winget upgrade all packages requiring admin priviledges at once

[akaegi]

Description of the new feature / enhancement

I'd like to have the possibility to filter all packages that require admin priviledges and upgrade them in a single command. This way I could run an elevated command prompt and run the upgrade from there.

Background: My company requires to use a different user for gaining admin rights. This way, the update process is very cumbersome requiring to enter username, password and second factor for every upgradable package that requires elevation. Running winget upgrade --all in an elevated command prompt (under the admin user) is not an option - then the packages with "local installation" would go to the admin user instead of my "default user".

Any thoughts on this or have I misunderstood something?

Side question: Is "package requires elevated rights" the same as package requires "system scope"? Can I inspect this for a given package? If yes I could do the filtering myself and write such an update script.

Proposed technical implementation details

Something like winget upgrade --all-system-scope to upgrade all packages requiring elevated access at once.

[denelon]

I wouldn't necessarily equate the two, but generally, yes it means you need to either install the package in admin mode or grant permissions. Some installers may perform "system" vs. "user" install when elevated, and some may need elevation to install a service component, or they just didn't remove that unnecessary portion of the install process. There are a few classes of installer scenarios that need to be reasoned about here.

There is a key in the manifest for "requiresElevation" or "prohibitsElevation".

Each package requires its own "prompt" for elevation, but I can certainly see an optimization like: Upgrade everything that doesn't require elevation. winget upgrade --all --<doesn't require elevation>

When we think about "scope" in WinGet we're thinking about things that install per user or per machine. Elevation sadly isn't consistently used across all installers, so I'm not sure that necessarily solves the problem you are encountering.

If you can launch an elevated Terminal (Shell) then upgrade the remaining packages, it might help so you don't get a UAC prompt for all the packages.

[akaegi]

Thank you for you detailed answer @denelon! The --<doesn't require elevation> flag you are proposing seems exactly what I'm looking for. Then I could run that from a normal shell and later on another winget upgrade --all from an elevated shell (running under the admin user). That would make the upgrade process much more pleasant IMO.

[Trenly]

[Policy] Command-Upgrade

[andrewgwallace]

The following command will run the upgrade of all applications in an elevated PowerShell window with Administrative privileges. Start-Process "powershell" -ArgumentList "winget upgrade --all --accept-package-agreements --accept-source-agreements" -Verb RunAs

[IngwiePhoenix]

So did this end up becoming a thing? I have a good amount of software that is updated regularily and on my work laptop, I have to type out a stupidly long login due to the way the AD is set up... It would be great to save myself from sore fingers x)

Jokes aside though; I tried the PowerShell line and the window just...disappeared. I suppose that was not supported after all? Either way, really hoping for a solution to this that won't flood me with UACs.

Thanks!

[cmahnke]

This (and the opposite - that is running winget upgrade --all only on packages that won't need privilege elevation) is urgently needed. Especially in a managed environment, where a uses has some right to install things the current update process is painfully slow / complicated...