Summary
When PowerShell 7 is installed as an MSIX package, the system-wide profile ($profile.AllUsersAllHosts) is not writable by administrators. The parent directory (C:\Program Files\WindowsApps\...) does not grant Administrators write permission under the MSIX ACL model.
Impact
Administrators cannot modify the machine-wide PowerShell profile, which is a common enterprise configuration pattern for:
- Setting organization-wide environment variables
- Loading enterprise modules on startup
- Enforcing execution policy and logging hooks
This is a behavioral difference from the MSI-installed version, where $profile.AllUsersAllHosts in C:\Program Files\PowerShell\7\ is writable by Administrators.
Repro
# From an elevated session with MSIX-packaged PS7
$profile.AllUsersAllHosts
# Returns path inside C:\Program Files\WindowsApps\...
Add-Content -Path $profile.AllUsersAllHosts -Value '# test'
# Access is denied.
Workaround
None currently. A potential mitigation using MSIX mutable package directories is under investigation. Reference: https://learn.microsoft.com/en-us/windows/msix/manage/create-directory
Context
We are tracking this internally and working toward a resolution. We will update this issue as progress is made.
Update — profile relocation deferred from #27632 (still open)
The MachineFolder per-machine data store (design #27697) is the intended fix. However, PR #27632 has been scoped down to configuration-file merging only, and the AllUsers profile relocation was removed from that PR and deferred to a dedicated follow-up.
As of that change, the AllUsers profile path resolves to $PSHOME again (Utils.GetApplicationBase(shellId) in HostUtilities.cs) on every install type, so under MSIX the machine-wide profile remains non-writable by admins — i.e. this gap is not yet resolved. This issue remains the tracking item for implementing the relocation.
Open questions for the follow-up PR:
- Relocate both
AllUsersAllHosts and AllUsersCurrentHost (and keep host-specific separation, e.g. pwsh vs. the VS Code host).
- Ensure all users can read the relocated profiles (MachineFolder SDDL grants read to all users, write to admins).
- Keep per-package-family isolation (stable / preview / LTS).
- Surface the effective location via
$PROFILE.* and document how to discover/edit it.
- Validate system-account installs.
Related: #27697 (design), #27565 (MSIX tracking), #27702 (experimental features, also deferred from #27632).
Summary
When PowerShell 7 is installed as an MSIX package, the system-wide profile (
$profile.AllUsersAllHosts) is not writable by administrators. The parent directory (C:\Program Files\WindowsApps\...) does not grant Administrators write permission under the MSIX ACL model.Impact
Administrators cannot modify the machine-wide PowerShell profile, which is a common enterprise configuration pattern for:
This is a behavioral difference from the MSI-installed version, where
$profile.AllUsersAllHostsinC:\Program Files\PowerShell\7\is writable by Administrators.Repro
Workaround
None currently. A potential mitigation using MSIX mutable package directories is under investigation. Reference: https://learn.microsoft.com/en-us/windows/msix/manage/create-directory
Context
We are tracking this internally and working toward a resolution. We will update this issue as progress is made.
Update — profile relocation deferred from #27632 (still open)
The MachineFolder per-machine data store (design #27697) is the intended fix. However, PR #27632 has been scoped down to configuration-file merging only, and the AllUsers profile relocation was removed from that PR and deferred to a dedicated follow-up.
As of that change, the AllUsers profile path resolves to
$PSHOMEagain (Utils.GetApplicationBase(shellId)inHostUtilities.cs) on every install type, so under MSIX the machine-wide profile remains non-writable by admins — i.e. this gap is not yet resolved. This issue remains the tracking item for implementing the relocation.Open questions for the follow-up PR:
AllUsersAllHostsandAllUsersCurrentHost(and keep host-specific separation, e.g.pwshvs. the VS Code host).$PROFILE.*and document how to discover/edit it.Related: #27697 (design), #27565 (MSIX tracking), #27702 (experimental features, also deferred from #27632).