Jump to content
Sign in to follow this  
jheyde

Scripting Local Group Policy Changes

Recommended Posts

jheyde

I'm trying to change some local group policy settings to have local lab computers get their windows updates from my WSUS server. Instead of touching each one I'd like to script it. I can't seem to find the values of each drop down menu to click. Are there any suggestions as to how I tackle this?

Share this post


Link to post
Share on other sites
Jos

I have installed SUS a couple of years ago and used the below to set the proper values in the registry. maybe that still works:

RunWait(@ComSpec & ' /c NET STOP "Automatic Updates"', "", "")
; when its a PC set SUS to download the patch and install the patch at 3:00 or next boot
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "AUOptions", "REG_DWORD", "00000004")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "NoAutoRebootWithLoggedOnUsers", "REG_DWORD", "00000001")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "NoAutoUpdate", "REG_DWORD", "00000000")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "RescheduleWaitTime", "REG_DWORD", "00000001")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "ScheduledInstallDay", "REG_DWORD", "00000000")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "ScheduledInstallTime", "REG_DWORD", "00000003")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "UseWUServer", "REG_DWORD", "00000001")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "WUServer", "REG_SZ", "http://" & $SUSSERVER)
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "WUStatusServer", "REG_SZ", "http://" & $SUSSERVER)
RunWait(@ComSpec & ' /c NET START "Automatic Updates"', "", "")

SciTE4AutoIt3 Full installer Download page   - Beta files       Read before posting     How to post scriptsource        Forum Rules
 
Live for the present,
Dream of the future,
Learn from the past.
  :)

Share this post


Link to post
Share on other sites
zorphnog

I wrote this one for my clients quite some time ago, but it still works. It saves the current settings before directing to the WSUS server so that you can easily change back later.

#cs ----------------------------------------------------------------------------

 Script:         WSUS_Client.au3
 AutoIt Version: 3.1.1.0
 Author:         Michael Mims
 Version:        1.0.0.0

 Script Function:
    Activates or deactivates WSUS settings.

#ce ----------------------------------------------------------------------------

#include <constants.au3>
#include <array.au3>
#include <process.au3>
#include <file.au3>

;Hide the system tray icon
Opt("TrayIconHide", 1)

;Log file
$logFile = @WindowsDir & "\WSUSClient.log"

;Registry constants
$keys = _ArrayCreate("HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update")
$valueName = _ArrayCreate("WUServer", "WUStatusServer", "UseWUServer", "AUOptions")
$type = _ArrayCreate("REG_SZ", "REG_SZ", "REG_DWORD", "REG_DWORD")

;Services constants
$servKey = "HKLM\SYSTEM\CurrentControlSet\Services\"
$services = _ArrayCreate("wuauserv","BITS")

;Check if WSUS settings are active
$SSCCkey = "HKLM\Software\SSCC\WSUS Client"
$state = RegRead($SSCCkey,"State")
If @error Then
    ActivateSettings()
Else
    $retVal = MsgBox(36, "WSUS Client Configuration", "Deactivate WSUS Client settings?")
    If $retVal = 6 Then
        DeactivateSettings()
    Else
        Exit
    EndIf
EndIf

Func ActivateSettings ()
    ;Get WSUS server name
    $serverName = InputBox("WSUS Client Configuration", "Enter the WSUS server name:", "", "", 190, 120)
    If @error <> 0 Then Exit
    
    ;New registry values
    $value = _ArrayCreate("http://" & $serverName, "http://" & $serverName, 1, 2)

    ;Set new registry values
    For $i = 0 To 3
        $retVal = RegRead($keys[$i], $valueName[$i])
        If $retVal <> "" Then
            RegWrite($SSCCkey, $valueName[$i], $type[$i], $retVal)
        EndIf
        RegWrite($keys[$i], $valueName[$i], $type[$i], $value[$i])
    Next

    ;Set WSUS Client state
    RegWrite($SSCCkey, "State", "REG_SZ", "Active")
    
    ;Save/change services settings and start services
    For $element In $services
        $retVal = RegRead($servKey & $element, "Start")
        RegWrite($SSCCkey, $element, "REG_DWORD", $retVal)
        ;If $retVal <> 2 Then
        ;   RegWrite($servKey & $element, "Start", "REG_DWORD", 3)
        ;EndIf
        RunCommand("sc config " & $element & " start= auto")
        RunCommand("net start " & $element)
    Next
    
    ;Prod WSUS server for detection
    Run(@ComSpec & " /c wuauclt /detectnow", @SystemDir, @SW_HIDE)
    
    ;Notify user of results
    MsgBox(4096, "WSUS Client Configuration", "WSUS Client settings have been activated. Updates detection may take several minutes.")
EndFunc

Func RunCommand ($command)
    $line = ""
    $procHandle = Run(@comspec & " /c " & $command, @SystemDir, @SW_HIDE, $STDOUT_CHILD)
    While 1
        $output = StdoutRead($procHandle)
        If @error Then ExitLoop
        $line = $output
    WEnd
    _FileWriteLog($logFile, $line)
EndFunc

Func DeactivateSettings ()
    Dim $value[UBound($valueName)]
    
    ;Restore original registry settings
    For $i = 0 To 3
        $value[$i] = RegRead($SSCCkey, $valueName[$i])
        RegWrite($keys[$i], $valueName[$i], $type[$i], $value[$i])
    Next
    
    ;Remove registry keys if necessary
    If $value[2] = "" Then RegDelete($keys[2])
    If $value[0] = "" And $value[1] = "" And $value[2] = "" Then RegDelete($keys[0])
    
    ;Restore services settings
    For $element In $services
        $retVal = RegRead($SSCCkey, $element)
        RegWrite($servKey & $element, "Start", "REG_DWORD", $retVal)
        If $retVal = 4 Or $retVal = 3 Then
            RunCommand("sc stop " & $element)
        EndIf
    Next
    
    ;Delete WSUS Client registry key
    RegDelete($SSCCkey)
    
    ;Notify user of results
    MsgBox(4096, "WSUS Client Configuration", "WSUS Client settings have been deactivated, and original settings have been restored.")
EndFunc

Share this post


Link to post
Share on other sites
jheyde

Thanks guys! I'll give these a whirl! I'm pretty new to all of this obviously, but I like the challenge of learning this stuff on the fly. I appreciate everyones help!

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×