How to Install Programs on Windows 11 & 10 Safely (Store, winget, Official Sites)

To install a program on Windows 11 or 10, the safest route is the Microsoft Store: open it, search for the app, and click Get or Install. For apps not in the Store, download the installer from the developer's official website, open the downloaded .exe or .msi file, approve the User Account Control prompt, and follow the setup wizard, choosing Custom install when offered so you can clear bundled extras. Power users can also run winget install in Terminal. Here is the step most guides skip: check where the installer came from before you run it. Search ads and "download" sites often serve repackaged installers that add adware or worse. Right-click the downloaded file, choose Properties > Digital Signatures, and confirm the signer is the real developer. That ten-second check prevents most install-related trouble.

Ethan's father wanted a free photo editor and clicked the first result in a search, which was an ad. The download was named like the real program, installed it, and also installed a browser toolbar, a "PC speed booster" and a new search engine in every browser. Two weeks later his PC was slow and full of pop-ups. At Jake's shop they uninstalled the extras, reset the browsers, and reinstalled the photo editor from the Microsoft Store in under a minute. Jake showed him the habit that would have avoided it all: Store first, official site second, and a quick look at the digital signature before running anything. This page explains every way to install programs on Windows, and how to tell a safe installer from a risky one.

Installing software needs an administrator account for most desktop programs; Store apps and some per-user programs install without it. If you use a standard account, Windows asks for an administrator's password, which is a useful safety check on a family PC.

Ways to install programs, compared

The top three rows cover almost every program most people need. Treat everything below them as a last resort, and never as a shortcut to save a minute of searching for the official page.

Install from the Microsoft Store

1. Open the Microsoft Store from Start or the taskbar.
2. Search for the app by name, or browse categories.
3. Check the publisher name under the app's title; it should be the real developer, such as Adobe, Mozilla or Spotify.
4. Click Get, Install or the price for paid apps. Sign in with your Microsoft account if asked.
5. When it finishes, click Open, or find the app in Start.

The Store now carries many traditional desktop programs, not just small apps: browsers, Office, media players, Zoom, WhatsApp, Spotify, VLC, GIMP and plenty more. Apps from the Store install without bundled offers and update automatically through the Store's Library. If an app exists in the Store, that is the easiest and safest way to get it, exactly what fixed Ethan's father's photo editor problem.

If the Get button is grayed out, the app may not support your Windows version or device type, such as an Arm PC; the app page lists system requirements under its details.

Install from the developer's website

1. Go to the developer's official site. Type the address yourself, or search and skip anything labeled Sponsored or Ad.
2. Find the Download page and choose the Windows version that matches your PC (see the architecture section below).
3. Save the file; it lands in Downloads unless your browser asks.
4. Before running it, check its digital signature as shown in the next section.
5. Double-click the file. Click Yes at the User Account Control prompt if it shows the expected publisher.
6. In the setup wizard, choose Custom or Advanced install when offered, and clear any checkboxes for extra software, toolbars or changing your browser's home page.
7. Finish, then open the program from Start.

Many installers offer an option to create a desktop shortcut and to start the app at sign-in. Decline startup unless you need it; too many startup apps slow sign-in.

How to spot fake download sites

• Sponsored results: search ads can point to look-alike sites. Scroll past them to the organic result, or type the developer's address directly.
• Odd addresses: look for misspellings, extra words or unusual endings, such as photo-editor-free-download.example instead of the developer's own domain.
• Multiple big green Download buttons: real sites have one clear download link; ad-filled portals show several, most of them ads.
• A "downloader" instead of the program: a small file that then downloads the real program plus extras is a common bundling trick.
• Pressure: countdowns, "your PC needs this" warnings or claims that a free program costs money are signs to leave.

When unsure, search the program's name on Wikipedia, which usually links to the official website, and go from there.

Bookmark the official download pages for programs you install regularly, such as your browser and media player; next time, the bookmark takes you straight there with no searching at all.

Unblock a downloaded file

Windows marks downloaded files as coming from the internet. Most installers run normally with this mark and show a security prompt. If an installer, script or help file refuses to run or shows blank content, right-click it, choose Properties, and check Unblock at the bottom of the General tab, then click OK. Only unblock files you trust; the mark is part of what protects you from harmful downloads.

Files extracted from a blocked ZIP inherit the mark too, so unblock the ZIP itself before extracting if a portable app's help files or scripts refuse to work.

Check a download's digital signature

1. In File Explorer, right-click the downloaded installer and choose Properties.
2. Open the Digital Signatures tab. If there is no such tab, the file is unsigned.
3. Check the Name of signer matches the developer, for example "Mozilla Corporation" for Firefox.
4. Select it and click Details; it should say This digital signature is OK.

