Windows Update for Business via GPO¶

# Create four WUfB deployment ring GPOs with correct deferral settings
# Requires: RSAT GroupPolicy module, Domain Admin or GPO Creator Owner rights

#Requires -Modules GroupPolicy, ActiveDirectory

$domain    = (Get-ADDomain).DNSRoot
$domainDN  = (Get-ADDomain).DistinguishedName

# Ring definitions: Name, QualityDeferDays, FeatureDeferDays, BranchReadiness, OUPath
$rings = @(
    @{
        Name            = "WUfB-Ring-Pilot"
        QualityDefer    = 0
        FeatureDefer    = 0
        BranchReadiness = 16     # GA Channel
        OUPath          = "OU=Pilot,OU=Computers,$domainDN"
        Description     = "WUfB Ring 0 - Pilot: IT team and volunteers. No deferral."
    },
    @{
        Name            = "WUfB-Ring-EarlyAdopters"
        QualityDefer    = 7
        FeatureDefer    = 30
        BranchReadiness = 16
        OUPath          = "OU=EarlyAdopters,OU=Computers,$domainDN"
        Description     = "WUfB Ring 1 - Early Adopters: 7d quality / 30d feature deferral."
    },
    @{
        Name            = "WUfB-Ring-Production"
        QualityDefer    = 21
        FeatureDefer    = 90
        BranchReadiness = 16
        OUPath          = "OU=Production,OU=Computers,$domainDN"
        Description     = "WUfB Ring 2 - Production: 21d quality / 90d feature deferral."
    },
    @{
        Name            = "WUfB-Ring-Critical"
        QualityDefer    = 30     # Maximum enforced by Windows Update
        FeatureDefer    = 180
        BranchReadiness = 16
        OUPath          = "OU=Critical,OU=Computers,$domainDN"
        Description     = "WUfB Ring 3 - Critical: 30d quality (max) / 180d feature deferral."
    }
)

foreach ($ring in $rings) {
    Write-Host "Creating GPO: $($ring.Name)..."

    # Create GPO
    $gpo = New-GPO -Name $ring.Name -Comment $ring.Description
    $gpoId = $gpo.Id

    # --- Quality Updates deferral ---
    Set-GPRegistryValue -Guid $gpoId `
        -Key  "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
        -ValueName "DeferQualityUpdates" `
        -Type DWord -Value 1

    Set-GPRegistryValue -Guid $gpoId `
        -Key  "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
        -ValueName "DeferQualityUpdatesPeriodInDays" `
        -Type DWord -Value $ring.QualityDefer

    # --- Feature Updates deferral ---
    Set-GPRegistryValue -Guid $gpoId `
        -Key  "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
        -ValueName "DeferFeatureUpdates" `
        -Type DWord -Value 1

    Set-GPRegistryValue -Guid $gpoId `
        -Key  "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
        -ValueName "DeferFeatureUpdatesPeriodInDays" `
        -Type DWord -Value $ring.FeatureDefer

    # --- Branch readiness (GA Channel = 16) ---
    Set-GPRegistryValue -Guid $gpoId `
        -Key  "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
        -ValueName "BranchReadinessLevel" `
        -Type DWord -Value $ring.BranchReadiness

    # --- Explicitly disable WSUS pointer to avoid coexistence conflict ---
    Set-GPRegistryValue -Guid $gpoId `
        -Key  "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
        -ValueName "UseWUServer" `
        -Type DWord -Value 0

    # Link GPO to the target OU
    if (Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$($ring.OUPath)'" -ErrorAction SilentlyContinue) {
        New-GPLink -Guid $gpoId -Target $ring.OUPath -LinkEnabled Yes
        Write-Host "  Linked to $($ring.OUPath)" -ForegroundColor Green
    } else {
        Write-Warning "  OU not found: $($ring.OUPath) — GPO created but NOT linked."
    }
}

Write-Host ""
Write-Host "Done. Created $($rings.Count) WUfB ring GPOs." -ForegroundColor Cyan
Write-Host "Verify with: Get-GPO -All | Where-Object Name -like 'WUfB-Ring-*' | Select-Object DisplayName, GpoStatus"

# Replace default security filtering (Authenticated Users) with a specific group
# This approach is used when OU structure does not map cleanly to rings

param(
    [string]$GPOName,
    [string]$AllowedGroup    # e.g. "GRP-WUfB-EarlyAdopters"
)

# Remove the default "Authenticated Users" apply permission
Set-GPPermission -Name $GPOName `
    -TargetName "Authenticated Users" `
    -TargetType Group `
    -PermissionLevel GpoRead

