Intune Winget App Updater

Controlled Microsoft Intune Proactive Remediation package for updating approved Windows applications with winget.

This project is not a read-only audit repository. It detects, reports and attempts to update a limited allowlist of applications with winget.

Purpose

The purpose of this repository is to provide a controlled way to pilot and run application updates through Microsoft Intune without using:

winget upgrade --all

The package:

• detects installed applications with winget list
• uses the Windows uninstall registry as a fallback detection source
• separates states such as WingetInstalled, RegistryOnly, NotInstalled and Unknown
• updates only approved allowlist applications that are manageable by winget
• does not install missing applications
• does not run winget upgrade --all
• writes local log files
• provides compact Intune export output
• includes an offline technician tool for manual validation

Main components

Component	Version	File
Approved App Updates Detection	v10.3	scripts/approved-app-updates/Intune-Winget-AppUpdates-Detection-v10.3-HybridRegistry.ps1
Approved App Updates Remediation	v10.3	scripts/approved-app-updates/Intune-Winget-AppUpdates-Remediation-v10.3-HybridRegistry-AllNonFatal.ps1
Log Summary Detection	v10	scripts/log-summary/Winget-LogSummary-Detection-v10.ps1
Log Summary No-Op Remediation	v10	scripts/log-summary/Winget-LogSummary-NoOp-Remediation-v10.ps1
Offline Technician Tool	v10.3	tools/Intune-Winget-Offline-Technician-Tool-v10.3.ps1

Approved application allowlist

7zip.7zip
Notepad++.Notepad++
Mozilla.Firefox
Google.Chrome
Adobe.Acrobat.Reader.32-bit
Adobe.Acrobat.Reader.64-bit

Intune packages

Winget - Approved App Updates

Detection script:

Intune-Winget-AppUpdates-Detection-v10.3-HybridRegistry.ps1

Remediation script:

Intune-Winget-AppUpdates-Remediation-v10.3-HybridRegistry-AllNonFatal.ps1

Recommended settings:

Run this script using the logged-on credentials: No
Enforce script signature check: No
Run script in 64-bit PowerShell: Yes

Winget - Log Summary

Detection script:

Winget-LogSummary-Detection-v10.ps1

Remediation script:

Winget-LogSummary-NoOp-Remediation-v10.ps1

Logs

C:\ProgramData\IntuneWingetUpdates\Logs

The scripts remove log files older than 14 days and keep the log folder below 50 MB.

Intune output markers

WINGET_DETECTION_V10_3
WINGET_REMEDIATION_V10_3
WINGET_LOG_SUMMARY_V10

Offline technician tool

Detection mode:

powershell.exe -ExecutionPolicy Bypass -File .\tools\Intune-Winget-Offline-Technician-Tool-v10.3.ps1 -Mode Detection

Full mode:

powershell.exe -ExecutionPolicy Bypass -File .\tools\Intune-Winget-Offline-Technician-Tool-v10.3.ps1

If PowerShell is not elevated, the tool starts a UAC elevation prompt.

Repository documentation

• GitHub Pages documentation
• Intune setup
• Pilot runbook
• Quality and safety model
• Changelog

Quality and safety checks

This repository uses GitHub Actions and branch protection to keep public repository quality under control.

Check	Purpose
PSScriptAnalyzer	Static analysis for PowerShell scripts
Secret Scan / Gitleaks	Detects accidentally committed secrets
Pester Tests	Repository smoke tests and script parsing validation
Public Safety Check	Detects generated output files and unsafe public markers

Pilot guidance

Recommended rollout flow:

1. Deploy first to a small pilot device group.
2. Run hourly for one business day.
3. Review Intune exports and Log Summary output.
4. Confirm that no unexpected applications are updated.
5. Move to a daily schedule after stable pilot results.

Registry-only applications

winget may not always recognize an application that exists in the Windows uninstall registry.

In that case the application is reported as RegistryOnly and is not force-updated.

License

This repository is licensed under the MIT License.

Security note

This repository contains remediation scripts that can update approved applications on managed Windows devices.

Do not commit:

• real Intune exports
• real device names
• user names
• customer names
• tenant identifiers
• internal hostnames
• private IP addresses
• generated logs or reports
• secrets, tokens or credentials

Current script baseline

Current approved app update scripts:

• Detection: Intune-Winget-AppUpdates-Detection-v10.4-HybridRegistry-Discovery.ps1
• Remediation: Intune-Winget-AppUpdates-Remediation-v10.4-HybridRegistry-AllNonFatal.ps1

Baseline: �v10.4.0

Public safety note

This repository is intended to contain only public-safe material. Do not commit customer-specific data, tenant identifiers, credentials, generated audit reports, internal hostnames, private IP addresses or environment-specific exports.