@echo off

rem Determine if WSUS is in use
call :reset-errorlevel
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer > nul 2>&1
if %ERRORLEVEL% EQU 0 ( for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer') do if "%%b"=="0x1" goto :check-wuserver )
goto :wuau-config

:check-wuserver
rem WSUS might be configured, now we'll check the other WSUS keys to see if it's properly setup
call :reset-errorlevel
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer > nul 2>&1
if %ERRORLEVEL% EQU 0 (
    for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer') do set WUServer=%%b
    goto :check-wustatusserver
)

:check-wustatusserver
rem WSUS has definitely been configured, now we'll get the name of the WUStatusServer
call :reset-errorlevel
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer > nul 2>&1
if %ERRORLEVEL% EQU 0 (
    for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer') do set WUStatusServer=%%b
    goto :wsus-config
)

:wsus-config
echo Configuring Windows Server Update Services (WSUS)
if [%WUServer%] NEQ [] echo   - Configured WSUS Server:        %WUServer%
if [%WUStatusServer%] NEQ [] echo   - Configured WSUS Status Server: %WUStatusServer%
call :reset-errorlevel
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer /t REG_DWORD /d "0x0" /f > nul 2>&1
if %ERRORLEVEL% EQU 0 echo   - Disable WSUS (this might be enabled again via GPO)
echo.
goto :wuau-config

:wuau-config
echo Configuring Windows Automatic Updates
call :reset-errorlevel
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d "0x1" /f > nul 2>&1
if %ERRORLEVEL% EQU 0 echo   - Disabled "Keep my computer up to date" option

call :reset-errorlevel
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d "0x1" /f > nul 2>&1
if %ERRORLEVEL% EQU 0 echo   - Disabled automatic restart while user is logged in and Automatic Updates are in use (this is just a failsafe)

call :reset-errorlevel
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d "0x1" /f > nul 2>&1
if %ERRORLEVEL% EQU 0 echo   - Disabled Automatic Updates

if %ERRORLEVEL% NEQ 0 echo There were errors while updating the registry. Please make sure this script runs with administrative privileges.
echo.

call :reset-errorlevel
echo Configuring Windows Update service
sc config wuauserv start= auto > nul 2>&1
if %ERRORLEVEL% EQU 0 echo   - Set startup type to automatic
call :reset-errorlevel
net start wuauserv > nul 2>&1
if %ERRORLEVEL% NEQ 0 (
    echo The Windows Update service may not have been started. Here's it's current status:
    sc query wuauserv
) else (
    echo   - Started Windows Update service
)

:done
goto :EOF

:reset-errorlevel
cmd /c "exit /b 0"