BigFix Support for Updating Built-in Windows Apps

2

Yes, we can update Windows Store applications.

How that's done depends a bit upon your environment setup. Out of the box, the BigFix Modern Client Management (MCM) is the easiest way to report and update individual Store apps, or all Store apps. This is described at Application management

If you don't have MCM deployed, and you're going to be managing per-user configurations like Store apps regularly, then ... you should probably talk to your TA about whether it's worthwhile to you.

If we assume you go down that path and decide not to add the Modern Client Management features, there are still a few ways to update Store apps. Anythin that one can do on a command line, one can also do via BigFix. Which methods work may depend somewhat upon whether your clients have access to the Windows Store, or an internal Microsoft Store for Business, or no Store at all. So these examples are just a starting point for how one could build some custom content.

I'm not actually testing these right now but will update with working scripts if someone finds issues and posts a solution; these are just examples of the approaches:

Run as the User, using PowerShell

(see also Tip - Action Override User settings)

In Windows 11 these Powershell commands can help. They must be executed in the context of the user to update:

List updates:

  • store updates

Update all apps:

  • store update --all

Update a single app:

  • store update "App Name"
action uses wow64 redirection false

override wait
runas=currentuser
completion=job
hidden=true
timeout_seconds=300

wait powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "store update 'Microsoft.WindowsNotepad'"

Run as the User, using WinGet

Similarly, 'winget' can be used to update both Store apps and other apps. I haven't used it as much but expect these should work as


action uses wow64 redirection false

override wait
runas=currentuser
completion=job
hidden=true
timeout_seconds=300

// 2. Launch PowerShell as the user and trigger the Winget Store update for Notepad
wait powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "winget upgrade --id 'Microsoft.WindowsNotepad' --source msstore --accept-package-agreements --accept-source-agreements"

Update for All Users, using cached copy of the Bundle

Microsoft does not provide direct downloads for Store apps like Notepad. You have to either use a caching proxy or a third-party cacher to obtain a time-limited download link, download and stage the msixbundle or appxbundle files locally. Then you can use the 'Add-AppxProvisionedPackage' cmdlet to provision the package to all users on the machine -- this installs/upgrades for all current and future local users on the machine:

Step 1: How to download the Notepad .msixbundle

Microsoft does not provide a direct click-to-download link for the Notepad package, but you can securely fetch it from their official content delivery network (CDN) using an online generator tool like rg-adguard:

  1. Go to https://rg-adguard.net.
  2. Paste the official Microsoft Store URL for Notepad: https://apps.microsoft.com/detail/9nkw1w68zj9m
  3. Select Retail from the dropdown menu and click the checkmark.
  4. Locate the latest version of the file ending in .msixbundle or .appxbundle (usually containing a name like Microsoft.WindowsNotepad_..._neutral_~_8wekyb3d8bbwe.msixbundle). Download this file and upload it to your BigFix Root Server / Software Distribution dashboard. [1]

Step 2: ActionScript to update

// 1. Download the Notepad package from your BigFix server/repo
prefetch Microsoft.WindowsNotepad.msixbundle sha1:YOUR_SHA1 size:YOUR_SIZE http://YOUR_SERVER:52311/Uploads/Microsoft.WindowsNotepad.msixbundle

// 2. Clear any prior staging folders if they exist
folder delete "C:\Windows\Temp\NotepadUpdate"
folder create "C:\Windows\Temp\NotepadUpdate"

// 3. Move the downloaded package to a local staging area
move __Download\Microsoft.WindowsNotepad.msixbundle "C:\Windows\Temp\NotepadUpdate\Notepad.msixbundle"

// 4. Run PowerShell as SYSTEM to provision the app machine-wide

action uses wow64 redirection false

wait powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-AppxProvisionedPackage -Online -PackagePath 'C:\Windows\Temp\NotepadUpdate\Notepad.msixbundle' -SkipLicense"

// 5. Cleanup the local staging file
folder delete "C:\Windows\Temp\NotepadUpdate"

I do have a few other tricksy ways to install these packages but I expect one of these is probably going to be the easiest for you. Let me know if none of these work and we need to try more methods.

3 Likes