Missing winget and GPO/Intune Policy interrelations

[byjrack]

Brief description of your issue

So we have been working with Microsoft Support on winget acting up both on the msstore and winget Sources in our environment.

Thus far it looks to be a conflict between winget, windows update, and our internal SUS. The recommendation from MS support has been to disable WU via Policy which might be ok, but feels strange. And given I know that winget and WU work fine on non-SUS machines it's not as clear cut as winget+store source+wua = failure.

One example where Policies seem to influence results. verbose logs just show the 403 so the policy I think is enforced in the wininet stack, but in a way that is very course grain so winget just gets the 403 and not the reason the specific cdn endpoint is blocked.

It would be great to have a list of GPOs that can influence source usage so that we can troubleshoot more effectively.

2023-10-10 07:45:45.001 [YAML] Detected UTF-8
2023-10-10 07:45:45.001 [REPO] Named source to be updated, found: winget
2023-10-10 07:45:45.268 [FAIL] WindowsPackageManager.dll!00007FFD63E7F002: ReturnHr(1) tid(3ac4) 80190193 Forbidden (403).
    Msg:[D:\a\_work\1\s\external\pkg\src\AppInstallerCommonCore\HttpStream\HttpClientWrapper.cpp(50)\WindowsPackageManager.dll!00007FFD63E62ECE: (caller: 00007FFD63D3FDB9) Exception(1) tid(3ac4) 80190193 Forbidden (403).
] 

compared to a machine with GPOs tweaked

2023-10-10 07:55:32.893 [YAML] Detected UTF-8
2023-10-10 07:55:32.893 [REPO] Named source to be updated, found: winget
2023-10-10 07:55:32.919 [CORE] Examining extension: PFN = Microsoft.Winget.Source_8wekyb3d8bbwe, ID = IndexDB
2023-10-10 07:55:32.919 [CORE] Found matching extension.
2023-10-10 07:55:32.928 [CORE] Retrieving headers from url: https://cdn.winget.microsoft.com/cache/source.msix

[byjrack]

I can't see in the black box of wininet, but based on some of the posts around #3652 I bumped my winget manually from 1.5.2201 to 1.6.2771 and the 403 on winget source update --name=winget went away. No other changes to GPOs on the machine, no reboots, etc.

We have some issues w MS Store due to GPOs and a known issue w SUS+Store+WUA that the MS team is working on so the auto-update of winget from the Store is not functioning.