Sideload Apps with DISM

Applies To: Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2

You can sideload line-of-business (LOB) Windows Store apps to a Windows® image by using Windows PowerShell® or the Deployment Image Servicing and Management (DISM) platform. Windows Store apps are a new type of application that runs on:

• Windows 8.1 devices

• Windows 8 devices

• Windows Server 2012 R2 devices

• Windows Server 2012

• Windows Embedded 8 Industry

Typically, Windows Store apps are available only through the Windows® Store. You can submit LOB Windows Store apps to the Windows Store and make them available outside of your enterprise. However, you can also develop Windows Store apps for use only within your enterprise and add them to Windows devices you manage through a process we call sideloading. Sideloaded apps do not have to be certified by or installed through the Windows Store.

Here’s what you’ll need to know in order to sideload apps:

Understand Sideloading Concepts

Windows Store apps are based on the Windows Runtime API and differ from traditional desktop apps in their design and in the way users can interact with them. To learn more about Windows Store apps, see what is a Windows Store App?.

You cannot sideload an app that has been downloaded from the Windows Store. To install Windows Store apps that are not part of your business line, you must use the Windows Store. For more information about the Windows Store, see Managing Client Access to the Windows Store.

LOB Windows Store apps that are not signed by the Windows Store can be sideloaded or added to a PC in the enterprise through scripts at runtime on a per-user basis. They can also be provisioned in an image by the enterprise so that the app is registered to each new user profile that's created on the PC. The requirements to sideload the app per-user or in the image are the same, but the Windows PowerShell cmdlets you use to add, get, and remove the apps are different. This topic provides steps for both methods.

Before you can sideload LOB Windows Store apps that are not signed by the Windows Store, you will need to configure the PC, see Configure PCs for Sideloading Requirements.

When You’re Developing LOB Windows Store apps for Your Enterprise

LOB Windows Store apps that are not signed by the Windows Store must be cryptographically signed. The apps can only be installed on a computer that trusts the signing certificate.

For more information about how to sign an app and using certificates, see App Packaging Tools.

However, you can use a developer license to add apps that are in development to your PC. For more information about testing apps that are in development, see Get a Developer License.

You can use Group Policy to configure your domain-joined PCs to have a developer license that does not expire to support app development. Once the PCs are configured, you won’t need to connect to the Internet to obtain or renew a license. See Configure PCs for Developing Windows Store Apps for more information.

Configure PCs for Sideloading Requirements

Until the device meets all of the sideloading requirements, app tiles on the Start menu will show an "X" in the bottom-right corner to indicate that a problem is preventing the app from running.

In some cases, part of those requirements includes using a sideloading product key. This key provides use rights needed to deploy Windows 8, or Windows 8.1 apps directly to devices without having to install them through the public Windows Store.

Before you can add and run sideloaded LOB Windows Store apps that are not signed by the Windows Store you must configure your device based on the following conditions:

1. For those devices that are joined to a workgroup, you must:

   • Activate the sideloading product key on the device.

   • And enable the Allow all trusted applications to install Group Policy setting. See Use Group Policy to configure your enterprise PCs for sideloading apps.

   This applies to:

   • Windows 8 Enterprise

   • Windows 8.1 Enterprise

   • Windows Embedded 8.1 Industry Enterprise

   • Windows 8.1 Pro Update

2. For those devices that will be joined to an Active Directory domain, you must:

   • Join the device to an Active Directory domain.

   • And enable the Allow all trusted applications to install Group Policy setting. See Use Group Policy to configure your enterprise PCs for sideloading apps.

   This applies to:

   • Windows 8 Enterprise

   • Windows 8.1 Enterprise

   • Windows Embedded 8.1 Industry Enterprise

   • Windows 8.1 Pro Update

   • Windows Server 2012

   • Windows Server 2012 R2

3. For those devices that will require a sideloading product key, whether the device is domain-joined or a member of a workgroup, you must:

   • Activate the sideloading product key on the device.

   • And enable the Allow all trusted applications to install Group Policy setting. See Use Group Policy to configure your enterprise PCs for sideloading apps.

   This applies to:

   • Windows RT 8

   • Windows RT 8.1

   • Windows 8 Pro

   • Windows 8.1 Pro

   • Windows Embedded 8.1 Industry Pro

4. For certain Windows Embedded 8 Industry devices, you no longer need a sideloading product key whether the device is domain-joined or a member of a workgroup. In this case, you must:

   • Enable the Allow all trusted applications to install Group Policy setting on the device.

   For more information about sideloading on Windows Embedded 8 Industry, see Enterprise guide to installing modern apps on Windows Embedded 8 Industry.

   This applies to:

   • Windows Embedded 8.1 Industry Pro Update

   • Windows Embedded 8.1 Industry Enterprise Update

Use Group Policy to configure your enterprise PCs for sideloading apps

1. Open the Group Policy Management Editor for a domain—based Group Policy Object (GPO) to which you will be applying the group policy setting, as specified below, to your selected PCs.

