You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Enable Windows Package Manager
This policy controls whether the Windows Package Manager can be used by users.
If you enable or do not configure this setting, users will be able to use the Windows Package Manager.
If you disable this setting, users will not be able to use the Windows Package Manager.
Enable Windows Package Manager Settings Command
This policy controls whether users can change their settings.
If you enable or do not configure this setting, users will be able to change settings for the Windows Package Manager.
If you disable this setting, users will not be able to change settings for the Windows Package Manager.
Enable Windows Package Manager Hash Override Argument
This policy controls whether or not the Windows Package Manager can be configured to enable the ability override the SHA256 security validation via Windows Package Manager settings.
If you enable or do not configure this policy, users will be able to enable the ability override the SHA256 security validation via Windows Package Manager settings.
If you disable this policy, users will not be able to enable the ability override the SHA256 security validation via Windows Package Manager settings.
Enable Windows Package Manager Experimental Features
This policy controls whether users can enable experimental features in the Windows Package Manager.
If you enable or do not configure this setting, users will be able to enable experimental features for the Windows Package Manager.
If you disable this setting, users will not be able to enable experimental features for the Windows Package Manager.
Enable Windows Package Manager Local Manifest Files
This policy controls whether users can install packages with local manifest files.
If you enable or do not configure this setting, users will be able to install packages with local manifests using the Windows Package Manager.
If you disable this setting, users will not be able to install packages with local manifests using the Windows Package Manager.
Set Windows Package Manager Source Auto Update Interval In Minutes
This policy controls the auto update interval for package-based sources.
If you disable or do not configure this setting, the default interval or the value specified in settings will be used by the Windows Package Manager.
If you enable this setting, the number of minutes specified will be used by the Windows Package Manager.
Enable Windows Package Manager Default Source
This policy controls the default source included with the Windows Package Manager.
If you do not configure this setting, the default source for the Windows Package Manager will be available and can be removed.
If you enable this setting, the default source for the Windows Package Manager will be available and cannot be removed.
If you disable this setting the default source for the Windows Package Manager will not be available.
Enable Windows Package Manager Microsoft Store Source
This policy controls the Microsoft Store source included with the Windows Package Manager.
If you do not configure this setting, the Microsoft Store source for the Windows Package manager will be available and can be removed.
If you enable this setting, the Microsoft Store source for the Windows Package Manager will be available and cannot be removed.
If you disable this setting the Microsoft Store source for the Windows Package Manager will not be available.
Enable Additional Windows Package Manager Sources
This policy controls additional sources provided by the enterprise IT administrator.
If you do not configure this policy, no additional sources will be configured for the Windows Package Manager.
If you enable this policy, the additional sources will be added to the Windows Package Manager and cannot be removed. Each additional source requires a name, argument (URL), and type (Microsoft.Rest or Microsoft.PreIndexed.Package).
If you disable this policy, no additional sources can be configured for the Windows Package Manager.
Enable Windows Package Manager Allowed Sources
This policy controls additional sources allowed by the enterprise IT administrator.
If you do not configure this policy, users will be able to add or remove additional sources other than those configured by policy.
If you enable this policy, only the sources specified can be added or removed from the Windows Package Manager. Each allowed source requires a name, argument (URL), and type (Microsoft.Rest or Microsoft.PreIndexed.Package).
If you disable this policy, no additional sources can be configured for the Windows Package Manager.
For "Enable Windows Package Manager Settings Command", does this block the user from editing the file in %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json by changing file system permissions, or does it just block the winget settings command?
For "Enable Windows Package Manager Allowed Sources", is there a way (currently or planned) for a user to get a list of the allowed sources?
Easton Pillay (@jedieaston), thanks for taking a look. We're planning on "retaining" the settings such that if the policies are "removed", the user will default back to their settings file. It's just going to block the "winget -settings" command. The intent is just to reduce the confusion when there are settings conflicting with policies.
The policies will be available via winget --info. We use that for troubleshooting, and figure that's the best place. Since we ask for that output with bugs, it's hopefully an obvious place to see what is affecting users.
I just thought of another one that would be nice to see: limit users to installing only "User-scoped" manifests that can be installed without admin rights. Preferably, this would also hide manifests that are scoped for the entire system from showing up in winget search.
This would help a ton with preventing user confusion when they get winget and half the things they try to install don't work, since this way winget can hopefully explain what's going on or not show them packages they won't be able to install anyway.
Activity
denelon commentedon Feb 4, 2021
Here is a list of policies we're considering:
Enable Windows Package Manager
This policy controls whether the Windows Package Manager can be used by users.
If you enable or do not configure this setting, users will be able to use the Windows Package Manager.
If you disable this setting, users will not be able to use the Windows Package Manager.
Enable Windows Package Manager Settings Command
This policy controls whether users can change their settings.
If you enable or do not configure this setting, users will be able to change settings for the Windows Package Manager.
If you disable this setting, users will not be able to change settings for the Windows Package Manager.
Enable Windows Package Manager Hash Override Argument
This policy controls whether or not the Windows Package Manager can be configured to enable the ability override the SHA256 security validation via Windows Package Manager settings.
If you enable or do not configure this policy, users will be able to enable the ability override the SHA256 security validation via Windows Package Manager settings.
If you disable this policy, users will not be able to enable the ability override the SHA256 security validation via Windows Package Manager settings.
Enable Windows Package Manager Experimental Features
This policy controls whether users can enable experimental features in the Windows Package Manager.
If you enable or do not configure this setting, users will be able to enable experimental features for the Windows Package Manager.
If you disable this setting, users will not be able to enable experimental features for the Windows Package Manager.
Enable Windows Package Manager Local Manifest Files
This policy controls whether users can install packages with local manifest files.
If you enable or do not configure this setting, users will be able to install packages with local manifests using the Windows Package Manager.
If you disable this setting, users will not be able to install packages with local manifests using the Windows Package Manager.
Set Windows Package Manager Source Auto Update Interval In Minutes
This policy controls the auto update interval for package-based sources.
If you disable or do not configure this setting, the default interval or the value specified in settings will be used by the Windows Package Manager.
If you enable this setting, the number of minutes specified will be used by the Windows Package Manager.
Enable Windows Package Manager Default Source
This policy controls the default source included with the Windows Package Manager.
If you do not configure this setting, the default source for the Windows Package Manager will be available and can be removed.
If you enable this setting, the default source for the Windows Package Manager will be available and cannot be removed.
If you disable this setting the default source for the Windows Package Manager will not be available.
Enable Windows Package Manager Microsoft Store Source
This policy controls the Microsoft Store source included with the Windows Package Manager.
If you do not configure this setting, the Microsoft Store source for the Windows Package manager will be available and can be removed.
If you enable this setting, the Microsoft Store source for the Windows Package Manager will be available and cannot be removed.
If you disable this setting the Microsoft Store source for the Windows Package Manager will not be available.
Enable Additional Windows Package Manager Sources
This policy controls additional sources provided by the enterprise IT administrator.
If you do not configure this policy, no additional sources will be configured for the Windows Package Manager.
If you enable this policy, the additional sources will be added to the Windows Package Manager and cannot be removed. Each additional source requires a name, argument (URL), and type (Microsoft.Rest or Microsoft.PreIndexed.Package).
If you disable this policy, no additional sources can be configured for the Windows Package Manager.
Enable Windows Package Manager Allowed Sources
This policy controls additional sources allowed by the enterprise IT administrator.
If you do not configure this policy, users will be able to add or remove additional sources other than those configured by policy.
If you enable this policy, only the sources specified can be added or removed from the Windows Package Manager. Each allowed source requires a name, argument (URL), and type (Microsoft.Rest or Microsoft.PreIndexed.Package).
If you disable this policy, no additional sources can be configured for the Windows Package Manager.
sebawern commentedon Feb 4, 2021
I‘d rather (or also?) like to be able to configure this using Intune (even if that means using CSPs).
denelon commentedon Mar 4, 2021
We will have CSP as well.
denelon commentedon Mar 10, 2021
#789
jedieaston commentedon Apr 4, 2021
These look great!
Two questions:
For "Enable Windows Package Manager Settings Command", does this block the user from editing the file in %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json by changing file system permissions, or does it just block the
winget settingscommand?For "Enable Windows Package Manager Allowed Sources", is there a way (currently or planned) for a user to get a list of the allowed sources?
denelon commentedon Apr 4, 2021
Easton Pillay (@jedieaston), thanks for taking a look. We're planning on "retaining" the settings such that if the policies are "removed", the user will default back to their settings file. It's just going to block the "winget -settings" command. The intent is just to reduce the confusion when there are settings conflicting with policies.
The policies will be available via
winget --info. We use that for troubleshooting, and figure that's the best place. Since we ask for that output with bugs, it's hopefully an obvious place to see what is affecting users.jedieaston commentedon Apr 9, 2021
I just thought of another one that would be nice to see: limit users to installing only "User-scoped" manifests that can be installed without admin rights. Preferably, this would also hide manifests that are scoped for the entire system from showing up in
winget search.This would help a ton with preventing user confusion when they get winget and half the things they try to install don't work, since this way winget can hopefully explain what's going on or not show them packages they won't be able to install anyway.
denelon commentedon May 3, 2021
The initial work for group policy has been released.
https://aka.ms/winget-policy also hosts the files for ADMX Ingestion.
Squashed 'src/Valijson/valijson/' changes from 2dfc7499..94d3bfd3
Squashed 'src/Valijson/valijson/' changes from 2dfc7499..94d3bfd3
Squashed 'src/Valijson/valijson/' changes from 2dfc7499..0b4771e2