Automating Software Provisioning on Windows with PowerShell and WinGet

Configuring a new Windows workstation manually consumes hours downloading installers, clicking through wizards, and verifying consistent baseline tools across machines. Using Windows Package Manager (winget) paired with a small PowerShell script turns workstation provisioning into a repeatable task for IT teams and security practitioners.

How the Provisioning Pair Works

The workflow relies on two lightweight files kept in the same directory:

1. Default.cmd: A minimal batch launcher that locates installer.ps1 in the same folder (%~dp0installer.ps1) and invokes PowerShell with execution policy bypass for the current run.
2. installer.ps1: The provisioning script that checks prerequisites (such as WinGet availability), installs a curated software baseline via winget install, and logs status per package.

Downloads

• Download Default.cmd
• Download installer.ps1

Operational Best Practices

• Inspect before execution: Always review Default.cmd and installer.ps1 line by line and tailor the package IDs to your organization’s internal security and compliance policies before running them in production.
• Pin exact package IDs: Specify explicit --id and --exact flags in winget commands to prevent ambiguous name matches.
• Verify source repositories: Confirm whether your environment allows public winget community manifests, Microsoft Store packages, or requires an internal private repository/mirror.

If you need a full interactive GUI with profile management, system inventory, optional Appx cleanup, and timestamped deployment reports, check out the later SetupHub project as well.