added script

2021-10-28 15:42:59 -04:00
parent c1b06c4e06
commit e6f4eda212
1 changed files with 71 additions and 0 deletions
@@ -0,0 +1,71 @@
+@echo off
+
+rem Determine if WSUS is in use
+call :reset-errorlevel
+reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer > nul 2>&1
+if %ERRORLEVEL% EQU 0 ( for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer') do if "%%b"=="0x1" goto :check-wuserver )
+goto :wuau-config
+
+:check-wuserver
+rem WSUS might be configured, now we'll check the other WSUS keys to see if it's properly setup
+call :reset-errorlevel
+reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer > nul 2>&1
+if %ERRORLEVEL% EQU 0 (
+    for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer') do set WUServer=%%b
+    goto :check-wustatusserver
+)
+
+:check-wustatusserver
+rem WSUS has definitely been configured, now we'll get the name of the WUStatusServer
+call :reset-errorlevel
+reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer > nul 2>&1
+if %ERRORLEVEL% EQU 0 (
+    for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer') do set WUStatusServer=%%b
+    goto :wsus-config
+)
+
+:wsus-config
+echo Configuring Windows Server Update Services (WSUS)
+if [%WUServer%] NEQ [] echo   - WSUS Server:        %WUServer%
+if [%WUStatusServer%] NEQ [] echo   - WSUS Status Server: %WUStatusServer%
+call :reset-errorlevel
+reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer /t REG_DWORD /d "0x0" /f > nul 2>&1
+if %ERRORLEVEL% EQU 0 echo   - Disable WSUS (this might be enabled again via GPO)
+echo.
+goto :wuau-config
+
+:wuau-config
+echo Configuring Windows Automatic Updates
+call :reset-errorlevel
+reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d "0x1" /f > nul 2>&1
+if %ERRORLEVEL% EQU 0 echo   - Disabled "Keep my computer up to date" option
+
+call :reset-errorlevel
+reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d "0x1" /f > nul 2>&1
+if %ERRORLEVEL% EQU 0 echo   - Disabled automatic restart while user is logged in and Automatic Updates are in use (this is just a failsafe)
+
+call :reset-errorlevel
+reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d "0x1" /f > nul 2>&1
+if %ERRORLEVEL% EQU 0 echo   - Disabled Automatic Updates
+
+if %ERRORLEVEL% NEQ 0 echo There were errors while updating the registry. Please make sure this script runs with administrative privileges.
+echo.
+
+call :reset-errorlevel
+echo Configuring Windows Update service
+sc config wuauserv start= auto > nul 2>&1
+if %ERRORLEVEL% EQU 0 echo   - Set startup type to automatic
+call :reset-errorlevel
+net start wuauserv > nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    echo The Windows Update service may not have been started. Here's it's current status:
+    sc query wuauserv
+) else (
+    echo   - Started Windows Update service
+)
+
+:done
+goto :EOF
+
+:reset-errorlevel
+cmd /c "exit /b 0"