How to Disable MSIX Uninstallation

Written by Alex Marin · June 18th, 2020

Although not necessarily common practice, there are some instances where you would want to prevent users from uninstalling specific MSIX packages such as monitoring software that is required to gather data from all employees.

Can you prevent users from uninstalling MSIX packages?

If you decide to forbid users to uninstall MSIX packages, you need to take into consideration the difference between MSI technology and MSIX technology.

MSI technology allows you to disable the Change or Remove buttons present in the Add/Remove Programs, or hide the entry completely using the ARPSYSTEMCOMPONENT property.

However, with MSIX technology, there are no such settings to be placed in the AppxManifest file, which brings many to question if there is such a way to prevent the removal of a certain package.

The answer is yes, and you will need to use a PowerShell cmdlet to achieve this. Let's see how.

Set the non-removal policy

Starting with Windows 10 version 1809, Microsoft introduced a policy that can be used by IT Pros to disable the uninstallation of MSIX packages. The PowerShell cmdlet for this action is Set-NonRemovableAppsPolicy.

To set a non-removal policy for a specific MSIX package, you can use the following command:

Set-NonRemovableAppsPolicy -PackageFamilyName "PublisherName.AppName_hash" -nonremovable 1 -online 

For example:

Set-NonRemovableAppsPolicy -PackageFamilyName "Caphyon.SampleMSIXPackage_r21n0w1rc5s2y" -nonremovable 1 -online

The -nonremovable parameter can be 0 or 1, and the -online parameter specifies that "the action is to be taken on the operating system that is currently running on the local computer”.

Once a package is defined as non-removable, when a user tries to uninstall it, it will prompt an error message stating that "The operation did not complete successfully."

In all the tests we conducted, the error code that we noticed to be assigned for this behavior was 0x80073d01.

Remove the policy

If you no longer wish to prevent users from uninstalling MSIX packages, you can always remove the policy for any package you marked as non-removable by using the command:

Set-NonRemovableAppsPolicy -PackageFamilyName "PublisherName.AppName_hash" -nonremovable 0 -online 

The only difference you will see in the command is the -nonremovable parameter, which takes the value 0, in turn disabling the non-removal policy that was previously placed on the desired package.

Once this command is executed, the users will be able to uninstall the MSIX package without any further warnings or error codes.

Check the policies

Now, it is also important to further review the non-removal policies that are in place or in a particular machine. To do that, you can use the PowerShell cmdlet Get-NonRemovableAppsPolicy.

Get-NonRemovableAppsPolicy -online

This command will return all the packages that have the uninstall option disabled. In our case, only one package that we previously set as non-removable appears on the list.

All the cmdlets must be executed from an elevated command.

To wrap-up, we saw in this post that you are able to prevent users from uninstalling the MSIX packages by following the steps above. Remember that it is always important to double-check the policies once you've taken action on them.

We hope you found this short tutorial useful.

Video Tutorial

What other tutorials do you want to see here? Tell us in the comment section below.