Numerous Issues with WinGet

[PanicLAN0815]

Brief description of your issue

Running WinGet in different security context than the actual logged on user results in strange behavior.
We could solve or at least workaround most of these issues but I thought I would post this A. for the dev team to maybe consider this for future updates and B. for the uncountable amount of other users facing similar issues.
This post actually tackles more than one issue.

Steps to reproduce

Situation 1: Running WinGet in an elevated Powershell / CMD window (e.g. logged on User has no Admin permission and you right click the Powershell with "run as administrator"
Situation 2: Running WinGet as NT-Authority\System with psexec or in our case TacticalRMM Powershell Scripts.

Expected behavior

Expected behavior would be for WinGet to either work as it does when ran from an logged on user security context or give exact error and troubleshooting steps on why it does not run as expected.

Actual behavior

Situation 1: WinGet may or may not run at all. If it does run it will not find Packages from the WinGet Source but only from MSStore Source.

Situation 2: WinGet does not put out any response whatsoever. Not even an error.

Environment

This happens in multiple Environments all running the latest winget version as of the posting date.
Most clients are running Windows 11 with some still on Windows 10 but all with the latest patch level.
What we are doing is automating SW deployment with TacticalRMM in combination with winget.
So we are running most of our Scripts as NT\System.

Here are some Solutions for the dev´s and community hope this helps someone out there:

WinGet is not installed or want run at all:
One or the combination of all the following commands fixed this for us...
# Install-Module -Name Microsoft.WinGet.Client -Force -Repository PSGallery | Out-Null
# Repair-WinGetPackageManager -Force -Latest
# Get-AppxPackage appInstaller | Reset-AppxPackage
# .\winget.exe source reset --force
# Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.Winget.Source_8wekyb3d8bbwe

Winget does not find packages from sources other than MSSTORE (User context and elevated context)
Try the commands above and
# [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
# Install-PackageProvider -Name NuGet -Force | Out-Null

Winget does produce any output at all (also no errors).
For the NT\System Account to run WinGet you must first of all run it directly from its directory:
$WinGetLoc=(Get-Childitem -Path "C:\Program Files\WindowsApps" -Include winget.exe -Recurse -ErrorAction SilentlyContinue | Select-Object -Last 1 | %{$_.FullName} | Split-Path)
cd $WinGetLoc
.\winget.exe

Also if this still does not provide any output check if VC Redist (Visual C++ Redistributable) is installed on your machines and if not install it.
# Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://vcredist.com/install.ps1'))


With the commands above and / or the combination of them we were able to solve all our WinGet issues.
Please keep in mind that I am no PowerShell / WinGet pro and that I have no idea what I am doing for the most part... All of this is copied from somewhere at the internet and put together in questionable ways by me and my colleagues. So use this at your own risk.
Have a nice day!

[denelon]

WinGet in system contest:

The WinGet Client is delivered via an MSIX package. These packaged applications are made available to logged in user's path via the App Execution Alias mechanism. Due to this mechanism and the packaged application lifecycle, running "winget.exe" is not supported in system context. I'd suggest using the Microsoft.WinGet.Client PowerShell module for any use in the system context. Note: there are caveats with installing any packaged application in system context as well as any application that installs per user.

[denelon]

WinGet elevated shell, but the logged in user does not have administrator access:

This one isn't something I've personally encountered. We'll have to do some testing to see what's possible. I suspect the pre-indexed package source isn't "registered" for the administrative context in this case. Installing the PreIndexed source manually may work, but I don't know for sure.

The "winget" source pre-indexed package is available at https://cdn.winget.microsoft.com/cache/source2.msix and you may need to use an "In-Private" window to download the file.

[PanicLAN0815]

Hey,

to help you guys out here is what I am running at the moment in terms of automation / scripts.
This Powershell script is running as NT-Aut\System (via TacticalRMM) and works fine in our environment:
(If you are wandering were I get the $env:RMMDomain and stuff - thats an TacticalRMM thing where you can set env variables on a per script basis)

