Windows 11 Chocolatey Patch Management & Vulnerability Remediation Lab

Aug 2

3 min read

Updated: Aug 4

Introduction

As part of building my Windows 11 home lab, I wanted to explore how Chocolatey could be used to manage third-party software updates. While Windows Update keeps the operating system current, many commonly used applications have their own update cycle. Keeping these applications up to date is an important part of maintaining a secure and compliant endpoint.

For this lab, I simulated a routine software audit by creating a Windows 11 machine with outdated applications already installed. I then used Chocolatey to identify the outdated software, remediate the affected applications and verify that the endpoint was fully up to date.

Lab Environment

Component	Details
Operating System	Windows 11 Pro
Package Manager	Chocolatey
Terminal	Windows PowerShell (Administrator)
Applications	7-Zip, VLC Media Player

Lab Scenario

Imagine a Windows 11 workstation has been flagged during a routine software audit. The objective is to determine whether any applications managed by Chocolatey are outdated, update them where necessary and confirm the workstation is compliant once remediation has been completed.

To create this scenario, I deliberately installed older versions of 7-Zip and VLC Media Player before beginning the assessment. This allowed me to simulate a workstation that had fallen behind on its regular software updates.

https://video.wixstatic.com/video/2c498b_3fe00b84904e430d9125c15be4ef8478/720p/mp4/file.mp4

Installing Chocolatey

The first step was ensuring Chocolatey was installed on my Windows 11 virtual machine. Chocolatey is a Windows package manager that simplifies installing, updating and maintaining third-party applications from PowerShell.

Once installed, I verified that Chocolatey was functioning correctly before moving on to the software audit.

Reviewing Installed Software

Before checking for updates, I wanted to see which packages Chocolatey was currently managing on the workstation.

Using the command below, I displayed all locally installed packages along with their installed versions.

choco list

This provided a useful inventory of the software managed by Chocolatey and established a baseline before any remediation work began.

Displaying the locally installed Chocolatey packages and their current versions prior to performing the software audit.

Identifying Outdated Applications

With the software inventory established, I performed an audit using Chocolatey's built-in outdated package detection.

choco outdated

Chocolatey compared the installed package versions against those available in its repository and reported that both 7-Zip and VLC Media Player required updating.

Although only two applications needed remediation, the command demonstrated how quickly administrators can identify software that has fallen behind on updates without manually checking each application individually.

Chocolatey identifies 7-Zip and VLC Media Player as outdated, confirming that the workstation requires remediation.

Remediating the Outdated Software

After identifying the outdated applications, I upgraded each package individually using Chocolatey's upgrade functionality.

choco upgrade 7zip -y

choco upgrade vlc -y

Chocolatey automatically downloaded the latest package versions and completed the upgrades without requiring manual downloads or installers.

This highlights one of Chocolatey's key advantages: maintaining third-party software through a consistent command-line interface, making patch management faster and more repeatable.

Upgrading 7-Zip and VLC Media Player to their latest available versions using Chocolatey.

Verifying the Remediation

After completing the upgrades, I ran another audit to confirm the workstation was fully up to date.

choco outdated

This time, Chocolatey reported that 0 packages were outdated, confirming that both applications had been successfully updated and the endpoint was compliant.

Performing a verification step after remediation is a simple but important practice, ensuring that the intended changes have been applied successfully.

Running a final Chocolatey audit confirms that no outdated packages remain.

This lab showed how Chocolatey simplifies Windows 11 patch management by identifying outdated software, applying updates, and verifying remediation.

While completed on a single VM, the same process applies to real-world endpoint management: detect, update, and maintain system compliance. Chocolatey is a valuable addition to any Windows administration or home lab toolkit.