Patch Policy to Prevent Windows Updates.

[timbuck2]

With lots of bad events occurring this past week and one happening right now. I went to create a policy for patch management so that a computer could be assigned to a policy that would prevent windows updates until issues can be resolved.

So I have set it to not install under all conditions. It requires me to set a schedule. Is this schedule the dates on which Pulseway will check and refresh the Windows update policy in the event they have changed on the PC or does this schedule apply to anything in this case ? I guess I'm wondering how the policy is enforced. If I set it to repeat daily does it update the windows update settings once a day or is this checked before any update can occur. 

 

 

[Chris]

Hi @timbuck2,

Pulseway will not update local Windows update policy. If you want Pulseway to fully control all installed updates, then you need to disable Automatic checks for Windows updates on all your systems.

[Larnelhight]

Is there a way to disable Automatic checks through Pulseway?

[Chris]

Hi @Larnelhight,

Yes, it is possible to run the script via Pulseway which will create all required registry keys.

try{
    if(!(Test-Path -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate")){
       New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate"
    }
    if(!(Test-Path -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU")){
       New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU"
    }
    Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoUpdate" -Value 1
    Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "AUOptions" -Value 1
    Write-Host "Registry keys was created successfully"
    exit 0
}catch{
  Write-Host "An unexpected error ocurred"
  exit 1
}

And you may use the Pulseway Automation to run it on multiple systems at once.