Windows package managers turn one command into a download, an integrity check and an installer run, often with administrator rights, so whoever controls the package source effectively controls what executes on your endpoints. winget ships with Windows through App Installer, Chocolatey is common in IT operations and Scoop is popular with developers, and all three pull from community-maintained repositories by default. This guide explains where each tool gets its packages, what it verifies and what it does not, the Group Policy and configuration settings that put an organisation in control of sources, and how to detect bypasses. It is written for endpoint engineers, desktop and server administrators, and security teams who need to allow package managers without handing the software supply chain to strangers.
Key takeaways
- The source is the trust boundary. A hash check proves the file matches the manifest, not that the manifest or the vendor URL is trustworthy; decide which sources may be used before deciding anything else.
- Community repositories are not enterprise repositories. Chocolatey Software itself does not recommend its community repository for organisational use, and the winget and Scoop community sources carry the same structural risk.
- winget is controllable by policy. The App Installer ADMX templates can disable the default source, add enterprise sources that users cannot remove, restrict sources to an allowed list and block the hash override.
- Integrity overrides are the switches to watch. winget
--ignore-security-hash, Scoop--skip-hash-checkand Chocolatey's empty-checksum features all exist; disable them by policy or configuration and alert on their use. - Package managers are execution engines. Install scripts and installers run with the caller's rights, so pair source control with application control and least privilege rather than relying on either alone.
How the three package managers differ
The three tools solve the same problem in different ways, and the differences decide which controls apply.
| Aspect | winget (Windows Package Manager) | Chocolatey | Scoop |
|---|---|---|---|
| Delivery | Part of App Installer on Windows 11, modern Windows 10 (1809 and later) and Windows Server 2025, updated through the Microsoft Store | Separately installed client, open source and licensed editions | Installed per user from a non-admin PowerShell session |
| Default sources | winget (community repository), msstore (Microsoft Store), winget-font (explicit by default) | Community repository at community.chocolatey.org | Buckets (Git repositories of JSON manifests); the main bucket by default |
| What a package is | YAML manifest pointing at a vendor installer (MSIX, MSI, APPX, EXE); script-based installers not accepted in the community repository | NuGet package containing PowerShell install scripts, usually downloading the vendor binary at install time | JSON manifest with URL, hash and optional install scripts |
| Integrity check | SHA256 of the installer against the manifest | Package SHA512 recorded by the site; optional checksums in install scripts for downloaded binaries | SHA256 by default per URL, with sha512, sha1 or md5 prefixes allowed |
| Integrity override | --ignore-security-hash, gated by the InstallerHashOverride admin setting | allowEmptyChecksums and allowEmptyChecksumsSecure features | --skip-hash-check; nightly versions skip hash checks |
| Privilege model | Installers may prompt for UAC elevation; machine scope may need admin | Install scripts typically run elevated | User scope without UAC; --global requires admin rights |
| Enterprise control | App Installer ADMX policies, private REST sources | Internal repository and internalised packages; licensed features for self-service and admin-only sources | Private buckets; no central policy engine |
What each tool actually verifies
winget
Manifests submitted to the WinGet Community Repository are automatically validated and may also be reviewed manually, according to Microsoft Learn. At install time winget compares the installer's SHA256 with the manifest value; the App Installer policy text describes this as the "SHA256 security validation". The Microsoft Store source adds certificate pinning: winget checks that the msstore endpoint presents the expected Microsoft Store certificate, which is why enterprise TLS inspection can break the connection. Microsoft warns that bypassing pinning exposes the organisation to risk.
What winget does not prove: that the vendor behind the URL is who the manifest claims, or that the publisher has not been compromised upstream. If a legitimate vendor ships a trojanised build and the manifest is updated to the new hash, the check passes.
Chocolatey
Every version of every package on the community repository is moderated before it becomes public: an automated validator, a verifier that test-installs the package, VirusTotal scanning (including downloaded content) and a human review unless the package has trusted status. Chocolatey's own security page lists the gaps plainly: moderation reflects the package at review time, vendors can change what sits at their URLs, trusted packages skip human review, package signing was listed as a future enhancement, and only en-US installers are tested by default. Since version 0.10.0 checksums are enforced by default for non-HTTPS downloads.
Scoop
Scoop manifests carry a hash for each download URL, SHA256 by default. Manifests can also run pre_install, post_install and installer.script PowerShell during install and update, so a bucket author can execute code on the device. Scoop's install command offers -s, --skip-hash-check ("use with caution") and skips hash checks for nightly versions. The main selling point, installing without UAC prompts, also means Scoop is a route for users to run software outside admin-controlled deployment.
winget policy settings for enterprise control
The Desktop App Installer administrative templates ship as DesktopAppInstallerPolicies.zip on the winget-cli GitHub releases page. Copy the ADMX to C:\Windows\PolicyDefinitions (or the domain Central Store) and the ADML to the language folder. Settings write under HKLM\Software\Policies\Microsoft\Windows\AppInstaller. New policies appear in new releases, so check the release notes when updating templates.
| Policy (registry value) | Effect | Recommended enterprise setting |
|---|---|---|
| Enable Windows Package Manager Default Source (EnableDefaultSource) | Disabled removes the community winget source; enabled makes it present and non-removable | Disabled where an internal source exists |
| Enable Windows Package Manager Microsoft Store Source (EnableMicrosoftStoreSource) | Controls the msstore source the same way | Decide per estate; disable on servers |
| Enable Windows Package Manager Additional Sources (EnableAdditionalSources) | Adds enterprise sources that users cannot remove, using JSON from winget source export | Enabled with your private source |
| Enable Windows Package Manager Allowed Sources (EnableAllowedSources) | Only listed sources can be added or removed | Enabled, listing approved sources only |
| Enable Windows Package Manager Hash Override (EnableHashOverride) | Disabled stops users enabling the SHA256 override in settings | Disabled |
| Enable Windows Package Manager Local Manifest Files (EnableLocalManifestFiles) | Disabled blocks installs from local manifests | Disabled except packaging workstations |
| Enable Windows Package Manager Local Archive Malware Scan Override (EnableLocalArchiveMalwareScanOverride) | Disabled prevents skipping the malware scan for local archive installs | Disabled |
| Enable Windows Package Manager Microsoft Store Source Certificate Validation Bypass (EnableBypassCertificatePinningForMicrosoftStore) | Enabled bypasses Store certificate pinning | Disabled; exempt the Store endpoint from TLS inspection instead |
| Enable Windows Package Manager command line interfaces (EnableWindowsPackageManagerCommandLineInterfaces) | Disabled blocks the winget CLI and PowerShell cmdlets | Disabled for standard users if self-service is not offered |
| Enable Windows Package Manager Configuration (EnableWindowsPackageManagerConfiguration) | Controls the configuration (DSC) feature | Disabled unless used |
| Enable MCP Server for Windows Package Manager (EnableWindowsPackageManagerMcpServer) | Controls the winget Model Context Protocol server | Disabled until AI agent use is approved |
| Enable App Installer ms-appinstaller protocol (EnableMSAppInstallerProtocol) | Enabled allows installs from websites using the protocol; disabled or not configured blocks them | Disabled |
| Enable Microsoft SmartScreen checks for MSIX Packages (EnableMsixSmartScreenCheck) | Disabled stops SmartScreen evaluation of internet MSIX packages | Enabled or not configured |
The same five admin settings (LocalManifestFiles, BypassCertificatePinningForMicrosoftStore, InstallerHashOverride, LocalArchiveMalwareScanOverride, ProxyCommandLineOptions) can be toggled locally with winget settings --enable or Enable-WinGetSetting from an elevated session. They are disabled by default; Group Policy is how you keep them that way.
The ms-appinstaller row is not theoretical. In December 2023 Microsoft disabled the protocol handler by default from App Installer 1.21.3421.0 after financially motivated groups, including Storm-0569, Storm-1113, Sangria Tempest and Storm-1674, used it to deliver malware through malicious ads, fake software pages and Teams messages. The related spoofing flaw, CVE-2021-43890, is in the CISA Known Exploited Vulnerabilities catalog. See the Malvertising and SEO Poisoning Guide.
Choosing a source model
| Model | Fits | Trade-offs |
|---|---|---|
| Community sources allowed, unmanaged | Personal devices only | No control over what is published or when; not appropriate for managed estates |
| Community sources allowed, constrained by allowlisting | Small organisations without packaging staff | Application control blocks unexpected binaries, but each new version needs signer or hash rules |
| Internal mirror of approved packages | Most mid-sized and large organisations | You choose versions and timing; you also own the review and the update cadence |
| Internalised packages (binaries hosted internally) | Regulated, offline or high-assurance environments | Removes reliance on vendor URLs at install time; more storage and packaging effort |
| No CLI package managers; central deployment only | Kiosks, servers with strict change control | Simplest to govern; loses developer self-service |
- Small organisations: disable the default winget source on servers, keep it on workstations behind application control, and block Scoop and Chocolatey community feeds until there is a reason to allow them.
- Large organisations: run a private winget REST source (Microsoft's winget-pkgs documentation lists open source implementations) and an internal Chocolatey repository with internalised packages, and push both by policy. Chocolatey's documentation is explicit that internal packages can embed binaries because distribution-rights limits do not apply.
- Developer populations: if Scoop is allowed, publish a private bucket of reviewed manifests and treat third-party buckets like any unreviewed code dependency.
See the Endpoint Software Packaging and Distribution guide for building and signing the packages that go into an internal source.
Where identity fits
Package sources and the automation that drives them hold machine credentials. Chocolatey sources can be added with a username and password (stored encrypted in chocolatey.config) or an x509 client certificate, and private winget REST sources and Scoop buckets often sit behind repository tokens. Treat these as non-human identities: scope each feed credential to read-only on clients, keep publishing credentials only in the pipeline, rotate them, and never embed them in deployment scripts. Installs that run under SYSTEM through management tools inherit full machine rights, so the account that can publish to your internal feed is effectively a local administrator on every device that consumes it. See the Secrets Management Guide and the Endpoint Privilege Management Guide.
How to implement
- Inventory use. Find devices with winget activity, Chocolatey installed and Scoop directories in user profiles, and list the sources configured on each (
winget source list,choco source list,scoop bucket list). - Decide the source model per device class using the table above, and record approved sources and owners.
- Stand up internal sources. Export the definition of your private winget source with
winget source exportfor the Additional Sources and Allowed Sources policies; configure the internal Chocolatey feed with a priority so it is evaluated first. - Pilot policies on a test ring. Apply the App Installer policies (disable hash override, local manifests, certificate pinning bypass and the ms-appinstaller protocol; set allowed sources) to an IT pilot group and confirm business applications still install.
- Constrain execution. Use App Control for Business or AppLocker to decide whether Scoop and the Chocolatey client may run for standard users, and whether binaries installed into user-writable paths may execute. See the App Control for Business (WDAC) guide.
- Remove local admin where possible. Without it, machine-scope installs and Chocolatey scripts cannot run silently. See the Local Administrator Password Solution (LAPS) Guide for the accounts that remain.
- Roll out by ring with a documented rollback: removing the GPO or setting policies to Not Configured restores defaults, and the community source can be restored with
winget source reset --force. - Review quarterly: new ADMX settings, new sources requested, and any override events.
Detection and measurement
- Process creation: collect Windows Security event 4688 with command line or Sysmon Event ID 1, and alert on
wingetwith--ignore-security-hash,-m/--manifestorsource add;scoopwith--skip-hash-checkorbucket add; andchocowithsource addor feature changes to checksum settings. - Registry: monitor
HKLM\Software\Policies\Microsoft\Windows\AppInstallerfor drift from the GPO baseline. - Network: egress logs showing endpoints reaching community repository and raw GitHub content hosts when policy says they should use internal sources.
- Software inventory: compare installed applications against the approved catalogue; Scoop installs live under the user profile and are easy to miss.
Metrics that show the control is working:
- Percentage of managed devices with the community winget source disabled or allowed-sources policy applied.
- Integrity override attempts per month (target zero, every one investigated).
- Percentage of package-manager installs that came from an internal source.
- Median days from vendor release to approved version in the internal source (shows the mirror is not creating patch lag).
- Number of unapproved Scoop buckets or Chocolatey sources found in inventory.
Common failure patterns
- Assuming the hash check means safe. The hash proves the file matches the manifest. A compromised vendor build, a malicious manifest update or a typosquatted package ID all pass. Use
--idwith--exactand a named--sourcein scripts rather than name searches. - Disabling Store certificate pinning to fix TLS inspection. This trades a proxy error for a man-in-the-middle exposure. Exempt the endpoint from inspection instead.
- Leaving the community Chocolatey feed in production scripts. Install-time downloads depend on vendor URLs that change, and the vendor itself advises against community packages for organisations.
- Ignoring user-scope managers. Scoop installs without UAC, so admin-rights removal alone does not stop it; only application control and inventory do.
- Feed credentials in scripts. Source passwords and tokens copied into deployment scripts or golden images outlive the people who created them.
- Turning on new features by default. Each App Installer release can add capabilities (configuration, the MCP server); not configured usually means enabled.
Framework mapping
| Framework | Reference | How package manager control supports it |
|---|---|---|
| NIST CSF 2.0 | ID.AM-02, PR.PS-01, PR.PS-02 | Software inventory, configuration baselines for package sources, managed software maintenance |
| NIST SP 800-53 Rev. 5 | CM-7, CM-8, CM-11, CM-14, SI-7, SR-11 | Least functionality, component inventory, user-installed software, signed components, integrity checks, component authenticity |
| CIS Controls v8.1 | Control 2 (Inventory and Control of Software Assets), Control 4 (Secure Configuration of Enterprise Assets and Software) | Authorised software list and enforced package manager configuration |
| ISO/IEC 27001:2022 Annex A | 8.19 Installation of software on operational systems | Procedures controlling software installation |
| MITRE ATT&CK | T1072, T1195.002, T1204.002, T1105 | Abuse of deployment tools, compromised software supply chain, user-run malicious installers, tool transfer |
Practitioner checklist
- Import the current App Installer ADMX and ADML into the Central Store and track new policies each release.
- Set Allowed Sources and Additional Sources to approved internal sources; disable the default source where an internal one exists.
- Disable Hash Override, Local Manifest Files, Local Archive Malware Scan Override and Store certificate pinning bypass.
- Keep the ms-appinstaller protocol disabled and MSIX SmartScreen checks on.
- Host an internal Chocolatey repository with internalised packages and remove the community feed from managed devices.
- Decide whether Scoop is permitted; if so, approve buckets and enforce with application control.
- Store feed credentials as managed secrets with read-only client scope.
- Alert on integrity overrides and source changes from process command lines.
- Measure the share of installs from internal sources and the time to approve new versions.
Standards and references
- Microsoft Learn: winget source command
- Microsoft Learn: winget install command
- Microsoft: winget-cli repository and Desktop App Installer policy templates
- Chocolatey: Community Repository security
- Chocolatey: Configuration and features
- Scoop: App Manifests
- NIST: SP 800-53 Rev. 5
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Endpoint Software Packaging and Distribution · Application Allowlisting Guide · App Control for Business (WDAC) · Top 10 Supply Chain Attacks