The User Account Control prompt shows the same information: a verified publisher name means the file is signed. An unsigned file, or one signed by an unrelated company, is a red flag. Small open-source projects sometimes ship unsigned installers; for those, download only from the project's official site or a reputable repository, and scan the file with Microsoft Defender before running it. Our guide to scanning with Microsoft Defender shows how.

Some legitimate apps are signed by a parent company or distributor rather than the brand you know; if the signer name surprises you, search it together with the program's name to confirm the relationship before running the file.

Install with winget (Windows Package Manager)

winget is built into Windows 11 and current Windows 10. It installs apps from a curated catalog that points to official download sources.

1. Right-click Start and open Terminal.
2. Search: winget search firefox.
3. Install by exact ID: winget install --id Mozilla.Firefox.
4. Approve any User Account Control prompt. The first time, type Y to accept the source agreement.

To install several apps in one go, chain commands: winget install --id Mozilla.Firefox; winget install --id VideoLAN.VLC; winget install --id 7zip.7zip. winget upgrade --all updates every app winget recognizes, which is a quick way to keep a PC current. It is the fastest way to set up a new PC with your usual apps, and avoids download sites entirely.

If winget is missing or says it is not recognized, update App Installer from the Microsoft Store; winget is delivered as part of it.

Move your apps to a new PC with winget

winget can save a list of your installed apps and reinstall them on another PC. On the old PC, run winget export -o apps.json, which writes the list to a file. Copy apps.json to the new PC, then run winget import -i apps.json; winget installs each app it recognizes from official sources. Apps not in winget's catalog are listed so you can install them by hand. It turns hours of downloading into minutes, and avoids searching download sites for each app again.

The export file is plain text; open it in Notepad to remove apps you do not want on the new PC before importing. It is also a handy record of what was installed, worth keeping with your backups.

Installs blocked? Check these settings

Choose where to get apps

Windows can restrict app installs to the Microsoft Store. Open Settings > Apps > Advanced app settings > Choose where to get apps. The options are Anywhere, Anywhere, but let me know if there's a comparable app in the Microsoft Store, Anywhere, but warn me before installing an app that's not from the Microsoft Store, and The Microsoft Store only. If you see "The app you're trying to install isn't a Microsoft-verified app", this setting is on the Store-only option. Change it to allow other sources, or find the app in the Store. On a child's PC, leaving it on Store only is a sensible safety measure.

S mode

Windows 11 Home in S mode only runs Store apps, by design. You can switch out of S mode for free in Settings > System > Activation, then Switch out of S mode, which opens a Store page; the switch is one-way and cannot be undone. Stay in S mode if all the apps you need are in the Store, since it is more secure and often faster.

Smart App Control

On PCs with Smart App Control on, Windows blocks apps that are unsigned or unknown to Microsoft's reputation service, with a message that Smart App Control blocked an app. It cannot be told to allow one app. Check its status in Windows Security > App & browser control > Smart App Control. Look for a signed version or a Store version of the app first; turning Smart App Control off is possible, and on recent versions it can be turned back on later.

Installing apps on a child's account

Child accounts in Microsoft Family Safety can require a parent's approval for Store downloads and purchases. When a child tries to install an app, the parent receives a request by email or in the Family Safety app and can approve or decline it. Combined with a standard account, which cannot install desktop programs without an administrator password, and Choose where to get apps set to the Store only, this keeps a child's PC free of unexpected software while still letting them ask for apps they want.

Approval requests also work for free apps, so a parent sees everything a child asks to install, not only purchases.

Teenagers who need more freedom can have approval turned off while keeping a standard account, so they can install Store apps on their own but still need a parent for desktop programs that change the whole PC.

"Windows protected your PC" (SmartScreen)

When you run a downloaded program that few people have run, Microsoft Defender SmartScreen shows a blue Windows protected your PC window. It does not mean the file is harmful; it means it is unfamiliar. If you got it from the developer's official site and its signature checks out, click More info, confirm the app and publisher shown, and click Run anyway. If you are not sure where it came from, click Don't run and delete the file. Never turn SmartScreen off to avoid the prompt; it is one of the best protections against fake installers.

SmartScreen also checks files you open from email attachments and messaging apps, and the same advice applies: run it only if you were expecting the file and know who sent it.

When the Microsoft Store will not install

If the Store shows an error such as 0x8000ffff, check the PC's date and time, run wsreset.exe, and sign out and back in to the Store. Our guide to error 0x8000ffff covers every Store fix. While you repair the Store, winget can install many Store apps directly with winget install --id ID --source msstore, using the same catalog.

