Block Metro App with GPO – Software Restriction Policy

So I finally found the answer. In our Software Restrictions rules there is a path rule as such:

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%

This allows any executable inside of the Program Files directory and it's child directories to run unencumbered. This path is added by default when you configure Software Restrictions. Removing this path rule causes all programd to be denied, even if their executable is explicitly added as an unrestricted path.

Which begs the question: If 99% of all programs are installed to the Program Files directory, but I want to restrict certain programs, how can I achieve this with Software Restrictions?

Equally important is the question, exactly what good are Software Restrictions except for those programs or executables not located in Program Files?

You can try to run gpupdate as admin if you have not tried that.

Software restriction policies do not apply when Windows is started in Safe Mode. You can run gpupdate in Safe Mode to refresh the software restriction GPO.