fleetdm
Support of MSIX applications in osquery programs table
Fleet version: 4.65.0
Web browser and operating system: n/a
Originally spotted with Microsoft teams. However, this particular fix is not teams specific. We were not scanning the registry locations where any MSIX application is installed.
💥 Actual behavior
Microsoft Teams does not show up in /hosts/id/software
🧑💻 Steps to reproduce
- On an enrolled Windows host, install Microsoft Teams (https://go.microsoft.com/fwlink/?linkid=2281613&clcid=0x409&culture=en-us&country=us)
- Run the installer to install Microsoft Teams
- Refetch host vitals
🕯️ Expected
Microsoft Teams should show up in the list of software and be checked for vulnerabilities on the next vulnerability cron run.
🕯️ More info (optional)
It appears osquery looks in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall for information about installed software, however, Microsoft Teams does not have any information there, instead for this installation it was found in Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\
See https://www.reddit.com/r/MicrosoftTeams/comments/180o878/new_teams_client_version_info_in_registry/
Reproduced on a physical Windows 11 box and a VM
Ensure that installed MSFT Teams appears in /hosts/id/software
So what's weird on this is code to look in HKEY_USERS has been in osquery for awhile. But HKEY_CURRENT_USER isn't there.
This brings up the question of how much of a can of worms software inventory for user-scoped software is...and we probably have this issue for user installs across the board. @mostlikelee, thoughts?
Thinking that we'll need osquery changes here to fix this, and if my assumption is correct that we're not getting user-scoped software inventory for anything that means that we won't get inventory for the three packages on Windows FMA that are user-scoped (Notion, Postman, Teams), see #27179.
@jmwatts can you check if Postman or Notion show up in software inventory for Windows? If not, we should update the ticket to be a larger issue, and probably throw a P2 on this + intentionally skip FMA for now for the user installs until we can automate them.
@iansltx both Postman and Notion show up when I install them via exe locally on the host and then refetch host vitals.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users
HKEY_USERS: Contains all the actively loaded user profiles on the computer. HKEY_CURRENT_USER is a subkey of HKEY_USERS. HKEY_USERS is sometimes abbreviated as HKU.
@iansltx I should point out that when I ran the installers I was not given the option to install only for this user vs all users on this host. So it may not have been a user-scoped install.
@jmwatts Teams is exclusively user-scoped (per @mostlikelee's research on it for FMAs). Can chat through during standup/estimation.
@iansltx yes, sorry, I meant when I tested Notion and Postman. Teams was definitely a user-scope install.
@jmwatts Teams is exclusively user-scoped (per @mostlikelee's research on it for FMAs). Can chat through during standup/estimation.
That is from the perspective of winget (it only installs the user installable version). Microsoft does provide a machine installer separately: https://learn.microsoft.com/en-us/microsoftteams/new-teams-bulk-install-client
If osquery cannot detect msix user installs, we should consider taking it out of FMA scope until we're ready to add the bulk installer.
@mostlikelee Thanks for that clarification! Seems like we should pull this out of scope for this rev of FMA and then add the bulk installer directly (outside WinGet, which...easy enough) for consistency with "we choose machine-scoped whenever possible". Given nuances around how the bootstrapper works though that feels like its own ticket (distinct from inventory).
Doing some more research on this, it appears that we are fundamentally missing AppxPackages software.
"With the newer versions of Teams (Teams 2.0) being installed as a Windows Store app (AppX package/MSIX)"
@mostlikelee If I recall you mentioned the new MSIX installers: https://github.com/fleetdm/fleet/pull/27179 So any of those apps will be missing from osquery.
To preview the template for all msix applications, this is what the ms teams entry will look like:
Why...
is install_source empty?
MSIX/AppX model separates install source from the package metadata. Windows does not persist the original install path in the registry for MSIX apps.
is language empty?
