MSIX Win32 app reading raw \\.\C: (MFT) only when run as admin Is it Store-compliant?

Question

MSIX Win32 app reading raw \\.\C: (MFT) only when run as admin Is it Store-compliant?

Mustapha Ben 35

I'm building a disk-space visualizer (Link removed by Moderator) that I want to ship as a fully Microsoft Store–compliant MSIX (packaged full-trust Win32 app, EntryPoint="Windows.FullTrustApplication"), and I'm looking for the right way to do one thing.

The app works fully in both modes — elevation only changes the scan method, not what the app can do:

Standard user (default): scans by walking directories with the normal Win32 APIs (FindFirstFileExW). Everything works.
With admin: it instead reads the NTFS Master File Table directly by opening the raw volume, for a much faster whole-drive scan:

Same results either way. the MFT path is purely a speed optimization (the technique WizTree/TreeSize use), and opening the raw volume needs an administrator elevation.

My constraints

It must stay a pure, Store-compliant MSIX — not a classic Win32 installer / sideload.
It must not require elevation to run: no requireAdministrator, no forced UAC at launch. The app is fully usable by a standard user (it just uses the slower directory walk). A user-initiated UAC prompt to run the fast scan on demand is perfectly fine I only need to elevate that one operation, not the whole app.

What I'm asking

Is there a Store-compliant way for a pure MSIX to do this. ideally elevating just the fast scan on demand (e.g. one UAC prompt via a small elevated helper), without the whole app requiring admin? What approach would you recommend, and has anyone shipped something similar? Open to any pattern that keeps it a fully compliant Store MSIX.

Environment

MSIX, full-trust (Windows.FullTrustApplication); capabilities: runFullTrust (+ internetClient for an unrelated feature).
Access: CreateFileW("\\\\.\\C:", GENERIC_READ, …), read-only.
Behavior: MFT path used only when elevated; otherwise the standard directory walk.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Taki Ly (WICLOUD CORPORATION) 4,440 Microsoft External Staff Moderator

Hello @Mustapha Ben ,

I saw your question and wanted to suggest an architectural pattern that might help you achieve this. You could consider the Out-of-Process Pattern with IPC, which keeps your main app at standard privileges and only elevates a secondary background process when requested by the user.

Consider following these steps to implement this approach:

1. Enable Elevation in Package Manifest

You'll need to declare the allowElevation restricted capability in your app's manifest. This unlocks the ability to use the runas verb inside the MSIX container, without forcing a UAC prompt when the primary app initially opens.

Documentation reference: App capability declarations - restricted capabilities

2. Launch the Secondary Process on Demand

Extract your MFT scanning logic into a separate console application or background task. When the user initiates a fast scan, launch this secondary application using your language's standard Process invoking API (like ProcessStartInfo in .NET) while explicitly specifying the runas verb. This triggers the UAC prompt only for that specific background process. You can then catch any cancellation exceptions to calmly fall back to your normal standard scan.

3. Send Data Back via IPC (Named Pipes)

Since the background process runs elevated and the main app runs standard, they can communicate via Named Pipes. The crucial part in this step is that the elevated process must explicitly set a Security Descriptor (using PipeSecurity and adding an Access Rule for the WorldSid) to allow standard users to read from the pipe. If you skip the Access Control List configuration, your main app will likely get an Access Denied error.

When submitting to the Store, I suggest adding a note in your certification instructions explaining why the allowElevation capability is needed (for example, to run an optional on-demand process for faster low-level disk scanning).

I hope this points you in the right direction! If you found my response helpful or informative, I would greatly appreciate it if you could follow this guide for your confirmation.

Thank you.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Mustapha Ben 35 Reputation points

2026-07-13T11:44:24.85+00:00

Hello @Taki Ly (WICLOUD CORPORATION)
Thanks for you response!
With this pattern I still ship the app as packaged MSIX app right?
Taki Ly (WICLOUD CORPORATION) 4,440 Reputation points Microsoft External Staff Moderator

2026-07-14T03:29:42.5266667+00:00

Hi @Mustapha Ben ,

With this approach you can still package and distribute the application as an MSIX package.

One consideration, since you mentioned publishing through the Microsoft Store, is the use of the allowElevation restricted capability.

While this capability can be used within an MSIX-packaged application, Store submissions that include restricted capabilities may be subject to additional review. Microsoft documentation notes:

"For Microsoft Store submissions, this capability is subject to approval under strict criteria. If you intend to use this capability, contact reportapp@microsoft.com in advance with a detailed justification."

Based on that guidance, you may want to reach out to reportapp@microsoft.com before publishing and provide details about your scenario and why elevation is required.

I hope my assistance and the information shared throughout this discussion have been helpful. If so, I would greatly appreciate it if you could follow the instructions here so that others with a similar question can benefit as well.
Mustapha Ben 35 Reputation points

2026-07-14T14:47:40.4666667+00:00

Thank you for your answer I will execute this plan.
Mustapha Ben 35 Reputation points

2026-07-16T23:11:49.4433333+00:00

One question: since users can scan multiple different disks, I'd like to keep the helper running so it doesn't trigger a UAC prompt for every scan. Is this still allowed for Microsoft Store submissions?

Thank you.
Taki Ly (WICLOUD CORPORATION) 4,440 Reputation points Microsoft External Staff Moderator

2026-07-17T03:31:08.8066667+00:00
Hi @Mustapha Ben ,

Keeping a helper running in the background rather than triggering a new UAC prompt per drive is generally considered a viable architectural choice for minimizing user friction.

However, since you're submitting to the Microsoft Store, you might want to carefully consider how this approach interacts with the Store's safety standards, particularly Store Policy 10.2 (Security). According to the Microsoft Store Policies documentation, a product is expected not to jeopardize user or system security.

If an elevated process remains permanently active and listens on an IPC endpoint (like a Named Pipe), it typically raises concerns about Elevation of Privilege (EoP) vulnerabilities. A local malicious or unauthorized app theoretically might try to "piggyback" on your open pipe to interact with raw volumes.

If you explore this route, it's generally recommended to implement strict safeguards. You might consider:

Strong IPC Authentication: Rather than leaving the pipe open via simple Access Control Lists (ACLs), you could have the elevated server verify the client's Process ID and ensure it originates from your exact MSIX Package Identity.

Lifecycle Management: In relation to Policy 10.4.2 (Usability), you may want to ensure the helper includes logic to gracefully terminate itself immediately if the main app crashes or closes, preventing orphaned admin processes from lingering in the background.

When going through the certification process, detailing these exact security mitigations in your submission notes might be helpful. Since every Store review involving elevation capabilities is handled case-by-case, showing that you proactively secured the prolonged admin process could give the review team more confidence in your architecture.
Mustapha Ben 35 Reputation points

2026-07-19T11:36:13.44+00:00

Thank you for your answer. I have already implemented some security safeguards. The elevated process allows only two actions: ScanVolume and Shutdown. The input is length-prefixed. I will also add IPC authentication, as you suggested. Thank you again!
Taki Ly (WICLOUD CORPORATION) 4,440 Reputation points Microsoft External Staff Moderator

2026-07-20T02:49:54.5033333+00:00

Hi @Mustapha Ben ,

You're very welcome, and thank you for the update.

If you have any new questions in the future, please don't hesitate to post them on the forum. I'll be happy to continue assisting you.

Thank you, and have a great day!