Unable to remove a package "staged" for the NT AUTHORITY\SYSTEM user (`--defer` doesn't help)

[denbkh]

Hello, I have tried your tool to remove the Microsoft.WindowsAppRuntime.2 package, unfortunately without success:

PS C:\Windows\System32> Get-AppxPackage -AllUsers |
>>       Where-Object {
>>           $_.Name -match 'Microsoft.WindowsAppRuntime.2'
>>       } |
>>       Select-Object Name, PackageFullName, PackageUserInformation

Name                          PackageFullName                                          PackageUserInformation
----                          ---------------                                          ----------------------
Microsoft.WindowsAppRuntime.2 Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe {S-1-5-18 [S-1-5-18]: Staged}
Microsoft.WindowsAppRuntime.2 Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe {S-1-5-18 [S-1-5-18]: Staged}

PS C:\Windows\System32> msixadmin.exe package remove Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe --all-users
msixadmin v0.9.6 - Copyright (C) Howard Kapustein. All rights reserved.
Removing 'Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe'...
Error 0x80073CFA: Removal failed. Please contact your software vendor.
PS C:\Windows\System32> msixadmin.exe package remove Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe --all-users --defer
msixadmin v0.9.6 - Copyright (C) Howard Kapustein. All rights reserved.
Removing 'Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe'...
Error 0x80073CFA: Removal failed. Please contact your software vendor.

context: https://learn.microsoft.com/en-us/answers/questions/5996541/9nrzt3q9r3dl-microsoft-windowsappruntime-2-updates

[DrusTheAxe]

I can't repro that, but it's unclear exactly how your system's configured.

Error 0x80073CFA = ERROR_REMOVE_FAILED. Your eventlog should have more information about the error. Wiew the Microsoft-Windows-AppxDeploymentServer/Operational eventlog channel via eventvwr.exe or other tools.

I see your context link provided an answer. Does that address your issue?

[denbkh]

Error 0x80073CFA = ERROR_REMOVE_FAILED. Your eventlog should have more information about the error. Wiew the Microsoft-Windows-AppxDeploymentServer/Operational eventlog channel via eventvwr.exe or other tools.

PS C:\Users\DenisAdmin> msixadmin.exe package remove Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe --all-users
msixadmin v0.9.6 - Copyright (C) Howard Kapustein. All rights reserved.
Removing 'Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe'...
Error 0x80073CFA: Removal failed. Please contact your software vendor.


PS C:\Users\DenisAdmin> Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-AppxDeploymentServer/Operational'; StartTime=(Get-Date).AddMinutes(-1)} | Sort-Object TimeCreated | Format-List

TimeCreated  : 2026-09-08 12:21:19
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 603
Message      : Started deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe and
               Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.

TimeCreated  : 2026-09-08 12:21:19
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 10002
Message      : Creating Resiliency File C:\ProgramData\Microsoft\Windows\AppRepository\9aeb10ad-a503-492d-976a-2077f2646e0a_S-1-5-21-2779869789-3
               969710541-3631704298-1000_9.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe.

TimeCreated  : 2026-09-08 12:21:19
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 607
Message      : Deployment Remove operation on package Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe has been de-queued and is running
               for user SID S-1-5-21-2779869789-3969710541-3631704298-1000.

TimeCreated  : 2026-09-08 12:21:19
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 648
Message      : Error 0x80070520: Failure in the early preparatory steps of the request or in the SharedAppsRedirect state handler.

TimeCreated  : 2026-09-08 12:21:19
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 401
Message      : Deployment Remove operation with target volume C: on Package Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe from:
               failed with error 0x80070520. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.

TimeCreated  : 2026-09-08 12:21:19
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 404
Message      : AppX Deployment operation failed for package Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe with error 0x80073CFA. The
               specific error text for this failure is: A specified logon session does not exist. It may already have been terminated.

Looks like the actual error is 0x80070520 = "A specified logon session does not exist. It may already have been terminated."
I am working under a non-admin account, and when I need to run PowerShell code with admin rights, I right-click the PowerShell icon and select "Run as administrator."
So, I logged in as an admin and tried to execute the command one more time. It seemed to work and said that the package was removed. However, when I checked again with powershell 'Get-AppxPackage', I still see these two packages:

PS C:\Windows\System32> msixadmin.exe package remove Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe --all-users
msixadmin v0.9.6 - Copyright (C) Howard Kapustein. All rights reserved.
Removing 'Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe'...
'Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe' is removed


PS C:\Windows\System32> msixadmin.exe package remove Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe --all-users
msixadmin v0.9.6 - Copyright (C) Howard Kapustein. All rights reserved.
Removing 'Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe'...
'Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe' is removed


PS C:\Windows\System32> Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-AppxDeploymentServer/Operational'; StartTime=(Get-Date).AddMinutes(-2)} | sort-object TimeCreated |Format-List

TimeCreated  : 2026-09-08 12:25:36
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 603
Message      : Started deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See
               http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.