MSIX does not store a single "Language" value in the registry like legacy apps did — instead, language support is handled through resource packages(resources.pri) and is stored in the appxmanifest.xml file.
The tag in the appxmanifest.xml file looks like:
<Resources>
<Resource Language="en-US" />
<Resource Language="fr-FR" />
</Resources>
So listing a single language as the legacy apps do does not really make sense. I can put a comma separated list if that's desired.
is uninstall_string empty?
MSIX apps are managed by the Windows AppX Deployment Service. Install/uninstall is standardized and not handled by each app's custom EXE. Uninstallation should be done via one of the following:
Windows Settings
PowerShell (Remove-AppxPackage)
Deployment tools (Intune, Winget, etc.)
Note about install_date. I am using the file creation date, which could be inaccurate in some cases. Using the Get-AppxPacakge command it is possible to get a true install date for an msix application
Get-AppxPackage -Name "*MSTeams*" | Select Name, PackageFullName, InstallDate
Name : Microsoft.MSTeams
InstallDate: 3/15/2025 10:32:14 AM
However, this value comes from Windows' internal tracking and is not stored in the registry for msix applications.
Note about identifying_number. I am using the "Package Family Name". It is a combination of the package name and publisher hash. Using this provides a unique identifier (similar to bundle_identifier). This ensures apps with the same name from different publishers are considered different. It is also consistent across version (so the identifier will not change across application updates)
@iansltx @noahtalerman
I am currently putting PackageFamilyName (MSIX "bundle identifier") into the identifying_name column. This is the same column that ProductCode is currently being assigned to. Should we put PackageFamilyName into a different column? Along with the possible upcoming change to add UpgradeCode where available into that new column?
one column
or
two separate columns, package_family_name / upgrade_code
This is what the new MSIX records will look like (using teams as an example)
There is no ProductCode for MSIX applications so I am taking PackageFullName(<PackageName>_<Version>_<Architecture>__<PublisherHash>) and putting it into identifying_number (as it's similar to what ProductCode is for MSI applications).
Then added a package_family_name (<PackageName>_ <PublisherHash>) column.
To confirm, both of those two are fields in their own right in MS docs, so we aren't just concat'ing values into a properietary format to save columns?
I did not make these up. They are part of the MSIX definition
PackageFullName -> https://learn.microsoft.com/en-us/windows/apps/desktop/modernize/package-identity-overview#package-full-name
PackageFamilyName -> https://learn.microsoft.com/en-us/windows/apps/desktop/modernize/package-identity-overview#package-family-name
Sweet, thanks for the context! Wanted to triple check to avoid us winding up with complex queries to split the data later.
Looks reasonable to me.
@ksykulev I'm not sure how much I can actually QA this at this point. I used the binary you built and ran osqueryi.exe with select * from programs;
That did return Microsoft Teams in the output and there is a column called package_family_name:
osquery> select * from programs;
+-------------------------------------------------------+---------------------+--------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------+----------+----------------------------------------------------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------+--------------+----------------------------------------+--------------------------------------------------------------+
| name | version | install_location | install_source | language | publisher | uninstall_string | install_date | identifying_number | package_family_name |
+-------------------------------------------------------+---------------------+--------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------+----------+----------------------------------------------------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------+--------------+----------------------------------------+--------------------------------------------------------------+
