WinGet upgrade fails with 0x80070005 / 0x80073CF6 due to broken ACL inheritance on HKCU\Software\Classes\ActivatableClasses\Package

Hello,

I investigated a WinGet upgrade failure on Windows where WinGet failed during AppX package registration.

Symptoms:

• winget upgrade failed with:
  • HRESULT 0x80070005 (ACCESS_DENIED)
  • HRESULT 0x80073CF6 (Package could not be registered)

The failure occurred only when running WinGet as the normal user.
Running elevated worked.

Investigation:

ProcMon showed failed registry operations under:

HKCU\Software\Classes\ActivatableClasses\Package\

with access denied during AppX registration.

The problem was not caused by WinGet itself, but by an incorrect ACL on:

HKCU\Software\Classes\ActivatableClasses\Package

Broken ACL:

The key had explicit ACE entries and inheritance was disabled.

Example:

D:PAI(A;CI;KR;;;WD)...

A clean test user profile had:

User: FullControl (inherited)
SYSTEM: FullControl (inherited)
Administrators: FullControl (inherited)
Restricted: ReadKey (inherited)
ALL APPLICATION PACKAGES: ReadKey (inherited)
Capability SID: ReadKey (inherited)

Fix:

Restored inheritance on:

HKCU\Software\Classes\ActivatableClasses\Package

Removed the incorrect explicit ACE:

(A;CI;KR;;;AC)

After restoring the ACL to the inherited structure, WinGet immediately started working again.

Verification:

Before fix:

winget upgrade
-> AppX registration failures

After fix:

winget upgrade

Successfully enumerates available upgrades.

Final working SDDL:

O:S-1-5-21-...-1001
G:S-1-5-21-...-513
D:AI
(A;OICIID;KA;;;USER)
(A;OICIID;KA;;;SY)
(A;OICIID;KA;;;BA)
(A;OICIID;KR;;;RC)
(A;OICIID;KR;;;AC)
(A;OICIID;KR;;;CapabilitySID)

This may affect users where the HKCU\Software\Classes\ActivatableClasses\Package ACL was modified incorrectly.

Possible improvement:
WinGet/AppX registration errors could detect this ACL condition and provide a more meaningful diagnostic message.

I hope this helps with investigation.

Start by reproducing the failure with winget upgrade under a normal user and compare it with elevated execution. Review the AppX registration error path and the reported ACL condition under HKCU\Software\Classes\ActivatableClasses\Package; done would be a meaningful diagnostic when this condition causes registration failure.