nanvik's avatar
nanvik
Iron Contributor
Oct 14, 2020
Status:
In the backlog

Machine Wide Provisioning (Install for All Users)

Currently there is no convenient way for end end user who has purchased software from an ISV to install a side-loaded MSIX package machine-wide (for all users). Software is often licensed on a per-machine basis and not tied to a specific user. Non-technical users should be able to double-click on an MSIX package and have it installed machine-wide if the vendor has configured it to do so.

 

Perhaps there are other ways to accomplish this, but here is a suggestion.

 

Introduce an 'AllUsers' restricted capability to the appxmanifest file that flags the package so that when a user double-clicks the package to install it, it gets provisioned for all users (naturally would require specifying allowElevation in the manifest as well). Similarly, any user who tries to uninstall the package should get prompted for elevated privileges - once elevated, the uninstall should uninstall for all users.

 

Without this ability, I can't see how MSIX will replace MSI in the long term.

  • In case you are not aware...

     

    1) MSIX Installation may be performed in powershell using the Add-AppXProvisionedPackage cmdlet.  This methods provisions the package in a way such that any user logging into the box will have the installation registered for them.  This might provide what you need for the "all user install" scenario.  This functionality is also available from DISM in case you are thinking about image management.

     

    2) Supposedly, there is group policy support today to prevent uninstalls.  I'm not sure if it is AD or AAD only.  I think that today the control is a hammer affecting everything, but John mentioned more granular controls in the works in his recent video.