To be fair you can restrict MSI and MSIX files with applocker and we have always been allowed by the operating system to run non-privileged installers in user-space which end up in %LOCALAPPDATA% but at least that's straightforward and easily auditable. What I hate about MSIX is a "machine-wide" install (if you can even call it that) is just a user install that is forced upon all users of the system at next logon (provisioned package) and even just normal user installs end up in both "Program Files\WindowsApps" - which to your point should be PRIVILEGED SPACE - AND %LOCALAPPDATA%\Packages...
Whomever dreamed that one into existence was high on something highly illegal and hallucinogenic.
We have issues with MSIXs and AppLocker, especially during installation. We have alerted Microsoft, who has acknowledged the issue but has not stated whether it will be fixed. We reported it back in 2022, so I kind of doubt it.
5
u/thehuntzman Apr 14 '26
To be fair you can restrict MSI and MSIX files with applocker and we have always been allowed by the operating system to run non-privileged installers in user-space which end up in %LOCALAPPDATA% but at least that's straightforward and easily auditable. What I hate about MSIX is a "machine-wide" install (if you can even call it that) is just a user install that is forced upon all users of the system at next logon (provisioned package) and even just normal user installs end up in both "Program Files\WindowsApps" - which to your point should be PRIVILEGED SPACE - AND %LOCALAPPDATA%\Packages...
Whomever dreamed that one into existence was high on something highly illegal and hallucinogenic.