Flexapps Appearing in Add/Remove Programs

Answered

Stephen Osher

• September 12, 2023 14:06

Flexapps are appearing in Add/Remove programs even when users do not have permissions to the Flexapp. We're using Cloaking in our configuration. While users do not have the Flexapp installed if not in the filter it could still lead to false reporting as many tools leverage this to provide software reporting. Requesting to remove Flexapps from Add/Remove programs if user isn't in filter.

Thank you.

0

• Official comment

  

  Steven Hajek

  • September 12, 2023 14:27

  Hi Stephen - We do not cloak the uninstall key information by default because this key is accessed so frequently that we've found, unlike cloaking application-specific keys, cloaking the uninstall key values comes at a cost of slight increase in overhead to the Container Service.  (YMMV)

  That said, if you want to enable this functionality, you can edit the VirtFsService.exe.config file in the Flexapp folder on persistent/test machines and in the flexapp.zip of the deployment path (ContainerService\x64 folder) and add the uninstall keys to the CloakRoots setting like so:  (restart the machine/Container Service after if testing on a live machine)

        <setting name="CloakRoots" serializeAs="Xml">
          <value>
            <ArrayOfString xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" />
              <string>\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</string>
              <string>\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall</string>
          </value>
        </setting>
• 

  Steven Hajek

  • September 12, 2023 14:31

  Stephen - also to add, you will need to consider the execution/user context of the tools used for inventorying machines with FlexApp and cloaking - will the account used by the tool even have access to see the FlexApps when cloaked, and if not then I'm not sure how useful that tool would be when it would be omitting FlexApps potentially.  It seems that maybe both scenarios are undesirable and a choice must be made on how to handle this w/r to the inventory data collected by a third-party tool.

  0

Please sign in to leave a comment.