Manage Winget Sources Using Windows Registry

This article explains how to configure and control Windows Package Manager (winget) source repositories using the Windows Registry Editor (Regedit). It outlines the primary policy key paths, the specific DWORD values used to enable or restrict standard and third-party sources, and the subkeys utilized for managing allowed and additional package repository lists across a system.

Primary Registry Key Location

The behavior of winget source repositories is managed through Windows Group Policy settings stored in the Windows Registry. The core keys are located at:

• System-wide (All Users):
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsPackageManager
• Current User:
  HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\WindowsPackageManager

If these registry keys do not exist, they must be created manually to enforce policy settings.

Key Values for Managing Repository Sources

Within the WindowsPackageManager key, administrators can configure specific REG_DWORD values (set to 1 to enable or 0 to disable) to manage which repositories winget can query:

• EnableWindowsPackageManagerDefaultSource
  Controls access to the official Windows Package Manager community repository (winget). Set to 0 to completely block the default repository.
• EnableMicrosoftStoreSource
  Controls access to the Microsoft Store as a winget source (msstore). Set to 0 to prevent winget from searching or installing applications from the Microsoft Store.
• EnableAdditionalSources
  Determines whether users are allowed to add custom, third-party repositories via the winget source add command. Setting this to 0 disables user-defined sources.
• EnableAllowedSources
  Restricts winget to query only repositories explicitly defined in the administrative policy.

Managing Source Whitelists and Additional Sources

To enforce specific repositories, configure the following subkeys directly under WindowsPackageManager:

1. Allowed Sources Subkey

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsPackageManager\AllowedSources

When EnableAllowedSources is active, only sources defined inside this subkey will be accessible to the client.

2. Additional Sources Subkey

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsPackageManager\AdditionalSources

This subkey allows administrators to provision enterprise or private repository endpoints that are automatically registered and trusted by winget on the client machine.

Verifying Repository Configuration

After modifying these keys in the Windows Registry, open a command-line interface (Command Prompt or PowerShell) and run:

winget source list

This command outputs all currently active and allowed package sources, reflecting the policies applied via the registry.