Introducing new Group Policy EnableWindowsPackageManagerCommandLineInterfaces for Intune #3524

Madhusudhan-MSFT · 2023-08-15T19:51:05Z

[Why;]

To allow Intune to be able to set a group policy to block end user installing packages from WinGet Command Line interfaces such as WinGet CLI, PowerShell modules while Intune can still install package by themselves by consuming WinGet APIs directly.

[WHAT:]

Policy Changes:

ADMX/ADML Changes to include EnableWindowsPackageManagerCommandLineInterfaces policy
EnableWindowsPackageManagerCommandLineInterfaces is another simple
- EnableValue/DisableValue boolean (1/0) policy.

WinGet CLI Changes:

WinGetCLi command code update to read & validation EnableWindowsPackageManagerCommandLineInterfaces
Group Policy i.e block when disabled.
WinGetCLI End to End tests to validate EnableWindowsPackageManagerCommandLineInterfaces policy in
combination with "EnableAppInstaller" WinGet Policy

How Tested:

Patch Group Policy AMDX/AMDL
Deploy WinGetCLIDev package on a test machine.
Run WinGetDev commands with policy enabled/disabled and verify policy blocks CLI execution when it is disabled.

PowerShell Module related changes:

Shared code to read Group Policies "Microsoft.WinGet.SharedLib" right now limited to read only Toggle Policies
just enough to address the scope of Intune deliverable.
Group policy read and validation logic to block PowerShell modules
1. Microsoft.WinGet.Client.psd1 PowerShell module
2. Microsoft.WinGet.Configuration.psd1 PowerShell module
  when any of two policies are disabled
  "EnableAppInstaller" or "EnableWindowsPackageManagerCommandLineInterfaces"
Pester Tests to validate PowerShell WinGet Client & Configuration cmdlets when Group Policy in effect

How Tested:

Patch Group Policy AMDX/AMDL
Deploy Microsoft.WinGet.Client.psd1 & Microsoft.WinGet.Configuration.psd1 PowerShell modules.
Import Microsoft.WinGet.Client.ps1 powershell module & run cmdlets with policy enabled/disabled and verify policy blocks
PowerShell module execution when it is disabled.
- For ex: Get-WinGetSource
  wingetdev configure E:\winget\src\AppInstallerCLIE2ETests\TestData\Configuration\PSGallery_NoModule_NoSettings.yml
Import Microsoft.WinGet.Configuration.psd1 PowerShell module & run cmdlets with policy enabled/disabled and verify policy blocks PowerShell module execution when it is disabled.

For ex: Get-WinGetConfiguration -File "E:\winget\src\AppInstallerCLIE2ETests\TestData\Configuration\PSGallery_NoModule_NoSettings.yml"

Related to : https://microsoft.visualstudio.com/OS/_workitems/edit/45810849/

I have signed the Contributor License Agreement.
This pull request is related to an issue.

Microsoft Reviewers: Open in CodeFlow

…terfaces for Intune The changess part of this commit includes: 1. ADMX/ADML Changes to include EnableWindowsPackageManagerCommandLineInterfaces policy 2. EnableWindowsPackageManagerCommandLineInterfaces is another simple - EnableValue/DisableValue boolean (1/0) policy

…dLineInterfaces Group Policy This commit includes: 1. WinGetCLi command code update to read & validation EnableWindowsPackageManagerCommandLineInterfaces Group Policy i.e block when disabled. 2. WinGetCLI End to End tests to validate EnableWindowsPackageManagerCommandLineInterfaces policy in combination with "EnableAppInstaller" WinGet Policy

