WinGet on Windows: Stop Installer “Next Next Finish” and Secure Upgrades

Picture this: you’ve just set up a new Windows 11 PC or refreshed an older machine. The operating system is pristine, but the real work hasn’t started. Over the next hour, you’ll bounce between browser tabs, hunt down official download pages, and click through countless “Next → I Agree → Install → Finish” installer wizards. Each one carries the risk of bundled adware, outdated versions, or even a malicious impersonator. It’s a ritual Windows users have endured for decades—but it’s now entirely avoidable.

Microsoft’s own Windows Package Manager, better known as WinGet, flips the script. Instead of chasing EXE and MSI files, you type a single command and let the tool fetch, verify, and deploy software directly from trusted sources. Whether you’re a developer setting up a coding environment, an IT professional provisioning a fleet of machines, or a home user who simply wants to keep everything current without the babysitting, WinGet delivers speed, security, and sanity.

What Exactly Is WinGet?

WinGet is an open-source command-line package manager client for Windows, first introduced at Microsoft Build 2020 and now bundled with modern versions of the OS. It connects to a community-maintained repository of software manifests—think of it as a vast catalog of installation instructions—and automates the entire discovery, download, installation, and upgrading process. Under the hood, it uses YAML manifests that pinpoint official installer URLs, file hashes, silent installation switches, and dependencies. The client validates those hashes before executing anything, so you’re not just saving clicks; you’re drastically reducing the attack surface of your system.

The WinGet client ships as part of the App Installer package, which comes preinstalled on Windows 11 and all supported editions of Windows 10 (version 1809 and later). If you’re on an older build, you can grab it from the Microsoft Store or the GitHub releases page. To confirm it’s available, open a terminal and run winget --version. As of recent stable channel releases, you’ll see version 1.6 or later, reflecting a robust, production-ready tool.

Commands That Replace the Browser

The core workflow revolves around a handful of intuitive commands. Let’s walk through the most essential ones.

Searching for Software

Say you need Visual Studio Code. Instead of navigating to code.visualstudio.com, you simply type:

winget search vscode

WinGet returns a list of matching packages, showing the package ID, name, and often the version. The official VS Code package is usually listed as Microsoft.VisualStudioCode. You can also search by publisher or category, though the repository is still building out rich metadata.

Installing with Confidence

Once you’ve identified the package, installation is a one-liner:

winget install Microsoft.VisualStudioCode

WinGet downloads the installer, checks its SHA256 hash against the manifest, and then executes it with the appropriate silent flags—no GUI, no prompts, no bundled junk. If the installer requires admin rights, WinGet elevates automatically (you’ll see a UAC prompt). For system-wide installs, you can add --scope machine.

Want multiple apps at once? Chain them:

winget install Microsoft.VisualStudioCode Mozilla.Firefox 7zip.7zip VideoLAN.VLC

You can even pass a JSON or text file listing dozens of packages and have them installed sequentially—a gift for provisioning scripts.

Keeping Everything Current

One of WinGet’s killer features is centralized upgrading. Instead of each application nagging you with its own update prompt (or worse, silently staying vulnerable), run:

winget upgrade

That shows a table of all installed apps that have newer versions available in the repository. To apply all updates:

winget upgrade --all

Or cherry-pick:

winget upgrade Mozilla.Firefox

This command respects the same verification steps, so you leap directly from version 115 to 116 without ever opening a browser or an installer window.

Managing Installed Packages

Curious what WinGet knows about your system? winget list enumerates every application that reports its installation via standard Windows inventory mechanisms—not just those installed through WinGet. This means you get a holistic view of your software estate. You can export that list, pipe it into a text file, and even use it to recreate a machine’s software configuration on another PC.

Security: Why WinGet Beats the Browser

The traditional “download and double-click” model is a security nightmare. Even experienced users fall for look-alike domains, typosquatted applications, and poisoned search ads. WinGet tackles these risks on multiple fronts.

Verified manifests: The community winget-pkgs repository on GitHub requires submitters to include official download URLs and cryptographic hashes. While any open-source repo can theoretically be exploited, the submission process includes automated checks and human review. Microsoft also publishes a curated source for certain first-party and well-known packages, which users can opt to trust exclusively.

Reproducibility: Because every install is driven by a manifest, you can inspect exactly what a command will do before running it. Contrast that with a random EXE from a download portal where you have no idea what silent switches exist or what registry keys it will modify.

No adware slipstreaming: Many popular Windows installers—even from legitimate hosts like CNET, SourceForge, or sometimes the vendor’s own site—bundle optional offers or toolbars. WinGet sidesteps that entirely by using the original, unaltered installer binary and passing flags that suppress bloatware.

Tamper-proof delivery: The hash verification ensures that if a content delivery network is compromised or a download is intercepted, the corrupted file won’t execute. You’ll get an error instead of a ransomware payload.

Least-privilege awareness: While many WinGet operations require elevation, you can install per-user packages (--scope user) without admin rights. This reduces the blast radius if something goes wrong and aligns with zero-trust principles.

For enterprise environments, WinGet also supports group policy controls and integration with Microsoft Intune. Administrators can restrict installation sources to their own private repositories, enforce software baselines, and automate patching through scripts that call WinGet—dramatically simplifying compliance.

Real-World Scenarios

The New PC Boot-Up

Buy a Windows 11 laptop, sign in, and open Terminal. A single command file installs your entire toolkit: browsers, IDEs, compression utilities, media players, cloud clients, and utilities. Ten minutes later, you’re fully operational—no browser needed. This is especially powerful when combined with winget configure, a newer feature that lets you apply a complete development environment configuration that includes VS Code extensions, Windows settings, and more.

