How to Fix the NuGet Provider Installation Error in PowerShell
Resolve the 'Unable to install NuGet provider' error in PowerShell by enabling TLS 1.2, updating PowerShellGet, and troubleshooting connectivity to PowerShell Gallery.
- Difficulty
- Intermediate
- Time required
- 10-20 minutes
- Steps
- 6
- Platform
- PowerShell
Table of contents
Quick Answer
Go to the stepsThe NuGet provider error is caused by PowerShell using TLS 1.0 instead of TLS 1.2, which PowerShell Gallery requires. Run the SecurityProtocol command in an elevated session, then install PowerShellGet.
- Open PowerShell as Administrator.
- Run: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
- Run: Install-Module PowerShellGet -Force -AllowClobber
- Type Y when prompted to install the NuGet provider.
- Restart PowerShell and test with Install-Module.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Expected result: PowerShell can connect to PowerShell Gallery and install modules without NuGet errors.
Key takeaways
- You'll learn how to fix the NuGet provider installation failure in PowerShell by enabling TLS 1.2, updating PowerShellGet and PackageManagement modules, and troubleshooting network connectivity to PowerShell Gallery.
- Without the NuGet provider, you can't install modules from PowerShell Gallery, blocking access to tools like ExchangeOnlineManagement, AzureAD, Microsoft Graph, and hundreds of other essential admin modules.
- Enable TLS 1.2 first. Then install PowerShellGet. Don't run Install-PackageProvider -Name NuGet directly after updating.
Introduction
The 'Unable to install NuGet provider' error is one of the most common PowerShell problems, especially on Windows Server 2016 and older systems. The error appears when you try to install a module from PowerShell Gallery and PowerShell can't download the NuGet package provider it needs.
The root cause is almost always a TLS protocol mismatch. PowerShell Gallery requires TLS 1.2 for secure connections, but PowerShell 5.1 on older systems defaults to TLS 1.0, which the Gallery no longer accepts. Per the official Microsoft PowerShell Team blog post from January 2022, the earliest version of PackageManagement (1.0.0.1) shipped without the NuGet provider, creating a circular dependency where the tool needed NuGet to install NuGet.
This tutorial walks through the fix in order: enable TLS 1.2 first (which solves most cases immediately), then update the core modules if needed, and finally troubleshoot network or proxy issues for enterprise environments.
Who this is for: IT administrators and DevOps engineers running PowerShell 5.1 on Windows Server 2016/2019/2022 or Windows 10/11 who encounter NuGet provider errors.
Before you start
- Access
- Administrator access on the Windows system.
- Required roles
- Local administrator
- Required licenses
- None
- None (PowerShell is included with Windows)
- Environment
- Windows system with PowerShell 5.1.
- Vendor
- Microsoft
- Administrator permissions required
TLS 1.2 fix takes under a minute. Full module updates take 5-10 minutes.
Note: Session-only fix vs permanent fix
The TLS 1.2 command only applies to the current PowerShell session. For a permanent fix, add it to your PowerShell profile or apply the registry changes described in Step 5.
1Open PowerShell as Administrator
Launch an elevated PowerShell session.
Right-click the Windows Start button and select Windows PowerShell (Admin) or Terminal (Admin) on Windows 11. Verify the window title shows 'Administrator.'
Expected result: PowerShell opens with 'Administrator' in the title bar.
Note
User-level installations with -Scope CurrentUser don't require admin, but fixing NuGet system-wide does.
2Enable TLS 1.2 for the current session
Switch the PowerShell session to use TLS 1.2.
Run: [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Then verify: [Net.ServicePointManager]::SecurityProtocol. You should see Tls12 in the output. On older systems the default is Ssl3, Tls, which the Gallery rejects.
Per the Microsoft PowerShell Team blog, this is the primary fix. PowerShell Gallery dropped TLS 1.0 and 1.1 in April 2020.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Expected result: SecurityProtocol output shows Tls12. PowerShell can now connect to PowerShell Gallery.
Note
This only applies to the current session. See Step 5 for a permanent fix.
3Install or update PowerShellGet
Install the latest PowerShellGet, which includes the NuGet provider.
Run: Install-Module PowerShellGet -Force -AllowClobber. Type Y when prompted about NuGet provider.
If you get a PSGallery trust warning, run Set-PSRepository -Name PSGallery -InstallationPolicy Trusted first.
Per the Microsoft PowerShell Team, updating PowerShellGet is preferred over Install-PackageProvider -Name NuGet, which can revert to the broken bootstrap version 2.8.5.208.
Install-Module PowerShellGet -Force -AllowClobberExpected result: PowerShellGet installs successfully. NuGet provider installed as a dependency.
Note
After updating, close and reopen PowerShell. Run Get-Module PowerShellGet -ListAvailable to confirm version 2.x or newer.
4Verify NuGet provider and test module installation
Confirm NuGet provider is installed and modules work.
Close and reopen PowerShell as Administrator. Run Get-PackageProvider -Name NuGet. You should see version 2.8.5.201 or newer.
Test with: Install-Module PSReadLine -Force. If it completes without NuGet errors, the fix is working.
Get-PackageProvider -Name NuGetExpected result: NuGet provider shows version 2.8.5.201+. Module installation completes without errors.
5Make TLS 1.2 permanent via registry
Make TLS 1.2 the system default permanently.
Run both commands to set strong cryptography for 64-bit and 32-bit .NET Framework:
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Restart PowerShell or reboot the system for changes to take effect.
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWordExpected result: After restarting PowerShell, SecurityProtocol shows Tls12 without the per-session command.
Note
This is especially important on Windows Server 2016. On Windows Server 2019+ and Windows 10/11, TLS 1.2 is usually the default already.
6Troubleshoot proxy and firewall issues
Resolve network-level connectivity issues for enterprise environments.
Test connectivity: Test-NetConnection -ComputerName www.powershellgallery.com -Port 443
If this fails, configure proxy settings: $proxy = [System.Net.WebRequest]::GetSystemWebProxy(); $proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials; [System.Net.WebRequest]::DefaultWebProxy = $proxy
For WinHTTP proxy: netsh winhttp set proxy proxy-server:port
Also test DNS: Resolve-DnsName www.powershellgallery.com
Test-NetConnection -ComputerName www.powershellgallery.com -Port 443Expected result: Test-NetConnection returns TcpTestSucceeded: True.
Note
Some HIDS and antivirus products can intercept and break TLS connections. If connectivity tests pass but downloads fail, check with your security team about SSL inspection.
How to Confirm NuGet Provider Is Working
Verify fix
Run Get-PackageProvider -Name NuGet to confirm version 2.8.5.201 or newer is installed. Test a module installation with Install-Module Az.Accounts -Force. If it completes without NuGet errors, your environment is fully functional.
For a complete check, run Get-PackageProvider -ListAvailable. You should see NuGet, PowerShellGet, and other providers without errors.
If you applied the registry fix, verify that [Net.ServicePointManager]::SecurityProtocol shows Tls12 in a new session without the per-session command.
Normal result: NuGet provider version 2.8.5.201+. Modules install without errors. TLS 1.2 is default.
Abnormal result: If NuGet errors persist, check that you restarted PowerShell after registry changes. If Test-NetConnection fails, it's a network-level issue.
Successful fix
NuGet 2.8.5.201 installed, modules work
TLS 1.2 enabled, PowerShellGet updated.
Partial fix
NuGet installs but modules fail with 403
Proxy or firewall issue. See Step 6.
Persistent error
NuGet 2.8.5.208 still showing
Restart PowerShell to load new version.
Troubleshooting
Circular dependency: NuGet needed to install NuGet
Warning
Cause: PackageManagement 1.0.0.1 doesn't include NuGet provider. TLS 1.0 is rejected by the Gallery.
Enable TLS 1.2 first, then run Install-Module PowerShellGet -Force -AllowClobber. This bypasses the circular dependency.
Module installs but old version still loads
Warning
Cause: Multiple versions exist in different module paths. PowerShell loads the old one first.
Run Get-Module PowerShellGet -ListAvailable to find all versions. Remove old versions from user-profile module folders. Never delete from the System32 modules path.
Test-NetConnection fails to PowerShell Gallery
Warning
Cause: Corporate firewall or proxy blocking outbound HTTPS to powershellgallery.com.
Configure PowerShell proxy settings. Ask your network team to whitelist powershellgallery.com and onegetcdn.azureedge.net. Or download modules manually from the Gallery.
Registry changes don't take effect
Note
Cause: PowerShell or .NET runtime cached old TLS settings.
Restart PowerShell completely. If registry keys still don't take effect, reboot the system. The SchUseStrongCrypto keys require a full .NET runtime reload.
Frequently asked questions
Why does PowerShell need a NuGet provider?
The NuGet provider enables PowerShell to interact with NuGet-based repositories like PowerShell Gallery. Without it, Install-Module and other package commands can't download modules.
Is the TLS 1.2 command permanent?
No. The SecurityProtocol command only applies to the current session. For a permanent fix, set the .NET Framework SchUseStrongCrypto registry keys.
What is NuGet provider version 2.8.5.208?
Version 2.8.5.208 is the bootstrap version that ships with older PackageManagement modules. It often fails to upgrade properly. The minimum required version is 2.8.5.201.
Can I install NuGet provider without internet?
Yes. Download the PackageManagement module manually from powershellgallery.com, rename the .nupkg to .zip, extract it, and copy to the modules directory on the offline system.
Does PowerShell 7 have the same issue?
Rarely. PowerShell 7 uses modern .NET which defaults to TLS 1.2. The issue primarily affects PowerShell 5.1 on the older .NET Framework.
Conclusion
The NuGet provider error is almost always caused by a TLS protocol mismatch. Enabling TLS 1.2 fixes most cases immediately. For a permanent solution, set the SchUseStrongCrypto registry keys. Then update PowerShellGet, which installs the NuGet provider as a dependency.
Enable TLS 1.2 first. Then install PowerShellGet. Don't run Install-PackageProvider -Name NuGet directly after updating.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Sources3