$LOGPath = "C:\ST-LOG\#TRMM-Machine-Installer.log"
if(Test-Path -Path C:\ST-LOG){}
else{New-Item -ItemType Directory -Path C:\ST-LOG}
if((Get-ChildItem C:\ST-LOG | % {[math]::ceiling($_.length / 1kb)}) -gt 50000){
Remove-Item -Path C:\ST-LOG -Force}
Start-Transcript -Append -Force -IncludeInvocationHeader -Path $LOGPath

function Strip-Progress {
    param([ScriptBlock]$ScriptBlock)
    $progressPattern = 'Γû[ÆêÔûê]|^\s+[-\\|/]\s+$'
    $sizePattern = '(\d+(\.\d{1,2})?)\s+(B|KB|MB|GB|TB|PB) /\s+(\d+(\.\d{1,2})?)\s+(B|KB|MB|GB|TB|PB)'
    $previousLineWasEmpty = $false
    & $ScriptBlock 2>&1 | ForEach-Object {
        if ($_ -is [System.Management.Automation.ErrorRecord]) {
            "ERROR: $($_.Exception.Message)"
        } elseif ($_ -match '^\s*$') {
            if (-not $previousLineWasEmpty) {
                Write-Output ""
                $previousLineWasEmpty = $true
            }
        } else {
            $line = $_ -replace $progressPattern, '' -replace $sizePattern, '$1 $3 / $4 $6'
            if (-not [string]::IsNullOrWhiteSpace($line)) {
                $previousLineWasEmpty = $false
                $line
            }
        }
    }
}

$ErrorActionPreference = 'SilentlyContinue'
$RMMDomain = $env:domain
$PCDomain = (Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Domain).Domain
$MachineName = [Environment]::machineName
$LocalFolder = "\\DC01\ST-SW-TRMM$\"

if ($RMMDomain -eq $null){Write-Output "Not an correct Domain"
exit
}

if ($PCDomain -eq $RMMDomain){	
$MachineGroup = @()
$MachineDN = ([adsisearcher]"(&(objectClass=computer)(name=$MachineName))").FindAll().Properties.distinguishedname
([adsisearcher]"(&(objectClass=group)(name=ST-SW-TRMM-*)(member:1.2.840.113556.1.4.1941:=$MachineDN))").FindAll() | foreach{
        $GroupName = [STRING]$_.Properties.name     
        $InstallerType = [STRING]$_.Properties.extensionattribute10
        $SWID = [STRING]$_.Properties.extensionattribute11
        $Prio = [INT][STRING]$_.Properties.extensionattribute12
        $Area = [STRING]$_.Properties.extensionattribute13
        $MachineGroup += [PSCustomObject]@{Group = $GroupName ; Installer  = $InstallerType ; SWID = $SWID ; Prio = $Prio ; Area = $Area}  
}
$MachineGroup = $MachineGroup | ?{ $_.Installer -ne "" -and $_.SWID -ne "" -and $_.Prio -ne ""}
if ($MachineGroup -eq ""){$MachineGroup="I am just a placeholder!"}

$ADGroup=@()
([adsisearcher]"(&(objectClass=group)(name=ST-SW-TRMM-*))").FindAll() | foreach{
        $GroupName = [STRING]$_.Properties.name     
        $InstallerType = [STRING]$_.Properties.extensionattribute10
        $SWID = [STRING]$_.Properties.extensionattribute11
        $Prio = [INT][STRING]$_.Properties.extensionattribute12
        $Area = [STRING]$_.Properties.extensionattribute13
        $ADGroup += [PSCustomObject]@{Group = $GroupName ; Installer  = $InstallerType ; SWID = $SWID ; Prio = $Prio ; Area = $Area}  
}
$ADGroup = $ADGroup | ?{ $_.Installer -ne "" -and $_.SWID -ne "" -and $_.Prio -ne ""}

$WinGetLoc=(Get-Childitem -Path "C:\Program Files\WindowsApps" -Include winget.exe -Recurse -ErrorAction SilentlyContinue | Select-Object -Last 1 | %{$_.FullName} | Split-Path)

if(.$WinGetLoc\winget.exe --version -eq "")
    {
Install-PackageProvider -Name NuGet -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://vcredist.com/install.ps1'))
#Install-Module -Name Microsoft.WinGet.Client -Force -Repository PSGallery | Out-Null
#Repair-WinGetPackageManager -Force -Latest
#Get-AppxPackage appInstaller | Reset-AppxPackage
}