If the Store is unavailable on a managed or restricted PC, ask whoever manages it; some organizations provide a Company Portal app with approved software instead.

Also check free space on the drive where Store apps install; a full drive causes vague Store errors rather than a clear space warning.

Choose the right version: x64, ARM64 or x86

Download pages often offer several Windows versions. Most PCs need 64-bit (x64). PCs with Snapdragon and other Arm processors, such as many Copilot+ PCs, run ARM64 versions natively and emulate x64 apps, so pick ARM64 when offered. 32-bit (x86) versions still run on 64-bit Windows but are only needed for very old programs or add-ins. To check your PC, open Settings > System > About and read System type, such as "64-bit operating system, x64-based processor" or "ARM-based processor". Our guide to finding your Windows version shows the rest of that page.

When in doubt on an Arm PC, the x64 version usually works through emulation; the ARM64 version is simply faster and uses less battery.

Some download pages detect your PC automatically and offer the right version; double-check before clicking, since detection is sometimes wrong on Arm PCs or when using a different browser.

.exe, .msi, .msix and other installer types

• .exe: a setup program; the most common type. Double-click to run.
• .msi: a Windows Installer package; installs cleanly and supports Repair and Change later. Double-click, or install silently with msiexec /i file.msi.
• .msix, .appx, .appinstaller: modern app packages installed through the App Installer app, similar to Store apps; they uninstall cleanly and can update themselves.
• .zip: often a portable app; extract with right-click > Extract All, then run the program inside. Do not run programs from inside the ZIP.
• .iso: a disc image; double-click to mount it as a virtual drive, then run setup from it.

Whatever the file type, the source rule does not change: a .msi or .msix from an untrusted site is just as risky as an .exe, so the signature check applies to all of them.

Avoid bundled extras during setup

Free programs sometimes fund themselves by offering other software during installation: antivirus trials, browser extensions, "PC optimizers" or a new default search engine. These offers usually appear as pre-checked boxes or full screens with a large Accept button and a small Decline or Skip link. Read each screen, choose Custom install, clear checkboxes for anything you did not ask for, and click Decline on offer screens. If extras slipped through anyway, uninstall them in Settings > Apps > Installed apps sorted by install date; our guide to uninstalling programs covers stubborn ones.

Pay special attention to installers for free utilities, file converters and media codecs, which are the most common carriers of bundled offers. A good test is the final screen before installation begins: it should list only the program you came for. If it mentions anything else, go back and clear it.

Fonts, drivers and browser extensions

Not everything installs through a setup program. Fonts: right-click a .ttf or .otf file and choose Install (just for you) or Install for all users, or drag it to Settings > Personalization > Fonts. Drivers: come from Windows Update or the PC or device maker's support page; avoid driver updater utilities. Browser extensions: install from the browser's own store, such as the Microsoft Edge Add-ons or Chrome Web Store, never from a website's download button. Each has its own place to remove it later, which is worth knowing before you install.

Fonts and extensions are small, but each is software from someone; the same rule applies: trusted source, then install.

Store version or desktop version?

Many apps exist both in the Microsoft Store and as a download from the developer, such as VLC, Spotify, WhatsApp and Zoom. The Store version installs and updates through the Store, uninstalls cleanly, and is sandboxed in some cases; the desktop version may offer extra features, plugins or settings. For most people, the Store version is simpler and perfectly capable. Choose the desktop version when you need a specific feature the developer says is missing from the Store edition. Avoid installing both, which leads to two copies, two sets of settings and confusion over which opens files.

Verify large downloads with a checksum

For big downloads such as disc images or professional software, developers often publish a SHA-256 checksum. In Terminal, run Get-FileHash "C:\Users\you\Downloads\file.iso" and compare the result with the one on the developer's site. A match means the file is complete and unaltered. It takes seconds and is the surest way to know a large or important download is genuine.

Checksums prove the file matches what the developer published, but only if you read the checksum from the developer's own site; a checksum on a download portal proves nothing about the portal's file.

Installing open-source software safely

Open-source programs are often excellent and free, but they are copied around the web more than most. Download from the project's official website or its official releases page on its code hosting site, not from mirrors that wrap the installer. Check the signature where the project signs its releases, or the checksum where it publishes one. Many popular open-source apps are also in the Microsoft Store or winget, which is the easiest safe route.

Popular projects sometimes have imitators with similar names; check the project's star count, contributors and release history before trusting an unfamiliar repository.

