See my work in progress analysis here: https://bigfix.me/analysis/details/2998575
One issue is there are 3 different levels of “installation” of Windows Store UWP apps (WinRT)
There is in the image:
unique values of (it as string) of node values of selects "/Bundle/Identity/@Name" of xml documents of files "AppxBundleManifest.xml" of folders "AppxMetadata" of folders of folders "InfusedApps\Applications" of windows folder
This should be what Get-AppxProvisionedPackage –online
is doing.
There is staged for install on new user login:
unique values of names of folders whose(name of it contains "_") of folders "WindowsApps" of folders whose(name of it starts with "Program Files") of folders "C:\"
This is even better:
unique values of node values of selects "/Package/Identity/@Name" of xml documents of files "AppxManifest.xml" of folders whose(name of it contains "_" AND name of it does not start with "Microsoft.NET.Native." AND name of it does not start with "Microsoft.VCLibs.") of folders "WindowsApps" of folders whose(name of it starts with "Program Files") of folders "C:\"
This should be similar to what Get-AppXPackage -AllUsers | Select Name
does.
There is “installed” for existing users:
unique values whose(it contains "_") of names of folders of folders "AppData\Local\Packages" of folders of folders "C:\Users"
This should be similar to what Get-AppXPackage | Select Name
does.
Most of these will not give the same results because some of the folders given are actually sub-apps of other apps.
Also, Powershell is generally going to have a better understanding of the true state of the apps, but you can infer most of the info without actually running any powershell. There is also info in the windows registry in some places. Probably WMI as well.
Registry Detection Options for UWP apps:
Each one of the following has slightly different context and usefulness and info available.
number of unique values of names of keys of keys "Software\Classes\ActivatableClasses\Package" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)
unique values of preceding texts of firsts "_" of (it as string) of values of keys of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*" of (x64 registries; x32 registries)
This seems to enumerate the apps installed by all users but in the Local Machine context, which is unusual.
unique values of preceding texts of firsts "_" of names of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages" of (x64 registries; x32 registries)
unique values of preceding texts of firsts "_" of names of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx" of (x64 registries; x32 registries)
values of keys "PackageFamilyName" of jsons of (it as string) of values of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallAgent\CategoryCache" of (x64 registries; x32 registries)
unique values of preceding texts of firsts "_" of (it as string) of values "PackageId" of keys "Shell\open" of keys of keys "Software\Classes" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)
unique values of following texts of lasts "%255C" of preceding texts of firsts "_" of names of keys of keys "Software\Classes\Local Settings\MrtCache" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)
unique values of (it as string) of values "Moniker" of keys of keys "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)
unique values of names of keys of keys "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families" of keys of keys "HKEY_USERS" of (x64 registries; x32 registries)
This set of keys seems to have the time the user installed the app, which is useful.
Related:
- (Powershell) trying to delete unwanted apps in Windows 10
- https://deploymentparts.wordpress.com/2015/09/10/remove-builtin-apps-from-windows-10-reference-image/
- https://powertoe.wordpress.com/2012/11/02/get-a-list-of-metro-apps-and-launch-them-in-windows-8-using-powershell/
- https://stackoverflow.com/questions/12925748/iapplicationactivationmanageractivateapplication-in-c
- https://docs.microsoft.com/en-us/powershell/module/appx/remove-appxpackage?view=win10-ps