstall/DisablePushToInstall
Turn off Push To Install service Policy Using Intune
To apply the Turn off Push To Install service Policy Using Intune, follow the steps stated below:
- Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
- Select Devices > Windows > Configuration profiles > Create a profile.
In Create Profile, Select Windows 10 and later in Platform, and Select Profile Type as Settings catalog. Click on Create button.
| Platform | Profile Type |
|---|---|
| Windows 10 and later | Settings Catalog |
On the Basics tab pane, provide a name for the policy as “Turn off Push To Install service Policy.” Optionally, you can enter a description for the policy and then proceed by selecting “Next.
Now in Configuration settings, click Add Settings to browse or search the catalog for the settings you want to configure.
In the Settings Picker windows, search by the keyword Push to Install, you will see one category by the name of Administrative Templates\Windows Components\Push To Install, and select this.
When you select the option as stated above, you will see the Turn off Push To Install service. After selecting your setting, click the cross mark at the right-hand corner, as shown below.
Now, in the Administrative Templates, set Turn off Push To Install service to Enabled, as shown below in the image.
Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required) and click Next to continue. Now in Assignments, in Included Groups, you need to click on Add Groups, choose Select Groups to include one or more groups, and click Next to continue.
In the Review + Create tab, you need to review your settings. After clicking on Create, your changes are saved, and the profile is assigned.
Upon successfully creating the “Turn off Push To Install service Policy,” notification will appear in the top right-hand corner, confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.
Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Intune Report for Turn off Push To Install service Policy
From Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.
To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list. By reviewing the device and user check-in status, you can determine if the policy has been successfully applied. If you require more detailed information, you can click on “View Report” to access additional insights.
Intune MDM Event Log
To verify the successful implementation of String or integer policies on Windows 10 or 11 devices through Intune, you can leverage event IDs 813 and 814. These event IDs provide valuable insights into the application status of the policy as well as the specific value assigned to the policy on those devices. In the case of this particular policy, the value is a String and is linked to the event ID 814.
By analyzing these event IDs, you can gain a clear understanding of the policy’s application status and the corresponding value associated with it on the devices in question.
To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
MDM PolicyManager: Set policy string, Policy: (DisablePushToInstall), Area: (ADMX_PushToInstall), EnrollmentID requesting merge: (E874113F-6CF1-4718-8730-0553BDF7C4AC), Current User: (Device), String: (<enabled />), Enrollment Type: (0x6), Scope: (0x0).
Upon examining the above-mentioned log in the Event Viewer, you will discover crucial details such as the Area and Enrollment ID. These pieces of information are instrumental in identifying the registry path. To find the relevant information, kindly refer to the table provided below:
| Area | Policy | String | Scoped | Event ID |
|---|---|---|---|---|
| ADMX_PushToInstall | DisablePushToInstall | Enabled | Device | 814 |
The information provided in the above table for Turn off Push To Install service Policy Using Intune can be utilized to access the registry settings storing group policy configurations on a target computer. By running “REGEDIT.exe” on the target computer, you can navigate to the specific registry path where these settings are stored.
- Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\E874113F-6CF1-4718-8730-0553BDF7C4AC\default\Device\ADMX_PushToInstall
When you navigate to the above path in the Registry Editor, you will find the registry key with the name DisablePushToInstall. Refer to the table and image below.
| Registry Name | Value |
|---|---|
| DisablePushToInstall | Enabled |
Author
Abhinav Rana is working as an SCCM Admin. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.