# winget: make a Windows dev environment repeatable

> Use winget to search, install, upgrade and export Windows packages, build a reproducible manifest, and avoid supply-chain traps.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-28

## The short answer

`winget` is the Windows Package Manager. It installs from configured sources (typically `winget` and `msstore`) using package IDs. It is good for **repeatable developer tools**, not for pirated software or random scripts.

The workflow that matters:

1. `winget search` to find the exact ID.
2. `winget install --id ... -e` for a specific package.
3. `winget export` to record what you have.
4. `winget import` on a new PC.
5. Re-check IDs/versions before trusting an old manifest.

## Check it

```powershell
winget --version
winget source list
```

If `winget` is missing, install **App Installer** from the Microsoft Store. On Windows Server, winget support is more limited; check the current docs.

## Install and upgrade

```powershell
winget search powershell
winget install --id Microsoft.PowerShell -e
winget upgrade --id Microsoft.PowerShell -e
winget upgrade --all
```

- `-e` means exact ID; use it to avoid a similar-name package.
- `--scope machine` installs for all users where the package supports it; otherwise it may be per-user.
- `--silent` / `--accept-package-agreements` are convenient for automation; read what you are accepting.
- `winget list` shows installed packages; `winget upgrade` shows available updates.

## Export and import

```powershell
winget export -o C:\dev\packages.json
winget import -i C:\dev\packages.json
```

The export contains package IDs and source names, not the installer binaries. On a new PC:

- review the JSON before importing;
- remove packages you no longer use;
- check whether a package needs a specific scope/version;
- do not import a manifest from an untrusted repository.

For more complex setups, `winget configure` uses DSC configuration files. It is powerful and easy to over-apply; start with a small file and read the plan before applying.

## Security rules

- Prefer the official `winget`/`msstore` sources.
- Verify the package ID and publisher; a similar name can be a different product.
- Do not add a random third-party source just to get one app.
- Do not use winget to install cracked/pirated software.
- Treat an imported manifest as code: it changes your machine.

> **Tip: Pin the tools you care about**
>
> For critical tools, record the exact version in your own notes, even if winget upgrades them. A reproducible environment needs a known version, not just “latest”.

## Sources

- [Microsoft — winget](https://learn.microsoft.com/en-us/windows/package-manager/winget/)
- [Microsoft — winget export](https://learn.microsoft.com/en-us/windows/package-manager/winget/export)
- [Microsoft — winget import](https://learn.microsoft.com/en-us/windows/package-manager/winget/import)

---

Source: https://windows.homes/en/windows/dev/winget/