Let Windows Feature Experience Pack access the file C: \Users\User\AppData\Local\packages \MicrosoftWindows.Client.CBS_cw5n1h2txyewy \Settings\settings.dat?

Levi Hagleitner | PrioIT-FlexCo 0 Reputation points
2026-09-10T13:33:31.94+00:00

Hello, we are experiencing odd messages everytime a user logs in. We use Citrix Daas local (VDA) to deploy a golden image via PVS. Since the last Updates all users get this message when they log in:
User's image

These messages will appear everytime no matter what option is used in the dialoug window. These Messages doe not occure on the Golden Image server itself.

Sometimes there will be an additional second message where the path directs to the windows lock screen.

The OS underneath is a Windows Server 2025 25H2.
Every Help is appreciated.

Windows for business | Windows Client for IT Pros | Performance | Windows desktop and shell experience
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Harry Phan 30,640 Reputation points Independent Advisor
    2026-09-10T14:12:26.1733333+00:00

    Hello Levi,

    What you are seeing is a side effect of the latest cumulative updates applied to Windows Server 2025 (25H2) in combination with Citrix VDA/PVS streaming. The dialog originates from the Windows Feature Experience Pack (WFEP), which is responsible for modern shell components such as lock screen, Start menu, and certain personalization features. On non-persistent environments like Citrix PVS, the WFEP attempts to access per-user configuration files under C:\Users\<username>\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat. Because the streamed image does not handle the AppX package state consistently across sessions, the system prompts for consent every time a user logs in.

    The reason you don’t see this on the golden image itself is that the AppX provisioning state is intact there. Once streamed via PVS, the user profile redirection and package registration mismatch causes WFEP to request access repeatedly. The secondary message pointing to the lock screen path is another WFEP component trying to read its personalization data.

    At this point, there is no supported way to suppress the prompt via Group Policy or registry because it is tied to AppX runtime permissions. The most reliable mitigation is to re-provision the WFEP package cleanly into your golden image before sealing it. Run the following on the golden image before capture:

    DISM /Online /Add-Capability /CapabilityName:Windows.Client.ShellComponents~~~~0.0.1.0

    Then re-seal and push the image. This forces WFEP to be provisioned correctly and eliminates the runtime prompt. If the package is already present, you may need to remove and re-add it with:

    DISM /Online /Remove-Capability /CapabilityName:Windows.Client.ShellComponents~~~~0.0.1.0

    DISM /Online /Add-Capability /CapabilityName:Windows.Client.ShellComponents~~~~0.0.1.0

    After resealing, test with a fresh PVS target device.

    If the issue persists even after reprovisioning, it is likely a regression introduced in the 25H2 servicing stack. In that case, the only safe path is to wait for Microsoft to release a servicing fix, as this is not something that can be bypassed without breaking WFEP functionality. I would recommend opening a support case with Microsoft Premier Support and referencing the WFEP AppX prompt behavior in non-persistent Citrix environments on Server 2025 25H2.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

    HP.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.