…read and respect "EnableAppInstaller" & EnableWindowsPackageManagerCommandLineInterfaces Group Policies The commit includes: 1. Shared code to read Group Policies "Microsoft.WinGet.SharedLib" right now limited to read only Toggle Policies just enough to address the scope of Intune deliverable. 2. Group policy read and validation logic to block PowerShell modules 1. Microsoft.WinGet.Client.psd1 PowerShell module 2. Microsoft.WinGet.Configuration.psd1 PowerShell module when any of two policies are disabled "EnableAppInstaller" or "EnableWindowsPackageManagerCommandLineInterfaces" 3. The PowerShell module consumes the "Microsoft.WinGet.SharedLib" share code as file links added to - Microsoft.WinGet.Client.Engine - Microsoft.WinGet.Configuration.Engine cs projects and they compiled into its own assemblies to address following issues 1. PowerShell modules for WinGetClient & WinGet Configure target different OS versions & .net framework combination as a result having a common shared .net standard library fails to compile due to OS target version compatibility issues. 2. We can also avoid duplicating same share code b/w PowerShell module projects. NOTE: GroupPolicyResource.resx resource is duplicated into PowerShell modules assemblies as adding link resulted runtime failure due to missing resource file 4. Tests to validate PowerShell WinGet Client command with Group Policy in effect TODOs: Add Group Policy tests for WinGet Configure PowerShell cmdlets this is manually validated by running PowerShell cmdlets but actual test requires some additional setup so plan is add those test in future.

florelis · 2023-08-15T19:56:30Z

doc/admx/DesktopAppInstaller.admx

@@ -146,5 +146,15 @@
        <decimal value="0" />
      </disabledValue>
    </policy>
+    <policy name="EnableWindowsPackageManagerCommandLineInterfaces" class="Machine" displayName="$(string.EnableWindowsPackageManagerCommandLineInterfaces)" explainText="$(string.EnableWindowsPackageManagerCommandLineInterfacesExplanation)" key="Software\Policies\Microsoft\Windows\AppInstaller" valueName="EnableWindowsPackageManagerCommandLineInterfaces">


Do we need to include "WindowsPackageManager" in the name? None of the other policies do. Would be nice to stay consistent.

It is not a requirement that we prefix the title of our policies with "Desktop App Installer". The direction of this policy is at the WinGet functionality only, therefore prefixing the title with "Windows Package Manager" makes sense.

It would make sense for more of our policies to be prefixed like this.

Yeah, it would make sense to have them prefixed, but the others are not and that's hard to change. I can see the point of having a prefix, but I also think there is some value in having them all be consistent.

And if we are prefixing, does it need to be with WindowsPackageManager? Could it be just WinGet or something short?

In this context, we shouldn't be prefixing our GPOs with an abbreviation or shortened form of our product name. Which is why we are pushing for the "Windows Package Manager" as the new prefix.

src/AppInstallerCLICore/Command.cpp

florelis · 2023-08-15T20:15:42Z

doc/admx/DesktopAppInstaller.admx

@@ -146,5 +146,15 @@
        <decimal value="0" />
      </disabledValue>
    </policy>
+    <policy name="EnableWindowsPackageManagerCommandLineInterfaces" class="Machine" displayName="$(string.EnableWindowsPackageManagerCommandLineInterfaces)" explainText="$(string.EnableWindowsPackageManagerCommandLineInterfacesExplanation)" key="Software\Policies\Microsoft\Windows\AppInstaller" valueName="EnableWindowsPackageManagerCommandLineInterfaces">


Yeah, it would make sense to have them prefixed, but the others are not and that's hard to change. I can see the point of having a prefix, but I also think there is some value in having them all be consistent.

And if we are prefixing, does it need to be with WindowsPackageManager? Could it be just WinGet or something short?

Madhusudhan-MSFT · 2023-08-15T22:09:01Z

/azp run

azure-pipelines · 2023-08-15T22:09:09Z

Azure Pipelines successfully started running 1 pipeline(s).

