PowerShell Modules: Finding, Installing and Trusting Them Safely

Install-Module downloads code from the internet and makes it available to run on your machine. Most of the time that’s fine, and the PowerShell Gallery hosts a lot of genuinely excellent work. But it’s worth understanding what you’re agreeing to, because the gallery is not curated the way people assume.

Finding a module

# Search the gallery
Find-Module -Name *ActiveDirectory* | Select-Object Name, Version, Author, PublishedDate

# What's already available locally
Get-Module -ListAvailable | Select-Object Name, Version | Sort-Object Name

Before installing anything, look at three things: who published it, how many downloads it has, and when it was last updated. A module with four downloads published last week, whose name is one character from a popular one, deserves suspicion.

Find-Module -Name PSWindowsUpdate | Format-List Name, Author, CompanyName, PublishedDate, ProjectUri

A ProjectUri pointing at a real repository you can read is a good sign. No project URI at all, for a module you’re about to run as administrator, is not.

Read it before you run it

This is the step almost everyone skips, and it costs about two minutes:

# Download without installing
Save-Module -Name SomeModule -Path C:\Temp\Inspect -Repository PSGallery

# Then read it
Get-ChildItem C:\Temp\Inspect -Recurse -Include *.ps1,*.psm1 |
    Select-String -Pattern 'Invoke-WebRequest|Invoke-Expression|DownloadString|Start-Process|-enc '

You’re not auditing the whole thing. You’re looking for a module that fetches and executes remote code, or launches processes you weren’t expecting. A disk-reporting module has no business calling Invoke-Expression on a downloaded string.

Installing sensibly

# Sensible default: current user, specific version, from a known repository
Install-Module -Name PSWindowsUpdate `
    -Scope CurrentUser `
    -RequiredVersion 2.2.1 `
    -Repository PSGallery

• -Scope CurrentUser installs to your profile, needs no admin rights, and can’t affect other users or services.
• -RequiredVersion pins it. Without this, a rebuilt machine picks up whatever is current, which may behave differently.
• -Repository is explicit about where it came from. Worth being deliberate if you’ve added others.
• Avoid -Force as a habit. It suppresses exactly the prompts that are trying to tell you something.

Trusting the repository

The first install prompts about an untrusted repository. Many people silence it permanently:

# Common, and worth thinking about
Set-PSRepository -Name PSGallery -InstallationPolicy Trusted

That’s convenient and it’s also removing a checkpoint. On a personal machine, reasonable. On a build server that installs modules automatically, you’ve made it silently accept anything. Prefer pinned versions and an internal repository for anything production.

Running an internal repository

If you’re deploying modules across an estate, host your own. An internal NuGet feed, an Azure Artifacts feed, or even an SMB share registered as a repository gives you a curated set that you control:

Register-PSRepository -Name Internal `
    -SourceLocation '\\server\psrepo' `
    -InstallationPolicy Trusted

Keeping things tidy

# What's installed and where
Get-InstalledModule | Select-Object Name, Version, InstalledLocation

# Multiple versions accumulate. Check before removing
Get-InstalledModule -Name SomeModule -AllVersions

# Update deliberately, not automatically
Update-Module -Name SomeModule -RequiredVersion 2.3.0

Modules don’t replace old versions when they update. They install alongside. Over time you accumulate several versions, and PowerShell loads the newest unless told otherwise. Worth an occasional clear-out.

Glossary

Frequently asked questions

Is the PowerShell Gallery safe?

Mostly, but it isn’t vetted. Anyone can publish. Treat it like npm or PyPI: check the author and download count, and read the code for anything you’ll run with elevated rights.

Should I install modules for all users or just me?

CurrentUser by default. It needs no admin rights and can’t affect services or other users. Use AllUsers only when a scheduled task or service genuinely needs it.

Why does PowerShell warn about an untrusted repository?

Because the gallery is open publication, so PowerShell can’t vouch for what you’re about to download. You can mark it trusted, but understand you’re removing a prompt rather than adding safety.

How do I stop a module updating and breaking my scripts?

Pin with -RequiredVersion at install time, and update deliberately rather than running Update-Module across everything.

What’s the difference between Install-Module and Import-Module?

Install-Module downloads it onto the machine, once. Import-Module loads an already-installed module into the current session, and modern PowerShell usually does that automatically when you call one of its commands.

Disclosure: this post may contain affiliate links. If you buy through one of them, we may earn a small commission at no extra cost to you. We only recommend products we’ve tested or genuinely rate.