[1709, fcu] Domain user profile missing modern apps after deleting local profile

[Raisin]

Hi everyone,

 

I'm a part time lurker, first time poster.

 

We're preparing to add Windows 10 1709 (latest updates as of november 28th) in our classrooms. I'm pretty far along but I had to backtrack to isolate this problem:

 

 

1. Sign in with a domain account with a local profile: everything is fine and the modern apps are all there.
   
2. Delete that domain accounts' local profile from the "User Profiles" window in "System Properties" with local admin account.
   
3. Sign in with that domain account again: I'm missing every modern app.
   
4. Delete that domain accounts' local profile from the "User Profiles" window in "System Properties" with local admin account.
   
5. Sign in with that domain account again: everything is fine and the modern apps are all there.
   

 

How does Windows 10 handle domain accounts with a local profiles? This is extremely confusing. I'm leaving out a bunch of information since I'm scared a wall of text might scare you off. If you have any questions, ask away!

 

Thanks

[Raisin]

Let's try to simplify things a bit as my post seems to be a bit to hard to answer.

 

Is anyone not experiencing the behaviour listed in the 5 steps from my original post?

[psydii]

I’ve seen odd behaviour with modern app provisioning. Your description is great, and so clear that perhaps no one else is taking those exact steps?

 

Just riffing off what I think you have been trying to do when you hit this issue:

 

What happens if you make the users members of the local guest group? (This should force temporary local profiles for members who log on, and thus get deleted at log off) is the app problem replicated?

 

https://support.microsoft.com/en-gb/help/165398/profiles-for-members-of-guests-group-are-deleted

[Raisin]

We were using the local guests group to flush student profiles for Windows 7 but the behaviour in Windows 10 is different and seems to consistently prevent any sort of modern app provisioning except Edge. I'm not sure what the normal behaviour is supposed to be since I haven't found any recent documentation concerning the local guests group and Windows 10.

 

I wanted to go that way but I had to backtrack and remove all variables because nothing was working with modern apps. I circled back to the simple manual deletion procedure listed in my original post and found that even that doesn't work right. I'm at a loss here.

Edited November 30, 2017 by Raisin

[psydii]

Try using the feedback app to report it to MS. Or if you have a budget, log a Support call with them (about £200).

 

It would be interesting to see what is going on.

[Raisin]

A Microsoft National Technology Strategist on the CanadaEducation Yammer asked me for some logs. I've got a thread on TechNet as well. We'll see.

 

I'm still open to some suggestions from the EduGeek community as you guys are more likely to have some experience with my use case.

[Arthur]

I’ve seen odd behaviour with modern app provisioning.

We were using the local guests group to flush student profiles for Windows 7 but the behaviour in Windows 10 is different and seems to consistently prevent any sort of modern app provisioning except Edge. I'm not sure what the normal behaviour is supposed to be since I haven't found any recent documentation concerning the local guests group and Windows 10.

From Windows 8 onwards, guest users have what Microsoft call "special profiles" that do not allow deployment of Metro/Modern/Universal/Windows Store Windows apps by default. This behaviour can be changed by enabling the Allow deployment operations in special profiles GPO.

 

https://gpsearch.azurewebsites.net/#7390

 

Computer Configuration \ Administrative Templates \ Windows Components \ App Package Deployment \ [b]Allow deployment operations in special profiles[/b] = Enabled

 

 

I am assuming you skipped Windows 8/8.1 which is why you haven't seen this before?

[psydii]

...and now we have the magic incantation (in bold above), here is the documentation on this behaviour:

 

https://technet.microsoft.com/en-us/library/jj649079(v=ws.11).aspx

 

Obviously it is in the the **roaming profiles** pages. Not the first place one would look to troubleshoot local profile behaviour.

[stumiester]

I am also having exactly the same problem. I am getting the following error in event viewer.

 

ShellExperienceHost (18756,P,0) TILEREPOSITORYS-1-5-21-464534488-3285807761-4229456692-2612: An attempt to open the device with name "\\.\C:" containing "C:" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).

[Mujja]

I have noticed the exact same issue on a W10 1709 VM.

 

I'm using it to test group policies and remove the user profiles regularly to test a GPO has applied correctly.

 

Step 3 doesn't happen every time though and these GPOs are for shared computers where a user will usually login with a new profile.

[Raisin]

From Windows 8 onwards, guest users have what Microsoft call "special profiles" that do not allow deployment of Metro/Modern/Universal/Windows Store Windows apps by default. This behaviour can be changed by enabling the Allow deployment operations in special profiles GPO.

 

https://gpsearch.azurewebsites.net/#7390

 

Computer Configuration \ Administrative Templates \ Windows Components \ App Package Deployment \ [b]Allow deployment operations in special profiles[/b] = Enabled

 

 

I am assuming you skipped Windows 8/8.1 which is why you haven't seen this before?

 

This group policy in addition to the local guests group seems to be a functioning workaround for me. I would even say this scenario and behavior was what was intended originally. This will hold us off until I can look into UE-V. Thanks, this is extremely appreciated.

