Preview packages with winget upgrade, then use winget upgrade --all to attempt available updates; unknown-version packages and apps WinGet cannot identify may be omitted.

Conceptual flow of previewing WinGet updates, reviewing selected apps, and checking results after updating

What WinGet can update

WinGet is the Windows Package Manager command-line client, delivered through App Installer on supported Windows 10/11 versions. It can update packages it identifies and matches to an available release; it does not cover every installed program. See the Microsoft overview. If the command is unavailable, check that App Installer is installed and that this Windows user has signed in for the first time; WinGet registration may take place asynchronously afterward. If it remains unavailable, follow Microsoft’s installation and troubleshooting guidance.

Preview and choose updates

Run winget upgrade to preview available updates before winget upgrade --all. Review package IDs and versions; use an ID to update one package or defer a change. Microsoft says --all attempts updates for installed apps with an available update. Packages with unknown installed versions may be skipped unless --include-unknown is used, which broadens the target set.

Expert perspective: limits, permissions, and patching guidance

NIST SP 800-40 Rev. 4, by Murugiah Souppaya and Karen Scarfone, describes enterprise patch management as identifying, prioritizing, installing, and verifying updates. This general guidance supports review and follow-up; it is not WinGet-specific. Microsoft’s command reference is product guidance, not an independent security audit or package-safety certification. Some installers request elevation when WinGet runs without administrator rights; refusing can fail that package’s install. An elevated prompt may suppress confirmation, and installer behavior varies, so use trusted packages and expect user prompts.

Check pinned packages

winget upgrade --all skips packages with a WinGet pin by default. Before running it, use winget pin list to inspect current pins. If you deliberately want to update a package with a non-blocking pin, --include-pinned can include it; that option does not override a blocking pin. Decide separately whether changing or overriding a pin is appropriate for that package. See Microsoft’s upgrade reference and pin reference.

Run and verify

After reviewing the list, run winget upgrade --all, then run winget upgrade again to check remaining or failed updates. Follow the publisher’s process for failures. Add --include-unknown only after reviewing that broader target set. Portable apps and private company tools may need separate update processes.

Sources