Universal Windows Platform (UWP) Apps Inspector

Content Authoring
1

Hi All,

I’m looking to see how people are interrogating UWP Apps. I can’t look for them the same way I look for apps in add remove programs. I also don’t see them in regapps. I know I can see them from powershell using:

Get-AppxProvisionedPackage –online

are there any inspectors to achieve this?

1 Like
2

You might need to submit an RFE (Request For Enhancement) to have this functionality added to the Windows agent.

Have a look at this posting from @jgstew for information.

1 Like
3

There is a way to find them on the file system, particularly those preinstalled by windows. I have relevance for this… somewhere.

A proper inspector for UWP apps would be useful all the same.

If you want to remove preinstalled apps from windows and prevent them from being installed for new users or uninstall them from existing users, there are like 3 different locations to check.

You can remove it from the installed windows image using dism, but then you need a different command to remove them from program files or program data or something, and then something else entirely to remove them from the user.

I have stuff written in varying degrees of working, but I don’t think I ever put any of it into full production use.

I’m pretty sure I have more than this: https://bigfix.me/fixlet/details/23890

4

Have you tried using these?

https://developer.bigfix.com/relevance/reference/winrt-package.html

1 Like
5

Thank You @AlanM . That is what I was looking for. However, the results look slightly different from powershell

get-appxpackage | select Name

compared to

Q: names of ids of winrt packages

6

Can you give some examples of what the differences are?

7

Sure, it is not a huge difference. The fixlet debugger returns the following:

Q: names of ids of winrt packages
A: Microsoft.VCLibs.120.00
A: Microsoft.VCLibs.120.00
A: Microsoft.NET.Native.Framework.1.1
A: Microsoft.NET.Native.Framework.1.1
A: Microsoft.NET.Native.Runtime.1.1
A: Microsoft.NET.Native.Runtime.1.1
A: Microsoft.VCLibs.140.00
A: Microsoft.VCLibs.140.00
A: Microsoft.3DBuilder
A: Microsoft.Appconnector
A: Microsoft.BingFinance
A: Microsoft.BingNews
A: Microsoft.BingSports
A: Microsoft.BingWeather
A: Microsoft.CommsPhone
A: Microsoft.ConnectivityStore
A: Microsoft.Getstarted
A: Microsoft.Messaging
A: Microsoft.MicrosoftOfficeHub
A: Microsoft.Office.OneNote
A: Microsoft.Office.Sway
A: Microsoft.People
A: Microsoft.Windows.Photos
A: Microsoft.WindowsAlarms
A: Microsoft.WindowsCalculator
A: Microsoft.WindowsCamera
A: microsoft.windowscommunicationsapps
A: Microsoft.WindowsMaps
A: Microsoft.WindowsPhone
A: Microsoft.WindowsSoundRecorder
A: Microsoft.WindowsStore
A: Microsoft.ZuneMusic
A: Microsoft.ZuneVideo
A: Microsoft.BioEnrollment
A: Microsoft.AAD.BrokerPlugin
A: Microsoft.Windows.CloudExperienceHost
A: Microsoft.Windows.ShellExperienceHost
A: windows.immersivecontrolpanel
A: Microsoft.Windows.Cortana
A: Microsoft.AccountsControl
A: Microsoft.LockApp
A: Microsoft.MicrosoftEdge
A: Microsoft.Windows.AssignedAccessLockApp
A: Microsoft.Windows.ContentDeliveryManager
A: Microsoft.Windows.ParentalControls
A: Microsoft.Windows.SecondaryTileExperience
A: Microsoft.WindowsFeedback
A: Microsoft.XboxGameCallableUI
A: Microsoft.XboxIdentityProvider
A: Windows.ContactSupport
A: Windows.MiracastView
A: Windows.PrintDialog
A: Windows.PurchaseDialog
A: windows.devicesflow
A: Microsoft.MicrosoftEdge
T: 62.193 ms
I: plural string

Powershell returns this:

Name
----
Microsoft.VCLibs.140.00
Microsoft.VCLibs.140.00
Microsoft.NET.Native.Framework.1.1
Microsoft.NET.Native.Framework.1.1
Microsoft.NET.Native.Runtime.1.1
Microsoft.NET.Native.Runtime.1.1
Microsoft.BioEnrollment
Microsoft.AAD.BrokerPlugin
Microsoft.Windows.CloudExperienceHost
Microsoft.Windows.ShellExperienceHost
windows.immersivecontrolpanel
Microsoft.Windows.Cortana
Microsoft.AccountsControl
Microsoft.LockApp
Microsoft.Windows.AssignedAccessLockApp
Microsoft.Windows.ContentDeliveryManager
Microsoft.Windows.ParentalControls
Microsoft.Windows.SecondaryTileExperience
Microsoft.WindowsFeedback
Microsoft.XboxGameCallableUI
Microsoft.XboxIdentityProvider
Windows.ContactSupport
Windows.MiracastView
Windows.PrintDialog
Windows.PurchaseDialog
Microsoft.BingNews
Microsoft.BingFinance
microsoft.windowscommunicationsapps
Microsoft.BingWeather
Microsoft.Getstarted
Microsoft.WindowsCamera
Microsoft.WindowsStore
Microsoft.ZuneMusic
Microsoft.Windows.Photos
windows.devicesflow
Microsoft.WindowsAlarms
Microsoft.ZuneVideo
Microsoft.WindowsSoundRecorder
Microsoft.WindowsPhone
Microsoft.WindowsMaps
Microsoft.WindowsCalculator
Microsoft.People
Microsoft.Office.Sway
Microsoft.Office.OneNote
Microsoft.Messaging
Microsoft.ConnectivityStore
Microsoft.CommsPhone
Microsoft.BingSports
Microsoft.Appconnector
Microsoft.3DBuilder
Microsoft.MicrosoftEdge

So, I think the only differences I see are that the Fixlet debugger returned

Microsoft.MicrosoftOfficeHub
Microsoft.VCLibs.120.00

Where the PowerShell did not

8

It looks like the VCLibs.120.00 might be the old version. Wonder if there is some internal “newer” logic that the Powershell is hiding some results.

9

See my work in progress analysis here: https://bigfix.me/analysis/details/2998575

One issue is there are 3 different levels of “installation” of Windows Store UWP apps (WinRT)

There is in the image:

unique values of (it as string) of node values of selects "/Bundle/Identity/@Name" of xml documents of files "AppxBundleManifest.xml" of folders "AppxMetadata" of folders of folders "InfusedApps\Applications" of windows folder

This should be what Get-AppxProvisionedPackage –online is doing.

There is staged for install on new user login:

unique values of names of folders whose(name of it contains "_") of folders "WindowsApps" of folders whose(name of it starts with "Program Files") of folders "C:\"

This is even better:

unique values of node values of selects "/Package/Identity/@Name" of xml documents of files "AppxManifest.xml" of folders whose(name of it contains "_" AND name of it does not start with "Microsoft.NET.Native." AND name of it does not start with "Microsoft.VCLibs.") of folders "WindowsApps" of folders whose(name of it starts with "Program Files") of folders "C:\"

This should be similar to what Get-AppXPackage -AllUsers | Select Name does.

There is “installed” for existing users:

unique values whose(it contains "_") of names of folders of folders "AppData\Local\Packages" of folders of folders "C:\Users"

This should be similar to what Get-AppXPackage | Select Name does.

Most of these will not give the same results because some of the folders given are actually sub-apps of other apps.

Also, Powershell is generally going to have a better understanding of the true state of the apps, but you can infer most of the info without actually running any powershell. There is also info in the windows registry in some places. Probably WMI as well.

Registry Detection Options for UWP apps:

Each one of the following has slightly different context and usefulness and info available.

number of unique values of names of keys of keys "Software\Classes\ActivatableClasses\Package" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)

unique values of preceding texts of firsts "_" of (it as string) of values of keys of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*" of (x64 registries; x32 registries)

This seems to enumerate the apps installed by all users but in the Local Machine context, which is unusual.

unique values of preceding texts of firsts "_" of names of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages" of (x64 registries; x32 registries)

unique values of preceding texts of firsts "_" of names of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx" of (x64 registries; x32 registries)

values of keys "PackageFamilyName" of jsons of (it as string) of values of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallAgent\CategoryCache" of (x64 registries; x32 registries)

unique values of preceding texts of firsts "_" of (it as string) of values "PackageId" of keys "Shell\open" of keys of keys "Software\Classes" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)

unique values of following texts of lasts "%255C" of preceding texts of firsts "_" of names of keys of keys "Software\Classes\Local Settings\MrtCache" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)

unique values of (it as string) of values "Moniker" of keys of keys "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)

unique values of names of keys of keys "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)

This set of keys seems to have the time the user installed the app, which is useful.

Related:

1 Like
11

What would be the best method to see if a single application by ID is installed? For example, I have a fixlet that will install pakcage with ID 31e6402e-0407-4419-a6c3-7c6d18576017 and I want to see if it is already installed.

Or the version of an installed ID.

1 Like