Running Winget without users being administrators.

[heinejeppesen]

Hi,

I'm deploying a number of hosts (Windows 11 25H2) for use as Tier 0 management jumphosts.
For this reason, they are unmanaged with any management tools, such as Intune, ConfigMgr etc.

Users are not permitted to by local administrators.
So basically, a standard PC in an Enterprise environment.

Given the limitation in MSIX to install Winget in SYSTEM context, I install it as the user.
I install it like this:

_Invoke-WebRequest https://github.com/microsoft/winget-cli/releases/latest/download/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle -OutFile winget.msixbundle;

Add-AppxPackage .\winget.msixbundle_

This is done using a Scheduled Task, that runs for every user logging in and in the users context and it works.
At least when the user is local admin. As non admin, winget does get installed too.

Meaning I can run Winget, but it fails with:

This is quite easily fixed with winget source reset and winget source update.
But... The two commands requires the user being local admin, which is not the case for most enterprise setups.

And there is no way to perform these tasks in any other way.
Winget does not (officially) run in SYSTEM context and the users cannot be local admin.

So basically we are stuck just before the finish line.

I get that, due to how MSIX works, that it's difficult to run in SYSTEM context.

But this leaves the tool in a place, where I really don't see the use-cases for it.
Assuming users are local admins seems complete counterintuitive, to what every single organization has been aiming for, for decades?

Is there literally no way, for non-admins, to make winget work in a controlled way?

If not, the use-case for winget seems very confusing, since it can't run in SYSTEM context and users must be local admins?