Category: Powershell

New Windows package management: winget
article #1504, updated 17 hours ago

It’s built into the latest builds of Windows 10 and 11 and Server, and can be installed into many. One good way to try it, is to install Microsoft .NET framework (SDK) 6, thus, from administrative Powershell:

winget install --id Microsoft.DotNet.Runtime.6 --silent --accept-source-agreements

I learned just now that if you add other seemingly valuable options to the one above, e.g., --scope machine, at least while running as SYSTEM, it will fail citing package not found. So you’ll want to test carefully.

Here’s one proven just now for 7zip (there’s a “search” option in winget to get the ID):

winget install --exact --id 7zip.7zip --accept-package-agreements --silent --scope machine

Here’s one for Google Chrome, needs a bit of extra:

winget.exe install --exact --id Google.Chrome --silent --accept-package-agreements --accept-source-agreements --scope machine

If you do want to use it from the SYSTEM account, in scripting, it gets interesting. You’ll want to first run this:

$ResolveWingetPath = Resolve-Path "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_*_x64__8wekyb3d8bbwe"
    if ($ResolveWingetPath){
           $WingetPath = $ResolveWingetPath[-1].Path
$ENV:PATH += ";$WingetPath"

and then winget will run as expected.

If your system is Windows 10/2016/2019 build 1809 or higher, we can add winget if it’s not already there. Go to the Microsoft Store, and search for “App Installer” by Microsoft. Attempts to script this can be found, but none have worked persistently yet.



Update Windows via Powershell
article #1479, updated 120 days ago

This method uses Powershell module PsWindowsUpdate.

  1. Run this in administrative Powershell:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Set-Executionpolicy RemoteSigned -Scope Process -Force
Install-PackageProvider -Name NuGet -Force -ErrorAction 'SilentlyContinue' > $null
Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
If (Get-InstalledModule -Name PsWindowsUpdate -ErrorAction 'SilentlyContinue') {
	Update-Module -Name PSWindowsUpdate -Force
} Else {
	Install-Module -Name PSWindowsUpdate -Force
Import-Module PSWindowsUpdate
  1. Then check the list of available updates:
  1. The next step is to actually do the updates. There are good reasons and multiple methods to be careful. Alas, thus far, there does not appear to be a way to install updates a given number of days after release, e.g., 30, so as to give Microsoft time to respond to issues. Here is a glancing overview of what we do have:
  • Lots of firmware is being sent by Microsoft now, and some of this is more up-to-date than that available from the vendors. But there is risk in these, don’t forget. You may find that you want to install current Windows patches, but no drivers, firmware, services packs, feature packs, etc. To do this:
Install-WindowsUpdate -NotCategory "Drivers","Service Packs","FeaturePacks" -NotTitle "preview" -AcceptAll 

And to do it while ignoring reboot:

Install-WindowsUpdate -NotCategory "Drivers","Service Packs","FeaturePacks" -NotTitle "preview" -AcceptAll -IgnoreReboot

The -IgnoreReboot ignores all relevant reboot automata. -NotTitle "preview" omits all updates with the word “preview” in their name.

But sometimes, e.g. with a new PC install, we’ll want to install all updates and reboot automatically:

Install-WindowsUpdate -AcceptAll -AutoReboot
  • You may find that you want to omit granularly, e.g., specific build upgrades. If you found one marked KB1234567, you would install all and omit that one thus:
Install-WindowsUpdate -NotKBArticleID KB1234567 -AcceptAll
  • If you wanted to do that, and explicitly not reboot if indicated:
Install-WindowsUpdate -NotKBArticleID KB1234567 -AcceptAll -IgnoreReboot
  • If you had two KBs to omit:
Install-WindowsUpdate -AcceptAll -NotKBArticleID "KB1234567,KB7654321"
  • There are other noteworthy items. Lots of firmware is being sent by Microsoft now, and some of this is more up-to-date than that available from the vendor. But there is risk in firmware updates, don’t forget. Some of the items don’t have KBs, and there are two other command-line arguments to omit those, -NotTitle and -NotUpdateID.
  • And then there’s:
  • To get a full list of functions:
Get-Command -Module PSWindowsUpdate

Get-Help works for all of them.



