Purpose and fixed path
4.0.6 lets administrators protect exact IDs from upgrades directly initiated by the Winget module on one PC. The policy is not a global rule for other computers.
C:\ProgramData\Kraugh\MaintenanceToolkit\exceptions\winget-exception.jsonThe path is shared by EXE, BAT and PS1 entry points, elevated interactive use and SYSTEM tasks. Versions earlier than 4.0.6 ignore the file.
1. Identify the computer and package IDs
Use the target’s local computer name without its domain and exact IDs recognised by Winget on that machine. A display name is insufficient: verify identifiers in the Winget JSON export. The example contains placeholders and must be adapted before use.
{
"schemaVersion": "1.0",
"computerName": "TARGET-PC",
"mode": "exclude_packages",
"excludedPackageIds": [
"Vendor.ProtectedPackage"
]
}2. Create and protect the file
- On the target PC, with administrator privileges, create the exceptions directory at the fixed path and save the JSON as UTF-8.
- Replace TARGET-PC and placeholder IDs. schemaVersion must be the string 1.0.
- Set folder and file ownership to Administrators (SID S-1-5-32-544) or SYSTEM (S-1-5-18), remove inherited permissions and grant FullControl only to these two principals. Do not use links or reparse points.
- Verify SYSTEM read access. Ordinary users must not be able to modify the file. Keep corporate policies out of public packages.
3. Choose the mode
| Mode | Effect |
|---|---|
| exclude_packages | Exclude listed IDs; the array must contain at least one ID. |
| block_module | Block the entire Winget module; use excludedPackageIds: []. Other modules remain independent. |
IDs match case-insensitively. Wildcards, duplicates and command-line options are rejected. A wrong computer, unsupported schema, invalid JSON, unsafe permissions or a read failure blocks the module without a fallback to global upgrades.
4. Verify the plan before upgrading
MT validates the complete JSON export, filters protected IDs and invokes individual upgrades with --id --exact --source --skip-dependencies, without --all or --force. No permanent pins are added or removed. Verify the plan read-only before enabling maintenance.
An export with code 0 may warn about applications not associated with a source: these applications remain outside the plan. Allowed packages are installed candidates, not necessarily available upgrades. A successful command does not certify each installed version.
5. Inspect results and coverage
Exceptions produce WARN and partial coverage, not a false fully updated result. Inspect the summary, winget-exceptions-status.json in the session directory and maintenance.data.wingetExceptions in the DMT inventory snapshot.
The user reported a SYSTEM MSI upgrade to 4.0.6 with exit code 0, verified version, an unchanged eight-exception file and preserved GPO task configuration. A live selective Winget upgrade remains unverified. Recheck preservation in your deployment. Plan checks were read-only and do not certify all selective installers. On failure or timeout, the summary may lose a restart requirement observed during processing: inspect individual command outcomes.
Protection limits
The policy controls direct Winget targets and disables Winget dependency processing. It cannot guarantee that an installer will not modify bundled prerequisites, and it does not block application self-updates, Microsoft Update, OEM tools or external commands. Use block_module to suspend all operations of the module; assess other engines separately.
windows_update-exception.json and other future exception files are not implemented in 4.0.6. Verify any non-blocking pin behaviour with explicit upgrades before use.
Changing or removing exceptions
Keep a backup before editing IDs and revalidate the policy. To deliberately remove all exceptions, archive the file outside exceptions: normal Winget processing resumes on the next run. Do not leave an empty or malformed file. Do not edit or remove the policy while MT is running.
Maintenance Toolkit 4.1
The Languages menu (H) selects Italian, English, French, Spanish, German, Simplified Chinese or Japanese. The five new translations cover menus and 4.1 workflows; some historical diagnostics use English fallback. Documentation and the website are available in Italian and English.
MT updates, SYSTEM scheduling and standalone/GPO management →
4.1.2: verified installation detection fix
Malformed uninstall paths belonging to unrelated programs no longer block MT installation detection on Windows PowerShell 5.1. Invalid MT registrations remain blocked. Affected 4.1.1 installations need a verified manual MSI/ZIP upgrade. The final signed packages passed fresh MSI installation and manual MSI/ZIP upgrades from 4.0.6 and 4.1.1 on Windows 11 / PowerShell 5.1, installed SelfTest, data/task preservation, signed-script tamper rejection and locked-file ZIP recovery. No maintenance or automatic restart was executed. Windows 10, real GPO/corporate SMB and live selective Winget are not certified by these tests. GPO remains responsible for managed installations. Seven UI languages are available, with partial translation coverage and English fallback; documentation remains Italian/English. Earlier public packages remain unchanged.