| Git | 2.49.0 | C:\Program Files\Git\ | | | The Git Development Community | "C:\Program Files\Git\unins000.exe" | 20250409 | | |
| | | C:\Windows\System32\ | | | Microsoft Corporation | "C:\Windows\System32\mstsc.exe" /uninstall | | | |
| Go Programming Language arm64 go1.24.2 | 1.24.2 | | \\Mac\Home\Downloads\ | 1033 | https://go.dev | MsiExec.exe /X{0D4A18EC-20F7-469D-AA92-C1B5A8CA7AE0} | 20250409 | {0D4A18EC-20F7-469D-AA92-C1B5A8CA7AE0} | |
| Parallels Tools | 20.2.2.55879 | | C:\Program Files\Common Files\Parallels\{C869392E-9771-4B87-A8F6-63E387E20855}\ | 1033 | Parallels International GmbH | MsiExec.exe /I{91059C67-7066-4DE0-BBFF-9D7939E57F41} | 20250321 | {91059C67-7066-4DE0-BBFF-9D7939E57F41} | |
| Microsoft Teams Meeting Add-in for Microsoft Office | 1.25.04401 | | C:\Program Files\WindowsApps\MSTeams_25060.205.3499.6849_arm64__8wekyb3d8bbwe\ | 1033 | Microsoft | MsiExec.exe /I{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91} | 20250409 | {A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91} | |
| Microsoft Edge | 135.0.3179.54 | C:\Program Files (x86)\Microsoft\Edge\Application | | | Microsoft Corporation | "C:\Program Files (x86)\Microsoft\Edge\Application\135.0.3179.54\Installer\setup.exe" --uninstall --msedge --channel=stable --system-level --verbose-logging | 20250409 | | |
| | 1.3.195.49 | | | | | | | | |
| Microsoft Edge WebView2 Runtime | 134.0.3124.93 | C:\Program Files (x86)\Microsoft\EdgeWebView\Application | | | Microsoft Corporation | "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\134.0.3124.93\Installer\setup.exe" --uninstall --msedgewebview --system-level --verbose-logging | 20250409 | | |
| 1527c705-839a-4832-9118-54d4Bd6a0c89 | 10.0.19640.1000 | C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | 1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy |
| c5e2524a-ea46-4f67-841f-6a9465d9d515 | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy |
| Clipchamp.Clipchamp | 4.2.10020.0 | C:\Program Files\WindowsApps\Clipchamp.Clipchamp_4.2.10020.0_arm64__yxz26nhyzhsrt | | | Microsoft Corp. | | 20250409 | | Clipchamp.Clipchamp_yxz26nhyzhsrt |
| E2A4F912-2574-4A75-9BB0-0D023378592B | 10.0.19640.1000 | C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy |
| F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy |
| Microsoft.AAD.BrokerPlugin | 1000.19580.1000.2 | C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20250322 | | Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy |
| Microsoft.AccountsControl | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.AccountsControl_cw5n1h2txyewy |
| Microsoft.ApplicationCompatibilityEnhancements | 1.2411.16.0 | C:\Program Files\WindowsApps\Microsoft.ApplicationCompatibilityEnhancements_1.2411.16.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.ApplicationCompatibilityEnhancements_8wekyb3d8bbwe |
| Microsoft.AsyncTextService | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe | | | CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.AsyncTextService_8wekyb3d8bbwe |
| Microsoft.AV1VideoExtension | 1.3.4.0 | C:\Program Files\WindowsApps\Microsoft.AV1VideoExtension_1.3.4.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.AV1VideoExtension_8wekyb3d8bbwe |
| Microsoft.AVCEncoderVideoExtension | 1.1.13.0 | C:\Program Files\WindowsApps\Microsoft.AVCEncoderVideoExtension_1.1.13.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.AVCEncoderVideoExtension_8wekyb3d8bbwe |
| Microsoft.BingNews | 4.55.62231.0 | C:\Program Files\WindowsApps\Microsoft.BingNews_4.55.62231.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.BingNews_8wekyb3d8bbwe |
| Microsoft.BingSearch | 1.1.34.0 | C:\Program Files\WindowsApps\Microsoft.BingSearch_1.1.34.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.BingSearch_8wekyb3d8bbwe |
| Microsoft.BingWeather | 4.54.63007.0 | C:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63007.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.BingWeather_8wekyb3d8bbwe |
| Microsoft.BioEnrollment | 10.0.19587.1000 | C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.BioEnrollment_cw5n1h2txyewy |
| Copilot | 1.25032.167.0 | C:\Program Files\WindowsApps\Microsoft.Copilot_1.25032.167.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.Copilot_8wekyb3d8bbwe |
