0

I am trying to automate setting about 40 non domain servers to use a WSUS server. I've read posts like Can I use Powershell to configure Local group policy settings in windows server 2008 r2 and I've gotten it to work ... sort of. If I run the script it makes the expected registry entries but if I go in Group Policy Editor it still shows "Not Configured" but when I check for updates it goes to the update server. Then I've read things that say these settings should be done via the "Local Security Policy" and not Group Policy but I can't find the settings in the LSP.

These are windows 2008 and 2012 servers.

1 Answer 1

0
  1. Windows Update related settings are not managed from the Local Security Policy.

  2. The Group Policy editor doesn't read the settings from the registry, it reads the settings from the Group Policy files in the file system, located at C:\Windows\System32\GroupPolicy on a default install of Windows.

  3. When editing local Group Policy, the settings are written to the Policy related registry keys, not read from them.

6
  • But then the OS reads the registry keys? So is there a way to accomplish both?
    – dblwizard
    Sep 5, 2018 at 2:19
  • 1
    Accomplish both what? If you want the GP Editor to show the settings as being configured then you need to configure the settings with the GP Editor. If you simply want to configure the settings to make the machines use your desired Windows Update settings then just use your PoSH script.
    – joeqwerty
    Sep 5, 2018 at 2:26
  • Yes both. Seems improper for the "Editor" to no reflect the actual settings on the machine. Isn't that what GPUpdate is for to load those settings in real time?
    – dblwizard
    Sep 5, 2018 at 14:23
  • 1
    You're misunderstanding this. The GP Editor doesn't read the settings from the registry. It reads them from the Group Policy files in the file system. The GP Editor reflects the settings as they're configured in the Group Policy files, not as they're configured in the registry.
    – joeqwerty
    Sep 5, 2018 at 14:30
  • 1
    My point is if I use the "Set-ItemProperty" in script then the registry and the GP Editor are out of sync and do not reflect the same settings. - Because they aren't supposed to be in sync. The GP editor reads and writes the settings to the Group Policy files in the file system. The CSE's then read those settings and write them to the registry. Again, the GP editor does not read the settings from the registry. You're expecting it to and expecting it to reflect the settings in the registry, but that isn't what the GP editor does nor is that how it works. I can't make this any more clear.
    – joeqwerty
    Sep 6, 2018 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .