PS7-packaged: Update-Help -Scope AllUsers fails under MSIX ($PSHOME read-only) #27699

Tracked by #27565 · Design: #27697 · Original gap report: #9278

Summary

Update-Help defaults to -Scope AllUsers, which writes help content into each module's ModuleBase. For in-box modules that path is under $PSHOME, which is read-only under MSIX, so the update fails:

Update-Help: Access to the path
'C:\Program Files\WindowsApps\Microsoft.PowerShell…\en-US\Microsoft.PowerShell.Commands.Management.dll-Help.xml' is denied.

Only -Scope CurrentUser works today — it redirects to the user help location (HelpUtils.GetModuleBaseForUserHelp). There is no working machine-wide help update under MSIX. (This was one of the gaps originally enumerated in #9278.)

Details

• UpdateHelpScope has two values, CurrentUser and AllUsers (the default).
• For AllUsers, Update-Help targets module.ModuleBase; for in-box modules that is under $PSHOME → access denied under MSIX.

Solution directions (design discussion — pick one)

1. Redirect AllUsers help to the MachineFolder store ([Design] MachineFolder: a per-machine writable data store for MSIX-packaged PowerShell #27697) — write system-wide help under the per-machine data store and add that location to the help search path. Consistent with the config/profile relocation; keeps -Scope AllUsers working under MSIX.
2. Relocate the in-box modules/help folder out of $PSHOME to a writable machine location so AllUsers help lands somewhere writable and on the lookup path.
3. Disallow -Scope AllUsers under MSIX — fail fast with a clear, actionable error (point to -Scope CurrentUser) instead of a raw Access-denied. Lowest effort; does not restore the capability.

Acceptance criteria

• Under MSIX, Update-Help -Scope AllUsers either (a) writes to a writable location that the help subsystem then reads, or (b) fails with a clear, actionable error — never a raw Access denied.
• Get-Help resolves the updated system-wide help where applicable.
• No regression for unpackaged installs.

Related

• Design / mechanism: [Design] MachineFolder: a per-machine writable data store for MSIX-packaged PowerShell #27697
• Original gap report (also lists SessionConfig + system config): Some cmdlets and config require writing to $PSHOME\SessionConfig folder #9278
• Umbrella: Tracking: MSIX packaging gaps for PowerShell 7 #27565