How to change group policy via command line?

Question

I want to update group policy in windows server using command line. I don't want programatic way. I read this & this, and then tried delete registry keys based on the mapping of group policy and registry keys, but the group policy didn't got updated.

Specifically, I want to set Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates to Not configured in group policy.

So, I ran following commands,

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallTime /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallDay /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /f
The operation completed successfully.

But after that the group policy wasn't updated. Do I need to run another command to propagate my registry changes to group policy? If yes, what is it? What am I missing?

I tried, gpupdate /force, it overrided my registry changes. I need converse of this.

Babul

gpupdate /f updates Group Policy which will fix what you've done. GP is updated every hour (might be 2 hours). So your changes should be overwritten by your group policy file (group policy changes the registry when it's applied). Changing registry values is not changing Group Policy and GP will overwrite your changes. If your registry changes aren't taking effect then the component probably reads it on startup. – Physiology

I thought the mapping of registry is for this purpose.Is there a way to solve this? – Babul

Just disable Windows Update service in Services. – Physiology

That is manual step. I'm trying to automate this step. This is one of the steps in automation. – Babul

sc config wuauserv start= disabled – Physiology

@Noodles is disabled == not configured ? Also, how did you found the name of the service? I want to disable few more group policies. – Babul

sc GetDisplayName Servicename and sc getkeyname servicename. Everything is kept under here in the registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. – Physiology

@Noodles Got it. Thanks. But that didn't changed the group policy. When I restarted the machine, group policy overrided it again :| – Babul

Yes. That is what group policy does. And it will do it every two hours as well. So change group policy or disable the services after boot and every two hours. – Physiology

@Noodles So, can I change that group policy using a command? Actually, that is my actual question :) – Babul

No. Need to use the GUI. – Physiology

@Noodles So, I'll have write c++ code. – Babul

Answer 1

How to change group policy from the command line? Voila:

LGPO.exe – Local Group Policy Object Utility, v1.0

Auspex

Could you add more detail to your answer? Links can become broken – Cons

This Tool is able to Export GPO files (.POL, .INF, .CSV) to editable text format, then import them back to a new system. The updated version (LGPO V 3) is available here : microsoft.com/en-us/download/details.aspx?id=55319 – Lev

Answer 2

For group policy objects in a domain, registry-based group policy settings can be configured from the command line using Powershell. If you are not running on a domain controller, the Group Policy Management Console must be installed.

See Group Policy Cmdlets in Windows PowerShell and in particular the Set-GPRegistryValue cmdlet.

You can of course run a Powershell command from the legacy command line, e.g.,

powershell get-gpregistryvalue -Name gpo-name -Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU -ValueName AUOptions

As far as I know, there is no command-line solution for local group policy. For local group policy, see Glenn's answer.

Lynlyncean

This is for getting the value, right? I need to set them. – Babul

That was just an example, one I could test easily. If you want to set the group policy, use Set-GPRegistryValue instead of Get-GPRegistryValue. You'll have to figure out the exact syntax yourself. – Lynlyncean

It is not working for local group policy, as you said. I need to add the machine to some domain for it to work? :( – Babul

If you have to manipulate local group policy from the command line, you'll need to look for a third-party tool, or write your own. It might be quicker just to use the GUI, depending I guess on just how many machines you're talking about. – Lynlyncean

Can you suggest any 3rd party tool? I've looked on web and found a source code, in a language not known to me. It's extension was .au3 – Babul

This answer may be useful, discussing the IGroupPolicyObject COM interface. I believe you can use COM in Powershell, though it would probably be too complicated to turn into a one-liner. – Lynlyncean

Got it. Thanks for the link, it is similar to the links I shared. Logically, a single command should have sufficed, as we are finding a key and setting it's value. I'm not sure why MS didn't gave this feature/command to user. – Babul

That would be the -100 points principle, see technet.microsoft.com/en-us/library/dn167709.aspx ; in short, very few people would use such a feature, so it wouldn't be cost-effective to implement. – Lynlyncean

Nice one. Thanks for making me aware if it. – Babul

@HarryJohnson regarding "there is no command-line solution for local group policy." -- see blogs.technet.microsoft.com/secguide/2016/01/21/… – Auspex

@GlennSlayden: excellent. You should post that as an answer. – Lynlyncean

Answer 3

Set-GPRegistryValue is the way to go here. The problem, which is common, is that you have the GP path and you need to raw data. You can get the raw data (Keypath and value) from the settings spreadsheet, from the ADMX file (if administrative template setting) or from a free tool call registry.pol viewer from GPOGuy.

The commands you put up clean up registry data, these cmdlets don't do that. They add values to the registry.pol file (or registry.xml for GP Preference) stored in the GPO. Those settings are then sent down to target systems and applied to registry. Also, for non-registry based policy and ability to automate settings across local policies search "Group Policy Automation" there is a solution out there you may want to look at.

Advertent

According to the OP, at least, Set-GPRegistryValue doesn't work for local group policy. – Lynlyncean

Set-GPRegsitryValue does not work against local policy directly - there are 1) third party options here (search 'automating group policy') and there are 2) 'hacks' where you can take domain based GP data and port it to local policy but I wouldn't not suggest them. the 3) LGPO tool is OK if the local policy piece is required but not super flexible. – Advertent

also @HarryJohnston apologies, I didn't see the local policy mention in the OP, I had neglected to expand the comment. My mistake. – Advertent

@Advertent As Set-GPRegistryValue changes registry value, it will be overridden in next restart. Correct? – Babul

Sorry for delay @Babul - so set-gpregistryvalue does not change the registry... it changes the registry.pol in the GPO. The actual registry is not updated until the group policy is linked and client system refreshes policy. When the client target updates policy with this new registry.pol file it will store the data in the appropriate place in the registry and will not be overridden on next restart. – Advertent

Great. Let me give it a try and get back. – Babul

Answer 4

Group Policy Settings Reference for Windows and Windows Server
https://www.microsoft.com/en-us/download/details.aspx?id=25250 https://download.microsoft.com/download/8/F/B/8FBD2E85-8852-45EC-8465-92756EBD9365/Windows10andWindowsServer2016PolicySettings.xlsx

Mostly stored in the registry. Find the reference above, then use reg.exe command line to modify them.

Conchology