Cowork MSIX stays Staged (0x80073D28, packaged service CoworkVMService) for standard users under machine-wide Add-AppxProvisionedPackage in split-account enterprise

Summary

Deploying Claude Desktop machine-wide via Add-AppxProvisionedPackage (the documented enterprise method) does not produce a usable Cowork install for standard, non-local-admin users in a split-account enterprise (interactive standard user + a separate admin account used only for UAC elevation). The package provisions machine-wide but fails to register for the standard user and stays Staged; Cowork reports "Cowork requires Claude Desktop be installed with our modern installer." Root cause is the packaged Windows service (CoworkVMService), whose per-user registration requires admin.

Same underlying problem as #25055 and #32341 (both locked/closed with no fix or workaround); filing a fresh report because it also affects the recommended machine-wide provisioning path, not just the interactive self-elevating installer — and it is effectively org-wide for any enterprise that doesn't grant standard users local admin.

Environment

• Windows 11, build 10.0.26200
• Claude Desktop MSIX 1.5354.0.0 (x64) — package family Claude_…
• Microsoft Intune managed, Entra-joined
• Split accounts: interactive user is a standard user without local admin; a separate admin account is used only for UAC elevation
• Deployment: Intune Win32 app, Install behavior = System, wrapping:

``
Add-AppxProvisionedPackage -Online -PackagePath Claude.msix -SkipLicense -Regions all
``

• VirtualMachinePlatform enabled via Intune Remediation (SYSTEM), active after reboot
• Device verified clean (any prior per-user/Squirrel Claude fully removed)

Symptoms / evidence

• Get-AppxProvisionedPackage -Online → Claude is provisioned machine-wide.
• Get-AppxPackage -AllUsers -Name Claude* → for the standard user's SID the state is Staged, never Installed.
• Event log Microsoft-Windows-AppXDeploymentServer/Operational:
• Claude_1.5354.0.0_x64__… — Deployment Register operation failed 0x80073D28: "Cannot register the package. Administrator privileges required to install packaged service."
• Related, same device: MdOdrMcpFilterPackage_1.0.0.0_neutral__… — 0x80073D0B "already installed with a different external location."
• Manual Add-AppxPackage -RegisterByFamilyName in the standard user's context also fails with 0x80073D28.
• The standard per-user (Squirrel) build installs and runs fine for the same standard user with no admin — only the machine-wide MSIX with the packaged service fails to register for the standard account.

Repro

1. Split-account device: standard user (no local admin) + separate admin for elevation.
2. Provision the MSIX machine-wide as SYSTEM: Add-AppxProvisionedPackage -Online -PackagePath Claude.msix -SkipLicense -Regions all.
3. Standard user signs in / reboots → OS attempts per-user registration.
4. Registration fails 0x80073D28 (packaged service needs admin) → stays Staged → Cowork unavailable ("requires the modern installer").

Impact

Blocks Cowork for all standard, non-local-admin users in split-account enterprises — a mainstream, security-recommended posture (users are not local admins). The documented machine-wide provisioning path cannot deliver a working Cowork install to these users; effectively org-wide.

What a fix appears to need (consistent with #25055)

• Install/register the packaged service (CoworkVMService) machine-wide at provision time under SYSTEM, and register the app per-user at logon without requiring admin, so standard users register cleanly.
• Register to the calling user's SID/profile, not the elevating admin account.
• Resolve the MdOdrMcpFilterPackage "different external location" conflict (0x80073D0B).

Happy to provide full deployment/AppX logs and to test candidate fixes.