WIN-018 · Script

App Updates via WinGet

Lists available app updates with the Windows Package Manager (WinGet) and can install them silently.

What it does

Uses winget.exe, which is part of the App Installer package included with current Windows 10 and 11 releases. When the script runs as SYSTEM, winget is not on the PATH, so the script looks for the newest Microsoft.DesktopAppInstaller folder under C:\Program Files\WindowsApps and runs winget.exe from there. If WinGet cannot be found the script stops with a clear message and changes nothing.

Report mode (default) lists the apps that have an update available. Apply mode upgrades either every listed app (default) or only the package IDs in -Ids, always with --silent --accept-source-agreements --accept-package-agreements. Use -ExcludeIds to skip apps when upgrading all.

By default only the "winget" community source is used, because the Microsoft Store source usually does not work under the SYSTEM account. Apps installed per user (in a user's profile) are generally not visible to SYSTEM; run the script as the user for those. Some apps ignore silent switches or need to be closed before they can update; those are reported as failures. Runs silently. No prompts.

Requirements

Windows PowerShell 5.1+, App Installer (WinGet) 1.4 or later, run as SYSTEM or local admin

How to run it

• Run as: SYSTEM or a local administrator
• Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
• Script type: PowerShell, 64-bit
• User interaction: none; the script never prompts
• Timeout: 10 minutes (30 for Windows Update installs)

Settings

Exit codes

• 0 = No updates available, or all requested updates installed
• 1 = Updates available (Report), or one or more updates failed
• 2 = Script error, or WinGet not found

Testing steps

1. Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

App updates cannot be rolled back automatically. To go back, uninstall the app and install the older version, for example with winget install --id <Id> --version <old version>, and add the ID to -ExcludeIds so it is not updated again.

Version and change log