$ADGroup | Sort-Object -Property Prio -Descending  | foreach {
    $Date = Date
    Write-Output $Date
    $FailureText = "No applicable installer found; see logs for more details."
	### Winget Block START
	if ($_.Installer -eq "winget"){
		$logging = "C:\ST-LOG\"+$_.SWID
		$logging = $logging+".log"
		New-Item -ItemType File -Path $logging -Force
		if ($_.Group -in $MachineGroup.Group){
			Write-Output "Domain & Group found! Installing: $_"
			Strip-Progress -ScriptBlock{
			.$WinGetLoc\winget.exe install $_.SWID --accept-source-agreements --accept-package-agreements --silent --scope machine --disable-interactivity
			} >> $logging
            $LogText = Get-Content -Path $logging -Tail 1
            if($FailureText -in $LogText){
            Strip-Progress -ScriptBlock{
			.$WinGetLoc\winget.exe install $_.SWID --accept-source-agreements --accept-package-agreements --silent --disable-interactivity
			} >> $logging  
            }
			Write-Output "Installation done!"
			return
		}
		else{
			Write-Output "Not an Groupmember! Removing: $_"
			Strip-Progress -ScriptBlock{
			.$WinGetLoc\winget.exe uninstall $_.SWID --all-versions --scope machine --silent --force --purge --ignore-warnings --disable-interactivity
			.$WinGetLoc\winget.exe uninstall $_.SWID --all-versions --scope user --silent --force --purge --ignore-warnings --disable-interactivity
			.$WinGetLoc\winget.exe uninstall $_.SWID --all-versions --silent --force --purge --ignore-warnings --disable-interactivity
		} >> $logging
			Write-Output "Uninstall finished!"
			return
		}
	}
	### Winget Block END
	### Chocolatey Block START
	if ($_.Installer -eq "choco"){
		$logging = "C:\ST-LOG\"+$_.SWID
		$logging = $logging+".log"
		if ($_.Group -in $MachineGroup.Group){
			Write-Output "Domain & Group found! Installing: $_"
			C:\ProgramData\chocolatey\choco.exe install $_.SWID --accept-license --confirm --allow-unofficial-build --use-system-powershell --skip-compatibility-checks --ignore-checksums --log-file=$logging
			Write-Output "Installation done!"
			return
		} 
		else{
			Write-Output "Not an Groupmember! Removing: $_"
			C:\ProgramData\chocolatey\choco.exe uninstall $_.SWID --accept-license -y -f --ignore-checksums --limitoutput -x --no-progress --log-file=$logging
			Write-Output "Uninstall finished!"
			return
		}
	}
	### Chocolatey Block END
	### Local Block START
	if ($_.Installer -eq "local"){
		if ($_.Group -in $MachineGroup.Group){
			Write-Output "Domain & Group found! Installing: $_"
            $InstallerCMD = $LocalFolder+$_.SWID+'\install.cmd'
            $InstallerPS1 = $LocalFolder+$_.SWID+'\install.ps1'
			$InstallerBAT = $LocalFolder+$_.SWID+'\install.bat'
			
                if (Test-Path $InstallerCMD){
					C:\Windows\System32\cmd.exe /c $InstallerCMD
                }
                if (Test-Path $InstallerPS1){
					$InstallerPS1
                }
				if (Test-Path $InstallerBAT){
					C:\Windows\System32\cmd.exe /c $InstallerBAT
                }
			Write-Output "Installation done!"
			} 
		else {
			Write-Output "Not an Groupmember! Removing: $_"
			Write-Output "Uninstall finished!"
		}	
	}
	### Local Block END
}
Write-Output "###### Starting Software Upgrade ALL ######"
.$WinGetLoc\winget.exe upgrade --all --accept-source-agreements --accept-package-agreements --silent --scope machine --include-unknown --include-pinned --disable-interactivity --force
.$WinGetLoc\winget.exe upgrade --all --accept-source-agreements --accept-package-agreements --silent --scope user --include-unknown --include-pinned --disable-interactivity --force
.$WinGetLoc\winget.exe upgrade --all --accept-source-agreements --accept-package-agreements --silent --include-unknown --include-pinned --disable-interactivity --force
choco upgrade all --accept-license --confirm --allow-unofficial-build --use-system-powershell --skip-compatibility-checks --ignore-checksums 

### Experimental Windows Update Script
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
Import-Module PSWindowsUpdate
try{Get-WindowsUpdate}catch{
    Install-Module -Name PSWindowsUpdate -Force -Repository PSGallery | Out-Null
    Import-Module PSWindowsUpdate
    Reset-WUComponents -Verbose
}
Get-WindowsUpdate -Install -AcceptAll -IgnoreReboot -Verbose

$ADGroup.Dispose()
$MachineGroup.Dispose()
$MachineDN.Dispose()
Write-Output "Check Log for Errors!"

Write-Output "!!! KiCad needs manual uninstall !!!"
Write-Output "!!! Steam needs manual uninstall !!!"

