Winget is broken with BlockNonAdminUserInstall being set

Relevant area(s)

WinGet CLI

Relevant command(s)

winget install, winget upgrade, winget repair

Brief description of your issue

On machines with BlockNonAdminUserInstall = 1 being set, its impossible to use winget

Steps to reproduce

Our IT provisions our developer machines with an ENTRA/firstName.lastName account without admin rights and sets HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ApplicationManagement\BlockNonAdminUserInstall = 1 via Intune.
They grant us the ability to install software via a secondary ENTRA/adm-firstName.lastName account with admin rights.

Trying to use winget install for anything on the winget source leads to

Unexpected error while executing the command:
0x8a15000f : Data required from the source is missing

This is due to AddPackage on the Microsoft.Winget.Source failing with 0x80070005 (access denied).
Since this is a per-user package, the adm account doesn't help here.

Expected behavior

Being able to install software with winget, if needed by using elevate.

Actual behavior

Installing software is impossible with BlockNonAdminUserInstall being set on a non admin account, even if a secondary admin account is available.

Environment

winget --info
Windows-Paket-Manager v1.29.280
© 2026 Microsoft. Alle Rechte vorbehalten.

Windows: Windows.Desktop v10.0.26200.9106
Systemarchitektur: X64
Paket: Microsoft.DesktopAppInstaller v1.29.280.0

WinGet-Verzeichnisse
-----------------------------------------------------------------------------------------------------------------------------------------
Protokolle                                   %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir
Benutzereinstellungen                        %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json
Verzeichnis für portierbare Links (Benutzer) %LOCALAPPDATA%\Microsoft\WinGet\Links
Portables Linkverzeichnis (Computer)         C:\Program Files\WinGet\Links
Portierbarer Paketstamm (Benutzer)           %LOCALAPPDATA%\Microsoft\WinGet\Packages
Portierbarer Paketstamm                      C:\Program Files\WinGet\Packages
Portierbares Paketstamm (x86)                C:\Program Files (x86)\WinGet\Packages
Installationsprogrammdownloads               %USERPROFILE%\Downloads
Konfigurationsmodule                         %LOCALAPPDATA%\Microsoft\WinGet\Configuration\Modules

Links
-----------------------------------------------------------------------------------------
Datenschutzerklärung              https://aka.ms/winget-privacy
Lizenzvereinbarung                https://aka.ms/winget-license
Hinweise von Drittanbietern       https://aka.ms/winget-3rdPartyNotice
Startseite                        https://aka.ms/winget
Windows Store-Nutzungsbedingungen https://www.microsoft.com/en-us/storedocs/terms-of-sale

Administratoreinstellung                  Status
-----------------------------------------------------
LocalManifestFiles                        Deaktiviert
BypassCertificatePinningForMicrosoftStore Deaktiviert
InstallerHashOverride                     Deaktiviert
LocalArchiveMalwareScanOverride           Deaktiviert
ProxyCommandLineOptions                   Deaktiviert
ConfigurationProcessorPath                Deaktiviert
DefaultProxy                              Deaktiviert

Start by reproducing the issue with winget install, winget upgrade, and winget repair while BlockNonAdminUserInstall is set, and review the reported AddPackage access-denied failure. Trace how the WinGet source package is added for a non-admin user and how elevation is handled. Done means the commands can install software when a secondary administrator account is available.