Remove Appx Packages for old user profiles

Question

Hi,

Can anyone suggest a way to remove Appx Packages from old user profiles?

Here is the scenario, a user signs into a PC 4 months ago, they never sign into it again. Because of this, all the Appx packages are at the release version of 4 months ago, and any known vulnerabilities MS push updates out for don't get installed as it requires the user to sign in for the appx to update.

We do use Delprof to automatically delete profiles older than a certain age. But you can see the issue with this example, user signs into a PC on the 5th Feb 2023 and then on the 7th Feb 2023 MS release a patch to resolve a security bug. This never applies as that user doesn't sign back into the PC. Two days is obviously not a timeframe for Delprof to work on, users would go mad if it was that short a period.

Has anyone come across this issue before? I can see that applications can get installed in appdata\local\packages. But is this where the out of date/vulnerable version is likely to be, or would it be part of C:\Program Files\WindowsApps?

We use vulnerability scanners on our network which highlights these issues for us but only tells us the version which is an issue and for what PC it is found. It does not specifically give us the install location it finds it in (such as appdata\local\packages.

Any advice would be great. Would have been nice if Microsoft through this issue through before going down this route all those years ago.

Thanks

Answer 1

Hi,

I am also having this issue, specifically using Nessus scanner, we're seeing many vulnerabilities showing for Microsoft3DViewer, 3D Paint, Web Media Extensions Library RCE, WebP Image Extension RCE, MPEG-2 Video Extension RCE.

I have found that to get all users that have it installed, Get-AppxPackage -Name package name -AllUsers.

This will show the application, current version, and under PackageUserInformation, what users have that version installed. These will be listed by version so you may have more than 1 listed. If the user has been deleted from the machine, it may only show the SID for that user. The easiest way to pin this back to a username was by checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Depending on how the user was deleted then you may not even have a record here. We found that some old user accounts were deleted from a device by just deleting the user folder in C:\Users.

Something else I have found is when deleting users from a device showing these vulnerabilities, if you delete the user via Control Panel > User Accounts > Configure advanced user profile properties, this will complete a more in-depth deletion of the user and has helped with clearing old user records on these applications.

Although it doesn't appear to resolve everything for all Appx Packages, I have had success with the following command, Get-AppxPackage -Name package name | Remove-AppxPackage -AllUsers

Previously I had tried all different ways, even attempting to rebuild the database library where this information is stored. However, this resulted in a large number of user profile issues and I wouldn't recommend it.

On a larger scale, there may be something you can do within Powershell and a logon script, however, I've not reached that stage yet. If you find a way with the help of this information, please share.

Answer 2

Hi,

Thanks for taking the time to reply to me about this.

Unfortunately, think I read the help page where you got that information from.

You can imagine it's not feasible to do this on a large scale across an organisation.

Our scanner unfortunately does not tell us what profile has the old version, just that an old version is installed. If we can work that out, which I am struggling to do, I would then have to do that hundreds of times across the network for each appx vulnerability on each user profile.

Ideally what I would need to do in a powershell script, pushed out via SCCM would be to do the following;

1. Check for a specific appx being installed
2. Check what users have that appx installed (in some cases its a main application, for example it could be the calculator thats out of date.
3. Then check if the appx for each user meets the minimum recommended level so that it is secure
4. If it is fine, do nothing, if it is a version with an issue then uninstall it.

It really should not be this difficult but Microsoft being Microsoft find a way to make it so.

Answer 3

Hii there, I am also working on this MS store vulnerabilities in windows clients from last one month. Initially we thought these were arising from Stale users profiles and thought of giving a logon script to check and delete if there are any stale user profiles(powershell script will check all the users in c:\users folder using ADSIsearcher excluding default, public, local admin user profiles from C drive... If any of the user is not found in AD, It will deleted the userprofile in C:\users\ and Corrsposnding user profile SID in regsitry editor under hklm:\software\microsoft\windowsNT\currentversion\profilelist\Sidofuserprofile.Although we deployed it successfully but it ended up with releasing some free space in C drive but didn't give the results that we expected.... So we turned back and dig a deep little and found that these vulnerabilities can be associated with any user profile . We found two locations in C drive where these are residing and for which user it is contributing... To be clear, .dll and.exe files of appx packages contributing these vulnerabilities....and these are residing again in C/programfiles/windows apps/packages/ your vulnerable package name. And other location is C /users/userprofile/appdata/local/packages/yourpackage .....So after seggregarting the results based on the vulnerable versions and removing them... We finally remediated those vulnerabilities. #Tedious

Answer 4

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

Use the Windows PowerShell cmdlet Remove-AppxPackage to remove Appx Packages from outdated user profiles. You can delete an Appx package from any user profile, including inactive user profiles, using this cmdlet. Open a Windows PowerShell window with administrator rights before entering the following command to utilize this cmdlet:

Remove-AppxPackage <PackageName>

The name of the Appx package you wish to uninstall should be substituted for PackageName>. By utilizing the -User parameter, which accepts the user name as an argument, you can additionally define the user profile.

For instance, you would issue the following command to delete the Contoso Appx package from the user "Johnuser "'s profile:

Remove-AppxPackage Contoso -User John

Once the command is executed, the Appx package should be removed from the user profile.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.