PowerShell client modules doesn't work from x86 release, so skipping those test It follows the pattern used for "WinGetClientModule" tests

JohnMcPMS

I'm not too familiar with the structure of the shared code/resources here. Will let someone with more .Net experience weigh in.

src/AppInstallerCLIE2ETests/PowerShell/WinGetClientModuleGroupPolicyTests.cs

…ass library project file The commit includes: - Moving Microsoft.WinGet.SharedLib code to it own .net standard 2.0 class library project file - Removed explict links to shared code from - Microsoft.WinGet.Client.Engine.csproj - Microsoft.WinGet.Configuration.Engine.csproj and then now includes class library as project reference - Additonally updated - Microsoft.WinGet.Client.Cmdlets - Microsoft.WinGet.Configuration.Cmdlets projects to copy Microsoft.WinGet.SharedLib.dll to module path [How Tested:] - Did run some sanity tests to ensure all the changes works as expected.

…nfiguration Group Policy blocking scenario

Madhusudhan-MSFT · 2023-08-18T19:47:11Z

/azp run

azure-pipelines · 2023-08-18T19:47:19Z

Azure Pipelines successfully started running 1 pipeline(s).

…Content initialization logic in tests

msftrubengu

PowerShellwise this looks good to me

src/AppInstallerCLIE2ETests/PowerShell/WinGetClientModuleGroupPolicyTests.cs

…ered part of pester tests

denelon · 2023-08-29T18:30:05Z

Change WinGet behavior when the Microsoft Store UI is disabled #3025

randallfdez · 2023-10-10T21:37:35Z

Hello team, I was checking the conversation but I did not understand if this change was completed or what is the current status of this.

denelon · 2023-10-10T22:00:59Z

This change has been completed. The latest clients have support for the policy and the ADMX/ADML has been updated and published with the release at GitHub.

randallfdez · 2023-10-17T00:05:33Z

thank you for the reply Denelon, i was curious if this is only an intune policy or also a windows domain gpo. I am asking because on the Microsoft official documentation I found references only to the CSP policy
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-desktopappinstaller
and I found this other link but on those admx I was not able to saw the policy on the DesktopInstaller
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/manage-windows-package-manager-with-group-policy/ba-p/2346322

denelon · 2023-10-17T15:03:22Z

WinGet leverages the second mechanism via ADMX/ADML ingestion.

randallfdez · 2023-10-17T17:38:47Z

Understood, and this is working for all versions? I saw on the CSP link that this was only available for insider preview

Madhusudhan Gumbalapura Sudarshan added 3 commits August 15, 2023 12:00

Madhusudhan-MSFT requested a review from a team as a code owner August 15, 2023 19:51

This comment has been minimized.

Sign in to view

florelis reviewed Aug 15, 2023

View reviewed changes

Addressing spell checker comments and a NIT fix.

6e1fad2

This comment has been minimized.

Sign in to view

Madhusudhan Gumbalapura Sudarshan added 2 commits August 15, 2023 15:17

More spell cheker fixes

d66257a

spell checker fix missed in last commit

8866edb

This comment has been minimized.

Sign in to view

Madhusudhan Gumbalapura Sudarshan added 4 commits August 15, 2023 15:25

Addressing more down stream spell checker issues.

533e6b7

ADML consistency fix

e60bf6d

GroupPolicy_AllEnabled test failure fix

0b2e6f9

Fix for x86 WinGetClientModuleGroupPolicyTests failures

966d7f6

PowerShell client modules doesn't work from x86 release, so skipping those test It follows the pattern used for "WinGetClientModule" tests

Madhusudhan-MSFT requested review from JohnMcPMS and msftrubengu August 16, 2023 17:33

Fixing EnableWinGetCLIInterfacesPolicy tst for x86 arch to skip

b46c459

JohnMcPMS reviewed Aug 17, 2023

View reviewed changes

src/AppInstallerCLIE2ETests/PowerShell/WinGetClientModuleGroupPolicyTests.cs Outdated Show resolved Hide resolved

