Broken packages on devices - DesktopAppInstaller - Multiple versions being reported

[zeeter82]

I'm trying to see if I can fix some of my endpoints with what seems to be a broken DAI package. Where it's showing multiple versions of the DAI package installed. Is there anyway to force a removal/upgrade/remediation across multiple user profiles because that's where it seems the issue lies on a lot of these?

I've already tried creating a fix script doing multiple things and using the -AllUsers switch, but not having much luck on some of the devices - I'm trying to keep from having to re-image a lot of them, but obviously will if it comes to that - it's a mix of Win10/Win11:

The real reason behind this is a request from our NetSec team to try and remediate this CVE as much as possible: CVE-2021-43890

We also disable MS Store as a policy on most of our devices - only open up to a select few. So I'm wondering if that might cause some of these issues with DAI.

Any other suggestions or fixes I can try?

Start-Transcript -Path $env:SystemRoot\logs\DAI_Update.log

$DAI_CompliantLog = "$env:SystemRoot\logs\DAI_Compliant.log"
$DAI_NotCompliantLog = "$env:SystemRoot\logs\DAI_NotCompliant.log"
$DAI_SuccessLog = "$env:SystemRoot\logs\DAI_UpdateSuccess.log"
$DAI_FailLog = "$env:SystemRoot\logs\DAI_UpdateFail.log"
$DAIVersion1 = (Get-AppxPackage Microsoft.DesktopAppInstaller -ErrorAction SilentlyContinue | Sort-Object -Property Version | Select-Object -First 1).Version
$DAIVersion2 = (Get-AppxPackage -AllUsers Microsoft.DesktopAppInstaller -ErrorAction SilentlyContinue | Sort-Object -Property Version | Select-Object -First 1).Version

#Cleanup existing logs
Test-Path $DAI_CompliantLog -ErrorAction SilentlyContinue | Remove-Item $DAI_CompliantLog -Force -ErrorAction SilentlyContinue
Test-Path $DAI_NotCompliantLog -ErrorAction SilentlyContinue | Remove-Item $DAI_NotCompliantLog -Force -ErrorAction SilentlyContinue
Test-Path $DAI_SuccessLog | Remove-Item $DAI_SuccessLog -Force -ErrorAction SilentlyContinue
Test-Path $DAI_FailLog | Remove-Item $DAI_FailLog -Force -ErrorAction SilentlyContinue

if (([Version]$DAIVersion1 -ge "1.23.1911.0") -and ([Version]$DAIVersion2 -ge "1.23.1911.0")) {
  Write-Host "DAIVersion CurrentUser: $DAIVersion1"
  Write-Host "DAIVersion AllUsers: $DAIVersion2"
  Write-Host "DesktopAppInstaller version meets requirements - skipping update"
  echo "DAI compliant!" > $DAI_CompliantLog
  }
  else {
  Write-Host "DAIVersion CurrentUser: $DAIVersion1"
  Write-Host "DAIVersion AllUsers: $DAIVersion2"
  Write-Host DesktopAppInstaller version does not meet requirements - running update
  echo "DAI not compliant!" > $DAI_NotCompliantLog
  $file_url = "https://aka.ms/getwinget"
  $file_output = "$env:temp\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle"
  #$start_time = Get-Date
  $ProgressPreference = 'SilentlyContinue'
  Invoke-WebRequest -Uri $file_url -OutFile $file_output -ErrorAction SilentlyContinue
  #Write-Output "Time taken: $((Get-Date).Subtract($start_time).Seconds) second(s)"

if (!(Test-Path $file_output)) {
  Write-Warning "File not found - is device online?"
  $ProgressPreference = 'Continue'
}

  else {
	  <#
	  $OSVer = (Get-CimInstance Win32_OperatingSystem).Caption
if ($OSVer -like "*Windows 11*") {
	Write-Host "Win11 Device - running Win11 commands"
	#>
	
	#Remove existing DAI packages
	Get-AppxPackage -name Microsoft.DesktopAppInstaller -AllUsers -ErrorAction SilentlyContinue | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml" -ErrorAction SilentlyContinue}
	Start-Sleep 5
	Get-AppxPackage -name Microsoft.DesktopAppInstaller -AllUsers -ErrorAction SilentlyContinue | Foreach {Remove-AppxPackage -AllUsers -Package "$($_.PackageFullName)" -ErrorAction SilentlyContinue}
	Start-Sleep 5
	$DAIProvisioned = (Get-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -eq "Microsoft.DesktopAppInstaller"})
    if ($DAIProvisioned) {
        $DAIProvisioned | Remove-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue
    }
	Start-Sleep 5
    $DAIAllUsers = (Get-AppxPackage "Microsoft.DesktopAppInstaller" -AllUsers -ErrorAction SilentlyContinue)
    if ($DAIAllUsers) {
    $DAIAllUsers | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue
    }
	Start-Sleep 5
    $DAISingleUser = (Get-AppxPackage "Microsoft.DesktopAppInstaller" -ErrorAction SilentlyContinue)
    if ($DAISingleUser) {
    $DAISingleUser | Remove-AppxPackage -ErrorAction SilentlyContinue
    }
	Start-Sleep 5
	#Install latest DAI package that was downloaded
	Add-AppxProvisionedPackage -Online -PackagePath "$file_output" -SkipLicense -ErrorAction SilentlyContinue
    Start-Sleep 5
	Add-AppxPackage "$file_output" -ErrorAction SilentlyContinue
	Start-Sleep 5
	
    # Cleans up downloaded package
    cmd.exe /c del /q /f $file_output | out-null

    # Forces install for other users
    #Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml" -ErrorAction SilentlyContinue}
	
	$ProgressPreference = 'Continue'
}
	
  }
  
  <#
  #Check DAI version again
    $DAIVersion3 = (Get-AppxPackage Microsoft.DesktopAppInstaller -ErrorAction SilentlyContinue | Sort-Object -Property Version | Select-Object -First 1).Version
    $DAIVersion4 = (Get-AppxPackage -AllUsers Microsoft.DesktopAppInstaller -ErrorAction SilentlyContinue | Sort-Object -Property Version | Select-Object -First 1).Version
    if (([Version]$DAIVersion3 -ge "1.23.1911.0") -and ([Version]$DAIVersion4 -ge "1.23.1911.0")) {
    Write-Host "DAIVersion CurrentUser: $DAIVersion3"
    Write-Host "DAIVersion AllUsers: $DAIVersion4"
    Write-Host DesktopAppInstaller version meets requirements - skipping update
    #echo "DAI update success!" > $DAI_SuccessLog
	#cmd.exe /c del /q /f $DAI_NotCompliantLog | out-null
    }
    
	else {
    Write-Host "DAIVersion CurrentUser: $DAIVersion3"
    Write-Host "DAIVersion AllUsers: $DAIVersion4"
    Write-Host "DesktopAppInstaller version still does not meet requirements"
	#echo "DAI update failed - still not compliant!" > $DAI_FailLog
	#cmd.exe /c del /q /f $DAI_NotCompliantLog | out-null
	}
	#>

Stop-Transcript