| Microsoft.CredDialogHost | 10.0.19595.1001 | C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.CredDialogHost_cw5n1h2txyewy |
| Microsoft.DesktopAppInstaller | 1.25.340.0 | C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.25.340.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250323 | | Microsoft.DesktopAppInstaller_8wekyb3d8bbwe |
| Microsoft.ECApp | 10.0.26100.1150 | C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe | | | CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20241005 | | Microsoft.ECApp_8wekyb3d8bbwe |
| Microsoft.GetHelp | 10.2409.22951.0 | C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2409.22951.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.GetHelp_8wekyb3d8bbwe |
| Microsoft.HEIFImageExtension | 1.2.3.0 | C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.2.3.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.HEIFImageExtension_8wekyb3d8bbwe |
| Microsoft.HEVCVideoExtension | 2.2.33.0 | C:\Program Files\WindowsApps\Microsoft.HEVCVideoExtension_2.2.33.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.HEVCVideoExtension_8wekyb3d8bbwe |
| Microsoft.LockApp | 10.0.26100.3323 | C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20250322 | | Microsoft.LockApp_cw5n1h2txyewy |
| Microsoft.MicrosoftEdgeDevToolsClient | 1000.25128.1000.0 | C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe | | | CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe |
| Microsoft 365 Copilot | 18.2503.12711.0 | C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2503.12711.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe |
| Solitaire & Casual Games | 4.22.4040.0 | C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.22.4040.0_arm64__8wekyb3d8bbwe | | | Microsoft Studios | | 20250409 | | Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe |
| Microsoft.MicrosoftStickyNotes | 4.0.6104.0 | C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.6104.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe |
| Microsoft.MPEG2VideoExtension | 1.0.61931.0 | C:\Program Files\WindowsApps\Microsoft.MPEG2VideoExtension_1.0.61931.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20240401 | | Microsoft.MPEG2VideoExtension_8wekyb3d8bbwe |
| Microsoft .Net Native Framework Package 2.2 | 2.2.29512.0 | C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20240401 | | Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe |
| Microsoft .Net Native Runtime Package 2.2 | 2.2.28604.0 | C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20240401 | | Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe |
| Outlook for Windows | 1.2025.312.200 | C:\Program Files\WindowsApps\Microsoft.OutlookForWindows_1.2025.312.200_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250321 | | Microsoft.OutlookForWindows_8wekyb3d8bbwe |
| Microsoft.Paint | 11.2502.161.0 | C:\Program Files\WindowsApps\Microsoft.Paint_11.2502.161.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.Paint_8wekyb3d8bbwe |
| Microsoft.RawImageExtension | 2.5.3.0 | C:\Program Files\WindowsApps\Microsoft.RawImageExtension_2.5.3.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.RawImageExtension_8wekyb3d8bbwe |
| Microsoft.ScreenSketch | 11.2502.18.0 | C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2502.18.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.ScreenSketch_8wekyb3d8bbwe |
| Microsoft.SecHealthUI | 1000.27703.1006.0 | C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.27703.1006.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.SecHealthUI_8wekyb3d8bbwe |
| Microsoft Engagement Framework | 10.0.23012.0 | C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.23012.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.Services.Store.Engagement_8wekyb3d8bbwe |
| Microsoft.StorePurchaseApp | 22502.1401.1.0 | C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22502.1401.1.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.StorePurchaseApp_8wekyb3d8bbwe |
| Microsoft.Todos | 0.143.2921.0 | C:\Program Files\WindowsApps\Microsoft.Todos_0.143.2921.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.Todos_8wekyb3d8bbwe |
| Microsoft.UI.Xaml.2.7 | 7.2409.9001.0 | C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.7_7.2409.9001.0_arm64__8wekyb3d8bbwe | | | Microsoft Platform Extensions | | 20250322 | | Microsoft.UI.Xaml.2.7_8wekyb3d8bbwe |
