Allowed package family names for non-admin user install
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows 11 Version 22H2
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\App Package Deployment Description
Allowed package family names for non-Administrator user Windows app package installation. If you enable this policy, you can enter a list of Windows app packages non-Administrators will be able to initiate installation of regardless of the configured "Prevent non-admin users from installing packaged Windows apps" policy. The values provided will be treated as regular expressions (ECMA Script). A package family name like Contoso.ContosoApp_8wekyb3d8bbwe is itself a valid regular expression that will match all packages in that family. A regular expression like ^Contoso.*_8wekyb3d8bbwe$ will also match Contoso.ContosoApp_8wekyb3d8bbwe If the package family name of an installing Windows app package matches any rule it will not be blocked by the "Prevent non-admin users from installing packaged Windows apps" policy. Installation may still be blocked by other policy or settings. If you disable or do not configure this policy, all Windows app packages will be subject to the configured "Prevent non-admin users from installing packaged Windows apps" policy. Default is 'disabled' (key not present).
Registry
Software\Policies\Microsoft\Windows\Appx\AllowedNonAdminPackageFamilyNameRules MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowedNonAdminPackageFamilyNameRules Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Allowed package family names for non-admin user install
; State: Enabled
; Supported on: At least Windows 11 Version 22H2
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx\AllowedNonAdminPackageFamilyNameRules]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Allowed package family names for non-admin user install
# State: Enabled
# Supported on: At least Windows 11 Version 22H2
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Appx\AllowedNonAdminPackageFamilyNameRules'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowedNonAdminPackageFamilyNameRules
Data type: String
Value:
<enabled/>
<!-- AllowedNonAdminPackageFamilyNameRulesList: enter one value per line before copying this XML payload. -->Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Allowed package family names for non-admin user install
# State: Enabled
# Supported on: At least Windows 11 Version 22H2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows\Appx\AllowedNonAdminPackageFamilyNameRules: List values: enter one value per line in the builder UI.
# No testable registry values are available for this state.
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allowed package family names for non-admin user install
# State: Enabled
# Supported on: At least Windows 11 Version 22H2
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Appx\AllowedNonAdminPackageFamilyNameRules'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Allowed package family names for non-admin user install
# State: Enabled
# Supported on: At least Windows 11 Version 22H2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Allowed package family names for non-admin user install
# State: Enabled
# Supported on: At least Windows 11 Version 22H2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows\Appx\AllowedNonAdminPackageFamilyNameRules: List values: enter one value per line in the builder UI.
# No testable registry values are available for this state.
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allowed package family names for non-admin user install
# State: Enabled
# Supported on: At least Windows 11 Version 22H2
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Appx\AllowedNonAdminPackageFamilyNameRules'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.