Execute Script - Winget App Audit

Summary

This internal monitor executes the Winget App Audit script on Windows machines where the auditing component of the Winget Auto Update solution is enabled. It detects computers that have not been audited in the past seven days and triggers the script to collect up‑to‑date application inventory data.

Auditing is considered enabled when the client‑level Winget Auto Update EDF is set to Enabled for Servers and Workstations, Enabled for Workstations Only (for workstations), or Audit Only, and the computer is not excluded at the computer, location, or client level. Computers where the audit script has failed more than twice in the last seven days are temporarily excluded to avoid repeated failures.

Dependencies

• Script - Winget App Audit
• Custom Table - pvl_winget_audit
• Solution - Winget Auto Update

Target

Global

Alert Template

△ Custom - Execute Script - Winget App Audit

Changelog

2026-07-01

• Updated the monitor query to use the new Winget Auto Update EDF structure, including the Audit Only option.
• Removed the dependency on the agentignore table; exclusions are now fully driven by the EDFs.
• Adjusted logic to support the new single‑pass audit script that internally handles both system and user contexts.

2025-04-10

• Initial version of the document