Developer Machine Reset

When a dev machine becomes sluggish or riddled with test artifacts, a clean Windows install is tempting but painful. With WinGet, you keep a text file listing your essential packages. After a reset, run winget import -i packages.json and walk away. The machine rebuilds itself.

Family Tech Support

Instead of remoting into a relative’s PC and clicking through installers, you can send a script that runs WinGet commands. This not only ensures they get the correct software but also sets up automatic updates via a scheduled task that runs winget upgrade --all --silent weekly.

IT Fleet Management

For organizations not yet using Microsoft Endpoint Configuration Manager, WinGet offers a lightweight alternative. Using PowerShell scripts triggered by Intune, admins can force installation of critical applications and security patches. The --accept-source-agreements and --accept-package-agreements flags make fully unattended deployments possible, and the --header parameter can authenticate against private artifact feeds.

WinGet vs. Chocolatey and Others

Long before WinGet arrived, power users relied on Chocolatey, a mature third-party package manager with a vast repository. While Chocolatey remains popular, WinGet has several advantages for mainstream users:

Chocolatey’s library is larger and more battle-tested, but WinGet’s tight OS integration and zero-setup deployment make it the go-to for users who just want things to work. For power users, both can coexist: use WinGet for typical apps and fall back to Chocolatey for niche tools or custom packages.

Automation and Scripting Tricks

WinGet truly shines when scripted. Here are a few patterns that unlock serious productivity.

Batch installation from a list: Create a simple text file, apps.txt, with one package ID per line. Then in PowerShell:

Get-Content apps.txt | ForEach-Object { winget install -e --id $_ }

The -e flag ensures an exact match, preventing accidental installation of a similarly named package.

Scheduled upgrades: Create a scheduled task in Task Scheduler that runs daily with highest privileges. The action:

Program: winget
Arguments: upgrade --all --silent --accept-source-agreements --accept-package-agreements

Now your system stays patched with zero interaction. (Be mindful that some upgrades—like GPU drivers—may still require a reboot, so plan accordingly.)

Exporting a machine snapshot: To capture your current state:

winget export -o myapps.json

You can later restore it on another PC with winget import -i myapps.json --ignore-unavailable. The --ignore-unavailable flag skips packages not found in the repo, preventing the whole import from failing.

Custom sources: Enterprises can host their own manifest repository on a network share or web server. Register it with:

winget source add -n mycompany https://packages.contoso.com

Then restrict installations to only that source via group policy, ensuring employees never pull unvetted software.

Limitations and Cautions

WinGet isn’t a silver bullet. Understanding its current boundaries prevents frustration.

• Repository coverage: While the winget-pkgs repository grows daily, it doesn’t contain every Windows application. Proprietary enterprise tools, niche utilities, and older abandonware may be absent. You can still add custom manifests, but that requires manual effort.
• GUI tooling: Microsoft offers a basic winget GUI with the winget search --ui command, but it’s not yet a full graphical package manager. Third-party front-ends like WinGetUI (now UniGetUI) fill this gap nicely.
• Silent install pitfalls: Not all installers respect silent flags. The manifest must be carefully crafted, and sometimes a package may still pop up a dialog due to a faulty InnoSetup or InstallShield script. Hash validation will still protect integrity, but unattended deployment can hit snags.
• Updates require running WinGet explicitly: There’s no built-in daemon that auto-updates apps (the scheduled task workaround helps). Windows Update doesn’t yet dictate third-party software patches, so you must take responsibility.
• App Installer dependency: WinGet is tied to the App Installer package, which itself updates through the Microsoft Store. If Store updates are paused or blocked, you could fall behind on WinGet client security fixes.

Even with these caveats, the payoff is enormous. The minutes per install you save quickly compound, and the reduced risk of inadvertently installing malware is hard to overstate.

The Road Ahead

Microsoft continues to invest in WinGet as a cornerstone of Windows management. Recent Insider builds have previewed an improved winget configure experience that can apply DSC (Desired State Configuration) v3 settings, essentially making WinGet a full-blown provisioning engine. Integration with Dev Home, a new dashboard for developers, further lowers the barrier—allowing configuration of entire development environments with a few clicks.

On the security front, expect tighter integration with Microsoft Defender SmartScreen. Currently, SmartScreen can check downloaded files after the fact, but WinGet could soon leverage its cloud reputation service before initiating a download, blocking packages known to be malicious. The winget-pkgs community is also exploring support for additional installer technologies like portable apps and Microsoft Store listings, broadening the scope of what a “package” can be.

Microsoft has signaled that WinGet will become the default method for installing developer tools on Windows, with partners like JetBrains, Python, and Node.js already publishing manifests. As the tool matures, the line between “OS update” and “app update” may blur, delivering the holistic software freshness that macOS Homebrew users have enjoyed for years.

Ditch the Wizard for Good

If you’ve ever wasted an afternoon reinstalling Windows and then manually hunting down installers, WinGet is your ticket to reclaiming that time. The learning curve is minimal—four or five commands open a world where software appears on command and stays current without your intervention. And because it’s built into Windows, there’s nothing extra to download, no subscription to buy, and no unfamiliar third-party to trust.

Next time you reach for a browser to download something, open a terminal instead. Type winget install and the app name. Watch the magic happen. Then run winget upgrade --all and marvel at how many outdated threats you just patched. The old “Next Next Finish” routine is finally dead—and that’s a security upgrade worth celebrating.