| Microsoft.UI.Xaml.2.8 | 8.2501.31001.0 | C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_arm64__8wekyb3d8bbwe | | | Microsoft Platform Extensions | | 20250321 | | Microsoft.UI.Xaml.2.8_8wekyb3d8bbwe |
| Microsoft.UI.Xaml.CBS | 9.2311.10002.0 | C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe | | | Microsoft Platform Extensions | | 20240401 | | Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe |
| Microsoft Visual C++ 2015 UWP Desktop Runtime Package | 14.0.33728.0 | C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_arm64__8wekyb3d8bbwe | | | Microsoft Platform Extensions | | 20250321 | | Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe |
| Microsoft Visual C++ 2015 UWP Runtime Package | 14.0.33519.0 | C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_arm64__8wekyb3d8bbwe | | | Microsoft Platform Extensions | | 20250321 | | Microsoft.VCLibs.140.00_8wekyb3d8bbwe |
| Microsoft.VP9VideoExtensions | 1.2.2.0 | C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.2.2.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.VP9VideoExtensions_8wekyb3d8bbwe |
| Microsoft.WebMediaExtensions | 1.1.1295.0 | C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.1.1295.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WebMediaExtensions_8wekyb3d8bbwe |
| Microsoft.WebpImageExtension | 1.1.1711.0 | C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.1.1711.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WebpImageExtension_8wekyb3d8bbwe |
| Widgets Platform Runtime | 1.6.8.0 | C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.8.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250321 | | Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe |
| Microsoft.Win32WebViewHost | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Win32WebViewHost_cw5n1h2txyewy |
| Microsoft.Windows.Apprep.ChxApp | 1000.25128.1000.0 | C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy |
| Microsoft.Windows.AssignedAccessLockApp | 1000.25128.1000.0 | C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy |
| Microsoft.Windows.AugLoop.CBS | 1.1004.2226.0 | C:\WINDOWS\SystemApps\Microsoft.Windows.AugLoop.CBS_8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.Windows.AugLoop.CBS_8wekyb3d8bbwe |
| CapturePicker | 10.0.19580.1000 | C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | Microsoft.Windows.CapturePicker_cw5n1h2txyewy |
| Microsoft.Windows.CloudExperienceHost | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy |
| Microsoft.Windows.ContentDeliveryManager | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy |
| Microsoft.Windows.DevHome | 0.0.0.0 | C:\Program Files\WindowsApps\Microsoft.Windows.DevHome_0.0.0.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20240401 | | Microsoft.Windows.DevHome_8wekyb3d8bbwe |
| Microsoft.Windows.NarratorQuickStart | 10.0.26100.1 | C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe | | | CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe |
| Microsoft.Windows.OOBENetworkCaptivePortal | 10.0.21302.1000 | C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy |
| Microsoft.Windows.OOBENetworkConnectionFlow | 10.0.21302.1000 | C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy |
| Microsoft.Windows.ParentalControls | 1000.25128.1000.0 | C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.ParentalControls_cw5n1h2txyewy |
| Microsoft.Windows.PeopleExperienceHost | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy |
| Microsoft.Windows.Photos | 2025.11030.12002.0 | C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2025.11030.12002.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.Windows.Photos_8wekyb3d8bbwe |
| PinningConfirmationDialog | 1000.25140.1001.0 | C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy |
| Microsoft.Windows.PrintQueueActionCenter | 1.0.2.0 | C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy |
| Microsoft.Windows.SecureAssessmentBrowser | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy |
| Microsoft.Windows.ShellExperienceHost | 10.0.26100.3323 | C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20250322 | | Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy |
| Microsoft.Windows.StartMenuExperienceHost | 10.0.26100.3323 | C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20250322 | | Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy |
| Microsoft.Windows.XGpuEjectDialog | 10.0.26100.1 | C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy |
| Microsoft.WindowsAlarms | 1.0.211.0 | C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.211.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WindowsAlarms_8wekyb3d8bbwe |
| WindowsAppRuntime.1.4 | 4000.1309.2056.0 | C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.4_4000.1309.2056.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WindowsAppRuntime.1.4_8wekyb3d8bbwe |
| WindowsAppRuntime.1.5 | 5001.373.1736.0 | C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.5_5001.373.1736.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250321 | | Microsoft.WindowsAppRuntime.1.5_8wekyb3d8bbwe |
| WindowsAppRuntime.1.6 | 6000.457.2140.0 | C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.6_6000.457.2140.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.WindowsAppRuntime.1.6_8wekyb3d8bbwe |
| Microsoft.WindowsAppRuntime.CBS.1.6 | 6000.375.2142.0 | C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.vNext.CBS_8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WindowsAppRuntime.CBS.1.6_8wekyb3d8bbwe |
| Microsoft.WindowsAppRuntime.CBS | 5001.311.2039.0 | C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe |
| Microsoft.WindowsCalculator | 11.2502.2.0 | C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2502.2.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.WindowsCalculator_8wekyb3d8bbwe |
| Microsoft.WindowsCamera | 2025.2501.1.0 | C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2025.2501.1.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WindowsCamera_8wekyb3d8bbwe |
| Microsoft.WindowsFeedbackHub | 1.2411.17101.0 | C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2411.17101.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe |
| Microsoft.WindowsNotepad | 11.2501.31.0 | C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2501.31.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.WindowsNotepad_8wekyb3d8bbwe |
| Microsoft.WindowsSoundRecorder | 1.0.90.0 | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.90.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe |
| Microsoft Store | 22502.1401.11.0 | C:\Program Files\WindowsApps\Microsoft.WindowsStore_22502.1401.11.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.WindowsStore_8wekyb3d8bbwe |
| Microsoft.WindowsTerminal | 1.22.10731.0 | C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.WindowsTerminal_8wekyb3d8bbwe |
| Xbox TCUI | 1.24.10001.0 | C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.24.10001.0_x64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.Xbox.TCUI_8wekyb3d8bbwe |
| Microsoft.XboxGameCallableUI | 1000.25128.1000.0 | C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Microsoft.XboxGameCallableUI_cw5n1h2txyewy |
| Game Bar | 7.225.3271.0 | C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_7.225.3271.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.XboxGamingOverlay_8wekyb3d8bbwe |
| Microsoft.XboxIdentityProvider | 12.115.1001.0 | C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.115.1001.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250322 | | Microsoft.XboxIdentityProvider_8wekyb3d8bbwe |
| Microsoft.XboxSpeechToTextOverlay | 1.97.17002.0 | C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.97.17002.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20240401 | | Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe |
| Microsoft.YourPhone | 1.25022.70.0 | C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25022.70.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.YourPhone_8wekyb3d8bbwe |
| Microsoft.ZuneMusic | 11.2502.4.0 | C:\Program Files\WindowsApps\Microsoft.ZuneMusic_11.2502.4.0_arm64__8wekyb3d8bbwe | | | Microsoft Corporation | | 20250409 | | Microsoft.ZuneMusic_8wekyb3d8bbwe |
| MicrosoftCorporationII.QuickAssist | 2.0.29.0 | C:\Program Files\WindowsApps\MicrosoftCorporationII.QuickAssist_2.0.29.0_arm64__8wekyb3d8bbwe | | | Microsoft Corp. | | 20240401 | | MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe |
| MicrosoftWindows.Client.CBS | 1000.26100.54.0 | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.Client.CBS_cw5n1h2txyewy |
| MicrosoftWindows.Client.Core | 1000.26100.36.0 | C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.Client.Core_cw5n1h2txyewy |
| MicrosoftWindows.Client.FileExp | 1000.26100.3.0 | C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy | | | Microsoft Windows | | 20241005 | | MicrosoftWindows.Client.FileExp_cw5n1h2txyewy |
| MicrosoftWindows.Client.OOBE | 1000.26100.2.0 | C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy | | | Microsoft Windows | | 20241005 | | MicrosoftWindows.Client.OOBE_cw5n1h2txyewy |
| MicrosoftWindows.Client.Photon | 1000.26100.8.0 | C:\Windows\SystemApps\MicrosoftWindows.Client.Photon_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.Client.Photon_cw5n1h2txyewy |
| Windows Web Experience Pack | 525.5100.40.0 | C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.5100.40.0_arm64__cw5n1h2txyewy | | | Microsoft Windows | | 20250409 | | MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy |
| MicrosoftWindows.CrossDevice | 1.25031.44.0 | C:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.25031.44.0_arm64__cw5n1h2txyewy | | | Microsoft Windows | | 20250409 | | MicrosoftWindows.CrossDevice_cw5n1h2txyewy |
| MicrosoftWindows.LKG.AccountsService | 1000.26100.3470.0 | C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.AccountsService_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.LKG.AccountsService_cw5n1h2txyewy |
| MicrosoftWindows.LKG.DesktopSpotlight | 1000.26100.3470.0 | C:\WINDOWS\SystemApps\LKG\MicrosoftWindows.LKG.DesktopSpotlight_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.LKG.DesktopSpotlight_cw5n1h2txyewy |
| MicrosoftWindows.LKG.IrisService | 1000.26100.3470.0 | C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.IrisService_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.LKG.IrisService_cw5n1h2txyewy |
| MicrosoftWindows.LKG.RulesEngine | 1000.26100.3470.0 | C:\WINDOWS\SystemApps\LKG\MicrosoftWindows.LKG.RulesEngine_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.LKG.RulesEngine_cw5n1h2txyewy |
| MicrosoftWindows.LKG.SpeechRuntime | 1000.26100.3470.0 | C:\WINDOWS\SystemApps\LKG\MicrosoftWindows.LKG.SpeechRuntime_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.LKG.SpeechRuntime_cw5n1h2txyewy |
| MicrosoftWindows.LKG.TwinSxS | 1000.26100.3470.0 | C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.TwinSxS_cw5n1h2txyewy | | | Microsoft Windows | | 20250322 | | MicrosoftWindows.LKG.TwinSxS_cw5n1h2txyewy |
| UDK Package | 10.0.26100.1 | C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy | | | Microsoft Corporation | | 20240401 | | MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy |
| Microsoft Teams | 25060.205.3499.6849 | C:\Program Files\WindowsApps\MSTeams_25060.205.3499.6849_arm64__8wekyb3d8bbwe | | | Microsoft | | 20250409 | | MSTeams_8wekyb3d8bbwe |
| Windows.CBSPreview | 10.0.19580.1000 | C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Windows.CBSPreview_cw5n1h2txyewy |
| windows.immersivecontrolpanel | 10.0.8.1000 | C:\Windows\ImmersiveControlPanel | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | windows.immersivecontrolpanel_cw5n1h2txyewy |
| Windows.PrintDialog | 6.2.3.0 | C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy | | | CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US | | 20240401 | | Windows.PrintDialog_cw5n1h2txyewy |
+-------------------------------------------------------+---------------------+--------------------------------------------------------------------------------------------------------------+---------------------------------------------------------------------------------+----------+----------------------------------------------------------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------+--------------+----------------------------------------+--------------------------------------------------------------+
osquery>
I don't see any Fleet server changes or fleetd/osqueryd changes that would return this information back to Fleet. What else do I need to test on this one?
In the city of glass, MSIX apps now shine bright, Secure, in Fleet's grasp.