2. Click to expand Computer Configuration, Administrative Templates, Windows Components, and then App Package Deployment.

3. Double-click the Allow all trusted apps to install setting.

4. In the Allow all trusted apps to install window, click Enabled and then click OK.

Setting the Group Policy to allow trusted applications updates the following registry setting: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx\AllowAllTrustedApps = 1

To activate a sideloading product key

1. Open a command prompt with administrator privileges and type the following to add the sideloading product key:

   Slmgr /ipk <sideloading product key>
   

   Where <sideloading product key> is the 25 digit key to enable sideloading on the computer.

2. Activate the sideloading key by typing:

   slmgr /ato ec67814b-30e6-4a50-bf7b-d55daf729d1e
   

For more information about sideloading product keys, see the Windows 8 Licensing Guide.

Configure PCs for Developing Windows Store Apps

You can configure your PCs to have a developer license that does not expire. Once the PCs are configured, you won’t need to connect to the Internet to obtain or renew a license. Your computer must be a member of a domain and be running either of the following operating systems:

• Windows 8.1 Enterprise

• Windows 8 Pro

To configure your enterprise PCs with a developer license

1. Open the Group Policy Management Editor for a domain—based Group Policy Object (GPO) to which you will be applying the group policy settings, as specified below, to your selected PCs.

2. Click to expand Computer Configuration, Administrative Templates, Windows Components, and then App Package Deployment.

3. Double-click the Allow development of Windows Store apps without installing a developer license setting.

4. In the Allow development of Windows Store apps without installing a developer license window, click Enabled and then click OK.

5. Double-click the Allow all trusted apps to install setting.

6. In the Allow all trusted apps to install window, click Enabled and then click OK.

Setting the Group Policy to allow development of Windows Store apps without installing a developer license updates the following registry setting: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx\AllowDevelopmentWithoutDevLicense = 1

Setting the Group Policy to allow trusted applications updates the following registry setting: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx\AllowAllTrustedApps = 1

Add Apps

There are two ways to add apps. A user can add an app package, which will make the app available to just that user. Or the app can be installed in the Windows image, which will make the app available to every user of the Windows image at first logon or at the next logon, if the user account is already created. This second case is referred to as provisioning an app package.

Add an App Package

You can install an app package (.appx or .appxbundle) on a per-user basis by using the add-appxpackage PowerShell cmdlet. There is no limit to the number of LOB apps you can add for each user.

Add a LOB app to a user account

• At the Windows PowerShell prompt on a Windows 8 or Windows Server 2012 computer, add an .appx (or .appxbundle) file package. Include any required dependency app packages when you add the app. For example, type:

  add-appxpackage C:\app1.appx –DependencyPath C:\winjs.appx
  

  For more information, see App Installation Cmdlets in Windows PowerShell.

Add a provisioned LOB app to a Windows image

Apps that are installed in the Windows image are called provisioned apps. Provisioned apps are staged in the image and are scheduled to be installed for every user of the Windows image at first logon or at the next logon, if the user account is already created.

You can add these apps to a Windows image when you boot into audit mode before you deploy the image by using the DISM app provisioning commands. For more information about audit mode, see Audit Mode Overview.

Provisioned apps are specific to the PC and will not roam with the user. You can only install 24 provisioned apps in an image.

On a Windows image that has already been deployed, you should instead use the Add-AppxPackage cmdlet in Windows PowerShell. If you do use the DISM app provisioning commands on a deployed Windows image with active users, you should log all users off of the image, so that you are the only user logged on, before you run the command.

Add a provisioned LOB app to a Windows image

1. Use the Deployment Image Servicing and Management (DISM) command-line tool or PowerShell cmdlets to add the LOB app without a Windows store license. For example, at an elevated command prompt, type:

   DISM /Online /Add-ProvisionedAppxPackage /PackagePath:C:\App1.appx /SkipLicense
   

   Or, at a Windows PowerShell prompt, type:

   Add-AppxProvisionedPackage -Online -FolderPath C:\Appx -SkipLicense
   

   For more information, see DISM App Package (.appx or .appxbundle) Servicing Command-Line Options or DISM Cmdlets. For information about DISM supported platforms, see DISM Supported Platforms.

Update a provisioned LOB app once it is has been added to a Windows image

On Windows 8, to update a provisioned app, you must first remove the provisioned app and then deploy the new version of the app. The update will then be applied the next time each user logs in.

On Windows 8.1, to update a provisioned app, you will need to update the app for each user that has signed on to the Windows image provisioned with the app:

Update a provisioned LOB app to a Windows image

1. Use the PowerShell to update the LOB app without a Windows store license. This must be done for each user that has signed in to the PC running the Windows image. For example, if you have installed the original version of the app, 1.0.0.0, that now needs to be updated to version 1.0.0.1, then at a Windows PowerShell session, type:

   Add-AppxPackage –Path App1_1.0.0.2 -DependencyPath C:\appx\WinJS.appx
   

   Where c:\appx\WinJS.appx is the path to the dependency package.

