纯UWP应用（非Desktop Bridge）读取自定义组策略设置的方案咨询

Great question—this is a super common hurdle when migrating from desktop C# apps to pure UWP, since registry access is locked down and Microsoft's group policy APIs for UWP are notoriously under-documented. Let’s break down the feasible approaches, ordered by preference (per your request to avoid Desktop Bridge first):

1. Use the Native UWP Windows.Management.Policies API #

Microsoft provides a dedicated WinRT namespace for enterprise policy access in UWP: Windows.Management.Policies. This is the most native approach, designed specifically for UWP apps to access group policy settings that have been mapped to UWP-compatible policies.

Key Notes: #

• This works best for policies that Microsoft has explicitly adapted for UWP (including many built-in policies and some custom ADMX policies if they follow UWP policy schema guidelines).
• You’ll need to reference the policy’s namespace and name exactly as defined in your ADMX file.

Code Example: #

using Windows.Management.Policies;

public async Task<string> GetCustomGroupPolicyValue()
{
    var policyManager = new PolicyManager();
    
    // Replace with your ADMX policy's namespace and name
    var policyResult = policyManager.GetPolicy("YourCustomPolicyNamespace", "YourCustomPolicyName");

    if (policyResult.Status == PolicyStatus.Success)
    {
        // Cast the value to the appropriate type (string, bool, int, etc.)
        return policyResult.Value.ToString();
    }
    else
    {
        // Handle cases where the policy isn't set or isn't accessible
        return null;
    }
}

2. Query Group Policy via WMI (RSOP) #

If your custom policy isn’t exposed via the Windows.Management.Policies API, you can use UWP’s Windows.Management.Infrastructure namespace to query the Resultant Set of Policy (RSOP) via WMI. This lets you access the applied group policy settings stored in WMI repositories.

Key Notes: #

• You’ll need to declare the privateNetworkClientServer capability in your Package.appxmanifest to allow WMI access.
• This requires the app to run in an environment where WMI access is permitted (typically enterprise domains or managed devices).

Code Example: #

using Windows.Management.Infrastructure;

public async Task<string> GetPolicyFromWmi()
{
    try
    {
        // Connect to the local RSOP computer namespace
        var session = CimSession.Create(null);
        var query = "SELECT SettingValue FROM RSOP_PolicySetting WHERE SettingId='YourCustomPolicyID'";
        
        // Replace "root\RSOP\Computer" with "root\RSOP\User" for user-specific policies
        var results = session.QueryInstances(@"root\RSOP\Computer", "WQL", query);

        foreach (var instance in results)
        {
            return instance.CimInstanceProperties["SettingValue"].Value.ToString();
        }
    }
    catch (Exception ex)
    {
        // Handle WMI connection/query errors
        Debug.WriteLine($"WMI query failed: {ex.Message}");
    }
    return null;
}

3. Fallback: Desktop Bridge with Restricted Registry Access #

If the above methods don’t work for your custom policy, you can use Desktop Bridge (MSIX packaging) as a last resort. This lets you enable limited registry access for your UWP-style app without fully reverting to a desktop app.

Key Notes: #

• Add the rescap:RegistryReadAccess restricted capability to your Package.appxmanifest, specifying the exact registry path where your group policy stores its values.
• This is a workaround and doesn’t qualify as a "pure" UWP app, but it’s the closest alternative if native APIs don’t support your policy.

Manifest Snippet: #

<Package
  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
  IgnorableNamespaces="rescap">

  <Capabilities>
    <rescap:Capability Name="registryReadAccess" />
  </Capabilities>

  <Extensions>
    <rescap:Extension Category="windows.registry">
      <rescap:Registry>
        <rescap:Path>HKEY_LOCAL_MACHINE\Software\YourPolicyPath</rescap:Path>
        <rescap:Access>Read</rescap:Access>
      </rescap:Registry>
    </rescap:Extension>
  </Extensions>
</Package>

Important Limitations #

• Pure UWP apps cannot access arbitrary registry paths, so custom ADMX policies that only store values in non-UWP-accessible registry keys will require the Desktop Bridge workaround.
• Both native API and WMI approaches depend on your ADMX policy being recognized by Windows' enterprise policy infrastructure—if your custom policy is not mapped to UWP-compatible schemas, the WMI/RSOP approach is your best bet for pure UWP.

内容的提问来源于stack exchange，提问作者Yoav Feuerstein