microsoft / microsoft/winget-cli

ADMX configuration does not work through Microsoft Enpoint

Open
#1,892 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Feature
Dominant language
C++
Stars
26.4k
Forks
1.8k
Avg merge
1d 11h
Merged PRs (30d)
15

Description

Description of the new feature / enhancement

ADMX Ingestion [1] of the provided ADMX file fails due to constrains of Endpoint ADMX ingestion [2]

Registry keys within Software\Policies\Microsoft\Windows\AppInstaller are not writeable. Therefore, the ADMX ingestion does not work.

As we're going AADJ only and the MS Store does not really work with business accounts and is still enabled by default, we need to implement a cumbersome workaround.

[1] https://docs.microsoft.com/en-us/archive/blogs/ukplatforms/google-chrome-gpo-via-intune
[2] https://docs.microsoft.com/en-us/windows/client-management/mdm/win32-and-centennial-app-policy-configuration

Proposed technical implementation details

Direct Endpoint integration would be the best option i guess.
Add a new exception of a writeable registry key location to ADMX ingestion would be the second best option, but still requires the involvement of Microsoft outside the winget team.

Watching a second registry key location would be another (quite unclean) option.

Eventlog
Eventlog Errors 
Log Name:      Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
Source:        Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider
Date:          01/02/2022 14:01:33
Event ID:      404
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Description:
MDM ConfigurationManager: Command failure status. Configuration Source ID: (2FD40D97-DEA2-463C-918D-EE910BADD8E3), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (Policy), Command Type: (Add: from Replace or Add), CSP URI: (./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Microsoft/Policy/DesktopAppInstaller), Result: (Access is denied.).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider" Guid="{3da494e4-0fe2-415c-b895-fb5265c5c83b}" />
    <EventID>404</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2022-02-01T22:01:33.2204238Z" />
    <EventRecordID>4510</EventRecordID>
    <Correlation />
    <Execution ProcessID="15872" ThreadID="11512" />
    <Channel>Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin</Channel>
    <Computer>CLFPF21B7DS</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Message1">2FD40D97-DEA2-463C-918D-EE910BADD8E3</Data>
    <Data Name="Message2">MDMDeviceWithAAD</Data>
    <Data Name="Message3">Policy</Data>
    <Data Name="InternalCmdType">1</Data>
    <Data Name="Message5">./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Microsoft/Policy/DesktopAppInstaller</Data>
    <Data Name="HexInt1">0x80070005</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
Source:        Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider
Date:          01/02/2022 14:01:33
Event ID:      865
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      CLFPF21B7DS
Description:
MDM PolicyManager: ADMX Ingestion: EnrollmentId (2FD40D97-DEA2-463C-918D-EE910BADD8E3), app name (Microsoft), setting type (Policy), unique Id (DesktopAppInstaller). Result:(0x80070005) Access is denied..
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider" Guid="{3da494e4-0fe2-415c-b895-fb5265c5c83b}" />
    <EventID>865</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2022-02-01T22:01:33.2203516Z" />
    <EventRecordID>4509</EventRecordID>
    <Correlation />
    <Execution ProcessID="15872" ThreadID="11512" />
    <Channel>Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin</Channel>
    <Computer>CLFPF21B7DS</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Message1">2FD40D97-DEA2-463C-918D-EE910BADD8E3</Data>
    <Data Name="Message2">Microsoft</Data>
    <Data Name="Message3">Policy</Data>
    <Data Name="Message4">DesktopAppInstaller</Data>
    <Data Name="HexInt1">0x80070005</Data>
    <Data Name="HexInt3">0x80070005</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
Source:        Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider
Date:          01/02/2022 14:01:33
Event ID:      850
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      CLFPF21B7DS
Description:
MDM PolicyManager ADMX Ingestion: Blocked registry key: (Software\Policies\Microsoft\Windows\AppInstaller) in (policy) tag.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider" Guid="{3da494e4-0fe2-415c-b895-fb5265c5c83b}" />
    <EventID>850</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2022-02-01T22:01:33.2198261Z" />
    <EventRecordID>4508</EventRecordID>
    <Correlation />
    <Execution ProcessID="15872" ThreadID="11512" />
    <Channel>Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin</Channel>
    <Computer>CLFPF21B7DS</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Message1">Software\Policies\Microsoft\Windows\AppInstaller</Data>
    <Data Name="Message2">policy</Data>
  </EventData>
</Event>

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue provides no repository file, test, or entry point. Start by locating the ADMX ingestion and Microsoft Endpoint integration paths, then investigate handling of the blocked Software\Policies\Microsoft\Windows\AppInstaller registry location; done means the configuration can be applied through Endpoint without the reported access-denied errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.