2. Once you have updated your app, you can verify the version of the updated app. From a Windows PowerShell session, type:

   Get-AppxPackage | Out-GridView
   

Add Multiple Languages for Apps

To prepare a multi-lingual image, sign-in to the image, install any desired app resource packs (including language) and then use Copy Profile to capture the image.

Preparing a multi-lingual image for an app

1. Create an unattend.xml with the following contents to c:\unattend.xml:

   <?xml version="1.0" encoding="utf-8"?>
   <unattend xmlns="urn:schemas-microsoft-com:unattend">
       <settings pass="specialize">
           <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="https://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
               <CopyProfile>true</CopyProfile>
               <RegisteredOrganization />
               <RegisteredOwner />
           </component>
       </settings>
       <cpi:offlineImage cpi:source="catalog:d:/desktop/x86 clgs/install_windows vista ultimate.clg" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
   </unattend>
   

2. Sign-in to a local administrator user account from OOBE on clean image.

3. Add the desired languages to the current user’s language preference list.

4. Install app updates using a Windows Store account (MSA account)

   1. Sign-in to the store with an MSA account.

2.  Check for updates and install new language resource packs.

3.  Sign out of the Windows Store and remove the MSA account.

5. Open an elevated command prompt and type:

   Sysprep.exe /generalize /oobe /reboot /unattend:C:\unattend.xml
   

   Then press enter.

6. You should see the PC boot to OOBE. Any languages that you have added prior to Copy Profile should be present at this point.

Install app updates without using a Windows Store account (MSA account)

1. After the PC has finished installing, open an elevated command prompt.

2. Type Start ms-windows-store:Updates

3. You will see the Windows Store Updates page. You should see the pending updates displayed.

4. Tap Install to install the updates.

Inventory Apps

You can list the LOB apps installed in on offline or online Windows image and get additional information about the packages.

List LOB Apps per user account

• You can get a list of the modern LOB apps installed for a specific user account on the computer. You must open Windows PowerShell with administrator privileges to list the packages for a user other than the current user. For example, at the Windows PowerShell prompt, type:

  Get-AppxPackage -AllUsers
  

• You can get a list of packages installed for a specific user. You must open Windows PowerShell with administrator privileges to list the packages for a user other than the current user. For example, at the Windows PowerShell prompt, type:

  Get-AppxPackage -Name Package1 -User domain\username
  

• You can also get the manifest of an app package (.appx) which includes information such as the package ID. For example, at the Windows PowerShell prompt, type:

  Get-AppxPackageManifest -Package Package1
  

• You can use the pipeline to get the manifest for an app package (.appx) if you don’t know the full name of the package. For example, at the Windows PowerShell prompt, type:

  (Get-AppxPackage -Name "*WinJS*" | Get-AppxPackageManifest).package.applications.application.id
  

List LOB apps that are provisioned in a Windows image

• You can get a list of the packages that are provisioned in a Windows image that will be installed for each new user by using Dism.exe or Windows PowerShell. For example, at a Windows PowerShell prompt, type:

  Get-AppxProvisionedPackage -Path c:\offline
  

  Or, at a command prompt, type:

  DISM.exe /Image:C:\test\offline /Get-ProvisionedAppxPackages
  

For more information, see Take Inventory of an Image or Component Using DISM.

Remove Apps

You can remove individual instances of an app, or remove the provisioning setting of an app.

Remove LOB apps per user account

1. You can remove a single app for the current user only. For example, at a command prompt, type:

   Remove-AppxPackage Package1
   

Remove provisioned LOB apps in a Windows image

• When you remove a provisioned app, the app will not be installed for new user accounts. For the currently logged in user and other user accounts that are active on the computer, the app will not be removed from those accounts. The app will need to be uninstalled for those existing apps.

  For example, to remove a provisioned LOB app, MyAppxPkg, from a Windows image, at an elevated Windows PowerShell prompt, type:

  Remove-AppxProvisionedPackage -Online -PackageName MyAppxPkg
  

  Or, at a command prompt, type:

  DISM.exe /Online /Remove-ProvisionedAppxPackage /PackageName:microsoft.app1_1.0.0.0_neutral_en-us_ac4zc6fex2zjp
  

See Also

Tasks

Customize the Start Screen

Reference

DISM App Package (.appx or .appxbundle) Servicing Command-Line Options
DISM Supported Platforms

Other Resources

App Installation Cmdlets in Windows PowerShell
App Packaging Tools
AppX Module Cmdlets
Change the language used in apps
DISM Cmdlets
Enterprise guide to installing modern apps on Windows Embedded 8 Industry
Get a Developer License
Group Policy for Beginners
Group Policy Techcenter
Managing Client Access to the Windows Store
Microsoft Volume Licensing
Remote Server Administration Tools for Windows 8.1
What is a Windows Store App?
Windows 8 Licensing Guide