Write-Output "###### Script finished ######"
Stop-Transcript
exit
}
Write-Output "###### Not an Domainmember! Exiting Script! ######"
Stop-Transcript
exit

And this Powershell script is running as logged user also via TacticalRMM.
Was too lazy to translate that one to english, so the parts you cannot read are in german ;)
But this is basically the same.

$LOGPath = "C:\ST-LOG\#TRMM-User-Installer.log"
if(Test-Path -Path C:\ST-LOG){}
else{New-Item -ItemType Directory -Path C:\ST-LOG}
if((Get-ChildItem C:\ST-LOG | % {[math]::ceiling($_.length / 1kb)}) -gt 50000){
Remove-Item -Path C:\ST-LOG -Force}
Start-Transcript -Append -Force -IncludeInvocationHeader -Path $LOGPath

function Strip-Progress {
    param([ScriptBlock]$ScriptBlock)
    $progressPattern = 'Γû[ÆêÔûê]|^\s+[-\\|/]\s+$'
    $sizePattern = '(\d+(\.\d{1,2})?)\s+(B|KB|MB|GB|TB|PB) /\s+(\d+(\.\d{1,2})?)\s+(B|KB|MB|GB|TB|PB)'
    $previousLineWasEmpty = $false
    & $ScriptBlock 2>&1 | ForEach-Object {
        if ($_ -is [System.Management.Automation.ErrorRecord]) {
            "ERROR: $($_.Exception.Message)"
        } elseif ($_ -match '^\s*$') {
            if (-not $previousLineWasEmpty) {
                Write-Output ""
                $previousLineWasEmpty = $true
            }
        } else {
            $line = $_ -replace $progressPattern, '' -replace $sizePattern, '$1 $3 / $4 $6'
            if (-not [string]::IsNullOrWhiteSpace($line)) {
                $previousLineWasEmpty = $false
                $line
            }
        }
    }
}

$ErrorActionPreference = 'SilentlyContinue'
$RMMDomain = $env:domain
$PCDomain = (Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Domain).Domain
$MachineName = [Environment]::machineName
$LocalFolder = "\\DC01\ST-SW-TRMM$\"

$Logon = Query User | Measure-Object -Line
if($Logon.Lines -eq 0){1
    Write-Output "###### Kein User angemeldet! Beende User Skript! ######"
    Stop-Transcript
exit
}

if ($RMMDomain -eq $null){Write-Output "###### Keine Domain in den Environment vars in TRMM hinterlegt! (domain=ABC.DEF) ######"
exit
}

if ($PCDomain -eq $RMMDomain){	
$MachineGroup = @()
$MachineDN = ([adsisearcher]"(&(objectClass=computer)(name=$MachineName))").FindAll().Properties.distinguishedname
([adsisearcher]"(&(objectClass=group)(name=ST-SW-TRMM-*)(member:1.2.840.113556.1.4.1941:=$MachineDN))").FindAll() | foreach{
        $GroupName = [STRING]$_.Properties.name     
        $InstallerType = [STRING]$_.Properties.extensionattribute10
        $SWID = [STRING]$_.Properties.extensionattribute11
        $Prio = [INT][STRING]$_.Properties.extensionattribute12
        $Area = [STRING]$_.Properties.extensionattribute13
        $MachineGroup += [PSCustomObject]@{Group = $GroupName ; Installer  = $InstallerType ; SWID = $SWID ; Prio = $Prio ; Area = $Area}  
}
$MachineGroup = $MachineGroup | ?{ $_.Installer -ne "" -and $_.SWID -ne "" -and $_.Prio -ne "" -and $_.Area -eq "user"}
if ($MachineGroup -eq ""){$MachineGroup="I am just a placeholder!"}

$ADGroup=@()
([adsisearcher]"(&(objectClass=group)(name=ST-SW-TRMM-*))").FindAll() | foreach{
        $GroupName = [STRING]$_.Properties.name     
        $InstallerType = [STRING]$_.Properties.extensionattribute10
        $SWID = [STRING]$_.Properties.extensionattribute11
        $Prio = [INT][STRING]$_.Properties.extensionattribute12
        $Area = [STRING]$_.Properties.extensionattribute13
        $ADGroup += [PSCustomObject]@{Group = $GroupName ; Installer  = $InstallerType ; SWID = $SWID ; Prio = $Prio ; Area = $Area}  
}
$ADGroup = $ADGroup | ?{ $_.Installer -ne "" -and $_.SWID -ne "" -and $_.Prio -ne "" -and $_.Area -eq "user"}

try {winget --version}
catch {
	mkdir $env:USERPROFILE\TMP
	Invoke-WebRequest https://github.com/microsoft/winget-cli/releases/latest/download/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle -OutFile "$env:USERPROFILE\TMP\winget.msixbundle"
	Add-AppxPackage "$env:USERPROFILE\TMP\winget.msixbundle"
	rmdir -Force -Recurse $env:USERPROFILE\TMP
}