Antivirus warnings during install

If Microsoft Defender or another antivirus blocks an installer, take it seriously. Check Windows Security > Virus & threat protection > Protection history for the details. A detection labeled as a potentially unwanted app usually means bundled extras; a named threat means the file is harmful. Delete the file and download the program again from the official source. Do not turn off protection to force an install; legitimate installers from official sources almost never trigger a real detection.

If you are certain a file is a false positive, such as a niche tool from a trusted developer, report it to Microsoft through the Windows Security submission portal rather than disabling protection; the developer can also be told so they can fix the signing or packaging.

Where programs install, and changing it

Desktop programs usually install to C:\Program Files (64-bit) or C:\Program Files (x86) (32-bit), and some per-user apps to %LocalAppData%\Programs. Most installers let you change the folder on a Custom or Advanced screen, which is useful for large games or creative suites on a second drive. Store apps install to the location set in Settings > System > Storage > Advanced storage settings > Where new content is saved. Keep small apps on C:, where Windows expects them, and put big games and media tools on a larger drive.

Moving an installed desktop program to another drive by dragging its folder breaks it; uninstall and reinstall to the new location instead. Store apps and some games can be moved properly from Installed apps or their launcher.

Before installing to another drive, make sure that drive is always connected; programs on a USB drive that is sometimes unplugged fail to start and can confuse Windows about what is installed.

Install apps offline or from a USB drive

For a PC without internet, download the full offline installer on another PC, often labeled offline, standalone or full installer, and copy it over on a USB drive. Small web installers will not work offline because they download the program during setup. Check the signature on the target PC as usual, and keep the offline installers in a labeled folder if you set up several PCs. Our guide to the Edge offline installer is an example of this kind of download.

Offline installers are larger, sometimes several hundred megabytes, because they include everything the program needs; that is normal and a sign you have the right file.

Keep in mind that offline installers age: when you finally use one months later, run the program's updater straight after installing so it catches up on security fixes.

Install for all users or just for you

Some installers ask whether to install for all users or just for me. All users puts the program in Program Files, available to every account, and needs administrator rights. Just for me installs in your profile, only for your account, often without administrator rights. On a family PC, install shared programs such as a browser or PDF reader for all users, and personal tools just for the person who needs them.

Programs installed just for one user do not appear in other accounts' Start menus at all, which often explains "where did the app go?" questions on shared PCs.

If an installer does not ask, it decides for you; most install for all users and ask for administrator rights, while apps such as some chat and code editors install per user by default. The install location shown at the end of setup tells you which happened.

Common install errors and fixes

For errors not in the table, the installer's log file often explains them; many installers mention the log location in the error message or keep it in %Temp%, sorted by date.

Installing older programs

Many programs from the Windows 7 era still install and run on Windows 11. If one refuses, right-click the installer or program, choose Properties > Compatibility, check Run this program in compatibility mode for, and pick Windows 7 or 8. Some old programs need .NET Framework 3.5, which you add in Settings > System > Optional features > More Windows features. Programs from the Windows 95 or XP era with 16-bit installers cannot run on 64-bit Windows; look for a newer version or a modern alternative.

For truly old business or hobby software that will not run at all, a virtual machine with an older Windows version is a last resort; Windows 11 Pro includes Hyper-V for this.

Installing Microsoft Office

Microsoft 365 and Office are installed from your Microsoft account, not from a download site. Sign in at account.microsoft.com or microsoft365.com, choose Install apps, and run the installer it downloads. Many new PCs also include the Microsoft 365 app in Start, which offers the same install. Office sold as a key on unfamiliar websites is often unofficial or resold; buy from Microsoft or a recognized retailer, and redeem the key at the official setup page.

One Microsoft 365 subscription covers several PCs and phones; sign in on each device rather than buying separate copies.

If Office is already installed but asks you to activate, sign in with the account that holds the subscription; it activates without reinstalling.

Games and game launchers

Most PC games install through a launcher: Steam, the Xbox app, Epic Games, EA app or Battle.net. Install the launcher from its official site or the Microsoft Store, then install games inside it, which handles updates and large downloads. Choose a library folder on a large drive before installing big games. Avoid "free full version" game downloads from unknown sites, which are one of the most common sources of malware.

Mods and cheats from unknown sites carry the same risk; download them only from the game's official mod platform or well-known community sites.

Launchers can also be told not to start with Windows in their settings, which keeps startup quick while still letting you open them when you want to play.

Trials and subscriptions

Many apps install as free trials that become paid subscriptions. Before entering payment details, note the trial length and set a reminder to cancel if you do not want to keep it. Subscriptions bought in the Microsoft Store are managed at account.microsoft.com under Services & subscriptions; others are managed on the developer's site. Uninstalling an app does not cancel its subscription.

Free versions of many apps remain usable after a trial with fewer features, so check what happens when the trial ends before deciding whether to pay or uninstall.

Watch for installers that sign you up for a trial of something else during setup; read each screen, since clearing one checkbox is easier than cancelling an unwanted subscription later.

After installing: first steps

• Pin the app to Start or the taskbar if you will use it often; our guide to pinning to the taskbar covers it.
• Check Settings > Apps > Startup and turn the app off if it added itself to startup without need.
• Set it as default for its file types under Settings > Apps > Default apps, if you want it to open those files.
• Check its update setting, so it stays secure.
• Delete the installer from Downloads unless you need it again.

Run the app once and check its settings for telemetry, startup and notification options; a minute spent there saves surprises later.

Create a restore point before big installs

Before installing drivers, system utilities, security software or anything that changes Windows deeply, create a System Restore point: search for Create a restore point, select your system drive, and click Create. If the install causes problems, you can roll Windows back to the moment before it. Ordinary apps rarely need this, but it is a cheap safety net for the riskier ones.

If System Protection is off, turn it on for the C: drive on the same screen first; without it, Windows cannot create restore points.

Restore points do not touch your documents or photos, so rolling back after a bad install is safe for your files; only programs, drivers and settings return to the earlier state.

Keep installed programs updated

Outdated programs are a common route for malware. Store apps update automatically; check the Store's Library for pending updates. Desktop programs usually have their own updater in a Help or About menu; leave automatic updates on. winget upgrade --all in Terminal updates many common desktop apps at once. Remove programs you no longer use rather than leaving them un-updated.

Some programs also install separate updater services that run at startup; that is normal for browsers and security software. For less important apps, check the app's settings for an update schedule and leave it on rather than disabling the service.

Silent installs for power users

For setting up several PCs, most installers support silent switches that install without questions. For MSI packages, msiexec /i app.msi /qn installs silently. With winget, add --silent and --accept-package-agreements to install without prompts. Many .exe installers accept /S, /silent or /quiet; check the developer's documentation, since each installer differs. Silent installs accept defaults, including any bundled offers in some installers, so use them only with installers you have checked by hand first.

Keep a short text file of the silent commands that worked for each app; next time you set up a PC, the whole job becomes a copy and paste.

Installing apps for a relative

Helping a parent or grandparent install an app is easier remotely with Quick Assist, built into Windows: both open Quick Assist, you share a code, and with their permission you can see and control their screen. Install from the Store or the official site while they watch, and pin the new app to their taskbar before you finish. For relatives who often need help, keeping their account as a standard user, with you as the administrator, prevents most unwanted installs between visits.

Quick Assist needs the person on the other end to accept the connection each time, so it never gives anyone permanent access; end the session when the install is done.

Keep the PC clean: one in, one out

A simple habit keeps a PC fast for years: when you install something new, uninstall something you no longer use. Every few months, open Settings > Apps > Installed apps, sort by install date or size, and remove what you have not used. Fewer programs mean fewer updates, fewer background services and fewer ways for something to go wrong.

Ethan's father now does this at the start of each season, with a cup of tea, in ten minutes; his PC has stayed as quick as the day he bought it.

Windows 10 differences

On Windows 10, the same methods work: the Microsoft Store, official websites and winget. The Choose where to get apps setting is under Settings > Apps > Apps & features, and S mode exists on some Windows 10 devices too. Windows 10 reached end of support in October 2025, so some new apps may stop supporting it over time; check an app's system requirements before installing on a Windows 10 PC.

Many developers still offer Windows 10 versions, but security updates for the system itself matter as much as for the app, which is another reason to plan the move to Windows 11.

For IT admins: deploying software

Deployment. Use Intune with Win32 apps, the Microsoft Store integration (the new Store apps in Intune), or winget-based deployment. Package custom apps as .intunewin or MSIX.

Control. App Control for Business (formerly WDAC) and AppLocker restrict which apps run; Smart App Control is a consumer feature and is off on managed devices. Set Choose where to get apps by policy where appropriate, and block consumer Store access if your organization manages apps centrally.

Standard users. Running staff as standard users, with approved apps deployed centrally, prevents most unwanted installs without blocking real work.

Installing programs on Windows: frequently asked questions

Ethan's father now installs software the way Jake showed him: Store first, official site second, a quick look at the signature, and Custom install every time. His PC has not seen a surprise toolbar since. Most installation problems are not technical at all; they come from where the file was downloaded. Choose the source carefully, read each setup screen, and installing programs on Windows becomes quick, clean and safe.

Revision note. Written October 2, 2026, rewriting our 2016 guide for safe installs on Windows 11, from the Store to winget. May every app you install be exactly what you asked for.