Scripting Local Group Policy Changes

[jheyde]

I'm trying to change some local group policy settings to have local lab computers get their windows updates from my WSUS server. Instead of touching each one I'd like to script it. I can't seem to find the values of each drop down menu to click. Are there any suggestions as to how I tackle this?

[Jos]

I have installed SUS a couple of years ago and used the below to set the proper values in the registry. maybe that still works:

RunWait(@ComSpec & ' /c NET STOP "Automatic Updates"', "", "")
; when its a PC set SUS to download the patch and install the patch at 3:00 or next boot
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "AUOptions", "REG_DWORD", "00000004")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "NoAutoRebootWithLoggedOnUsers", "REG_DWORD", "00000001")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "NoAutoUpdate", "REG_DWORD", "00000000")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "RescheduleWaitTime", "REG_DWORD", "00000001")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "ScheduledInstallDay", "REG_DWORD", "00000000")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "ScheduledInstallTime", "REG_DWORD", "00000003")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "UseWUServer", "REG_DWORD", "00000001")
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "WUServer", "REG_SZ", "http://" & $SUSSERVER)
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "WUStatusServer", "REG_SZ", "http://" & $SUSSERVER)
RunWait(@ComSpec & ' /c NET START "Automatic Updates"', "", "")

[zorphnog]

I wrote this one for my clients quite some time ago, but it still works. It saves the current settings before directing to the WSUS server so that you can easily change back later.

expandcollapse popup

#cs ----------------------------------------------------------------------------

 Script:         WSUS_Client.au3
 AutoIt Version: 3.1.1.0
 Author:         Michael Mims
 Version:        1.0.0.0

 Script Function:
    Activates or deactivates WSUS settings.

#ce ----------------------------------------------------------------------------

#include <constants.au3>
#include <array.au3>
#include <process.au3>
#include <file.au3>

;Hide the system tray icon
Opt("TrayIconHide", 1)

;Log file
$logFile = @WindowsDir & "\WSUSClient.log"

;Registry constants
$keys = _ArrayCreate("HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU", "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update")
$valueName = _ArrayCreate("WUServer", "WUStatusServer", "UseWUServer", "AUOptions")
$type = _ArrayCreate("REG_SZ", "REG_SZ", "REG_DWORD", "REG_DWORD")

;Services constants
$servKey = "HKLM\SYSTEM\CurrentControlSet\Services\"
$services = _ArrayCreate("wuauserv","BITS")

;Check if WSUS settings are active
$SSCCkey = "HKLM\Software\SSCC\WSUS Client"
$state = RegRead($SSCCkey,"State")
If @error Then
    ActivateSettings()
Else
    $retVal = MsgBox(36, "WSUS Client Configuration", "Deactivate WSUS Client settings?")
    If $retVal = 6 Then
        DeactivateSettings()
    Else
        Exit
    EndIf
EndIf

Func ActivateSettings ()
    ;Get WSUS server name
    $serverName = InputBox("WSUS Client Configuration", "Enter the WSUS server name:", "", "", 190, 120)
    If @error <> 0 Then Exit
    
    ;New registry values
    $value = _ArrayCreate("http://" & $serverName, "http://" & $serverName, 1, 2)

    ;Set new registry values
    For $i = 0 To 3
        $retVal = RegRead($keys[$i], $valueName[$i])
        If $retVal <> "" Then
            RegWrite($SSCCkey, $valueName[$i], $type[$i], $retVal)
        EndIf
        RegWrite($keys[$i], $valueName[$i], $type[$i], $value[$i])
    Next

    ;Set WSUS Client state
    RegWrite($SSCCkey, "State", "REG_SZ", "Active")
    
    ;Save/change services settings and start services
    For $element In $services
        $retVal = RegRead($servKey & $element, "Start")
        RegWrite($SSCCkey, $element, "REG_DWORD", $retVal)
        ;If $retVal <> 2 Then
        ;   RegWrite($servKey & $element, "Start", "REG_DWORD", 3)
        ;EndIf
        RunCommand("sc config " & $element & " start= auto")
        RunCommand("net start " & $element)
    Next
    
    ;Prod WSUS server for detection
    Run(@ComSpec & " /c wuauclt /detectnow", @SystemDir, @SW_HIDE)
    
    ;Notify user of results
    MsgBox(4096, "WSUS Client Configuration", "WSUS Client settings have been activated. Updates detection may take several minutes.")
EndFunc

Func RunCommand ($command)
    $line = ""
    $procHandle = Run(@comspec & " /c " & $command, @SystemDir, @SW_HIDE, $STDOUT_CHILD)
    While 1
        $output = StdoutRead($procHandle)
        If @error Then ExitLoop
        $line = $output
    WEnd
    _FileWriteLog($logFile, $line)
EndFunc

Func DeactivateSettings ()
    Dim $value[UBound($valueName)]
    
    ;Restore original registry settings
    For $i = 0 To 3
        $value[$i] = RegRead($SSCCkey, $valueName[$i])
        RegWrite($keys[$i], $valueName[$i], $type[$i], $value[$i])
    Next
    
    ;Remove registry keys if necessary
    If $value[2] = "" Then RegDelete($keys[2])
    If $value[0] = "" And $value[1] = "" And $value[2] = "" Then RegDelete($keys[0])
    
    ;Restore services settings
    For $element In $services
        $retVal = RegRead($SSCCkey, $element)
        RegWrite($servKey & $element, "Start", "REG_DWORD", $retVal)
        If $retVal = 4 Or $retVal = 3 Then
            RunCommand("sc stop " & $element)
        EndIf
    Next
    
    ;Delete WSUS Client registry key
    RegDelete($SSCCkey)
    
    ;Notify user of results
    MsgBox(4096, "WSUS Client Configuration", "WSUS Client settings have been deactivated, and original settings have been restored.")
EndFunc

[jheyde]

Thanks guys! I'll give these a whirl! I'm pretty new to all of this obviously, but I like the challenge of learning this stuff on the fly. I appreciate everyones help!