如果您将已加入域的Windows 10计算机连接到启用了强制隧道的VPN 连接^{(VPN connection)}，并且当您尝试打开 Microsoft Store^{(open Microsoft Store)}时，它​​没有打开，并且您收到“此页面加载失败”^{(This page failed to load)}错误消息，那么这篇文章是旨在帮助您。在这篇文章中，我们将确定VPN^(VPN)上已加入域的 Windows 10 计算机无法打开Microsoft Store应用程序的潜在原因，并提供您可以尝试帮助解决此问题的解决方案。

据微软^(Microsoft)称，Windows Store应用程序使用依赖于网络隔离的安全模型。必须为商店应用启用特定的网络功能和边界，并且必须允许应用访问网络。

当Windows 防火墙^{(Windows Firewall)}配置文件不是 Public时，有一个默认阻止规则会阻止所有将远程 IP 设置为 0.0.0.0的传出流量。当计算机连接到启用了强制隧道的VPN连接时，默认网关 IP 设置为 0.0.0.0。因此，如果未正确设置网络访问边界，则会应用默认阻止防火墙规则，并阻止Microsoft Windows Store应用程序流量。

但是，如果您执行以下操作之一，Windows 应用商店^{(Windows Store)}将按预期打开：

• 断开计算机与域的连接，然后连接到VPN连接。
• 将计算机连接到禁用强制隧道的VPN连接。
• 关闭 Windows Defender 防火墙^{(Turn off the Windows Defender Firewall)} 服务，然后将计算机连接到VPN连接。

Microsoft Store应用程序在加入域后无法运行

如果您在VPN上的已加入域的^(VPN)Windows 10计算机无法打开Microsoft Store应用时遇到此问题，您可以按照下面概述的说明轻松解决此问题。

• 打开组策略管理管理单元 (gpmc.msc)。
• 打开默认域策略^{(Default Domain Policy)} 进行编辑。
• 从组策略管理编辑器^{(Group Policy Management Editor)}中，展开 计算机配置^{(Computer Configuration)} > 策略^(Policies) > 管理模板^{(Administrative Templates)} > 网络。^(Network.)
• 选择网络隔离^{(Network Isolation)}。
• 在右窗格中，双击 应用程序的专用网络范围^{(Private network ranges for apps)}。
• 在 应用程序的专用网络范围^{(Private network ranges for apps)} 对话框中，选择 已启用^(Enabled)。
• 在 私有子网文本框中，输入您的^{(Private subnets)}VPN适配器的 IP 范围。

例如，如果您的VPN适配器IP^(IPs)在 172.x中^(x)。x。x 范围，在文本框中添加 172.0.0.0/8  。

• 单击确定^(OK)。
• 双击 子网定义是权威的。^{(Subnet definitions are authoritative.)}
• 选择启用。^(Enabled.)
• 单击确定^(OK)。
• 重新启动客户端以确保GPO生效。

Windows 现在将创建允许流量的防火墙规则，并将用新规则覆盖以前的出站阻止规则，因为在应用组策略^{(Group Policy)}后，添加的 IP 范围是唯一可用于网络隔离的专用网络范围。

您现在可以将相同的GPO^(GPOs)从 DC 推送到多台计算机。在个别计算机上，您可以检查下面的注册表位置以确保GPO生效：

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation

最后，当您的VPN地址池范围发生变化时，您应该相应地更改此GPO - 否则问题将再次出现。

That’s it!

Microsoft Store app not working after joining domain

If you connect a domain-joined Windows 10 computer to a VPN connection that has force tunneling enabled, and when you try to open Microsoft Store, it does not open, and you receive a This page failed to load error message, then this post is intended to help you. In this post, we will identify the potential cause of why domain-joined Windows 10 computers on a VPN is not opening the Microsoft Store app, as well as provide the solution you can try to help remediate this issue.

According to Microsoft, the Windows Store app uses a security model that depends on network isolation. Specific network capabilities and boundaries must be enabled for the store app, and network access must be allowed for the app.

When the Windows Firewall profile is not Public, there is a default block rule that blocks all outgoing traffic that has the remote IP set as 0.0.0.0. While the computer is connected to a VPN connection that has force tunneling enabled, the default gateway IP is set as 0.0.0.0. Therefore, if the network access boundaries aren’t set appropriately, the default block firewall rule is applied, and Microsoft Windows Store app traffic is blocked.

However, if you do one of the following operations, Windows Store opens as expected:

• Disconnect the computer from the domain, and then connect to the VPN connection.
• Connect the computer to a VPN connection that has force tunneling disabled.
• Turn off the Windows Defender Firewall service, and then connect the computer to the VPN connection.

Microsoft Store app not working after joining domain

If you’re faced with this issue where a domain-joined Windows 10 computer on a VPN is not opening Microsoft Store app, you can follow the instructions outlined below to easily fix this issue.

• Open the Group Policy Management snap-in (gpmc.msc).
• Open the Default Domain Policy for editing.
• From the Group Policy Management Editor, expand Computer Configuration > Policies > Administrative Templates > Network.
• Select Network Isolation.
• In the right pane, double-click Private network ranges for apps.
• In the Private network ranges for apps dialog box, select Enabled.
• In the Private subnets text box, type the IP range of your VPN adapter.

For example, If your VPN adapter IPs are in the 172.x.x.x range, add 172.0.0.0/8 in the text box.

• Click OK.
• Double-click Subnet definitions are authoritative.
• Select Enabled.
• Click OK.
• Restart the client to make sure that the GPO takes effect.

Windows will now create a firewall rule that allows the traffic and will override the previous outbound block rule with the new rule because after the Group Policy is applied, the IP range that was added is the only private network range that is available for network isolation.

You can now push the same GPOs from the DC to multiple computers. And on the individual computers, you can check the registry location below to make sure that the GPO takes effect:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkIsolation

Finally, when your VPN address pool range changes, you should change this GPO accordingly – else, the issue will recur.

That’s it!

Related posts

• Fix Microsoft Store在Windows 11/10上登录error 0x801901f4

• Microsoft Account sign在Windows 10上的error 0x800706d9中

• Fix Microsoft Store Error 0x80072F7D

• Fix Microsoft Store Error 0x87AF0001

• Microsoft Store error 0x80072F05 - 服务器跌跌撞撞

• 如何在Windows 10上停止Apps Remote Installation

• Windows Store中Add，Remove Credit Card Edit Payment Method

• 如何更改Microsoft Store account详细信息和存储信息

• Fix Microsoft Store Error 0xc03f40c8在Windows 10上

• Microsoft Store的Windows 10最佳Action and Adventure games

• 如何在Microsoft Store中禁用Xbox One video自动播放

• Windows 10 Microsoft Store上最好的4 YouTube apps

• 如何修复PIN and Microsoft Store的Error Code 0x80090016

• Windows 10的新鲜Paint是一种易于使用的绘画Microsoft Store app

• Windows 11/10 Slow download Microsoft Store的速度

• Fix Microsoft Store or Windows Update error 0x80246013

• Time Lapse Creator app为Microsoft Store的Windows 10

• 对于Windows 10可在Microsoft Store弹道Mini Golf game

• 由多个用户安装的Microsoft Store app无法在Windows 10上启动

• Fix Windows 10 Store Error 0x80073CF9