{"id":341,"date":"2026-10-13T09:00:25","date_gmt":"2026-10-13T16:00:25","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/insidemsix\/?p=341"},"modified":"2026-09-27T22:54:23","modified_gmt":"2026-09-28T05:54:23","slug":"find-msix-package-application-identity","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/insidemsix\/find-msix-package-application-identity\/","title":{"rendered":"Is it MSIX? Part 3: Find Package and Application Identity with TASKLIST and PowerShell"},"content":{"rendered":"

We previously<\/a> determined how to programmatically retrieve a packaged process’ package and application identity. Now let’s find MSIX package identity using existing tools.<\/p>\n

TASKLIST.EXE<\/h2>\n

Using the packaged app AzVpnSysTrayApp.exe<\/code> from our previous example, we know the “image name” (aka executable filename) and that its PID (process ID) is 7664.<\/p>\n

TASKLIST.EXE \/APPS<\/code> lists packaged processes and their package names:<\/p>\n

[C:] TASKLIST \/APPS\n\nImage Name                                              PID    Mem Usage Package Name\n================================================== ======== ============ ==================================================\nCalculatorApp.exe (App)                               82876    106,528 K Microsoft.WindowsCalculator_11.2508.4.0_x64__8weky\n...\n<\/code><\/pre>\n
That’s overkill when we’re interested in a specific process. We can use the \/FI<\/code> (filter) option to limit the output to our target process:<\/p>\n
[C:] TASKLIST \/APPS \/FI \"PID eq 7664\"\n\nImage Name                                              PID    Mem Usage Package Name\n================================================== ======== ============ ==================================================\nAzVpnSysTrayApp.exe (App)                              7664     33,004 K Microsoft.AzureVpn_4.0.5.0_x64__8wekyb3d8bbwe\n<\/code><\/pre>\n
Or we can specify the image name and get the same result:<\/p>\n
[C:] TASKLIST \/APPS \/FI \"IMAGENAME eq AzVpnSysTrayApp.exe\"\n\nImage Name                                              PID    Mem Usage Package Name\n================================================== ======== ============ ==================================================\nAzVpnSysTrayApp.exe (App)                              7664     33,008 K Microsoft.AzureVpn_4.0.5.0_x64__8wekyb3d8bbwe\n<\/code><\/pre>\n
The Package Name<\/code> column is actually the package full name.<\/p>\n
Voila! Package identity for the packaged process.<\/p>\n
Unfortunately, TASKLIST<\/code> doesn’t display the Application User Model ID. For that, we need to get more creative.<\/p>\n
Application Identity via PowerShell<\/h2>\n
Fortunately, it’s easy enough to call the package query APIs<\/a> from PowerShell.<\/p>\n
Save the following PowerShell script to Get-Identity.ps1<\/code>:<\/p>\n
Param(\n    [Parameter(Mandatory=$true)]\n    [int]$ProcessId\n)\n\nSet-StrictMode -Version 3.0\n\n$ErrorActionPreference = \"Stop\"\n\n# Define APIs via P\/Invoke\nAdd-Type -TypeDefinition @\"\nusing System;\nusing System.Runtime.InteropServices;\nusing System.Text;\n\nnamespace AppModel\n{\n    public static class PackageUtil\n    {\n        [DllImport(\"kernel32.dll\", SetLastError = true)]\n        public static extern IntPtr OpenProcess(\n            int access,\n            bool inherit,\n            int processId);\n\n        [DllImport(\"kernel32.dll\", SetLastError = true)]\n        public static extern bool CloseHandle(IntPtr handle);\n\n        [DllImport(\"kernel32.dll\", CharSet = CharSet.Unicode)]\n        public static extern int GetPackageFullName(\n            IntPtr hProcess,\n            ref int packageFullNameLength,\n            StringBuilder packageFullName);\n\n        [DllImport(\"kernel32.dll\", CharSet = CharSet.Unicode)]\n        public static extern int GetApplicationUserModelId(\n            IntPtr hProcess,\n            ref int applicationUserModelIdLength,\n            StringBuilder applicationUserModelId);\n\n        public const int PROCESS_QUERY_LIMITED_INFORMATION = 0x1000;\n\n        public const int APPMODEL_ERROR_NO_PACKAGE = 15700;\n        public const int APPMODEL_ERROR_NO_APPLICATION = 15703;\n\n        \/\/ PACKAGE_FULL_NAME_MAX_LENGTH does not include the null terminator\n        public const int PACKAGE_FULL_NAME_MAX_LENGTH = 127;\n\n        \/\/ APPLICATION_USER_MODEL_ID_MAX_LENGTH includes the null terminator\n        public const int APPLICATION_USER_MODEL_ID_MAX_LENGTH = 130;\n    }\n}\n\"@\n\nfunction Get-IdentityFromPid\n{\n    param(\n        [Parameter(Mandatory=$true)]\n        [int]$ProcessId\n    )\n\n    $handle = [AppModel.PackageUtil]::OpenProcess(\n        [AppModel.PackageUtil]::PROCESS_QUERY_LIMITED_INFORMATION,\n        $false,\n        $ProcessId)\n\n    if ($handle -eq [IntPtr]::Zero)\n    {\n        Write-Warning \"Failed to open process $ProcessId\"\n        return\n    }\n\n    try\n    {\n        # PackageFullName max length is well defined and not large,\n        # so preallocate the worst case.