TimeCreated  : 2026-09-08 12:25:36
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 10002
Message      : Creating Resiliency File C:\ProgramData\Microsoft\Windows\AppRepository\9aeb10ad-a503-492d-976a-2077f2646e0a_S-1-5-21-2779869789-3969710541-3631704298-1000_10.rslc for Remove Operation on Package
               Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe.

TimeCreated  : 2026-09-08 12:25:36
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 607
Message      : Deployment Remove operation on package Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-2779869789-3969710541-3631704298-1000.

TimeCreated  : 2026-09-08 12:25:36
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 400
Message      : Deployment Remove operation with target volume C: on Package Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe from:   finished successfully.

TimeCreated  : 2026-09-08 12:25:44
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 603
Message      : Started deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See
               http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.

TimeCreated  : 2026-09-08 12:25:44
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 10002
Message      : Creating Resiliency File C:\ProgramData\Microsoft\Windows\AppRepository\9aeb10ad-a503-492d-976a-2077f2646e0a_S-1-5-21-2779869789-3969710541-3631704298-1000_11.rslc for Remove Operation on Package
               Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe.

TimeCreated  : 2026-09-08 12:25:44
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 607
Message      : Deployment Remove operation on package Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-2779869789-3969710541-3631704298-1000.

TimeCreated  : 2026-09-08 12:25:44
ProviderName : Microsoft-Windows-AppXDeployment-Server
Id           : 400
Message      : Deployment Remove operation with target volume C: on Package Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe from:   finished successfully.


PS C:\Windows\System32> Get-AppxPackage -AllUsers |
>>       Where-Object {
>>           $_.Name -match 'Microsoft.WindowsAppRuntime.2'
>>       } |
>>       Select-Object Name, PackageFullName, PackageUserInformation

Name                          PackageFullName                                          PackageUserInformation
----                          ---------------                                          ----------------------
Microsoft.WindowsAppRuntime.2 Microsoft.WindowsAppRuntime.2_2.4.0.0_x86__8wekyb3d8bbwe {S-1-5-18 [S-1-5-18]: Staged}
Microsoft.WindowsAppRuntime.2 Microsoft.WindowsAppRuntime.2_2.4.0.0_x64__8wekyb3d8bbwe {S-1-5-18 [S-1-5-18]: Staged}

I see your context link provided an answer. Does that address your issue?

Unfortunately, no. These two packages are not “provisioned.”

PS C:\Users\DenisAdmin> Get-AppxProvisionedPackage -Online

DisplayName  : AdvancedMicroDevicesInc-RSXCM
Version      : 22.10.0.0
Architecture : x64
ResourceId   :
PackageName  : AdvancedMicroDevicesInc-RSXCM_22.10.0.0_x64__v2es6h43hjn86
Regions      : all

DisplayName  : Microsoft.SecHealthUI
Version      : 1000.29628.1000.0
Architecture : x64
ResourceId   :
PackageName  : Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe
Regions      : all

DisplayName  : MicrosoftCorporationII.WinAppRuntime.Main.1.8
Version      : 8000.946.1701.0
Architecture : x64
ResourceId   :
PackageName  : MicrosoftCorporationII.WinAppRuntime.Main.1.8_8000.946.1701.0_x64__8wekyb3d8bbwe
Regions      : all

DisplayName  : MicrosoftCorporationII.WindowsSubsystemForLinux
Version      : 2.7.11.0
Architecture : x64
ResourceId   :
PackageName  : MicrosoftCorporationII.WindowsSubsystemForLinux_2.7.11.0_x64__8wekyb3d8bbwe
Regions      : all

[DrusTheAxe]

at an elevated command prompt what do you see for...

1. msix package list --user=* Microsoft.WindowsAppRuntime.2
2. msix package list Microsoft.WindowsAppRuntime.2
3. msix provision list --glob=Microsoft.WindowsAppRuntime.2

[denbkh]

C:\Windows\System32>msix package list --user=* Microsoft.WindowsAppRuntime.2
Error 0x00000001: Incompatible argument
    Full command line: 'msix  package list --user=* Microsoft.WindowsAppRuntime.2'
Argument: --dependencies and --user=<SID> are not compatible

C:\Windows\System32>msix package list Microsoft.WindowsAppRuntime.2
msix v0.9.6 - Copyright (C) Howard Kapustein. All rights reserved.
0 packages

C:\Windows\System32>msix provision list --glob=Microsoft.WindowsAppRuntime.2
msix v0.9.6 - Copyright (C) Howard Kapustein. All rights reserved.
0 packages