Hi everyone,

I’m seeing an issue with Dell Command | Update (Store package DellInc.DellCommandUpdate) on Windows clients. After an update, only the newest version is installed, but registry entries for earlier versions remain in the user profile hives. Our vulnerability scanner (Wazuh) reads these entries and reports vulnerabilities for versions that are no longer on the system.

Environment:

• Dell Command | Update 5.7.28.0 (Store/AppX package)
• Windows 11 25H2 (Build 26200.9711)
• Vulnerability scanner: Wazuh (syscollector)

What I found:

• Get-AppxPackage -AllUsers shows only 5.7.28.0 installed.
• Get-AppxProvisionedPackage -Online shows only 5.7.28.0 provisioned.
• The machine-wide package repository (HKLM) contains only 5.7.28.0.
• The per-user package repository still contains older versions:

HKEY_USERS\<SID>\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages

• User profile A: 5.5.58.0, 5.6.25.0, 5.7.276.0, 5.7.28.0
• User profile B: 5.5.58.0, 5.6.25.0, 5.7.276.0 (no current version at all)

Workaround:
I removed the stale keys for 5.5.58.0, 5.6.25.0 and 5.7.276.0 from the affected user hives and kept the entry for the installed version. After restarting the Wazuh agent, the false-positive findings disappeared. Dell Command | Update still works normally.

$keep = 'DellInc.DellCommandUpdate_5.7.28.0_x86__htrsf667h5kn2'$backup = 'C:\Temp\dcu-backup'New-Item -ItemType Directory -Path $backup -Force | Out-NullGet-ChildItem 'Registry::HKEY_USERS' | ForEach-Object {$p = "Registry::$($_.Name)\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages"if (Test-Path $p) {Get-ChildItem $p | Where-Object { $_.PSChildName -like 'DellInc.DellCommandUpdate_*' -and $_.PSChildName -ne $keep } | ForEach-Object {$file = Join-Path $backup "$($_.PSParentPath.Split('\')[1])_$($_.PSChildName).reg"reg export $_.Name $file /y | Out-Nullif ($LASTEXITCODE -ne 0) { throw "Export failed: $($_.Name)" }Remove-Item $_.PSPath -Recurse -Force}}}

Note: this only covers user hives that are currently loaded.

Questions:

1. Is this a known issue with the Dell Command | Update Store package?
2. Is there a supported way to clean up these stale per-user entries?
3. Is a fix planned so the update process removes old registrations automatically?
4. Side note: version 5.7.276.0 shows up in the registry and is numerically higher than the installed 5.7.28.0. Was 5.7.276.0 a real release, or is this a versioning quirk?

Thanks!