O script para atualizar aplicativos pelo WinGet não está sendo executado pelo GPO

Acontece que o problema não era com a Group Policy, mas com o script. Havia dois problemas:

Os comandos WinGet não estão disponíveis no contexto do sistema: https://github.com/microsoft/winget-cli/issues/3049

O módulo cliente Powershell WinGet deve ser executado no Powershell 7, e os scripts de inicialização são executados no Powershell 5.1 por padrão: https://github.com/microsoft/winget-cli/issues/4820

Corrigi isso criando um script auxiliar para baixar o Powershell 7 e então iniciar o primeiro script usando-o:

# Check if Powershell version 7 exists
$powershellSevenPath = "C:\Program Files\PowerShell\7\pwsh.exe"
$powershellSeven = Test-Path -Path $powershellSevenPath

if (!$powershellSeven) {
    # If it doesn't exist, install it.
    msiexec.exe /package PowerShell-7.5.0-win-x64.msi /quiet ADD_EXPLORER_CONTEXT_MENU_OPENPOWERSHELL=1 ADD_FILE_CONTEXT_MENU_RUNPOWERSHELL=1 ENABLE_PSREMOTING=1 REGISTER_MANIFEST=1 USE_MU=1 ENABLE_MU=1 ADD_PATH=1
}

# Run script with Powershell 7.
Start-Process -FilePath $powershellSevenPath -Verb RunAs -ArgumentList ".\Update-WinGet-Applications.ps1"

Também tive que alterar todos os comandos WinGet no script original para usar o WinGet Client Module:

<#
.SYNOPSIS
    Installs the Powershell WinGet client module.
.DESCRIPTION
    Checks to see if the Powershell WinGet client module is installed. If it isn't, attempts to install it.
    If the install fails, exits the program.
.NOTES
    The module can be found here: https://www.powershellgallery.com/packages/Microsoft.WinGet.Client/1.10.320.
#>
function Install-WinGetClientModule {
    # Check if official Powershell WinGet client is installed.
    if (Get-Module -ListAvailable -Name Microsoft.WinGet.Client) {
        Write-Host "Powershell Module for the Windows Package Manager Client is installed."

    } else {
        # Install NuGet package provider, which is a requirement to install the module.
        Write-Host "Installing NuGet..."
        Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

        # Check if NuGet installed successfully.
        if ($?) {
            Write-Host "Successfully installed." -ForegroundColor Green
        } else {
            # If install could not be completed, exit script.
            Write-Host "Could not install NuGet." -ForegroundColor Red
            exit
        }

        # Set PSGallery as a trusted repository to install from.
        Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted

        # Install the module.
        Write-Host "Installing the Powershell Module for the Windows Package Manager Client..."
        Install-Module -Name Microsoft.WinGet.Client

        # Check if the module installed successfully.
        if ($?) {
            Write-Host "Successfully installed." -ForegroundColor Green
        } else {
            # If install could not be completed, exit script.
            Write-Host "Could not install the Powershell Module for the Windows Package Manager Client." -ForegroundColor Red
            exit
        }
    }
}


<#
.SYNOPSIS
    Get WinGet applications that require updates.
#>
function Get-ApplicationsWithUpdates {
    # Store the applications with updates available through WinGet
    $applicationsWithUpdates = Get-WinGetPackage | Where-Object IsUpdateAvailable

    return $applicationsWithUpdates
}


<#
.SYNOPSIS
    Update applications though WinGet.
#>
function Update-Applications {
    param (
        [Parameter(Mandatory = $true)]
        [Array]$applicationsToUpdate
    )
    
    # Update each application provided.
    foreach ($app in $applicationsToUpdate) {
        $appName = $app.Name
        $appId = $app.Id
        Write-Host "Updating $appName..."
        
        # Update the application
        Update-WinGetPackage -Id $appId -Scope Any -Mode Silent -Force
        
        # Check if the application was successfully updated.
        if ($?) {
            Write-Host "$appName updated to the latest version." -ForegroundColor Green
        } else {
            # If the update failed, attempt to reinstall.
            Write-Host "Failed to update $appName. Attempting to reinstall..."
            Uninstall-WinGetPackage -Id $appId  -Scope Any -Mode Silent -Force
            Install-WinGetPackage -Id $appId  -Scope Any -Mode Silent -Force

            # Check if the application reinstalled successfully.
            if ($?) {
                Write-Host "$appName updated to the latest version." -ForegroundColor Green
            } else {
                Write-Host "Failed to update $appName." -ForegroundColor Red
            }
        }
    }
}


function Main {
    # Start logging.
    $logDate = Get-Date -Format FileDateTime
    Start-Transcript -Path C:\Users\$env:USERNAME\Documents\Update-WinGetApplicationsLogs\log-$logDate.txt

    # Get Powershell WinGet client.
    Install-WinGetClientModule

    # Check for application updates through WinGet.
    $applicationsToUpdate = Get-ApplicationsWithUpdates
    Write-Host $applicationsToUpdate

    # Check that the number of applications to update isn't 0.
    if ($applicationsToUpdate.Count -gt 0) {
        # Update applications.
        Update-Applications -ApplicationsToUpdate $applicationsToUpdate
    } else {
        Write-Host "All applications are up to date."
    } 

    # Stop logging.
    Stop-Transcript
}


# Run the script.
Main