\n        $length = [AppModel.PackageUtil]::PACKAGE_FULL_NAME_MAX_LENGTH + 1\n        $packageFullName = New-Object System.Text.StringBuilder $length\n\n        $rc = [AppModel.PackageUtil]::GetPackageFullName(\n            $handle,\n            [ref]$length,\n            $packageFullName)\n\n        if ($rc -eq [AppModel.PackageUtil]::APPMODEL_ERROR_NO_PACKAGE)\n        {\n            return [pscustomobject]@{\n                PID = $ProcessId\n                ImageName = (Get-Process -Id $ProcessId).ProcessName\n                PackageFullName = $null\n                ApplicationUserModelId = $null\n            }\n        }\n        elseif ($rc -ne 0)\n        {\n            Write-Warning \"Failed to retrieve package name for PID $ProcessId (error $rc)\"\n            return $null\n        }\n\n        $length = [AppModel.PackageUtil]::APPLICATION_USER_MODEL_ID_MAX_LENGTH\n        $applicationUserModelId = New-Object System.Text.StringBuilder $length\n\n        $rc = [AppModel.PackageUtil]::GetApplicationUserModelId(\n            $handle,\n            [ref]$length,\n            $applicationUserModelId)\n\n        if ($rc -eq [AppModel.PackageUtil]::APPMODEL_ERROR_NO_APPLICATION)\n        {\n            return [pscustomobject]@{\n                PID = $ProcessId\n                ImageName = (Get-Process -Id $ProcessId).ProcessName\n                PackageFullName = $packageFullName.ToString()\n                ApplicationUserModelId = $null\n            }\n        }\n        elseif ($rc -ne 0)\n        {\n            Write-Warning \"Failed to retrieve application identity for PID $ProcessId (error $rc)\"\n            return $null\n        }\n\n        return [pscustomobject]@{\n            PID = $ProcessId\n            ImageName = (Get-Process -Id $ProcessId).ProcessName\n            PackageFullName = $packageFullName.ToString()\n            ApplicationUserModelId = $applicationUserModelId.ToString()\n        }\n    }\n    finally\n    {\n        [AppModel.PackageUtil]::CloseHandle($handle) | Out-Null\n    }\n}\n\nGet-IdentityFromPid $ProcessId\n<\/code><\/pre>\n
Now run the script with a PID to display its package and application identity:<\/p>\n
[C:] pwsh -c .\\Get-Identity.ps1 7664\n\n PID ImageName       PackageFullName                               ApplicationUserModelId\n --- ---------       ---------------                               ----------------------\n7664 AzVpnSysTrayApp Microsoft.AzureVpn_4.0.5.0_x64__8wekyb3d8bbwe Microsoft.AzureVpn_8wekyb3d8bbwe!App\n<\/code><\/pre>\n
With TASKLIST<\/code> and PowerShell, we can find MSIX package identity and its Application User Model ID without writing a native application.<\/p>\n
Voila! Package and application identity, as requested.<\/p>\n","protected":false},"excerpt":{"rendered":"
We previously determined how to programmatically retrieve a packaged process’ package and application identity. Now let’s find MSIX package identity using existing tools. TASKLIST.EXE Using the packaged app AzVpnSysTrayApp.exe from our previous example, we know the “image name” (aka executable filename) and that its PID (process ID) is 7664. TASKLIST.EXE \/APPS lists packaged processes and […]<\/p>\n","protected":false},"author":911,"featured_media":101,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[17,9,11,2,18,34,35],"class_list":["post-341","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-msix","tag-application","tag-code","tag-identity","tag-msix","tag-powershell","tag-runtime","tag-tools"],"acf":[],"blog_post_summary":"
We previously determined how to programmatically retrieve a packaged process’ package and application identity. Now let’s find MSIX package identity using existing tools. TASKLIST.EXE Using the packaged app AzVpnSysTrayApp.exe from our previous example, we know the “image name” (aka executable filename) and that its PID (process ID) is 7664. TASKLIST.EXE \/APPS lists packaged processes and […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts\/341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/users\/911"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/comments?post=341"}],"version-history":[{"count":2,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts\/341\/revisions"}],"predecessor-version":[{"id":364,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts\/341\/revisions\/364"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/media\/101"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/media?parent=341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/categories?post=341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/tags?post=341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}