I want to run an analysis to check version of all Microsoft store app

I want to run an analysis to check version of all Microsoft store app
is there any way to do in BigFix i was able to get it done in PowerShell

Get-AppxPackage installer -AllUsers | ft Name,Version | Out-File “C:\Temp\Windows_Update_Log.txt” -Append
Name Version


1527c705-839a-4832-9118-54d4Bd6a0c89 10.0.19041.1023
c5e2524a-ea46-4f67-841f-6a9465d9d515 10.0.19041.1023
E2A4F912-2574-4A75-9BB0-0D023378592B 10.0.19041.1023
F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE 10.0.19041.1023
Microsoft.AAD.BrokerPlugin 1000.19041.1023.0
Microsoft.AccountsControl 10.0.19041.1023
Microsoft.AsyncTextService 10.0.19041.1023
Microsoft.BioEnrollment 10.0.19041.1023
Microsoft.CredDialogHost 10.0.19041.1023
Microsoft.ECApp 10.0.19041.1023
Microsoft.LockApp 10.0.19041.1023
Microsoft.MicrosoftEdgeDevToolsClient 1000.19041.1023.0
Microsoft.MicrosoftEdge 44.19041.1266.0
Microsoft.Win32WebViewHost 10.0.19041.1023
Microsoft.Windows.Apprep.ChxApp 1000.19041.1023.0
Microsoft.Windows.AssignedAccessLockApp 1000.19041.1023.0
Microsoft.Windows.CallingShellApp 1000.19041.1023.0
Microsoft.Windows.CapturePicker 10.0.19041.1023
Microsoft.Windows.CloudExperienceHost 10.0.19041.1266
Microsoft.Windows.ContentDeliveryManager 10.0.19041.1023
Microsoft.Windows.NarratorQuickStart 10.0.19041.1023
Microsoft.Windows.OOBENetworkCaptivePortal 10.0.19041.1023
Microsoft.Windows.OOBENetworkConnectionFlow 10.0.19041.1023
Microsoft.Windows.ParentalControls 1000.19041.1023.0
Microsoft.Windows.PeopleExperienceHost 10.0.19041.1023
Microsoft.Windows.PinningConfirmationDialog 1000.19041.1023.0
Microsoft.Windows.Search 1.14.2.19041
Microsoft.Windows.SecHealthUI 10.0.19041.1023
Microsoft.Windows.SecureAssessmentBrowser 10.0.19041.1023
Microsoft.Windows.ShellExperienceHost 10.0.19041.1320
Microsoft.Windows.StartMenuExperienceHost 10.0.19041.1023
Microsoft.Windows.XGpuEjectDialog 10.0.19041.1023
Microsoft.XboxGameCallableUI 1000.19041.1023.0
MicrosoftWindows.Client.CBS 120.2212.3920.0
MicrosoftWindows.UndockedDevKit 10.0.19041.1023
NcsiUwpApp 1000.19041.1023.0
Microsoft.WebMediaExtensions 1.0.42192.0
Microsoft.GetHelp 10.2202.613.0
Microsoft.YourPhone 1.22022.180.0
Microsoft.MicrosoftEdge.Stable 100.0.1185.29
Microsoft.Winget.Source 2022.403.2254.247

This is really a question that can be answered a few ways.

  1. Create a fixlet using native powershell to run that script then create an analysis to read that file
  2. Use the pre-built analysis in the BFI V10 site (if you have BFI) named “Installed Windows Applications”
  3. Use something like this in a custom analysis

