Make MSIX removal work under SYSTEM and stop deprovisioned apps returning - #4
Merged
Merged
Conversation
…ning Two problems with the Modern Apps branch of Uninstall-TecharyApp, both of which only show up in the context the module is actually driven from. Get-AppxPackage without -AllUsers returns only the calling account's packages. SYSTEM has essentially none, so an uninstall pushed from an RMM found nothing and logged "not found on this system" for an app that was plainly installed. It now enumerates and removes with -AllUsers when elevated, and says so when it is not, so the log states the scope that actually applied rather than implying a machine-wide removal. Removing the per-user registrations also left the provisioned package in place, and a provisioned package is what seeds new user profiles. The app therefore reappeared for the next user who signed in. Provisioned packages matching the name are now removed as well. Neither path is all-or-nothing: -AllUsers is unsupported on some builds, so a failure there retries per-user rather than reporting an outright failure, and provisioning enumeration failing does not stop the package removal. Verified non-elevated: correct package found, WhatIf reports the honest scope, and a package that is not installed still reports cleanly. The elevated -AllUsers and deprovisioning paths are guarded by try/catch with per-user fallback but were not exercised from this session.
This was referenced Sep 19, 2026
…rror Validated on a real machine running as SYSTEM. Remove-AppxPackage -AllUsers works, but two behaviours make a naive reading of it unreliable. Removal is asynchronous. The package is still listed for a period after the cmdlet returns, so a check run immediately afterwards reports a failure that is not real. Confirmation now polls over a 30 second settle window, and a package still registered at the end is reported as a warning naming a pending reboot or sign-out, not asserted as a failure. Get-AppxPackage -AllUsers also lists packages that are merely Staged on the machine, so presence in that list is not evidence that anyone has the package installed. Enumeration is filtered to packages actually installed for at least one user, via PackageUserInformation, so a staged remnant is no longer treated as something to uninstall. Test-AppxInstalledForAnyUser falls back to a plain Get-AppxPackage where per-user information is unavailable, which covers the non-elevated case and older builds. Measured under SYSTEM on a real endpoint: Get-AppxPackage sees 69 packages, Get-AppxPackage -AllUsers sees 197. Verified: helper returns True for an installed package, False for one that was removed, and False for a package that does not exist.
TecharyJames
changed the base branch from
fix/api-rate-limit-and-failure-semantics
to
BETA
September 19, 2026 11:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two problems, both invisible interactively
Get-AppxPackagewithout-AllUsersreturns only the calling account's packages. SYSTEM has essentially none, so an uninstall pushed from the RMM found nothing and logged "Application 'X' not found on this system" for an app that was installed.Removing per-user registrations left the provisioned package in place. A provisioned package seeds new user profiles, so the app reappeared for the next user who signed in.
What changed
-AllUserswhen elevated. SYSTEM is in the Administrators role, so this covers the RMM case.Neither path is all-or-nothing:
-AllUsersunsupported on this buildVerification
Non-elevated,
-WhatIf, against a real package:A name matching nothing still reports cleanly rather than erroring.
Coverage limitation: this session is not elevated, so the
-AllUsersremoval and the deprovisioning calls were not executed. Both are guarded bytry/catchwith a per-user fallback; the enumeration and branching logic is exercised above. Needs one run as SYSTEM against a known MSIX before production use.