The 'Unable to install NuGet provider' error is one of the most common PowerShell problems, especially on Windows Server 2016 and older systems. The error appears when you try to install a module from PowerShell Gallery and PowerShell can't download the NuGet package provider it needs.
The root cause is almost always a TLS protocol mismatch. PowerShell Gallery requires TLS 1.2 for secure connections, but PowerShell 5.1 on older systems defaults to TLS 1.0, which the Gallery no longer accepts. Per the official Microsoft PowerShell Team blog post from January 2022, the earliest version of PackageManagement (1.0.0.1) shipped without the NuGet provider, creating a circular dependency where the tool needed NuGet to install NuGet.
This tutorial walks through the fix in order: enable TLS 1.2 first (which solves most cases immediately), then update the core modules if needed, and finally troubleshoot network or proxy issues for enterprise environments.
Before you start
What you will learn
- You'll learn how to fix the NuGet provider installation failure in PowerShell by enabling TLS 1.2, updating PowerShellGet and PackageManagement modules, and troubleshooting network connectivity to PowerShell Gallery.
- Without the NuGet provider, you can't install modules from PowerShell Gallery, blocking access to tools like ExchangeOnlineManagement, AzureAD, Microsoft Graph, and hundreds of other essential admin modules.
Requirements
- Administrator access on the Windows system.
- Windows system with PowerShell 5.1.
- Local administrator
Good to know
- TLS 1.2 fix takes under a minute. Full module updates take 5-10 minutes.
Quick answer
The NuGet provider error is caused by PowerShell using TLS 1.0 instead of TLS 1.2, which PowerShell Gallery requires. Run the SecurityProtocol command in an elevated session, then install PowerShellGet.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Step-by-step tutorial
6 stepsOpen PowerShell as Administrator
Launch an elevated PowerShell session.
Right-click the Windows Start button and select Windows PowerShell (Admin) or Terminal (Admin) on Windows 11. Verify the window title shows 'Administrator.'
User-level installations with -Scope CurrentUser don't require admin, but fixing NuGet system-wide does.
Enable TLS 1.2 for the current session
Switch the PowerShell session to use TLS 1.2.
Run: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Then verify: [Net.ServicePointManager]::SecurityProtocol. You should see Tls12 in the output. On older systems the default is Ssl3, Tls, which the Gallery rejects.
Per the Microsoft PowerShell Team blog, this is the primary fix. PowerShell Gallery dropped TLS 1.0 and 1.1 in April 2020.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12This only applies to the current session. See Step 5 for a permanent fix.
Install or update PowerShellGet
Install the latest PowerShellGet, which includes the NuGet provider.
Run: Install-Module PowerShellGet -Force -AllowClobber. Type Y when prompted about NuGet provider.
If you get a PSGallery trust warning, run Set-PSRepository -Name PSGallery -InstallationPolicy Trusted first.
Per the Microsoft PowerShell Team, updating PowerShellGet is preferred over Install-PackageProvider -Name NuGet, which can revert to the broken bootstrap version 2.8.5.208.
Install-Module PowerShellGet -Force -AllowClobberAfter updating, close and reopen PowerShell. Run Get-Module PowerShellGet -ListAvailable to confirm version 2.x or newer.
Verify NuGet provider and test module installation
Confirm NuGet provider is installed and modules work.
Close and reopen PowerShell as Administrator. Run Get-PackageProvider -Name NuGet. You should see version 2.8.5.201 or newer.
Test with: Install-Module PSReadLine -Force. If it completes without NuGet errors, the fix is working.
Get-PackageProvider -Name NuGetMake TLS 1.2 permanent via registry
Make TLS 1.2 the system default permanently.
Run both commands to set strong cryptography for 64-bit and 32-bit .NET Framework:
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Restart PowerShell or reboot the system for changes to take effect.
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWordThis is especially important on Windows Server 2016. On Windows Server 2019+ and Windows 10/11, TLS 1.2 is usually the default already.
Troubleshoot proxy and firewall issues
Resolve network-level connectivity issues for enterprise environments.
Test connectivity: Test-NetConnection -ComputerName www.powershellgallery.com -Port 443
If this fails, configure proxy settings: $proxy = [System.Net.WebRequest]::GetSystemWebProxy(); $proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials; [System.Net.WebRequest]::DefaultWebProxy = $proxy
For WinHTTP proxy: netsh winhttp set proxy proxy-server:port
Also test DNS: Resolve-DnsName www.powershellgallery.com
Test-NetConnection -ComputerName www.powershellgallery.com -Port 443Some HIDS and antivirus products can intercept and break TLS connections. If connectivity tests pass but downloads fail, check with your security team about SSL inspection.
How to Confirm NuGet Provider Is Working
Run Get-PackageProvider -Name NuGet to confirm version 2.8.5.201 or newer is installed. Test a module installation with Install-Module Az.Accounts -Force. If it completes without NuGet errors, your environment is fully functional.
For a complete check, run Get-PackageProvider -ListAvailable. You should see NuGet, PowerShellGet, and other providers without errors.
If you applied the registry fix, verify that [Net.ServicePointManager]::SecurityProtocol shows Tls12 in a new session without the per-session command.
- NuGet provider version 2.8.5.201+. Modules install without errors. TLS 1.2 is default.
- If NuGet errors persist, check that you restarted PowerShell after registry changes. If Test-NetConnection fails, it's a network-level issue.
- TLS 1.2 enabled, PowerShellGet updated.
- Proxy or firewall issue. See Step 6.
- Restart PowerShell to load new version.
Troubleshooting
Circular dependency: NuGet needed to install NuGet
Cause: PackageManagement 1.0.0.1 doesn't include NuGet provider. TLS 1.0 is rejected by the Gallery.
Enable TLS 1.2 first, then run Install-Module PowerShellGet -Force -AllowClobber. This bypasses the circular dependency.
Module installs but old version still loads
Cause: Multiple versions exist in different module paths. PowerShell loads the old one first.
Run Get-Module PowerShellGet -ListAvailable to find all versions. Remove old versions from user-profile module folders. Never delete from the System32 modules path.
Test-NetConnection fails to PowerShell Gallery
Cause: Corporate firewall or proxy blocking outbound HTTPS to powershellgallery.com.
Configure PowerShell proxy settings. Ask your network team to whitelist powershellgallery.com and onegetcdn.azureedge.net. Or download modules manually from the Gallery.
Registry changes don't take effect
Cause: PowerShell or .NET runtime cached old TLS settings.
Restart PowerShell completely. If registry keys still don't take effect, reboot the system. The SchUseStrongCrypto keys require a full .NET runtime reload.
Frequently asked questions
Why does PowerShell need a NuGet provider?
The NuGet provider enables PowerShell to interact with NuGet-based repositories like PowerShell Gallery. Without it, Install-Module and other package commands can't download modules.
Is the TLS 1.2 command permanent?
No. The SecurityProtocol command only applies to the current session. For a permanent fix, set the .NET Framework SchUseStrongCrypto registry keys.
What is NuGet provider version 2.8.5.208?
Version 2.8.5.208 is the bootstrap version that ships with older PackageManagement modules. It often fails to upgrade properly. The minimum required version is 2.8.5.201.
Can I install NuGet provider without internet?
Yes. Download the PackageManagement module manually from powershellgallery.com, rename the .nupkg to .zip, extract it, and copy to the modules directory on the offline system.
Does PowerShell 7 have the same issue?
Rarely. PowerShell 7 uses modern .NET which defaults to TLS 1.2. The issue primarily affects PowerShell 5.1 on the older .NET Framework.
