Skip to content

PS7-packaged: $profile.AllUsersAllHosts not writable by administrators #27564

Description

@theJasonHelmick

Summary

When PowerShell 7 is installed as an MSIX package, the system-wide profile ($profile.AllUsersAllHosts) is not writable by administrators. The parent directory (C:\Program Files\WindowsApps\...) does not grant Administrators write permission under the MSIX ACL model.

Impact

Administrators cannot modify the machine-wide PowerShell profile, which is a common enterprise configuration pattern for:

  • Setting organization-wide environment variables
  • Loading enterprise modules on startup
  • Enforcing execution policy and logging hooks

This is a behavioral difference from the MSI-installed version, where $profile.AllUsersAllHosts in C:\Program Files\PowerShell\7\ is writable by Administrators.

Repro

# From an elevated session with MSIX-packaged PS7
$profile.AllUsersAllHosts
# Returns path inside C:\Program Files\WindowsApps\...

Add-Content -Path $profile.AllUsersAllHosts -Value '# test'
# Access is denied.

Workaround

None currently. A potential mitigation using MSIX mutable package directories is under investigation. Reference: https://learn.microsoft.com/en-us/windows/msix/manage/create-directory

Context

We are tracking this internally and working toward a resolution. We will update this issue as progress is made.


Update — profile relocation deferred from #27632 (still open)

The MachineFolder per-machine data store (design #27697) is the intended fix. However, PR #27632 has been scoped down to configuration-file merging only, and the AllUsers profile relocation was removed from that PR and deferred to a dedicated follow-up.

As of that change, the AllUsers profile path resolves to $PSHOME again (Utils.GetApplicationBase(shellId) in HostUtilities.cs) on every install type, so under MSIX the machine-wide profile remains non-writable by admins — i.e. this gap is not yet resolved. This issue remains the tracking item for implementing the relocation.

Open questions for the follow-up PR:

  • Relocate both AllUsersAllHosts and AllUsersCurrentHost (and keep host-specific separation, e.g. pwsh vs. the VS Code host).
  • Ensure all users can read the relocated profiles (MachineFolder SDDL grants read to all users, write to admins).
  • Keep per-package-family isolation (stable / preview / LTS).
  • Surface the effective location via $PROFILE.* and document how to discover/edit it.
  • Validate system-account installs.

Related: #27697 (design), #27565 (MSIX tracking), #27702 (experimental features, also deferred from #27632).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Package-MSIXIssue occurs with MSIX package

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions