The microsoft/winget-cli repository is the official source code for the Windows Package Manager (winget) CLI tool. Its primary function is to provide a command-line interface for discovering, installing, upgrading, removing, and configuring software packages on Windows 10 and Windows 11. Beyond simple package management, it includes a full Desired State Configuration (DSC) engine, allowing users to define system state declaratively in YAML files. It also exposes COM APIs (Microsoft.Management.Deployment and Microsoft.Management.Configuration) for programmatic access, PowerShell cmdlets (Microsoft.WinGet.Client), and an MCP server for AI tool integration. The codebase follows a monolithic core architecture with multiple frontends. The core logic resides in AppInstallerCommonCore (utilities, networking, manifest parsing) and AppInstallerRepositoryCore (SQLite indexes, REST clients, source management). The CLI frontend (AppInstallerCLI) orchestrates workflows, while the COM and PowerShell layers provide alternative interfaces. Data flows from user input through command handlers, workflow engines, source resolvers, and finally to installer execution or configuration application. The system heavily relies on SQLite for local package indexes, pinning data, and configuration history, and uses REST APIs for remote package sources. Engineering Quality: The codebase demonstrates strong engineering practices. Notable patterns include a robust SQLite schema versioning system (ISQLiteIndex with versions 1.0-2.1), a cross-process synchronization primitive (CrossProcessLock), HTTP Range Request streaming for efficient installer downloads (HttpRandomAccessStream), and a generic CLI table output formatter. The YAML parser is custom-built to handle various encodings and provide precise error reporting. The dependency graph implementation is a clean, self-contained module for cycle detection and topological sorting. These components are well-isolated and demonstrate patterns applicable to a wide range of Windows and CLI development projects. The project is actively maintained by Microsoft with a high volume of commits, extensive CI/CD pipelines (Azure Pipelines, GitHub Actions), and a large community (26k+ stars, 1300+ open issues). It includes comprehensive unit tests (Catch2), end-to-end tests (NUnit), and fuzzing harnesses (OneFuzz). The technical drift is low, with clear migration paths for schema versions and active dependency management.
AutoRuns is a PowerShell module for live incident response that enumerates Windows autorun artifacts used by legitimate programs and malware to achieve persistence. It scans over 20 categories of autostart execution points (ASEPs) including registry keys (Run, RunOnce, BootExecute, AppInit, etc.), file system locations (Startup folders), scheduled tasks, WMI subscriptions, services and drivers, Office addins, and more. The module provides three main functions: Get-PSAutorun to collect artifacts, New-AutoRunsBaseLine to create a baseline snapshot, and Compare-AutoRunsBaseLine to compare two baselines for change detection. It supports optional file hashing (MD5, SHA1, SHA256) and digital signature verification via Get-AuthenticodeSignature. The architecture is a single PowerShell script module (AutoRuns.psm1) with internal helper functions for registry reading, path normalization, and command-line parsing. It relies solely on PowerShell 4.0+ and Windows built-in APIs, with no external dependencies. The module is designed for forensic analysts and incident responders to quickly identify persistence mechanisms on a live Windows system.
This is a mature PowerShell module (`powershell-yaml`) that provides high-fidelity YAML serialization and deserialization for PowerShell objects. It wraps the popular YamlDotNet library and extends it with a powerful typed class system (`YamlBase`), custom type converters, metadata preservation (comments, tags, scalar styles, mapping styles), case-sensitive key support via `[YamlKey]` attribute, and duplicate key detection to prevent data loss. The architecture is a hybrid: a PowerShell script module (`powershell-yaml.psm1`) that loads a C# class library compiled for netstandard2.0, providing both synchronous cmdlets (`ConvertTo-Yaml`, `ConvertFrom-Yaml`) and public API functions for metadata manipulation. The C# code uses Assembly Load Context (ALC) isolation for YamlDotNet to avoid conflicts with other modules. The module supports both traditional hashtable output and an enhanced PSCustomObject mode with full round-trip metadata preservation, as well as strongly-typed deserialization into PowerShell classes inheriting from `YamlBase`. This is a production-quality library with extensive test coverage, active maintenance, and well-documented examples.
DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
IntuneWin32App is a PowerShell module designed for managing Windows 32-bit line-of-business applications in Microsoft Intune. It automates the entire lifecycle of Win32 app management, including packaging applications into the .intunewin format, creating/updating/deleting apps in Intune via Microsoft Graph API, managing assignments (to groups, all users, or all devices), and handling relationships such as dependencies and supersedence. The module implements multiple OAuth 2.0 authentication flows (interactive, device code, client secret, and client certificate) without external dependencies, providing a self-contained solution for secure Graph API interactions. The architecture follows a modular PowerShell module pattern with clear separation of concerns: public functions (user-facing cmdlets) in the Public directory, private helper functions in the Private directory, and a central module manifest. Key entry points include Connect-MSIntuneGraph for authentication, New-IntuneWin32AppPackage for creating .intunewin packages, and various Add/Set/Get functions for app and assignment management. Data flows involve authentication token acquisition, optional app packaging, Graph API calls for app creation/modification, and subsequent assignment/relationship operations. The module relies on Microsoft Graph API endpoints, Azure AD for authentication, and optionally the IntuneWinAppUtil.exe tool for packaging. Notable engineering practices include consistent parameter validation, standardized error handling, reusable API communication logic with retry/pagination mechanisms, and a clean pattern for constructing JSON payloads using ordered hashtables. The module demonstrates significant effort in implementing native OAuth 2.0 flows and maintaining compatibility with evolving Intune features through regular updates.