1

SETUP - I am running a small network with Windows Server 2008 R2 on it. I have 2 GPOs running security settings required by my company. In the following Hierachy:

  • GPO A (On Periodically)
  • GPO B (Constantly On)

GPO A is used to patching our system so the Windows Update service is set to Automatic when it in set to "Link Enabled". GPO B is setting company required security settings so it sets the Windows Update Service to Disabled.

PROBLEM - When GPO is enabled and enforced the Windows Update service is set to Disabled. According to RSOP it should be set to Automatic but it is not actually started or automatic, it is disabled. GPO A should be taking precedence and setting it to Automatic.

QUESTION - Can 2 GPOs not control 1 service? As I understand GPO is managed by precedence so GPO A should be keeping the service in automatic when the GPOs are processed. Is there a way I can keep these settings the same or does one of the GPOs need to have Windows Update server reconfigured?

EDIT 1: If I wrote a startup script which started the service in Powershell the GPO would disable the service once it reapplied every hour anyway. Even with the GPO enforced it still disables the service as well.

Improve this question
10
  • Please provide the settings in each GPO.
    – user5870571
    Mar 13, 2017 at 19:48
  • @user5870571 I did. GPO A sets Windows Update service to Automatic. GPO B sets Windows Update service to disabled.
    – JukEboX
    Mar 13, 2017 at 19:56
  • My question was if there were other settings included so we can figure out the best way to do what you are trying to do. This is not the best practice for how to do this. If you want the ability to review before installing Windows Updates, consider using WSUS.
    – user5870571
    Mar 13, 2017 at 19:58
  • @user5870571 This in use with WSUS. But due to security requirements I need to disable this service when not in use.
    – JukEboX
    Mar 13, 2017 at 20:01
  • 1
    Might be simpler for you to have a login script that starts or stops the service depending on the parameter used. This can easily be done with PowerShell and deployed with Group Policy. As to the way you are doing this, there is the "it should work" but generally applying conflicting GPOs to the same OU is a bad practice. Perhaps review this http://serverfault.com/questions/521180/what-takes-precedence-when-multiple-conflicting-gpos-apply-to-the-same-ou.
    – user5870571
    Mar 13, 2017 at 20:03

2 Answers 2

Reset to default
1

JukEboX,

Generally we do not write scripts for others but in this case, I think scripting is a better answer than using only Group Policy so much I am willing to write the PowerShell for anyone else who is trying to do the same thing.

In Group Policy, create a new GPO and in the GPO have a new file written to every computer (computer policy). The PowerShell file can be anywhere you want, but make a note of the location because you will need it later. In the example below I used the location \\server\share\status.txt. If you change the location or file name you will need to update the the code.

$WindowsServiceName = "wuauserv"
$NewStatus = Get-Content "\\server\share\status.txt"

function EnableWindowsService
{
    Set-Service $WindowsServiceName -StartupType Automatic
    Start-Service $WindowsServiceName
}

function DisableWindowsService
{
    Stop-Service $WindowsServiceName
    Set-Service $WindowsServiceName -StartupType Disabled
}

If ($NewStatus -like 'enabled' )
{
    EnableWindowsService
}
If ($NewStatus -like 'disabled' )
{
    DisableWindowsService
}

After you do that you should create a GPO that runs the PowerShell script as a logon script or logoff script (or you can build a scheduled task to run the PowerShell script when the trigger event you specify occurs).

In status.txt you should either write enabled or disabled.

When the trigger occurs, the PowerShell file will read the contents of status.txt and based on the contents of this file it will enable and start Windows Update Service or it will stop and disable Windows Update Service.

Since this is done with PowerShell you can also use PowerShell to remotely run the file on demand. If you use this method you need to remove both of the GPOs. You won't need them if you use this because this does the same thing. The only difference is you can run this more frequently than every 60 minutes, you can run it on demand, and you don't have conflicting GPOs. This meets the security requirements as you wrote them and works better.

Improve this answer
0

After doing some initial testing between System Services in GPO

Computer Configurations > Policies > Windows Settings > System Services

I found that these settings are best for setting preferences and security settings with the Windows Based services. I do have a number of system services disabled that are not Windows Based services and that is where I found the answer. The location is

Computer Configurations > Preferences > Control Panel Settings > Services enter image description here

There you can add the service you want to control the status of. enter image description here

On my security GPO I have the Startup set to Disabled and the Service action set to Stop Service. This will make sure that if that if the service is running outside of patching times it will stop the service and disable it.

On my update GPO I have the Startup set to Automatic and the Service action set to Start Service.

I have then placed my Patching GPO in a higher hierarchy in the Group Policy. When the Update GPO policy is enabled this GPO overwrites the policies applied in the security GPO.

If you set it in this way you can do a simple gpupdate /force on any machine and it will alter the control of the service depending on if the GPO is enable and which is higher in the hierarchy. This was exactly what I was looking for.

This article was greatly helpful and I hope can help others: How To Use Group Policy To Control Services by Alan Burchill

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .