Installing Codex on Windows without administrator rights can fail before the download even begins. OpenAI’s Windows documentation gives a short installation command.
winget install --id 9PLM9XGG6VKS -s msstoreUse that command when it works. Some managed computers do not have a usable winget, and the msstore source may be unavailable. The user can see Codex in Microsoft Store but cannot repair App Installer or change machine-wide policy.
I wrote wingets to cover this narrow case. It uses the Codex Store product ID to find the official packages, downloads them into the user’s profile, and registers them for the current user with Add-AppxPackage. It needs no administrator rights and installs no PowerShell module.
Install Codex first#
Open DawnMagnet’s wingets Gist if you want to inspect the complete source before running it. The following commands save the script under the current user’s LocalAppData and do not write to a system directory.
$wingetsPath = Join-Path $env:LOCALAPPDATA 'wingets\wingets.ps1'
$wingetsDir = Split-Path $wingetsPath
New-Item -ItemType Directory -Force -Path $wingetsDir | Out-Null
Invoke-WebRequest `
-Uri 'https://gist.githubusercontent.com/DawnMagnet/3b05c689a849ba0cfc48cbaf55969d32/raw/wingets.ps1' `
-OutFile $wingetsPathThen install Codex.
powershell.exe -NoProfile -ExecutionPolicy Bypass `
-File $wingetsPath install 9PLM9XGG6VKS-ExecutionPolicy Bypass applies only to the PowerShell process started by this command. It does not persistently change the machine or current-user execution policy. The script selects x64 by default. Windows on Arm devices should request arm64 explicitly.
powershell.exe -NoProfile -ExecutionPolicy Bypass `
-File $wingetsPath install 9PLM9XGG6VKS --architecture arm64Downloads go to %USERPROFILE%\Downloads\wingets by default. You can remove the script and download directory after installation without affecting the registered Codex app. Do not add --force for a first installation. That option removes the existing current-user package first and may also remove application data or settings.
The gap Wingets covers#
The official command depends on Windows Package Manager, the msstore source, and a working App Installer registration on the computer. An administrator can repair or redeploy those components. A regular user often has to stop there.
wingets skips an unavailable or damaged winget client while continuing to use Microsoft services and Windows package registration. It does not elevate privileges or evade organization policy. That distinction matters.
The script follows a compact path.
Codex Store product ID 9PLM9XGG6VKS
│
▼
Microsoft Store catalog returns WuCategoryId
│
▼
Windows Update resolves current Retail packages and dependencies
│
▼
Microsoft CDN download with digest verification
│
▼
Add-AppxPackage registers packages for the current userMicrosoft Store product metadata provides PackageFamilyName and WuCategoryId. The first value checks whether Codex is already installed. The second lets Windows Update resolve the current MSIX, AppX, and dependency packages. The script joins metadata and download URLs by FileDigest instead of assuming that response lists always use the same order.
Downloads are restricted to *.delivery.mp.microsoft.com. After each file is written, the script checks the SHA-1 digest returned by Windows Update over HTTPS. Windows then validates package signatures during installation. SHA-1 verifies the transferred bytes here, while publisher trust remains the job of Windows signature validation.
Why WinStoreRip was removed#
The early version depended on WinStoreRip. Further inspection showed that the target computer also needed PowerShell Gallery access and that package-link discovery depended on a third-party web page. Restricted computers are already prone to network and component failures, so installing another module at runtime added avoidable failure points.
The current wingets.ps1 is a single file. It talks directly to Microsoft Store, Windows Update, and Microsoft CDN. It does not need WinStoreRip or a third-party package-link service.
No administrator rights still has limits#
Wingets registers Store packages only for the current user and does not support --scope machine. If an organization explicitly blocks the package through AppLocker, WDAC, or AppX policy, the script will fail. It does not bypass those controls.
The computer must reach storeedgefd.dsx.mp.microsoft.com, fe3.delivery.mp.microsoft.com, and *.delivery.mp.microsoft.com. GitHub is needed only to obtain the script. If the Gist is inaccessible, download wingets.ps1 on another computer and copy it over.
Only the current Retail channel is supported, and arbitrary historical versions are unavailable. Wingets is not a complete winget replacement. It does not process MSI, EXE, portable, or archive packages from the community repository. Its purpose stays narrow and practical, installing the Microsoft Store release of Codex under regular user permissions.
What I actually tested#
The published version completed 26 tests under both Windows PowerShell 5.1 and PowerShell 7. The matrix covers Chinese and English output, short and long options, option ordering, explicit error boundaries, read-only Store lookup, digest metadata, CDN host restrictions, and a one-byte Range request.
A live query on September 14, 2026 returned OpenAI.Codex 26.908.4834.0 at 774,918,112 bytes. Microsoft CDN answered the Range request with 206 Partial Content. The final validation did not download the complete 739 MiB package again or forcibly uninstall the existing Codex app. Those operations would consume bandwidth or alter the workstation without adding useful coverage.
If the official winget command works, Wingets adds no benefit. Its use case is specific. You can run ordinary PowerShell and reach Microsoft’s Store and update services, but you do not have administrator rights to repair a broken installation path.