Disable Third-Party Winget Sources via Regedit

This guide explains how to disable third-party package source repositories in the Windows Package Manager (winget) using the Windows Registry Editor (Regedit). By configuring App Installer policy keys in the registry, system administrators can prevent users from adding, modifying, or installing packages from external and untrusted package sources, locking winget down to default or organization-approved channels.

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog.
  2. Type regedit and press Ctrl + Shift + Enter (or click OK) to launch the Registry Editor with administrative privileges.
  3. If prompted by User Account Control (UAC), click Yes.

Step 2: Navigate to the App Installer Policy Key

In the Registry Editor address bar, paste the following path and press Enter:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

Check if a subkey named AppInstaller exists under Windows. If it does not exist:

  1. Right-click the Windows folder.
  2. Select New > Key.
  3. Name the new key AppInstaller.

Step 3: Disable Additional Package Sources

  1. Click on the AppInstaller key in the left navigation pane.
  2. Right-click anywhere in the empty area in the right-hand pane.
  3. Select New > DWORD (32-bit) Value.
  4. Name the new value EnableAdditionalSources.
  5. Double-click EnableAdditionalSources and set its Value data to 0.
  6. Click OK to save the changes.

Setting EnableAdditionalSources to 0 explicitly prevents the addition and usage of custom or third-party repositories via the winget source add command.

Step 4: Verify the Configuration

To verify that the policy is working:

  1. Open PowerShell or Windows Command Prompt.

  2. Try adding a custom source by running:

    winget source add -n test https://example.com/source

  3. Winget will display an error message stating that the operation is blocked by Group Policy or system administration settings.