For broken clients. you can do the following in GPO to fix the app store. (Win8: App: Modern: Apps fail to start if default registry or file permissions modified)
1.) Fixing file system permissions changed by Group Policy
Have a Group Policy administrator do the following:
• Open Group Policy Administrative Console
• Locate the GPO identified in the step "Determining if Group Policy is being used to manage permissions"
• Right click and select edit.
• Go to the location Computer Configuration\Policy\Windows Settings\Security Settings\File System
• If there is an entry for the paths already created you can edit it. If no entry exists create a new entry for each path.
• To create a new entry right click file system and select add file
• Browse to the path c:\Program Files, click OK
• Select the Add button.
• Click the locations button and select the local machine name
• Add the "All Application Packages" group and grant them the Read, Read and Execute, List folder Contents permissions
• Click OK and OK
• Select the option "Replace existing permissions on all subfolders and files with inheritable permissions.
• Repeat for C:\Windows
• Repeat for C:\Users however grant the "All Application Packages" group Full Control.
You will need to wait for the Group policy change to replicate to all Domain Controller s and for all clients to update their Group Policy settings.
Note: Processing the File System changes will incur some logon delay the first time this policy is processed. Subsequent logons will not be impacted unless changes are made to the policy. As an alternative you can use a script that is called post logon by the user is run as a scheduled task.
2.) Fixing Registry Permissions that have been changed by Group Policy
Have a Group Policy administrator do the following:
• Open Group Policy Administrative Console
• Locate the GPO identified in the step "Determining if Group Policy is being used to manage permissions"
• Right click and select edit.
• Go to the location Computer Configuration\Policy\Windows Settings\Security Settings\Registry
• Right Click and select Add Key
• Select CLASSES_ROOT,
• Select the Add button.
• Click the locations button and select the local machine name
• Add the "All Application Packages" group and grant them Read
• Repeat for "Users"
• Repeat for MACHINE\HARDWARE, MACHINE\SAM, MACHINE\SOFTWARE and MACHINE\SYSTEM