Windows – Why do apps from the Microsoft store not require admin permission to install

permissionswindows 10

I noticed today when installing an app from the Microsoft store on my computer running Windows 10 that the app did not need administrator permission to install.

Normally when installing apps/programs from downloaded executables or installers the UAC window pops up to request my admin password before it is allowed to proceed. Even program updates often involve the UAC pop-up. I prefer things this way since my computer is occasionally used by people who I trust enough to use it, but not enough to install things or change important settings.

This question covers how to prevent users from installing apps from the store, but that's not what I'm wondering.

What is different about installing an app from the Microsoft store versus other methods that allows the app to install without admin permission? Is it that the installation process is different for those apps, or does the Store itself has special permissions?

Best Answer

Normally when installing apps/programs from downloaded executables or installers the UAC window pops up to request my admin password before it is allowed to proceed. Even program updates often involve the UAC pop-up.

The group policy that defines this behavior only applies to legacy desktop applications.

Even program updates often involve the UAC pop-up. I prefer things this way since my computer is occasionally used by people who I trust enough to use it, but not enough to install things or change important settings.

This is only true if the process requires permissions the user does not already have. Even installing legacy desktop applications can be granted to a user within the User usergroup.

What is different about installing an app from the Microsoft store versus other methods that allows the app to install without admin permission?

Universal Windows Programs (UWP) are sandboxed. The permission to install and remove these programs are handled by a different group policy.

Is it that the installation process is different for those apps, or does the Store itself has special permissions?

The ability to launch Windows Store, install/remove UWP already installed on the system, is indeed its own permission seperate from your ability to install a legacy desktop WIN32 application.