$ADGroup | Sort-Object -Property Prio -Descending  | foreach {
    $Date = Date
    Write-Output $Date
    $FailureText = "No applicable installer found; see logs for more details."
	### Winget Block START
	if ($_.Installer -eq "winget"){
		$logging = "C:\ST-LOG\"+$_.SWID
		$logging = $logging+".log"
		New-Item -ItemType File -Path $logging -Force
		if ($_.Group -in $MachineGroup.Group){
			Write-Output "###### Domain und Gruppe erkannt! Installiere: $_ ######"
			Strip-Progress -ScriptBlock{
			winget install $_.SWID --accept-source-agreements --accept-package-agreements --silent --scope user --disable-interactivity
			} >> $logging
            $LogText = Get-Content -Path $logging -Tail 1
            if($FailureText -in $LogText){
            Strip-Progress -ScriptBlock{
			winget install $_.SWID --accept-source-agreements --accept-package-agreements --silent --disable-interactivity
			} >> $logging  
            }
			Write-Output "###### Installation abgeschlossen! ######"
			return
		}
		else{
			Write-Output "###### Kein Gruppenmitglied! Entferne: $_ ######"
			Strip-Progress -ScriptBlock{
			winget uninstall $_.SWID --all-versions --scope user --silent --force --purge --ignore-warnings --disable-interactivity
			winget uninstall $_.SWID --all-versions --silent --force --purge --ignore-warnings --disable-interactivity
		} >> $logging
			Write-Output "###### Deinstallation abgeschlossen! ######"
			return
		}
	}
	### Winget Block ENDE
	### Chocolatey Block START
	if ($_.Installer -eq "choco"){
		$logging = "C:\ST-LOG\"+$_.SWID
		$logging = $logging+".log"
		if ($_.Group -in $MachineGroup.Group){
			Write-Output "###### Domain und Gruppe erkannt! Installiere: $_ ######"
			C:\ProgramData\chocolatey\choco.exe install $_.SWID --accept-license --confirm --allow-unofficial-build --use-system-powershell --skip-compatibility-checks --ignore-checksums --log-file=$logging
			Write-Output "###### Installation abgeschlossen! ######"
			return
		} 
		else{
			Write-Output "###### Kein Gruppenmitglied! Entferne: $_ ######"
			C:\ProgramData\chocolatey\choco.exe uninstall $_.SWID --accept-license -y -f --ignore-checksums --limitoutput -x --no-progress --log-file=$logging
			Write-Output "###### Deinstallation abgeschlossen! ######"
			return
		}
	}
	### Chocolatey Block ENDE
	### Local Block START
	if ($_.Installer -eq "local"){
		if ($_.Group -in $MachineGroup.Group){
			Write-Output "###### Domain und Gruppe erkannt! Installiere: $_ ######"
            $InstallerCMD = $LocalFolder+$_.SWID+'\install.cmd'
            $InstallerPS1 = $LocalFolder+$_.SWID+'\install.ps1'
			$InstallerBAT = $LocalFolder+$_.SWID+'\install.bat'
			
                if (Test-Path $InstallerCMD){
					C:\Windows\System32\cmd.exe /c $InstallerCMD
                }
                if (Test-Path $InstallerPS1){
					$InstallerPS1
                }
				if (Test-Path $InstallerBAT){
					C:\Windows\System32\cmd.exe /c $InstallerBAT
                }
			Write-Output "###### Installation abgeschlossen! ######"
			} 
		else {
			Write-Output "###### Kein Gruppenmitglied! Entferne: $_ ######"
			Write-Output "###### Keine Deinstallationsroutine bei lokaler Software vorhanden! ######"
			Write-Output "###### Deinstallation abgeschlossen! ######"
		}	
	}
	### Local Block ENDE
}
Write-Output "###### Starting Software Upgrade ALL ######"

$ADGroup.Dispose()
$MachineGroup.Dispose()
$MachineDN.Dispose()
Write-Output "###### Log auf Fehler checken! ######"
Write-Output "###### Skript beendet! ######"
Stop-Transcript
exit
}
Write-Output "###### Kein Domainmitglied! Beende Script! ######"
Stop-Transcript
exit