If you connect a domain-joined Windows 11/10/Server computer to a VPN connection that has force tunneling enabled, and when you try to open Microsoft Store, it does not open, and you receive a This page failed to load error message, then this post is intended to help you. In this post, we will identify the potential cause of why domain-joined Windows computers on a VPN is not opening the Microsoft Store app and provide the solution you can try to help remediate this issue.
According to Microsoft, the Windows Store app uses a security model that depends on network isolation. The store app must be enabled and allowed to access specific network capabilities and boundaries.
When the Windows Firewall profile is not Public, there is a default block rule that blocks all outgoing traffic that has the remote IP set as 0.0.0.0. While the computer is connected to a VPN connection that has force tunneling enabled, the default gateway IP is set as 0.0.0.0. Therefore, if the network access boundaries aren’t set appropriately, the default block firewall rule is applied, and Microsoft Windows Store app traffic is blocked.
However, if you do one of the following operations, Windows Store opens as expected:
- Disconnect the computer from the domain, and then connect to the VPN connection.
- Connect the computer to a VPN connection that has force tunneling disabled.
- Turn off the Windows Defender Firewall service, and then connect the computer to the VPN connection.
Microsoft Store not working after joining domain
If you’re faced with this issue where a domain-joined Windows computer on a VPN is not opening Microsoft Store app, you can follow the instructions outlined below to easily fix this issue.
- Open the Group Policy Management snap-in (gpmc.msc).
- Open the Default Domain Policy for editing.
- From the Group Policy Management Editor, expand Computer Configuration > Policies > Administrative Templates > Network.
- Select Network Isolation.
- In the right pane, double-click Private network ranges for apps.
- In the Private network ranges for apps dialog box, select Enabled.
- In the Private subnets text box, type the IP range of your VPN adapter.
For example, If your VPN adapter IPs are in the 172.x.x.x range, add 172.0.0.0/8 in the text box.
- Click OK.
- Double-click Subnet definitions are authoritative.
- Select Enabled.
- Click OK.
- Restart the client to make sure that the GPO takes effect.
Windows will now create a firewall rule that allows the traffic and will override the previous outbound block rule with the new rule because after the Group Policy is applied, the IP range that was added is the only private network range that is available for network isolation.
You can now push the same GPOs from the DC to multiple computers. And on the individual computers, you can check the registry location below to make sure that the GPO takes effect:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation
Finally, when your VPN address pool range changes, you should change this GPO accordingly – else, the issue will recur.
That’s it!
