Remove appxpackage with local system account

2016-11-14

Question

_{Monday, November 14, 2016 8:36 AM}

Hello

I have a problem removing modern apps on Windows 10 client with Powershell and from the local system account.

The goal is to distribute this task as a MSI package from Microsoft Intune MDM. Intune MDM executes MSI deployments as SYSTEM account in the background on the client.

To simulate the removal attempt from system-account I run the following procedure.

Open command prompt as administrator - I run following command string:
psexec.exe -i -s cmd
In the new window: the command ’whoami’ will output ”nt instans\system”
I run following command string:

powershell -NoProfile -Command "Get-AppxPackage -AllUsers *Microsoft.3Dbuilder* | Remove-AppxPackage"

I get no error message. I get the normal colored loading thing. But the modern app 3D Builder is still installed and visible in Start Menu.
If I reboot, it’s still there.
If I start first start Powershell and run the command string again but only the part with "Get-AppxPackage…" It wont work.
I also tried the command string:

Get-AppxPackage -User domain\username *Microsoft.3Dbuilder* | Remove-AppxPackage

I also tried the command string, back in command prompt.

powershell -NoProfile -Command "Start-Process powershell -ArgumentList 'Get-AppxPackage -AllUsers *Microsoft.3DBuilder* | Remove-AppxPackage' -verb RunAs"

Only way I can make it to work is to open command prompt as administrator and run the removal command, and skipping the System account. But this wont work with Intune MDM.
If I open cmd as administrator and just run this. The app is gone.

powershell -NoProfile -Command "Get-AppxPackage -AllUsers *Microsoft.3Dbuilder* | Remove-AppxPackage"

As you can see I know how to manually remove the modern apps from powershell as the logged in User - this information floods the Internet. Thats not the case. I want to run the removal from local system account. I run all installations och configurations from System account.

Have anyone else tussled with this and found a solution?

My backup solution will be to add a script in the users RunOnce registry. But dont find that as a nice approach.

Thanks for concrete comments

Best regards

All replies (4)

_{Tuesday, November 15, 2016 9:38 AM}

Hi ,

This article offers some information for your scenario, check if it helps.
Powershell Tip #53: Run PowerShell as SYSTEM (NT AUTHORITY\SYSTEM)
http://powershell-guru.com/powershell-tip-53-run-powershell-as-system/
NOTE: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites.

Best regards

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

_{Tuesday, November 15, 2016 1:46 PM}

None of these solution works.

_{Thursday, November 17, 2016 4:40 PM}

So here's the Appx log when trying this.

PS C:\WINDOWS\system32> Get-AppxPackage -Allusers Microsoft.3DBuilder* | Remove-AppxPackage
PS C:\WINDOWS\system32> Get-AppxLog

Time ID Message
--
2016-11-17 17:32:13 301 The calling process is powershell.exe
2016-11-17 17:32:13 603 Started deployment DeStage operation on a package with main parameter: Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe and Options: 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.
2016-11-17 17:32:13 10002 Creating Resiliency File C:\ProgramData\Microsoft\Windows\AppRepository\3f10e867-783b-4a87-9439-24c9295b3b13_S-1-5-18_1.rslc for Remove Operation on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe.
2016-11-17 17:32:13 607 Deployment Remove operation on package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe has been de-queued and is running for user NT instans\SYSTEM.
2016-11-17 17:32:13 627 Windows cannot remove Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.
2016-11-17 17:32:14 400 Deployment DeStage operation with target volume C: on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe from: finished successfully.

PS C:\WINDOWS\system32> whoami
nt instans\system
PS C:\WINDOWS\system32>

_{Thursday, November 17, 2016 4:43 PM}

The "-Allusers" parameter is'nt working.

I also tried to point out the user. But still it just trying with System account.

PS C:\WINDOWS\system32> Get-AppxPackage -user Fredrik Microsoft.3DBuilder* | Remove-AppxPackage
PS C:\WINDOWS\system32> Get-AppxLog

Time ID Message
--
2016-11-17 17:42:53 301 The calling process is powershell.exe
2016-11-17 17:42:53 603 Started deployment DeStage operation on a package with main parameter: Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe and Options: 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.
2016-11-17 17:42:53 10002 Creating Resiliency File C:\ProgramData\Microsoft\Windows\AppRepository\196e5530-0426-442f-a855-6c7363cf66d5_S-1-5-18_1.rslc for Remove Operation on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe.
2016-11-17 17:42:53 607 Deployment Remove operation on package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe has been de-queued and is running for user NT instans\SYSTEM.
2016-11-17 17:42:53 627 Windows cannot remove Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.
2016-11-17 17:42:53 400 Deployment DeStage operation with target volume C: on Package Microsoft.3DBuilder_11.1.9.0_x64__8wekyb3d8bbwe from: finished successfully.

PS C:\WINDOWS\system32>

Share via

Remove appxpackage with local system account

Question

All replies (4)

Additional resources