if (name of operating system as lowercase contains "win") then (unique values of (substrings separated by ";" of ((concatenation ";" OF ((unique values of ((if (exists value "DisplayName" of it AND exists value "DisplayName" of it as string) then (value "DisplayName" of it as string) else ( "" )) & (if (exists value "Publisher" of it) then ( " | " & value "Publisher" of it as string) else ( "" )) & (if (exists value "DisplayVersion" of it) then ( " | " & value "DisplayVersion" of it as string) else ( "" )) & (if (exists value "InstallDate" of it) then ( " | " & value "InstallDate" of it as string) else ( "" ))) of keys whose (exists value "UninstallString" of it AND (not exists value "SystemComponent" of it OR exists value "SystemComponent" whose (it as string = "0")of it) AND (it does not contain "Hotfix" AND it does not contain "Security Update for" AND it does not contain "Update for" AND it does not contain "Security Update for Windows" AND it does not contain "Update for Windows" AND it does not contain "Security Update for Microsoft" AND (length of it > 0) and (number of substrings " " of it < length of it)) of (value "DisplayName" of it as string)) of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of registry) )) ;(concatenation ";" OF ((unique values of ((if (exists value "DisplayName" of it AND exists value "DisplayName" of it as string) then (value "DisplayName" of it as string) else ( "" )) & (if (exists value "Publisher" of it) then ( " | " & value "Publisher" of it as string) else ( "" )) & (if (exists value "DisplayVersion" of it) then ( " | " & value "DisplayVersion" of it as string) else ( "" ))& (if (exists value "InstallDate" of it) then ( " | " & value "InstallDate" of it as string) else ( "" ))) of keys whose (exists value "UninstallString" of it AND (not exists value "SystemComponent" of it OR exists value "SystemComponent" whose (it as string = "0")of it) AND (it does not contain "Hotfix" AND it does not contain "Security Update for" AND it does not contain "Update for" AND it does not contain "Security Update for Windows" AND it does not contain "Update for Windows" AND it does not contain "Security Update for Microsoft" AND (length of it > 0) and (number of substrings " " of it < length of it)) of (value "DisplayName" of it as string)) of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of native registry)))))) else if (name of operating system as lowercase contains "aix") then (unique values of ((lpp_name of it & " | " & " | " & version of it as string & ".ppc") of filesets of products of object repository ; ((unique values of (name of it & " | " & " | " & version of it as string & "." & architecture of it) of packages of rpm) as string))) else if (name of operating system as lowercase contains "sun") then (unique values of (param "PKGINST" of it & " | " & " | " & version of it as string) of pkginfos of pkgdb) else if (name of operating system as lowercase contains "red" or name of operating system as lowercase contains "suse" or name of operating system as lowercase contains "oracle") then ((unique values of (name of it & " | " & " | " & version of it as string & "." & architecture of it) of packages of rpm) as string) else "OS not supported"

2 Likes

last one is only showing application in Appwiz.cpl
we have any store app also present like Calculator, 3D paint etc. which are not listed in appwiz.cpl

option 1 .- i am keeping it as last resort

there is one more way which i am using but there i cant verify the exact version
exist find folders “Microsoft.WebMediaExtensions*” of folder “C:\Program Files\WindowsApps”

file version and installed software version defer so can check for that also

I wonder if this reg key might help:

q: names of keys of key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages" of registry

Or this one

q: values "PackageID" of keys of keys "SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" of current user keys of registry

Just wondering if parsing the AppxManifest.xml from the folders under the WindowsApps folder would be another option here?

Q: (attribute "Name" of it as text, attribute "Version" of it as text) of ((xpaths ("xmlns:t='http://schemas.microsoft.com/appx/manifest/foundation/windows10'", "/t:Package/t:Identity") of it) of xml documents of files "AppxManifest.xml" of folders whose (name of it starts with "Microsoft.WebMediaExtensions") of folder "C:\Program Files\WindowsApps") 
A: Microsoft.WebMediaExtensions, 1.0.42192.0
A: Microsoft.WebMediaExtensions, 1.0.42192.0
T: 26.988 ms
I: plural ( string, string )

That said, its more efficient, evaluation time wise, to parse the registry key names and extract the name and/or version from that.

Q: ((preceding texts of firsts "_" of it, preceding texts of firsts "_" of following texts of firsts "_" of it) of (names whose (it starts with "Microsoft.WebMediaExtensions") of keys  of key "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages" of registry))
A: Microsoft.WebMediaExtensions, 1.0.42192.0
A: Microsoft.WebMediaExtensions, 1.0.42192.0
A: Microsoft.WebMediaExtensions, 1.0.42192.0
T: 5.148 ms
I: plural ( substring, substring )

So many ways to skin a cat eh :slight_smile:

4 Likes