How to change group policy via command line?

7
votes

I want to update group policy in windows server using command line. I don't want programatic way. I read this & this, and then tried delete registry keys based on the mapping of group policy and registry keys, but the group policy didn't got updated.

Specifically, I want to set Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates to Not configured in group policy.

So, I ran following commands,

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallTime /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallDay /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /f
The operation completed successfully.

But after that the group policy wasn't updated. Do I need to run another command to propagate my registry changes to group policy? If yes, what is it? What am I missing?

I tried, gpupdate /force, it overrided my registry changes. I need converse of this.

3
windowscommand-linecmdcommand-prompt
gpupdate /f updates Group Policy which will fix what you've done. GP is updated every hour (might be 2 hours). So your changes should be overwritten by your group policy file (group policy changes the registry when it's applied). Changing registry values is not changing Group Policy and GP will overwrite your changes. If your registry changes aren't taking effect then the component probably reads it on startup. – user6017774
I thought the mapping of registry is for this purpose.Is there a way to solve this? – Abhishek
Just disable Windows Update service in Services. – user6017774
That is manual step. I'm trying to automate this step. This is one of the steps in automation. – Abhishek
sc config wuauserv start= disabled – user6017774

3 Answers

10
votes

How to change group policy from the command line? Voila:

LGPO.exe – Local Group Policy Object Utility, v1.0

4
votes

For group policy objects in a domain, registry-based group policy settings can be configured from the command line using Powershell. If you are not running on a domain controller, the Group Policy Management Console must be installed.

See Group Policy Cmdlets in Windows PowerShell and in particular the Set-GPRegistryValue cmdlet.

You can of course run a Powershell command from the legacy command line, e.g.,

powershell get-gpregistryvalue -Name gpo-name -Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU -ValueName AUOptions

As far as I know, there is no command-line solution for local group policy. For local group policy, see Glenn's answer.

3
votes

Set-GPRegistryValue is the way to go here. The problem, which is common, is that you have the GP path and you need to raw data. You can get the raw data (Keypath and value) from the settings spreadsheet, from the ADMX file (if administrative template setting) or from a free tool call registry.pol viewer from GPOGuy.

The commands you put up clean up registry data, these cmdlets don't do that. They add values to the registry.pol file (or registry.xml for GP Preference) stored in the GPO. Those settings are then sent down to target systems and applied to registry. Also, for non-registry based policy and ability to automate settings across local policies search "Group Policy Automation" there is a solution out there you may want to look at.