# Grant the target group both Read and Apply
Set-GPPermission -Name $GPOName `
    -TargetName $AllowedGroup `
    -TargetType Group `
    -PermissionLevel GpoApply

Write-Host "GPO '$GPOName' will now apply only to members of '$AllowedGroup'"

# Set AllowTelemetry to Required (1) on all WUfB ring GPOs
# This is the minimum level for WUfB cloud reporting to function

$wufbGPOs = Get-GPO -All | Where-Object { $_.DisplayName -like "WUfB-Ring-*" }

foreach ($gpo in $wufbGPOs) {
    Set-GPRegistryValue -Guid $gpo.Id `
        -Key       "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" `
        -ValueName "AllowTelemetry" `
        -Type      DWord `
        -Value     1

    Write-Host "AllowTelemetry = 1 set on: $($gpo.DisplayName)"
}

# Check AllowTelemetry registry value on a remote machine
param(
    [string]$ComputerName = $env:COMPUTERNAME
)

$result = Invoke-Command -ComputerName $ComputerName -ScriptBlock {
    $key = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
    $val = (Get-ItemProperty -Path $key -Name AllowTelemetry -ErrorAction SilentlyContinue).AllowTelemetry

    [PSCustomObject]@{
        ComputerName    = $env:COMPUTERNAME
        AllowTelemetry  = if ($null -eq $val) { "NOT SET (defaults to 3 on non-Enterprise)" } else { $val }
        SufficientForWUfB = ($null -eq $val -or $val -ge 1)
    }
}

$result | Format-Table -AutoSize

# Configure WUfB restart behavior for enterprise workstations
# Target: minimize disruption while ensuring patches are applied within 7 days

param(
    [string]$GPOName = "WUfB-Ring-Production"
)

$gpoId = (Get-GPO -Name $GPOName).Id

# Active hours: protect 7:00 AM to 9:00 PM (21:00) — 14-hour window
Set-GPRegistryValue -Guid $gpoId `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
    -ValueName "ActiveHoursStart" -Type DWord -Value 7

Set-GPRegistryValue -Guid $gpoId `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
    -ValueName "ActiveHoursEnd" -Type DWord -Value 21

# Let users extend active hours but cap at 18 hours max
Set-GPRegistryValue -Guid $gpoId `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
    -ValueName "AutoRestartRequiredNotificationDismissal" -Type DWord -Value 1

# Notification frequency: remind every 60 minutes once deadline approaches
Set-GPRegistryValue -Guid $gpoId `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
    -ValueName "AutoRestartNotificationSchedule" -Type DWord -Value 60

# Engaged restart: 7-day deadline, 1-day snooze
Set-GPRegistryValue -Guid $gpoId `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
    -ValueName "EngagedRestartDeadline" -Type DWord -Value 7

Set-GPRegistryValue -Guid $gpoId `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
    -ValueName "EngagedRestartSnoozeSchedule" -Type DWord -Value 1

Write-Host "Restart policy configured on GPO '$GPOName'"
Write-Host "  Active hours   : 07:00 - 21:00"
Write-Host "  Restart deadline : 7 days after patch availability"
Write-Host "  Snooze duration  : 1 day"

# Alert on machines that have not installed quality updates in more than N days
# Schedule this script weekly via Task Scheduler on a management server

param(
    [int]$AlertThresholdDays  = 30,
    [string]$TargetOU         = "",        # OU DN, or empty for all domain computers
    [string]$AlertEmail       = "it-ops@contoso.local",
    [string]$SmtpServer       = "smtp.contoso.local",
    [string]$ReportPath       = "C:\Temp\WUfB-Compliance-$(Get-Date -Format 'yyyyMMdd').csv"
)

# Build the computer list
$queryParams = @{ Filter = "Enabled -eq `$true" }
if ($TargetOU) { $queryParams.SearchBase = $TargetOU }
$computers = Get-ADComputer @queryParams | Select-Object -ExpandProperty Name

Write-Host "Checking $($computers.Count) computers for update compliance..."

$results = $computers | ForEach-Object -ThrottleLimit 20 -Parallel {
    $computer = $_
    $threshold = $using:AlertThresholdDays

    try {
        $session = New-CimSession -ComputerName $computer -OperationTimeoutSec 10 -ErrorAction Stop

        # Get the last successful quality update installation date
        $wu = Get-CimInstance -CimSession $session `
            -ClassName Win32_QuickFixEngineering `
            -ErrorAction SilentlyContinue |
            Sort-Object InstalledOn -Descending |
            Select-Object -First 1

        $lastPatch = if ($wu -and $wu.InstalledOn) {
            [datetime]$wu.InstalledOn
        } else {
            $null
        }

        $daysSinceUpdate = if ($lastPatch) {
            (Get-Date) - $lastPatch | Select-Object -ExpandProperty Days
        } else { 999 }

        # Also check WUServer registry to detect WSUS override
        $wuServer = Invoke-Command -Session (New-PSSession -ComputerName $computer -ErrorAction SilentlyContinue) -ScriptBlock {
            (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
                -Name WUServer -ErrorAction SilentlyContinue).WUServer
        } -ErrorAction SilentlyContinue

        Remove-CimSession $session -ErrorAction SilentlyContinue

        [PSCustomObject]@{
            ComputerName    = $computer
            LastPatchDate   = if ($lastPatch) { $lastPatch.ToString("yyyy-MM-dd") } else { "Unknown" }
            DaysSinceUpdate = $daysSinceUpdate
            Compliant       = $daysSinceUpdate -le $threshold
            WUSERVERDefined = (-not [string]::IsNullOrEmpty($wuServer))
            Status          = if ($daysSinceUpdate -le $threshold) { "OK" }
                              elseif ($daysSinceUpdate -le $threshold + 7) { "WARNING" }
                              else { "CRITICAL" }
        }
    } catch {
        [PSCustomObject]@{
            ComputerName    = $computer
            LastPatchDate   = "Unreachable"
            DaysSinceUpdate = -1
            Compliant       = $false
            WUSERVERDefined = $false
            Status          = "UNREACHABLE"
        }
    }
}

# Export full report to CSV
$results | Export-Csv $ReportPath -NoTypeInformation
Write-Host "Report saved to $ReportPath"

# Summary
$critical = $results | Where-Object Status -eq "CRITICAL"
$warnings  = $results | Where-Object Status -eq "WARNING"
$ok        = $results | Where-Object Status -eq "OK"

Write-Host ""
Write-Host "=== Update Compliance Summary ==="
Write-Host "  OK         : $($ok.Count)"
Write-Host "  WARNING    : $($warnings.Count) (between $AlertThresholdDays and $($AlertThresholdDays + 7) days)"
Write-Host "  CRITICAL   : $($critical.Count) (more than $($AlertThresholdDays + 7) days behind)"
Write-Host "  UNREACHABLE: $(($results | Where-Object Status -eq 'UNREACHABLE').Count)"

# Send alert email if critical machines exist
if ($critical.Count -gt 0) {
    $emailBody = @"
Windows Update Compliance Alert — $(Get-Date -Format 'yyyy-MM-dd')

The following machines have not installed quality updates in more than $($AlertThresholdDays + 7) days:

$(($critical | Select-Object ComputerName, LastPatchDate, DaysSinceUpdate, WUSERVERDefined |
    Format-Table -AutoSize | Out-String))

Full report: $ReportPath

Immediate action required:
1. Verify the machine is reachable and the WUfB GPO is applied (gpresult /r).
2. Check if WUServer registry key overrides WUfB settings (WUSERVERDefined = True).
3. Force update check: usoclient StartScan; usoclient StartInstall
"@

    Send-MailMessage `
        -To         $AlertEmail `
        -From       "wu-monitor@contoso.local" `
        -Subject    "[ALERTE WUfB] $($critical.Count) machine(s) en retard critique — $(Get-Date -Format 'yyyy-MM-dd')" `
        -Body       $emailBody `
        -SmtpServer $SmtpServer

    Write-Host ""
    Write-Warning "Alert email sent to $AlertEmail — $($critical.Count) critical machine(s) detected."
}

# Diagnose and force Windows Update on a non-compliant machine
param(
    [Parameter(Mandatory)]
    [string]$ComputerName
)

Write-Host "=== WUfB Diagnostics: $ComputerName ===" -ForegroundColor Cyan

Invoke-Command -ComputerName $ComputerName -ScriptBlock {
    # 1. Check GPO result for Windows Update keys
    Write-Host "--- Applied Update Policy ---"
    $wuKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
    $auKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

    $props = @("WUServer","DeferQualityUpdates","DeferQualityUpdatesPeriodInDays",
               "DeferFeatureUpdates","DeferFeatureUpdatesPeriodInDays","BranchReadinessLevel")

    foreach ($p in $props) {
        $val = (Get-ItemProperty $wuKey -Name $p -ErrorAction SilentlyContinue).$p
        Write-Host "  $p = $(if ($null -eq $val) { '(not set)' } else { $val })"
    }

