Kod: Tümünü seç
# Windows Update + Store Policy Manager (GPO-based) - TRWE_2012
# Uses official Group Policy registry keys instead of service ACL hijacking
# where a real ADMX-backed policy exists.
# Compatible with Windows PowerShell 5.1 and PowerShell 7.x (Core) on Windows.
# Must be run as Administrator.
function Test-IsAdmin {
$currentUser = New-Object Security.Principal.WindowsPrincipal(
[Security.Principal.WindowsIdentity]::GetCurrent()
)
return $currentUser.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}
function Show-EngineInfo {
$engineVersion = $PSVersionTable.PSVersion.ToString()
$engineEdition = $PSVersionTable.PSEdition
Write-Host "Engine: PowerShell $engineVersion ($engineEdition)"
}
function Show-Menu {
Clear-Host
Write-Host "======================================"
Write-Host " Windows Update Policy Manager"
Write-Host " (Group Policy based) - TRWE_2012"
Write-Host "======================================"
Show-EngineInfo
Write-Host "--------------------------------------"
Write-Host "1. ENABLE Windows Update Auto-Download (Policy)"
Write-Host "2. DISABLE Windows Update Auto-Download (Policy)"
Write-Host "3. ENABLE Windows Update UI Access (Policy)"
Write-Host "4. DISABLE Windows Update UI Access (Policy)"
Write-Host "5. ENABLE Store Auto-Update (Policy)"
Write-Host "6. DISABLE Store Auto-Update (Policy)"
Write-Host "7. SHOW POLICY STATUS"
Write-Host "--------------------------------------"
Write-Host "8. DISABLE WaaSMedicSvc (registry Start value)"
Write-Host "9. ENABLE WaaSMedicSvc (restore to Manual)"
Write-Host "10. EXIT"
Write-Host "======================================"
}
function Ensure-RegistryPath {
param([string]$path)
if (-not (Test-Path -LiteralPath $path)) {
New-Item -Path $path -Force | Out-Null
}
}
function Invoke-GPUpdate {
Write-Host "Applying policy changes with gpupdate /force ..."
try {
$output = & gpupdate /force 2>&1
$output | ForEach-Object { Write-Host $_ }
}
catch {
Write-Host "WARNING: gpupdate /force could not be executed. Detail: $_"
Write-Host "You may need to sign out and back in, or reboot, for the policy to fully apply."
}
}
# ---- Windows Update auto-download policy (ADMX: "Configure Automatic Updates") ----
function Disable-WindowsUpdateAutoDownload {
$auPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
try {
Ensure-RegistryPath $auPath
Set-ItemProperty -Path $auPath -Name "NoAutoUpdate" -Value 1 -Type DWord -Force
Write-Host "Windows Update automatic download/install set to PERMANENT OFF."
Invoke-GPUpdate
}
catch {
Write-Host "ERROR: Could not disable Windows Update auto-download. Detail: $_"
Write-Host "Make sure the script is running as Administrator."
}
}
function Enable-WindowsUpdateAutoDownload {
$auPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
try {
if (Test-Path -LiteralPath $auPath) {
Remove-ItemProperty -Path $auPath -Name "NoAutoUpdate" -ErrorAction SilentlyContinue
}
Write-Host "Windows Update automatic download/install RESTORED to default."
Invoke-GPUpdate
}
catch {
Write-Host "ERROR: Could not restore Windows Update auto-download policy. Detail: $_"
}
}
# ---- Windows Update UI access policy (ADMX: "Remove access to use all Windows Update features") ----
function Disable-WindowsUpdateUIAccess {
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
try {
Ensure-RegistryPath $wuPath
Set-ItemProperty -Path $wuPath -Name "DisableWindowsUpdateAccess" -Value 1 -Type DWord -Force
Write-Host "Windows Update UI access set to PERMANENT OFF (hidden from Settings)."
Invoke-GPUpdate
}
catch {
Write-Host "ERROR: Could not disable Windows Update UI access. Detail: $_"
Write-Host "Make sure the script is running as Administrator."
}
}
function Enable-WindowsUpdateUIAccess {
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
try {
if (Test-Path -LiteralPath $wuPath) {
Remove-ItemProperty -Path $wuPath -Name "DisableWindowsUpdateAccess" -ErrorAction SilentlyContinue
}
Write-Host "Windows Update UI access RESTORED to default (visible in Settings)."
Invoke-GPUpdate
}
catch {
Write-Host "ERROR: Could not restore Windows Update UI access policy. Detail: $_"
}
}
# ---- Microsoft Store auto-update policy (ADMX: "Turn off Automatic Download and Install of updates") ----
function Disable-StoreAutoUpdatePolicy {
$storePath = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore"
try {
Ensure-RegistryPath $storePath
Set-ItemProperty -Path $storePath -Name "AutoDownload" -Value 2 -Type DWord -Force
Write-Host "Microsoft Store automatic updates set to PERMANENT OFF (policy)."
Invoke-GPUpdate
}
catch {
Write-Host "ERROR: Could not apply Store update disable policy. Detail: $_"
}
}
function Enable-StoreAutoUpdatePolicy {
$storePath = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore"
try {
if (Test-Path -LiteralPath $storePath) {
Remove-ItemProperty -Path $storePath -Name "AutoDownload" -ErrorAction SilentlyContinue
}
Write-Host "Microsoft Store automatic updates RESTORED to default."
Invoke-GPUpdate
}
catch {
Write-Host "ERROR: Could not restore Store update policy. Detail: $_"
}
}
# ---- Policy status ----
function Show-PolicyStatus {
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
$auPath = "$wuPath\AU"
$storePath = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore"
$accessBlocked = $null
$autoOff = $null
$storeOff = $null
if (Test-Path -LiteralPath $wuPath) {
$accessBlocked = (Get-ItemProperty -Path $wuPath -Name "DisableWindowsUpdateAccess" -ErrorAction SilentlyContinue).DisableWindowsUpdateAccess
}
if (Test-Path -LiteralPath $auPath) {
$autoOff = (Get-ItemProperty -Path $auPath -Name "NoAutoUpdate" -ErrorAction SilentlyContinue).NoAutoUpdate
}
if (Test-Path -LiteralPath $storePath) {
$storeOff = (Get-ItemProperty -Path $storePath -Name "AutoDownload" -ErrorAction SilentlyContinue).AutoDownload
}
$accessLabel = "NO (default)"
if ($accessBlocked -eq 1) { $accessLabel = "YES (OFF)" }
$autoLabel = "DEFAULT / ENABLED"
if ($autoOff -eq 1) { $autoLabel = "DISABLED" }
$storeLabel = "DEFAULT / ENABLED"
if ($storeOff -eq 2) { $storeLabel = "DISABLED" }
Write-Host "Windows Update UI access blocked : $accessLabel"
Write-Host "Windows Update auto-download : $autoLabel"
Write-Host "Store auto-update policy : $storeLabel"
$svc = Get-Service -Name "WaaSMedicSvc" -ErrorAction SilentlyContinue
if ($svc) {
Write-Host "WaaSMedicSvc service status : $($svc.Status) [StartType: $($svc.StartType)]"
} else {
Write-Host "WaaSMedicSvc service status : NOT FOUND / ACCESS DENIED"
}
}
# ---- WaaSMedicSvc registry Start value (no true ADMX policy exists for this service) ----
function Disable-WaaSMedicSvc {
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc"
$regNT = "SYSTEM\CurrentControlSet\Services\WaaSMedicSvc"
$adminSid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
try {
$keyOwn = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(
$regNT,
[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,
[System.Security.AccessControl.RegistryRights]::TakeOwnership
)
$acl = $keyOwn.GetAccessControl([System.Security.AccessControl.AccessControlSections]::None)
$acl.SetOwner($adminSid)
$keyOwn.SetAccessControl($acl)
$keyOwn.Close()
$keyPerm = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(
$regNT,
[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,
[System.Security.AccessControl.RegistryRights]::ChangePermissions
)
$acl2 = $keyPerm.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule(
$adminSid,
[System.Security.AccessControl.RegistryRights]::FullControl,
[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,
[System.Security.AccessControl.PropagationFlags]::None,
[System.Security.AccessControl.AccessControlType]::Allow
)
$acl2.AddAccessRule($rule)
$keyPerm.SetAccessControl($acl2)
$keyPerm.Close()
Set-ItemProperty -Path $regPath -Name "Start" -Value 4 -ErrorAction Stop
$svc = Get-Service -Name "WaaSMedicSvc" -ErrorAction SilentlyContinue
if ($svc -and $svc.Status -eq 'Running') {
Stop-Service -Name "WaaSMedicSvc" -Force -ErrorAction SilentlyContinue
}
Write-Host "WaaSMedicSvc DISABLED (registry Start=4)."
Write-Host "NOTE: This is a service registry change, not an official Group Policy."
Write-Host "A major Windows Feature Update may re-enable it."
}
catch {
Write-Host "ERROR: Could not disable WaaSMedicSvc. Detail: $_"
Write-Host "Make sure the script is running as Administrator."
}
}
function Enable-WaaSMedicSvc {
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc"
$regNT = "SYSTEM\CurrentControlSet\Services\WaaSMedicSvc"
$adminSid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
try {
$keyPerm = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(
$regNT,
[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,
[System.Security.AccessControl.RegistryRights]::ChangePermissions
)
$acl = $keyPerm.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule(
$adminSid,
[System.Security.AccessControl.RegistryRights]::FullControl,
[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,
[System.Security.AccessControl.PropagationFlags]::None,
[System.Security.AccessControl.AccessControlType]::Allow
)
$acl.AddAccessRule($rule)
$keyPerm.SetAccessControl($acl)
$keyPerm.Close()
Set-ItemProperty -Path $regPath -Name "Start" -Value 3 -ErrorAction Stop
Write-Host "WaaSMedicSvc RESTORED to Manual (original default)."
}
catch {
Write-Host "ERROR: Could not restore WaaSMedicSvc. Detail: $_"
}
}
# ---- Main loop ----
if (-not (Test-IsAdmin)) {
Write-Host "WARNING: This script is not running as Administrator."
Write-Host "Policy registry keys under HKLM require elevation to write."
}
$continueLoop = $true
while ($continueLoop) {
Show-Menu
$choice = Read-Host "Your choice (1-10)"
switch ($choice) {
'1' { Enable-WindowsUpdateAutoDownload }
'2' { Disable-WindowsUpdateAutoDownload }
'3' { Enable-WindowsUpdateUIAccess }
'4' { Disable-WindowsUpdateUIAccess }
'5' { Enable-StoreAutoUpdatePolicy }
'6' { Disable-StoreAutoUpdatePolicy }
'7' { Show-PolicyStatus }
'8' { Disable-WaaSMedicSvc }
'9' { Enable-WaaSMedicSvc }
'10' { $continueLoop = $false }
default { Write-Host "Invalid choice. Please try again." }
}
if ($continueLoop) {
Read-Host "`nPress ENTER to continue..."
}
}
Read-Host "`nPress ENTER to exit."
