Win8: App: Modern: Apps fail to start if default registry or file permissions modified

Article ID: 2798317 - View products that this article applies to.
Expand all | Collapse all

Symptoms

Modern Apps fail to open.

Specifically, clicking on the tile of a Modern app will begin to launch the application but the app simply returns the user to the start screen.
No on-screen error is displayed.

Microsoft-Windows-Immersive-Shell event 5961 is logged.

Log Name:      Microsoft-Windows-TWinUI/Operational
Source:        Microsoft-Windows-Immersive-Shell
Date:          1/3/2013 3:03:17 PM
Event ID:      5961
Task Category: (5961)
Level:         Error
Keywords:     
User:          <UserName>
Computer:      <ComputerName>
Description:
Activation of the app <app name> for the Windows.Launch contract failed with error: The app didn't start..

The event log path for that event is:

Applications and Services Logs\Microsoft\Windows\Apps\Microsoft-Windows-TWinUI/Operational event log.

Note: The app portion of the example event, "<app name>", will change depending on the application that fails to start. 

Possible values for <app name> include but are not limited to:

microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Chat

Prefixes for other built-in modern applications include:

Microsoft.BingFinance_8wekyb3d8bbwe!<app identifier>
Microsoft.BingMaps_8wekyb3d8bbwe!<app identifier>
Microsoft.BingNews_8wekyb3d8bbwe!<app identifier>
Microsoft.BingSports_8wekyb3d8bbwe!<app identifier>
Microsoft.BingTravel_8wekyb3d8bbwe!<app identifier>
Microsoft.BingWeather_8wekyb3d8bbwe!<app identifier>
Microsoft.Bing_8wekyb3d8bbwe!<app identifier>
Microsoft.Camera_8wekyb3d8bbwe!<app identifier>
Microsoft.Media.PlayReadyClient_8wekyb3d8bbwe!<app identifier>
microsoft.microsoftskydrive_8wekyb3d8bbwe!<app identifier>
Microsoft.Reader_8wekyb3d8bbwe!<app identifier>
Microsoft.VCLibs.110.00_8wekyb3d8bbwe!<app identifier>
microsoft.windows.authhost.a_8wekyb3d8bbwe!<app identifier>
microsoft.windowscommunicationsapps_8wekyb3d8bbwe!<app identifier>
microsoft.windowsphotos_8wekyb3d8bbwe!<app identifier>
Microsoft.WinJS.1.0.RC_8wekyb3d8bbwe!<app identifier>
Microsoft.WinJS.1.0_8wekyb3d8bbwe!<app identifier>
Microsoft.XboxLIVEGames_8wekyb3d8bbwe!<app identifier>
Microsoft.ZuneMusic_8wekyb3d8bbwe!<app identifier>
Microsoft.ZuneVideo_8wekyb3d8bbwe!<app identifier>

Cause

Registry and or file system permissions may have been changed from their defaults.  

The "All Application Packages" group (a well known group with a predefined SID) must have specific access to certain locations of the registry and file system for Modern Apps to function properly.

Resolution

Registry and File System permission must be reverted back to a state that will allow modern applications to function. Follow this method to resolve the issue

  1. Determine if file system permissions have been changed. If not see the "More Information" section below
  2. If so how were they changed? Manually or with Group Policy?
  3. Determine if registry permissions have been changed If not see the "More Information" section below
  4. If so how were they changed? Manually or with Group Policy?

Determining if File System permissions have been changed:

Check the folders listed below. Determine if the All Application Packages group has the access indicated. Most but not all sub directories of Windows, Program Files and WER also grant permissions to the All Application Packages group.

  • Program Files - Read, Read and Execute, List folder Contents
  • Windows - Read, Read and Execute, List folder Contents
  • Users\<userName>\AppData\Local\Microsoft\Windows\WER - Special Permissions (List folder / read data, Create Folders /Append Data)

Determining if registry permissions have changed

Check the registry keys listed below. Make sure the All Applications Packages group has the Read permissions to the following registry paths:

  • HKEY_CLASSES_ROOT
  • HKEY_LOCAL_MACHINE\Drivers
  • HKEY_LOCAL_MACHINE\HARDWARE
  • HKEY_LOCAL_MACHINE\SAM
  • HKEY_LOCAL_MACHINE\SOFTWARE
  • HKEY_LOCAL_MACHINE\SYSTEM
  • HKEY_USERS

Most but not all of the subkeys of the registry keys listed above will grant the "All Application Packages" group read access.

