7.7: MSIX-packaged PowerShell does not allow writes to certain HKLM keys

Prerequisites

Write a descriptive title.
Make sure you are able to repro it on the latest released version
Search the existing issues.
Refer to the FAQ.
Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

Attempting to write to an HKLM registry key using the newly packaged MSIX version of PowerShell 7.7.0 in elevated access results in access denial. This behavior is observed across both standard item-related cmdlets (e.g., New-Item) and .NET class calls to the registry.

Expected behavior

> New-Item Registry::HKLM\Software\A


    Hive: HKLM\Software


Name                           Property
----                           --------
A

> [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true)

Name                           Property
----                           --------

Actual behavior

> New-Item Registry::HKLM\Software\A
New-Item: Requested registry access is not allowed.

> [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true)
MethodInvocationException: Exception calling "OpenSubKey" with "2" argument(s): "Requested registry access is not allowed."

Error details

> Get-Error

Exception             :
    Type           : System.Management.Automation.MethodInvocationException
    ErrorRecord    :
        Exception             :
            Type    : System.Management.Automation.ParentContainsErrorRecordException
            Message : Exception calling "OpenSubKey" with "2" argument(s): "Requested registry access is not allowed."
            HResult : -2146233087
        CategoryInfo          : NotSpecified: (:) [], ParentContainsErrorRecordException
        FullyQualifiedErrorId : SecurityException
        InvocationInfo        :
            ScriptLineNumber : 1
            OffsetInLine     : 1
            HistoryId        : 4
            Line             : [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true)
            Statement        : [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true)
            PositionMessage  : At line:1 char:1
                               + [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true …
                               + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            CommandOrigin    : Internal
        ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
    TargetSite     :
        Name          : ConvertToMethodInvocationException
        DeclaringType : [System.Management.Automation.ExceptionHandlingOps]
        MemberType    : Method
        Module        : System.Management.Automation.dll
    Message        : Exception calling "OpenSubKey" with "2" argument(s): "Requested registry access is not allowed."
    Data           :
        System.Management.Automation.Interpreter.InterpretedFrameInfo, System.Management.Automation,
Version=7.7.0.500, Culture=neutral, PublicKeyToken=31bf3856ad364e35 : <ScriptBlock>

    InnerException :
        Type       : System.Security.SecurityException
        TargetSite :
            Name          : OpenSubKey
            DeclaringType : [Microsoft.Win32.RegistryKey]
            MemberType    : Method
            Module        : Microsoft.Win32.Registry.dll
        Message    : Requested registry access is not allowed.
        Source     : Microsoft.Win32.Registry
        HResult    : -2146233078
        StackTrace :
   at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)
   at CallSite.Target(Closure, CallSite, RegistryKey, String, Boolean)
    Source         : System.Management.Automation
    HResult        : -2146233087
    StackTrace     :
   at System.Management.Automation.ExceptionHandlingOps.ConvertToMethodInvocationException(Exception exception, Type
typeToThrow, String methodName, Int32 numArgs, MemberInfo memberInfo)
   at CallSite.Target(Closure, CallSite, RegistryKey, String, Boolean)
   at System.Dynamic.UpdateDelegates.UpdateAndExecute3[T0,T1,T2,TRet](CallSite site, T0 arg0, T1 arg1, T2 arg2)
   at System.Management.Automation.Interpreter.DynamicInstruction`4.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
FullyQualifiedErrorId : SecurityException
InvocationInfo        :
    ScriptLineNumber : 1
    OffsetInLine     : 1
    HistoryId        : 4
    Line             : [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true)
    Statement        : [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true)
    PositionMessage  : At line:1 char:1
                       + [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE', $true …
                       + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    CommandOrigin    : Internal
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1

Environment data

> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.7.0
PSEdition                      Core
GitCommitId                    7.7.0
OS                             Microsoft Windows 10.0.28120
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.4
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Visuals

It looks like only HKLM\Software and HKLM\Software\Classes are effected; other keys are not, which seems to partially line up with the existing MSIX documentation, though reads/writes should still succeed based on the docs?

We worked through this in the Discord, a workaround if you need to create a key in HKLM:\SOFTWARE\key is either of these two methods

# Direct creation
$k = [Microsoft.Win32.Registry]::LocalMachine.CreateSubKey('SOFTWARE\test')

# Creating from parent key with only the rights required
$k = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(
    'SOFTWARE',
    [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,
    [System.Security.AccessControl.RegistryRights]::CreateSubKey)
$k2 = $k.CreateSubKey('test')

As for the underlying problem the MSIX virtualisation done for HKLM:\SOFTWARE is special and no longer allows the KEY_SET_VALUE permission. We can see through the stacktrace that New-Item is calling OpenSubKey with the Boolean writable overload and this is set to true.

Exception             :
    Type       : System.Security.SecurityException
    TargetSite :
        Name          : OpenSubKey
        DeclaringType : [Microsoft.Win32.RegistryKey]
        MemberType    : Method
        Module        : Microsoft.Win32.Registry.dll
    Message    : Requested registry access is not allowed.
    Source     : Microsoft.Win32.Registry
    HResult    : -2146233078
    StackTrace :
   at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)
   at Microsoft.PowerShell.Commands.RegistryWrapper.OpenSubKey(String name, Boolean writable)
   at Microsoft.PowerShell.Commands.RegistryProvider.GetRegkeyForPath(String path, Boolean writeAccess)
   at Microsoft.PowerShell.Commands.RegistryProvider.GetRegkeyForPathWriteIfError(String path, Boolean writeAccess)

This overload is going to request KEY_WRITE which includes this KEY_SET_VALUE mask causing the failure for this particular parent.

PowerShell/src/System.Management.Automation/namespaces/RegistryProvider.cs

Lines 1000 to 1004 in 638faa6

    
           string parentPath = GetParentPath(path, null); 
        
           string childName = GetChildName(path); 
        
           // Get the key at the specified path 
        
           IRegistryWrapper key = GetRegkeyForPathWriteIfError(parentPath, true);

The fix would be to have a new method or flag that only requests RegistryRights.CreateSubKey and RegistryKeyPermissionCheck.ReadWriteSubTree for opening this key so it can create the sub key.

Navigation Menu

Repository navigation

7.7: MSIX-packaged PowerShell does not allow writes to certain HKLM keys #28390

Prerequisites

Steps to reproduce

Expected behavior

Actual behavior

Error details

Environment data

Visuals

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	string parentPath = GetParentPath(path, null);
	string childName = GetChildName(path);

	// Get the key at the specified path
	IRegistryWrapper key = GetRegkeyForPathWriteIfError(parentPath, true);

7.7: MSIX-packaged PowerShell does not allow writes to certain HKLM keys #28390

Description

Prerequisites

Steps to reproduce

Expected behavior

Actual behavior

Error details

Environment data

Visuals

Activity

Still34 commented on Nov 11, 2026

jborean93 commented on Nov 11, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions