Which services are required to install/remove AppX/UWP apps?

O

OpenSource Ghost

Member
I disabled many services I didn't need in Windows 11 23H2, but that also prevented me from being able to install/uninstall AppX/UWP apps, such as NVidia Control Panel. In Windows 10, I only needed to keep AppX Service enabled, but that was not enough for Windows 11. I wasn't able to narrow it down, but in Windows 11 it wasn't AppX, App Readiness, Capabilities Manager, and/or combination of all 3 being enabled...

Does anyone know for sure?

AppX/UWP are such a PITA. All it takes to corrupt one is removal the special "System App ID" permissions for "Program Files\WindowsApps" directory to permanently stop AppX/UWP apps in that directory from working until full OS wipe/re-install. That special permissions is labeled by Windows as "corrupt", but is actually required and there is no way to set it manually... Even removal of empty directories from "AppData\Local\Packages" ruins functions of whichever AppX/UWP app.
 
Last edited:
You're breaking the UWP security model. It's based on app containers, which provide protection to app folders and some user data.

Direct editing of the folder structure is not advised. You're supposed to use DISM or (preferably) PowerShell to add or remove Appx/MSIX packages or bundles. DISM or the PS cmdlets get their privileges through the TrustedInstaller service.

It's considered easier to remove packages from the offline image, when no services or running, and before any System Apps are tagged as non-removable in the SRM database.

Some of the required UWP services:
- App Readiness
- AppX Service
- Client License Service
- RPC Locator
 
I am very confused about Windows Containers. There is "App Guard / Containers" component, but I think it has nothing to do with AppX/UWP containerization and there is also Hyper-V containerization that doesn't have anything to do with AppX/UWP containers or Windows Containers. I think Windows Containers is "App Guard / Containers" and is specifically for Edge containerization. Then there also is a driver for Windows Containers and it is often running even when OS isn't using any Windows Containers - https://batcmd.com/windows/10/services/wcifs/ .

To keep AppX/UWP "sandboxing" requires AppX and Windows Bind Filter driver, but I haven't figured out what is needed to install and re-instal AppX/UWP, like NVidia Control Panel.
 
MS has a terrible addiction for overloading the same terminology for all products.

There are different levels of Windows virtualization:
- AppX -> app virtualization, using AppData folder and security model isolation
- Windows Sandbox -> Windows run-time containe, which overlays the filesystem using a filter driver
- WDAG -> browser execution container
- VBS -> kernel protection by virtualizing drivers behind another layer, so rogue kernel drivers can't tamper with protected memory
- Hyper-V -> full on virtualization

Using kernel filter drivers, you can create virtual instances of a copy-on-write filesystem on top of the existing one. This forks your copy, and sets aside writes to a different virtual volume. When the virtualization exits, this copy can be discarded without disturbing the original filesystem it was forked from. There's even a Windows mode where you can run a logon session, and upon exit, throws away everything that was touched.
 
Thank you for the info.

The posted like of services isn't enough. I test by installing and uninstalling NVidia Control Panel and I know for sure it needs services in addition to the required one listed below:
- App Readiness
- AppX
- Capabilities Access Manager (or else NVidia CP doesn't register)

Some other service is needed as well or else NVidia installs, but doesn't function. I am not able to narrow it down for now. I do know that that service isn't RPC Locator, Client License Service, and/or Windows License Manager.
 
Client License Service is required for apps downloading thru Store, or any sideloaded apps that don't provide a License1.xml. NVCP in the NVIDIA installer normally ships with a provided license file, which removes the need for ClipSvc.
 
garlin said:
Client License Service is required for apps downloading thru Store, or any sideloaded apps that don't provide a License1.xml. NVCP in the NVIDIA installer normally ships with a provided license file, which removes the need for ClipSvc.
Click to expand...

Didn't know that.

The final services needed for NVidia CP installation remain unknown then. I have 2 presets that break NVidia CP installation. One preset is exclusively component removal without any manual services tweaking and another is exclusively services tweaking without removing any components. I compare to see what they have in common. The preset exclusive to component removal rips out Provisioning component. The preset exclusive to service tweaking disables DeviceAssociationBrokerSvc and DmEnrollmentSvc. I think both of those services are part of Provisioning component. It is possible that it is those services that are needed for NVidia CP to install and launch at least one time. Once NVidia CP is successfully launched one time, DeviceAssociationBrokerSvc and DmEnrollmentSvc can be removed and/or disabled without affecting NVidia CP.
 
Last edited:
You must log in or register to reply here.
Back
Top