Tired of the Microsoft Store blocking your HEIC/HEVC codec deployments? Here are three real-world, scriptable solutions for sysadmins to bypass the Store and get these critical image codecs working on every machine, from VDI images to developer workstations.

Deploying the HEIC Codec Without the Microsoft Store: A DevOps War Story

I remember the day clearly. It was a Tuesday, always a Tuesday. We were hours from a go-live for a new document processing workflow. Everything was green on the board. Then the ticket came in, priority: critical. “URGENT: Finance Cannot Open Invoices from CEO.” My first thought was a corrupted PDF, maybe a network share permissions issue. Easy stuff. I was wrong.

It turns out the CEO, fresh from a weekend trip, had snapped photos of receipts on his new iPhone and emailed them. They were all .HEIC files. Our finance team’s brand new, fully locked-down VDI instances? They saw them as nothing more than gibberish. My usual deployment tools—Intune, Ansible—all failed to install the codec because they kept trying to call the Microsoft Store, which was disabled by policy. We had a hundred-thousand-dollar project dead in the water because of a “free” photo codec. That’s when I learned that sometimes, the simplest problems require the most creative, “off-label” solutions.

So, What’s the Real Problem Here?

Why is this so difficult? It boils down to one thing: Microsoft decided to package these essential codecs (HEIC for images, HEVC for video) as AppX/MSIX applications distributed exclusively through the Microsoft Store. This is great for a home user on their laptop, but for us in the enterprise, it’s a nightmare.

System-level deployments, golden images (like my VDI-GOLD-IMG-23H2), and non-persistent environments don’t have a logged-in “user” with a Store account to perform the installation. Our standard deployment scripts, running as SYSTEM, can’t authenticate to the Store to pull the package down. We’re left with a modern codec held hostage by a consumer-facing delivery mechanism. But don’t worry, we can break it out of jail.

Solution 1: The Quick Fix (Direct AppX/MSIX Sideload)

This is my go-to for fixing a single machine or building it into a golden image manually. We’re essentially downloading the offline installer package and telling Windows to install it for every user who logs into the machine from now on.

1. First, you need to grab the package. The easiest way is to use the online link generator for the Microsoft Store. Go to https://store.rg-adguard.net/.
2. Paste in the URL for the “HEVC Video Extensions from Device Manufacturer”:
   https://www.microsoft.com/en-us/p/hevc-video-extensions-from-device-manufacturer/9n4wgh0z6vhq
3. Download the correct .appx or .msixbundle file for your architecture (usually x64). You’ll get a file named something like Microsoft.HEVCVideoExtension_..._x64__8wekyb3d8bbwe.Appx.
4. Place that file somewhere accessible, like C:\Temp.
5. Now, run the following PowerShell command as an Administrator:

Add-AppxProvisionedPackage -Online -PackagePath "C:\Temp\Microsoft.HEVCVideoExtension_2.0.61931.0_x64__8wekyb3d8bbwe.Appx" -SkipLicense

This command “provisions” the package on the machine. Any new user profile created will automatically have the HEIC/HEVC codec installed and ready to go. Existing users will get it on their next login.

Pro Tip: The -SkipLicense flag is crucial for automation. It prevents a prompt that would otherwise hang your script. This method works great, but you have to manually keep the AppX file updated if a new version comes out.

Solution 2: The Scalable & Repeatable Fix (Automate with Winget)

This is the proper, DevOps-friendly approach. The Windows Package Manager (Winget) is built for this kind of thing. It knows how to talk to the Store’s backend repositories without needing a GUI or a logged-in user in the traditional sense. This is perfect for Intune Proactive Remediations, Ansible playbooks, or SCCM application deployments.

The command is beautifully simple. To install for the entire machine, run this from an elevated command prompt or PowerShell:

winget install -e --id 9N4WGH0Z6VHQ --source msstore --accept-package-agreements

Let’s break that down:

This single line of code is now part of our standard workstation and server build process. It’s idempotent, easy to version control, and requires no manual file downloads.

Solution 3: The ‘If All Else Fails’ Nuclear Option

Okay, let’s say you’re in an environment so locked down that even Winget is blocked, and you can’t get an exception. I’ve been there. It’s frustrating. This last method is a complete hack, it’s unsupported, and it will probably break during a major Windows feature update. But, if it’s the only way to get the finance department working, sometimes you have to do what you have to do.

Serious Warning: You’re on your own here. This involves manually ripping files out of the MSIX package and registering them. This is a last resort, not a first choice. I’m describing the theory, not endorsing it for production on prod-db-01.

The process generally looks like this:

1. Download the .msixbundle file as described in Solution 1.
2. Rename the file extension to .zip and extract its contents.
3. Inside, you’ll find another MSIX file for your architecture (e.g., x64). Rename that to .zip and extract it too.
4. Now you’re in the belly of the beast. You’ll find the actual codec DLLs (like heicdecoder.dll) in a subdirectory.
5. Copy these DLLs to a system folder, like C:\Windows\System32.
6. Use the regsvr32.exe command-line tool to manually register the DLLs with the operating system.

regsvr32 C:\Windows\System32\heicdecoder.dll

Again, this is messy. You’re manually managing files that a package manager should handle, and you lose all benefits of clean uninstalls or upgrades. But for that one fire-drill Tuesday, knowing this trick was the difference between a successful go-live and a very unpleasant meeting with the CFO.

Hopefully, one of these solutions saves you from your own “HEIC Tuesday.” Go with Winget if you can, fall back to the provisioned AppX if you must, and keep the nuclear option in your back pocket for emergencies.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions