Microsoft Intune / PowerShell / winget

Intune Winget App Updater

Controlled Microsoft Intune Proactive Remediation package for updating approved Windows applications with winget. This repository is intentionally documented as a remediation package, not a read-only audit project.

Purpose Components Safety model Pilot guidance Links

Purpose

The package provides a controlled way to pilot and run approved application updates through Microsoft Intune without using broad commands such as winget upgrade --all.

Allowlist based No missing app installs No upgrade-all behavior Local logging Intune export friendly

Detection behavior

  • Uses winget list and diagnostic fallback discovery for installed application detection.
  • Uses the Windows uninstall registry as a fallback source.
  • Separates states such as WingetInstalled, RegistryOnly, NotInstalled and Unknown.

Remediation behavior

  • Updates only approved allowlist applications.
  • Does not install missing applications.
  • Does not force-update applications that are only visible in the registry.

Main components

  • Approved App Updates Detection v10.4 - Intune detection script.
  • Approved App Updates Remediation v10.4 - controlled remediation script.
  • Log Summary Detection v10 - compact log summary for Intune reporting.
  • Log Summary No-Op Remediation v10 - no-op remediation pair for log summary.
  • Offline Technician Tool v10.3 - manual local validation tool.

Approved allowlist

7zip.7zip
Notepad++.Notepad++
Mozilla.Firefox
Google.Chrome
Adobe.Acrobat.Reader.32-bit
Adobe.Acrobat.Reader.64-bit

Output markers

WINGET_DETECTION_V10_3
WINGET_REMEDIATION_V10_3
WINGET_LOG_SUMMARY_V10

Log location

C:\ProgramData\IntuneWingetUpdates\Logs

Log retention is managed by age and total folder size.

Safety model

This repository contains remediation scripts that can update approved applications on managed Windows devices. It should be tested with a small pilot group before wider deployment.

  • No customer names, tenant identifiers, internal hostnames or private IP addresses should be committed.
  • No real Intune exports, generated reports or logs should be committed.
  • Secret scanning, public safety checks and Pester tests are included in GitHub Actions.

Pilot guidance

  1. Deploy first to a small pilot device group.
  2. Run hourly for one business day.
  3. Review detection, remediation and log summary output.
  4. Confirm that no unexpected applications are updated.
  5. Move to a daily schedule only after stable pilot results.

Quality checks

  • PSScriptAnalyzer
  • Secret Scan / Gitleaks
  • Pester Tests
  • Public Safety Check
  • GitHub Pages documentation build