1

Some of our computers have a random "local group policy" being set that forces them to check a nonexistent intranet server for Windows Updates instead of using WU over the internet as they should. This is happening only on certain random, unrelated computers. Simply fixing the setting locally does not solve the problem, as the value is reset when the computer restarts even though this is a local policy and not a domain one. All of the affected computers are running Windows 7 Enterprise, a mix of both 32- and 64-bit.

The solution has been to delete C:\Windows\System32\GroupPolicy\gpt.ini and then manually set the value; this has worked. I'd like to write a quick script to do this automatically, but the appropriate registry keys are in the below registry location:

HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{EXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate

The identifier in the middle is different on every computer and I have not been able to figure out what it is. It's not the user's or computer's AD GUID, and I don't know what else to even check.

How can I programmatically (PowerShell) determine what that identifier is so that it can be used in a script to edit the registry keys automatically?

vaindil
  • 107
  • 1
  • 10
  • 3
    Might it not be easier to apply a new local policy that overrides the setting or simply edit the existing policy? This might put you on the right direction: http://stackoverflow.com/questions/23260656/modify-local-security-policy-using-powershell – Tim Ferrill Apr 09 '15 at 14:56
  • @TimFerrill I'll look into that; all of the resources I found said things like "the Group Policy Editor is just a GUI for registry changes, so to make a batch file or PowerShell script that changes group policy you have to edit the registry". That link is very helpful, thank you! – vaindil Apr 09 '15 at 15:47
  • Does it show up in a gpresult /r query? – Colyn1337 Apr 10 '15 at 17:40
  • @Vaindil some gp settings are just registry changes, yes, but it does get more complicated than that at times, especially when trying to involve powershell. Also, can't you just use a wilcard * instead? If you use PS to search for a specific reg key, then once it returns you can just parse and delete that way if need be. – MDMoore313 Apr 13 '15 at 04:13

0 Answers0