    $useWU = (Get-ItemProperty $auKey -Name "UseWUServer" -ErrorAction SilentlyContinue).UseWUServer
    Write-Host "  UseWUServer = $(if ($null -eq $useWU) { '(not set)' } else { $useWU })"

    # 2. Force an update scan and install
    Write-Host ""
    Write-Host "--- Forcing update scan and install ---"
    usoclient StartScan
    Start-Sleep -Seconds 5
    usoclient StartInstall
    Write-Host "Update scan and install initiated. Check Windows Update log for progress."
}

# Verify WUfB settings are correctly applied on a set of target machines
param(
    [string[]]$ComputerNames,
    [string]$ExpectedRing     # "Pilot", "EarlyAdopters", "Production", "Critical"
)

$expectedSettings = @{
    Pilot        = @{ QualityDefer = 0;  FeatureDefer = 0   }
    EarlyAdopters = @{ QualityDefer = 7;  FeatureDefer = 30  }
    Production   = @{ QualityDefer = 21; FeatureDefer = 90  }
    Critical     = @{ QualityDefer = 30; FeatureDefer = 180 }
}

$expected = $expectedSettings[$ExpectedRing]

$results = $ComputerNames | ForEach-Object {
    $computer = $_

    $check = Invoke-Command -ComputerName $computer -ScriptBlock {
        $wuKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
        $auKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

        [PSCustomObject]@{
            QualityDefer    = (Get-ItemProperty $wuKey -Name DeferQualityUpdatesPeriodInDays -ErrorAction SilentlyContinue).DeferQualityUpdatesPeriodInDays
            FeatureDefer    = (Get-ItemProperty $wuKey -Name DeferFeatureUpdatesPeriodInDays -ErrorAction SilentlyContinue).DeferFeatureUpdatesPeriodInDays
            BranchReadiness = (Get-ItemProperty $wuKey -Name BranchReadinessLevel -ErrorAction SilentlyContinue).BranchReadinessLevel
            UseWUServer     = (Get-ItemProperty $auKey -Name UseWUServer -ErrorAction SilentlyContinue).UseWUServer
            Telemetry       = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name AllowTelemetry -ErrorAction SilentlyContinue).AllowTelemetry
        }
    } -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        ComputerName       = $computer
        QualityDefer_OK    = ($check.QualityDefer -eq $expected.QualityDefer)
        FeatureDefer_OK    = ($check.FeatureDefer -eq $expected.FeatureDefer)
        BranchReadiness_OK = ($check.BranchReadiness -eq 16)
        WSUSDisabled_OK    = ($check.UseWUServer -eq 0)
        Telemetry_OK       = ($null -ne $check.Telemetry -and $check.Telemetry -ge 1)
        AllOK              = (
            $check.QualityDefer  -eq $expected.QualityDefer -and
            $check.FeatureDefer  -eq $expected.FeatureDefer -and
            $check.BranchReadiness -eq 16 -and
            $check.UseWUServer   -eq 0 -and
            $check.Telemetry     -ge 1
        )
    }
}

$results | Format-Table -AutoSize

$failCount = ($results | Where-Object AllOK -eq $false).Count
if ($failCount -eq 0) {
    Write-Host "All $($ComputerNames.Count) machines are correctly configured for ring '$ExpectedRing'." -ForegroundColor Green
} else {
    Write-Warning "$failCount machine(s) have incorrect settings. Review the table above."
}

# Report which WUfB ring each machine belongs to based on its GPO application
param(
    [string[]]$ComputerNames
)

$ComputerNames | ForEach-Object {
    $computer = $_
    $info = Invoke-Command -ComputerName $computer -ScriptBlock {
        $wuKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"

        $quality = (Get-ItemProperty $wuKey -Name DeferQualityUpdatesPeriodInDays -ErrorAction SilentlyContinue).DeferQualityUpdatesPeriodInDays
        $feature = (Get-ItemProperty $wuKey -Name DeferFeatureUpdatesPeriodInDays -ErrorAction SilentlyContinue).DeferFeatureUpdatesPeriodInDays

        $ring = switch ($quality) {
            0       { "Pilot" }
            7       { "EarlyAdopters" }
            21      { "Production" }
            30      { "Critical" }
            default { "Unknown ($quality days)" }
        }

        [PSCustomObject]@{
            Ring         = $ring
            QualityDefer = $quality
            FeatureDefer = $feature
        }
    } -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        ComputerName = $computer
        Ring         = if ($info) { $info.Ring } else { "Unreachable" }
        QualityDefer = if ($info) { $info.QualityDefer } else { "-" }
        FeatureDefer = if ($info) { $info.FeatureDefer } else { "-" }
    }
} | Format-Table -AutoSize