Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Remove appxpackage with local system account


  • Please log in to reply
No replies to this topic

#1 Carenborn

Carenborn

  • Members
  • 1 posts
  • OFFLINE
  •  

Posted 18 November 2016 - 04:24 PM

Hello


I have a problem removing modern apps on Windows 10 client with Powershell and from the local system account.


The goal is to distribute this task as a MSI package from Microsoft Intune MDM. Intune MDM executes MSI deployments as SYSTEM account in the background on the client.


To simulate the removal attempt from system-account I run the following procedure.


1. Open command prompt as administrator - I run following command string:
psexec.exe -i -s cmd
2. In the new window: the command ’whoami’ will output ”nt instans\system”
3. I run following command string:


powershell -NoProfile -Command "Get-AppxPackage -AllUsers *Microsoft.3Dbuilder* | Remove-AppxPackage"


4. I get no error message. I get the normal colored loading thing. But the modern app 3D Builder is still installed and visible in Start Menu.
5. If I reboot, it’s still there.
6. If I start first start Powershell and run the command string again but only the part with "Get-AppxPackage…" It wont work.
7. I also tried the command string:


Get-AppxPackage -User domain\username *Microsoft.3Dbuilder* | Remove-AppxPackage


8. I also tried the command string, back in command prompt.


powershell -NoProfile -Command "Start-Process powershell -ArgumentList 'Get-AppxPackage -AllUsers *Microsoft.3DBuilder* | Remove-AppxPackage' -verb RunAs"


Only way I can make it to work is to open command prompt as administrator and run the removal command, and skipping the System account. But this wont work with Intune MDM.
If I open cmd as administrator and just run this. The app is gone.


powershell -NoProfile -Command "Get-AppxPackage -AllUsers *Microsoft.3Dbuilder* | Remove-AppxPackage"


As you can see I know how to manually remove the modern apps from powershell as the logged in User - this information floods the Internet. Thats not the case. I want to run the removal from local system account. I run all installations och configurations from System account.


Have anyone else tussled with this and found a solution?

My backup solution will be to add a script in the users RunOnce registry. But dont find that as a nice approach.

 

So here's the Appx log when trying this.

 



Microsoft Windows [Version 10.0.14393]
© 2016 Microsoft Corporation. Med ensamrätt.

C:\WINDOWS\system32>powershell
Windows PowerShell
Copyright © 2016 Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> Get-AppxPackage -Allusers Microsoft.3DBuilder* | Remove-AppxPackage
PS C:\WINDOWS\system32> Get-AppxLog

Time                      ID           Message
----                      --           -------
2016-11-17 17:32:13       301          The calling process is powershell.exe
2016-11-17 17:32:13       603          Started deployment DeStage operation on a package with main parameter: Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe and Options: 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.
2016-11-17 17:32:13       10002        Creating Resiliency File C:\ProgramData\Microsoft\Windows\AppRepository\3f10e867-783b-4a87-9439-24c9295b3b13_S-1-5-18_1.rslc for Remove Operation on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe.
2016-11-17 17:32:13       607          Deployment Remove operation on package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe has been de-queued and is running for user NT instans\SYSTEM.
2016-11-17 17:32:13       627          Windows cannot remove Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.
2016-11-17 17:32:14       400          Deployment DeStage operation with target volume C: on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe from:   finished successfully.

PS C:\WINDOWS\system32> whoami
nt instans\system
PS C:\WINDOWS\system32>

 

 

The "-Allusers" parameter is'nt working.

I also tried to point out the user. But still it just trying with System account.

PS C:\WINDOWS\system32> Get-AppxPackage -user Fredrik Microsoft.3DBuilder* | Remove-AppxPackage
PS C:\WINDOWS\system32> Get-AppxLog

Time                      ID           Message
----                      --           -------
2016-11-17 17:42:53       301          The calling process is powershell.exe
2016-11-17 17:42:53       603          Started deployment DeStage operation on a package with main parameter: Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe and Options: 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.
2016-11-17 17:42:53       10002        Creating Resiliency File C:\ProgramData\Microsoft\Windows\AppRepository\196e5530-0426-442f-a855-6c7363cf66d5_S-1-5-18_1.rslc for Remove Operation on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe.
2016-11-17 17:42:53       607          Deployment Remove operation on package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe has been de-queued and is running for user NT instans\SYSTEM.
2016-11-17 17:42:53       627          Windows cannot remove Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.
2016-11-17 17:42:53       400          Deployment DeStage operation with target volume C: on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe from:   finished successfully.

PS C:\WINDOWS\system32>


Best regards



BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users