Madhusudhan Gumbalapura Sudarshan added 4 commits August 17, 2023 15:42

Added Group Policy pester tests for WinGet Client PowerShell module

5a0f3c3

Fixing pester test failure & added pester test coverage for WinGet CO…

84d4c4c

…nfiguration Group Policy blocking scenario

Addressed minor tab alignment fix for the group policy pester tests

4ce5187

Spellcheck fix and removed an accidental duplication for settingsFile…

7b15b0d

…Content initialization logic in tests

msftrubengu previously approved these changes Aug 18, 2023

View reviewed changes

src/AppInstallerCLIE2ETests/PowerShell/WinGetClientModuleGroupPolicyTests.cs Outdated Show resolved Hide resolved

Removing WinGetClientModuleGroupPolicyTests C# test as we have it cov…

31d48ce

…ered part of pester tests

Madhusudhan-MSFT dismissed msftrubengu’s stale review via 31d48ce August 18, 2023 22:02

Madhusudhan-MSFT requested review from msftrubengu and JohnMcPMS August 18, 2023 22:04

JohnMcPMS approved these changes Aug 18, 2023

View reviewed changes

msftrubengu approved these changes Aug 18, 2023

View reviewed changes

Madhusudhan-MSFT merged commit 0c54657 into microsoft:master Aug 18, 2023
8 checks passed

Madhusudhan-MSFT deleted the user/masudars/GroupPolicy_EnableWindowsPackageManagerCommandLineInterfaces branch August 18, 2023 23:22

denelon linked an issue Aug 29, 2023 that may be closed by this pull request

Change WinGet behavior when the Microsoft Store UI is disabled #3025

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introducing new Group Policy EnableWindowsPackageManagerCommandLineInterfaces for Intune #3524

Introducing new Group Policy EnableWindowsPackageManagerCommandLineInterfaces for Intune #3524

Madhusudhan-MSFT commented Aug 15, 2023 •

edited

This comment has been minimized.

florelis Aug 15, 2023

RDMacLachlan Aug 15, 2023

florelis Aug 15, 2023

RDMacLachlan Aug 16, 2023

florelis Aug 15, 2023

This comment has been minimized.

Madhusudhan-MSFT commented Aug 15, 2023

azure-pipelines bot commented Aug 15, 2023

This comment has been minimized.

This comment has been minimized.

JohnMcPMS left a comment

Madhusudhan-MSFT commented Aug 18, 2023

azure-pipelines bot commented Aug 18, 2023

msftrubengu left a comment

denelon commented Aug 29, 2023

randallfdez commented Oct 10, 2023

denelon commented Oct 10, 2023

randallfdez commented Oct 17, 2023

denelon commented Oct 17, 2023

randallfdez commented Oct 17, 2023

Introducing new Group Policy EnableWindowsPackageManagerCommandLineInterfaces for Intune #3524

Introducing new Group Policy EnableWindowsPackageManagerCommandLineInterfaces for Intune #3524

Conversation

Madhusudhan-MSFT commented Aug 15, 2023 • edited

[Why;]

[WHAT:]

Microsoft Reviewers: Open in CodeFlow

This comment has been minimized.

florelis Aug 15, 2023

Choose a reason for hiding this comment

RDMacLachlan Aug 15, 2023

Choose a reason for hiding this comment

florelis Aug 15, 2023

Choose a reason for hiding this comment

RDMacLachlan Aug 16, 2023

Choose a reason for hiding this comment

florelis Aug 15, 2023

Choose a reason for hiding this comment

This comment has been minimized.

Madhusudhan-MSFT commented Aug 15, 2023

azure-pipelines bot commented Aug 15, 2023

This comment has been minimized.

This comment has been minimized.

JohnMcPMS left a comment

Choose a reason for hiding this comment

Madhusudhan-MSFT commented Aug 18, 2023

azure-pipelines bot commented Aug 18, 2023

msftrubengu left a comment

Choose a reason for hiding this comment

denelon commented Aug 29, 2023

randallfdez commented Oct 10, 2023

denelon commented Oct 10, 2023

randallfdez commented Oct 17, 2023

denelon commented Oct 17, 2023

randallfdez commented Oct 17, 2023

Madhusudhan-MSFT commented Aug 15, 2023 •

edited