Details
This service manages Apps that are pushed to the device from the Microsoft Store App running on other devices or the web.
The recommended state for this setting is: Disabled.
Rationale:
In a high security managed environment, application installations should be managed centrally by IT staff, not by end users.
Solution
To establish the recommended configuration via GP, set the following UI path to: Disabled.
Computer ConfigurationPoliciesWindows SettingsSecurity SettingsSystem ServicesWindows PushToInstall Service (PushToInstall)
Impact:
Users will not be able to push Apps to this device from the Microsoft Store running on other devices or the web.
Default Value:
Manual (Trigger Start)
CIS Controls:
Version 6
9.1 Limit Open Ports, Protocols, and Services
Ensure that only ports, protocols, and services with validated business needs are running on each system.
Version 7
9.2 Ensure Only Approved Ports, Protocols and Services Are Running
Ensure that only network ports, protocols, and services listening on a system with validated business needs, are running on each system.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.