Determining if Group Policy is being used to manage permissions

  1. Logon to a PC as a user experiencing the problem
  2. Open an administrative command prompt then run the following command:

    > gpresult /h <path>\gpreport.html

  3. Open the file gpreport.html and expand the following path:

    Computer Settings -> Policies\Windows Settings\Security Settings. look for "File System" and Registry. If these exist then GP is assigning permission. You must edit the GP to include the necessary permissions for the All Application Packages group.

Steps to fix the problem

Depending on how the file system permissions were changed will determine how to recover from the problem. The most common ways permissions are changed are manually and by Group Policy.

Important Note -  Make sure that you test your resolution in a lab before widely deploying. Always backup any important data before changing registry and file system permissions.

Fixing file system permissions that have been changed manually

  1. Open File Explorer
  2. Browse to "c:\Program Files "
  3. Right click and select properties
  4. Select the "Security" tab
  5. Click the "Advanced" button
  6. Click the "Change permissions" button
  7. Click the Add button
  8. Click "Select a principal" link
  9. Click the locations button and select the local computer
  10. Add the All Applications Packages group name and click ok
  11. Make sure that Type = allow and Applies to = This folder, subfolder and files.
  12. Check Read & Execute, List folder contents and Read.
  13. Check the box Replace all child object permissions with inheritable permission entries from this object
  14. Click Apply and OK.
  15. Repeat for c:\Windows
  16. Repeat for c:\Users but grant the "All Application Packages" group Full Control.
  17. Click Apply and Ok. 

Fixing file system permissions changed by Group Policy

  Have a Group Policy administrator do the following:

  • Open Group Policy Administrative Console
  • Locate the GPO identified in the step "Determining if Group Policy is being used to manage permissions"
  • Right click and select edit.
  • Go to the location Computer Configuration\Policy\Windows Settings\Security Settings\File System
  • If there is an entry for the paths already created you can edit it. If no entry exists create a new entry for each path.
  • To create a new entry right click file system and select add file
  • Browse to the path c:\Program Files, click OK
  • Select the Add button.
  • Click the locations button and select the local machine name
  • Add the "All Application Packages" group and grant them the Read, Read and Execute, List folder Contents permissions
  • Click OK and OK
  • Select the option "Replace existing permissions on all subfolders and files with inheritable permissions.
  • Repeat for C:\Windows
  • Repeat for C:\Users however grant the "All Application Packages" group Full Control.
  • You will need to wait for the Group policy change to replicate to all Domain Controller s and for all clients to update their Group Policy settings.

    Note: Processing the File System changes will incur some logon delay the first time this policy is processed. Subsequent logons will not be impacted unless changes are made to the policy. As an alternative you can use a script that is called post logon by the user is run as a scheduled task.

     

    Fixing registry permissions that have been changed manually

    • Open regedit.exe
    • Right click on HKEY_Users and select properties
    • Make sure that All Application Packages has Read
    • Repeat for HKEY_CLASSES_ROOT
    • Expand HKEY_LOCAL_MACHINE. Check the subkeys HARDWARE, SAM,SOFTWARE,SYSTEM. Make sure that All Application Packages has the Read permission.

     Fixing Registry Permissions that have been changed by Group Policy

     Have a Group Policy administrator do the following:

  • Open Group Policy Administrative Console
  • Locate the GPO identified in the step "Determining if Group Policy is being used to manage permissions"
  • Right click and select edit.
  • Go to the location Computer Configuration\Policy\Windows Settings\Security Settings\Registry
  • Right Click and select Add Key
  • Select CLASSES_ROOT,
  • Select the Add button.
  • Click the locations button and select the local machine name
  • Add the "All Application Packages" group and grant them Read
  • Repeat for "Users"
  • Repeat for MACHINE\HARDWARE, MACHINE\SAM, MACHINE\SOFTWARE and MACHINE\SYSTEM
  •  

    More Information

    Related Content:

    KB  2787623 Win8: App: Modern: Modern Apps Fail to Start if the User Profiles or the ProgramData directory are Moved from their Default Location

    Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

    Properties

    Article ID: 2798317 - Last Review: April 23, 2013 - Revision: 4.0
    Applies to
    • Windows 8 Pro
    • Windows 8 Enterprise
    Keywords: 
    KB2798317

    Give Feedback

     

    Contact us for more help

    Contact us for more help
    Connect with Answer Desk for expert help.
    Get more support from smallbusiness.support.microsoft.com