Set DNS in use via Powershell
article #1490, updated 149 days ago

  1. Open up an administrative Powershell. Run IPCONFIG /ALL. That will get you a list of active NICs. DNS in use, is set for each NIC if you have more than one.
  2. The name of each NIC has a prefix that has to be omitted. There are a number of prefixes which are common. For a simple wired NIC, it’s usually “Ethernet Adapter”; on many HPE servers, IPCONFIG /ALL will therefore show the second NIC as Ethernet adapter Embedded LOM 1 Port 2.
  3. So let’s say you have a LAN with three active DNS servers (,, and, and you want your HPE server of the above description, with the first two NICs active, to use all of them. Here’s the Powershell commands:
Set-DnsClientServerAddress "Embedded LOM 1 Port 1" -ServerAddresses ("","","")
Set-DnsClientServerAddress "Embedded LOM 1 Port 2" -ServerAddresses ("","","")
  1. For a second example, let’s say we’re on a common workstation, and we want to change DNS from a static setting, to whatever DHCP will pass out:
Set-DnsClientServerAddress "Ethernet" -ResetServerAddresses



Download URL Using Powershell
article #1439, updated 154 days ago

Longstanding, works well unless BITS is corrupt:

Start-BitsTransfer -Source $URL -Destination $Path

On 1809 and up:

curl.exe -O $URL

A pure Powershell method:

(New-Object System.Net.WebClient).DownloadFile($URL,$Path)



Remove all user local admins from local Administrators group
article #1464, updated 412 days ago

This removes all local admins from a machine’s Administrators group, except the built-in Administrator and “Domain Admins” if it’s on a domain.

$LocalDomain = $env:USERDOMAIN
$DomainAdmins = "$LocalDomain\Domain Admins"
$ComputerName = $env:COMPUTERNAME
$OEMAdministrator = "$ComputerName\Administrator"
Get-LocalGroupMember Administrators | ForEach-Object {
	$UserName = $_.Name
	"Found: $UserName"
	If (($UserName -ne $DomainAdmins) -and ($UserName -ne $OEMAdministrator)) {
		"Removing $UserName from local Administrators group."
		Remove-LocalGroupMember -Group Administrators -Member $UserName



When Group Policy doesn't work, or works wrong
article #1458, updated 451 days ago

If you see GPO policies get implemented and re-implemented even though the settings have been removed, or if it just doesn’t happen, try the following in administrative Powershell. These clear the GPO cache on the machine you’re looking at.

Remove-Item "$env:windir\system32\GroupPolicy" -Force -Recurse
Remove-Item "HKLM:\Software\Policies\Microsoft" -Force -Recurse
Remove-Item "HKCU:\Software\Policies\Microsoft" -Force -Recurse
Remove-Item "HKCU:\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects" -Force -Recurse
Remove-Item "HKCU:\\Software\Microsoft\Windows\CurrentVersion\Policies" -Force -Recurse



Log off all disconnected RDP sessions via Powershell
article #1451, updated 503 days ago

This appears to work well. It uses the olde ‘rwinsta’ command to work around some Powershell oddities.

# Get list of disconnected RDP sessions

$RDPDiscSessions = Get-RDUserSession | Where-Object SessionState -eq STATE_DISCONNECTED

# Disconnect each of them one by one

foreach ($row in $RDPDiscSessions)	{
	'Logging off ' + $row.SessionID
	rwinsta $row.SessionID



Simple Powershell Interactive Text-mode "GUI"
article #1450, updated 532 days ago

Rather elegant:



When Install-Module or Install-PackageProvider Fail
article #1372, updated 1059 days ago

An in-script fix:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

A permanent fix:

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord



Single Download via Powershell
article #1363, updated 1108 days ago

To download a single file in binary mode, try translating this:

Invoke-WebRequest -Uri "http://fq.dn/sub/binary.exe" -Outfile "C:\folder\binary.exe"