 

Now I can get back to my powershell deprovisioning scripts for unneeded Windows apps. I'll post some updates soon. I've got some MS folks looking into my original issue. Maybe it will get sorted out regardless.

 

Mujja and stumiester, this might work for you?

Edited December 5, 2017 by Raisin

[stumiester]

Thanks Raisin,

 

We have that policy in place but still experiencing the problem.

[Raisin]

Are you using the guests group? I am. The folders in C:\Users are deleted on sign out as well and the apps that were installed for that user on the first sign in still work after sign outs and sign ins unlike my original problem. I haven't tried deleting the local profiles manually though.

 

The only thing I'm not sure about is that apps that I deprovisioned with a "Remove-AppxProvisionedPackage" script after these domain users signed in once were still there after subsequent sign outs and sign ins. Even though the local profile and "C:\users\XXXX" are deleted on sign out, the initially installed apps for that user seem to remain untouched.

 

I will be running my "Remove-AppxProvisionedPackage" script on deployment but I worry about new apps installed with Windows updates and requests to reprovision some apps along the way.

 

I need to do some research on how appx packages are installed for users.

[psydii]

Do your users have roaming profiles? Perhaps the app is contained therein?

 

Removing provisioned apps will (should?) stop the app appearing for *new* users (i.e. ones that don't already have the app).

 

To remove already installed apps you need to run remove-AppxPackage in the context of the user for whom it is installed.

[Raisin]

No right now there's only a redirection of the "my documents folder".

 

With users in the guests group, I would have thought every sign in would be like a "new" user.

 

I'm familiar with the remove-AppxPackage command. I thought that users in the guest group would have their installed apps deleted/removed on sign out and that on the next sign in, the currently provisioned apps would be reinstalled. That doesn't seem to be the case with the guests group and "allow deployment operations in special profiles" GPO.

 

 

Edited December 6, 2017 by Raisin

[Raisin]

Well, the settings app and display apps don't work for users in the guests group... Back to square one!

[thatley]

Well, the settings app and display apps don't work for users in the guests group... Back to square one!

 

Hi Raisin,

 

I've been having this problem since 1709 also and have reported it to Microsoft on the feedback hub (no response as yet and others have reported it also!).

 

See my posts on this on another Edugeek Thread: http://www.edugeek.net/forums/windows-10/190663-1709-business-normal.html

 

My post on Microsoft Site: https://answers.microsoft.com/en-us/windows/forum/windows_10-start-win_menu/windows-10-1709-fresh-install-missing-apps/86d0b879-f3bb-45a5-8f7b-8e2b269179f3?tm=1511522174391&auth=1

 

I've wasted weeks on trying to get this to work!!

Edited December 12, 2017 by thatley

[v01d]

Same problem here.

 

1. Log in with a new domain user (local profiles, not roaming) and the calculator UWP app works fine.

2. Log out and log in as an admin user and delete local profiles.

3. Log back in again as the first user and trying to run the calculator app comes up with the dreaded "You’ll need a new app to open this calculator" message.

 

If I right-click the calculator tile in the start menu and run it as an administrator it'll actually start working again.

 

Still, this problem affects all deleted profiles, whether limited or local/domain administrator.

 

I hope there's a fix soon.

Edited December 12, 2017 by v01d

[Raisin]

Hi guys,

 

From my source at Microsoft Education Canada:

 

Good news everyone! As per the latest update the bug is resolved for RS4[1803](Releasing in April timeframe) and is in triage for RS3[1709].

[thatley]

Hi guys,

 

From my source at Microsoft Education Canada:

 

Finally!!!!

 

Thanks for the update

[Raisin]

In the meantime, you can use the following workaround if you have just a few users experiencing this issue : ·

 

· Navigate to location : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList\ S-1-5-21-XXXX

· Please note down the user’s SID number or take a screenshot of the SID so that you can use this information to deleted the SID from below mentioned location.

· Delete the user’s profile using System Properties > Advanced > User Profile.

· Navigate to registry location : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\S-1-5-21-XXXX

· The S-1-5-21-XXXX is the user SID for which we have deleted the profile.

· Delete that key and any sub-keys

· Then log off from that user and log back in with the same user to check if you are getting the modern apps or not.

 

In my case, this wouldn't work well for our school labs so we'll wait for the patch.

Edited January 24, 2018 by Raisin

[thatley]

Thanks for that, very useful to know but I'm in the same boat as you with many users in each school, so we'll wait for the patch too.

 

Would work well in my office though in the meantime.

[v01d]

Thanks for your effort and communication Raisin! One less thing to have to stress about whether it'll ever be resolved or not.

[Patrick]

Sorry to bump, but is there a hotfix/patch out yet for 1709 yet? This bug is super annoying!

[thatley]

Sorry to bump, but is there a hotfix/patch out yet for 1709 yet? This bug is super annoying!

 

Nothing yet and I've been looking at every update released so far (see here):

https://support.microsoft.com/en-gb/help/4043454/windows-10-windows-server-update-history

 

Looking at the update history, they seem to break more things than they fix.

 

Pi$$es me off too - I don't know how seriously MS has taken it but I hope they do something soon!