Microsoft 3D Viewer AppX package stuck as SYSTEM (Paused) and unable to uninstall or remove it

Check for and remove the parent bundle, because Remove-AppxPackage -AllUsers operates on the parent package type and an architecture-specific child package can remain when the bundle was not selected.^1^

1. Test the bundle-specific removal path

This is distinct from the package-removal commands already attempted. In elevated Windows PowerShell, run:

$bundle = Get-AppxPackage -AllUsers -PackageTypeFilter Bundle `
    -Name Microsoft.Microsoft3DViewer

$bundle | Format-List Name, PackageFullName, PackageUserInformation

if ($bundle) {
    $bundle | Remove-AppxPackage -AllUsers -ErrorAction Stop -Verbose
}

Get-AppxPackage -AllUsers -PackageTypeFilter Bundle `
    -Name Microsoft.Microsoft3DViewer
Get-AppxPackage -AllUsers -Name Microsoft.Microsoft3DViewer

A matching 3D Viewer removal case uses this bundle-aware command.^2^

If the first query returns no bundle, do not repeat the ordinary removal commands—they have already been exhausted.

Immediately note the operation time and inspect:

• Event Viewer → Applications and Services Logs → Microsoft → Windows → AppxDeployment-Server → Operational
• Warnings or errors at the removal time.
• Get-AppxLog for the most recent deployment operation.

Get-AppxLog |
    Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Select-Object -Last 30

These logs expose the underlying deployment result even when the console output is uninformative.^3^

What SYSTEM: Paused means

Paused means that installation for that user is paused; it does not, by itself, mean “orphaned registration.” PackageUserInformation reports the install state for the specified user, and S-1-5-18 is the SYSTEM account.^4^

Likewise, these values do not conclusively prove that executable files are absent:

• blank InstallLocation
• Status: Ok
• IsPartiallyStaged: False
• removal completing without an error

AppX removal first removes registrations. Payload deletion, called destaging, can happen later and only after no strong references remain. References can include provisioning, dependencies, a running process, a system pin, or Windows product membership.^5^

Establish whether version [IP Address] files remain

1. Obtain the exact detected path and binary version from the Nessus plugin output. This is the strongest way to distinguish vulnerable payload files from a stale package inventory finding.
2. Enumerate package volumes:

Get-AppxVolume |
    Format-Table Name, PackageStorePath, IsOffline, IsSystemVolume

Get-AppxVolume -Offline |
    Format-Table Name, PackageStorePath

The normal package store is C:\Program Files\WindowsApps, but other package volumes and other storage models are possible.^6^ Offline volumes cannot be searched until their underlying storage is reconnected or mounted.

3. Search the Nessus-reported location for:
   • Microsoft.Microsoft3DViewer_1.0.102.0_*
   • its executables or libraries, confirming their file versions.

WindowsApps is protected, so elevation alone might not permit enumeration. Microsoft’s vulnerability guidance recommends checking that folder—or copying its contents to another location for inspection when access permits—and notes that deregistered files can remain temporarily as inert leftovers.^7^ Do not take ownership, alter ACLs, or manually delete files from WindowsApps; Windows owns and protects package-volume contents.

Do not run the removal through PsExec as SYSTEM

The supported interface is elevated Remove-AppxPackage -AllUsers; Microsoft documents administrator permission for this operation.^1^ Running PowerShell as SYSTEM is unlikely to remove a strong package reference and adds risk without being a documented cleanup method.

If the bundle-aware command finds nothing, the logs show inconsistent deployment metadata, and Nessus confirms vulnerable files remain, use the non-destructive Windows 11 repair:

Settings → System → Recovery → Fix problems using Windows Update → Reinstall now

This reinstalls the current Windows version and repairs system files and components while preserving apps, files, and settings.^8^ Rescan afterward and retain the Nessus path, AppX query output, and deployment events as remediation evidence.

References

1. Remove-AppxPackage-Syntax
2. Intune - Microsoft 3D Viewer - Microsoft Q&A
3. MSIX deployment troubleshooting
4. PackageInstallState Enum-Definition
5. Package registration and lifetime
6. Package storage volumes
7. Modern apps or application packages are reported as vulnerable due to multiple versions
8. Fix issues by reinstalling the current version of Windows | Microsoft Support