71 lines
3.0 KiB
Batchfile
71 lines
3.0 KiB
Batchfile
@echo off
|
|
|
|
rem Determine if WSUS is in use
|
|
call :reset-errorlevel
|
|
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 ( for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer') do if "%%b"=="0x1" goto :check-wuserver )
|
|
goto :wuau-config
|
|
|
|
:check-wuserver
|
|
rem WSUS might be configured, now we'll check the other WSUS keys to see if it's properly setup
|
|
call :reset-errorlevel
|
|
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 (
|
|
for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer') do set WUServer=%%b
|
|
goto :check-wustatusserver
|
|
)
|
|
|
|
:check-wustatusserver
|
|
rem WSUS has definitely been configured, now we'll get the name of the WUStatusServer
|
|
call :reset-errorlevel
|
|
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 (
|
|
for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer') do set WUStatusServer=%%b
|
|
goto :wsus-config
|
|
)
|
|
|
|
:wsus-config
|
|
echo Configuring Windows Server Update Services (WSUS)
|
|
if [%WUServer%] NEQ [] echo - Configured WSUS Server: %WUServer%
|
|
if [%WUStatusServer%] NEQ [] echo - Configured WSUS Status Server: %WUStatusServer%
|
|
call :reset-errorlevel
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer /t REG_DWORD /d "0x0" /f > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 echo - Disable WSUS (this might be enabled again via GPO)
|
|
echo.
|
|
goto :wuau-config
|
|
|
|
:wuau-config
|
|
echo Configuring Windows Automatic Updates
|
|
call :reset-errorlevel
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d "0x1" /f > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 echo - Disabled "Keep my computer up to date" option
|
|
|
|
call :reset-errorlevel
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d "0x1" /f > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 echo - Disabled automatic restart while user is logged in and Automatic Updates are in use (this is just a failsafe)
|
|
|
|
call :reset-errorlevel
|
|
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d "0x1" /f > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 echo - Disabled Automatic Updates
|
|
|
|
if %ERRORLEVEL% NEQ 0 echo There were errors while updating the registry. Please make sure this script runs with administrative privileges.
|
|
echo.
|
|
|
|
call :reset-errorlevel
|
|
echo Configuring Windows Update service
|
|
sc config wuauserv start= auto > nul 2>&1
|
|
if %ERRORLEVEL% EQU 0 echo - Set startup type to automatic
|
|
call :reset-errorlevel
|
|
net start wuauserv > nul 2>&1
|
|
if %ERRORLEVEL% NEQ 0 (
|
|
echo The Windows Update service may not have been started. Here's it's current status:
|
|
sc query wuauserv
|
|
) else (
|
|
echo - Started Windows Update service
|
|
)
|
|
|
|
:done
|
|
goto :EOF
|
|
|
|
:reset-errorlevel
|
|
cmd /c "exit /b 0" |