Fix: winget Download Failed / Network Errors — 6 Fixes

winget install failing with "Failed to download installer", "Network error", or just hanging at 0%? Here are 6 fixes that resolve 99% of winget download issues.

Fix 1 — Switch the downloader to wininet

Single biggest fix. winget's default downloader is Delivery Optimization (DO) — Microsoft's P2P-style downloader that's intended for Windows Update. It frequently fails outside of corporate Windows networks.

Switch to the simpler HTTPS downloader:

winget settings

In the JSON editor that opens, add or update:

{
  "network": {
    "downloader": "wininet"
  }
}

Save. wininet downloads files like a browser does — much more reliable.

This resolves ~70% of all winget network errors. Try this first before anything else.

Fix 2 — Check basic internet

If wininet doesn't help, verify the obvious:

Test-NetConnection cdn.winget.microsoft.com -Port 443
Test-NetConnection github.com -Port 443

Both should return TcpTestSucceeded: True. If False:

• Check Wi-Fi / Ethernet connection
• Restart your router
• Try with mobile hotspot to isolate (if it works on hotspot, the issue is your network)
• Disable VPN and retry

Fix 3 — Configure proxy (corporate networks)

On corporate networks, winget needs explicit proxy config. Windows system proxy is fine for browsers but the default winget downloader bypasses it.

After switching to wininet (Fix 1), set system proxy via Windows Settings:

• Settings → Network & Internet → Proxy
• Enable Use a proxy server
• Enter your corporate proxy URL and port

wininet downloader inherits this. Restart Terminal and retry winget.

For PAC-script proxies, add to winget settings:

{
  "network": {
    "downloader": "wininet"
  }
}

wininet uses the same WPAD / PAC resolution Windows itself does.

Environment variable proxy

You can also set:

$env:HTTPS_PROXY = "http://proxy.company.com:8080"
$env:HTTP_PROXY  = "http://proxy.company.com:8080"
winget install --id <ID>

Useful in scripts where you don't want to change system settings.

Fix 4 — Fix TLS / certificate errors

If you see "The remote certificate is invalid", "SSL handshake failed", or "The server certificate is not trusted", your Windows root certificate store is out of date.

Refresh it:

# Run in Admin PowerShell
certutil -generateSSTFromWU "$env:TEMP\roots.sst"
Import-Certificate -FilePath "$env:TEMP\roots.sst" -CertStoreLocation Cert:\LocalMachine\Root

This pulls the latest trusted root certificates from Microsoft. Reboot, then retry winget.

If your machine is corporate and uses a custom CA (TLS interception), make sure that CA is in Cert:\LocalMachine\Root — ask IT for the cert.

Fix 5 — Antivirus / firewall whitelisting

Real-time AV scanning every downloaded byte can stall downloads to the point of timeout. Whitelist:

Windows Defender:

1. Windows Security → Virus & threat protection → Manage settings → Add or remove exclusions
2. Add Process: winget.exe
3. Add Process: msiexec.exe
4. Add Folder: %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache

Third-party AV (Bitdefender, Norton, Kaspersky, etc.): check the vendor docs for "process exclusions."

Windows Firewall:

# Allow winget through firewall (admin)
New-NetFirewallRule -DisplayName "winget" -Direction Outbound -Program "C:\Path\To\winget.exe" -Action Allow

But usually firewall isn't the issue — AV scanning is.

Fix 6 — Increase download timeouts

If your connection is slow but stable, default 60-second timeouts may kill downloads:

winget settings

{
  "network": {
    "downloader": "wininet",
    "doProgressTimeoutInSeconds": 300
  }
}

5-minute timeout. Helpful on slow corporate uplinks.

Specific error scenarios

"Failed when searching source: winget"

Index download failed, not the installer. See Winget search not working.

"Insufficient storage space"

winget downloads to %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache and then extracts. Need ~2× installer size free on C: drive.

Clear winget cache:

Remove-Item "$env:LOCALAPPDATA\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache\Local\Microsoft\WinGet\Cache\*" -Recurse -Force -ErrorAction SilentlyContinue

"Connection was forcibly closed"

CDN or your network dropped the connection mid-download. Retry. If repeated, try wininet downloader (Fix 1) or a different network.

"Could not connect to remote server"

DNS or network unreachable. Try nslookup cdn.winget.microsoft.com — should return Microsoft IPs. If it doesn't, your DNS is misconfigured:

# Reset DNS to Google
Set-DnsClientServerAddress -InterfaceIndex (Get-NetAdapter | Where-Object Status -eq Up).ifIndex -ServerAddresses 8.8.8.8,1.1.1.1
ipconfig /flushdns

Downloads work in browser but not winget

Almost always Delivery Optimization. Apply Fix 1.

Downloads work on home network but not at work

Corporate firewall blocking. Apply Fix 3 (proxy config).

Verify after fixing

After applying fixes:

winget source update
winget install --id Mozilla.Firefox -e --log "$env:TEMP\winget.log" --verbose

If you see network activity in winget.log and the install completes — you're fixed.

Permanent prevention

Add this to your winget settings as a baseline for any new machine:

{
  "$schema": "https://aka.ms/winget-settings.schema.json",
  "network": {
    "downloader": "wininet",
    "doProgressTimeoutInSeconds": 300
  },
  "installBehavior": {
    "preferences": {
      "scope": "user"
    }
  }
}

These four settings prevent 90% of network and permission issues from day one.

What's next?

• Winget search not working: 8 fixes → — index/source errors
• Stuck/hanging fixes → — when downloads stall
• All winget error codes → — full reference
• Installer hash does not match → — post-download errors