How to change group policy via command line?

windows command-line cmd command-prompt

52,012

Solution 1

How to change group policy from the command line? Voila:

LGPO.exe – Local Group Policy Object Utility, v1.0

Solution 2

For group policy objects in a domain, registry-based group policy settings can be configured from the command line using Powershell. If you are not running on a domain controller, the Group Policy Management Console must be installed.

See Group Policy Cmdlets in Windows PowerShell and in particular the Set-GPRegistryValue cmdlet.

You can of course run a Powershell command from the legacy command line, e.g.,

powershell get-gpregistryvalue -Name gpo-name -Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU -ValueName AUOptions

~~As far as I know, there is no command-line solution for local group policy.~~ For local group policy, see Glenn's answer.

Solution 3

Set-GPRegistryValue is the way to go here. The problem, which is common, is that you have the GP path and you need to raw data. You can get the raw data (Keypath and value) from the settings spreadsheet, from the ADMX file (if administrative template setting) or from a free tool call registry.pol viewer from GPOGuy.

The commands you put up clean up registry data, these cmdlets don't do that. They add values to the registry.pol file (or registry.xml for GP Preference) stored in the GPO. Those settings are then sent down to target systems and applied to registry. Also, for non-registry based policy and ability to automate settings across local policies search "Group Policy Automation" there is a solution out there you may want to look at.

52,012

Abhishek

I'm a polygot software developer trying to learn , learn & implement! :)

Updated on July 09, 2022

Comments

Abhishek almost 2 years
I want to update group policy in windows server using command line. I don't want programatic way. I read this & this, and then tried delete registry keys based on the mapping of group policy and registry keys, but the group policy didn't got updated.

Specifically, I want to set Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates to Not configured in group policy.

So, I ran following commands,
```
C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallTime /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallDay /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /f
The operation completed successfully.

C:\Windows\system32>reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /f
The operation completed successfully.
```
But after that the group policy wasn't updated. Do I need to run another command to propagate my registry changes to group policy? If yes, what is it? What am I missing?

I tried, gpupdate /force, it overrided my registry changes. I need converse of this.
- Admin over 7 years
  
  gpupdate /f updates Group Policy which will fix what you've done. GP is updated every hour (might be 2 hours). So your changes should be overwritten by your group policy file (group policy changes the registry when it's applied). Changing registry values is not changing Group Policy and GP will overwrite your changes. If your registry changes aren't taking effect then the component probably reads it on startup.
- Abhishek over 7 years
  
  I thought the mapping of registry is for this purpose.Is there a way to solve this?
- Admin over 7 years
  
  Just disable Windows Update service in Services.
- Abhishek over 7 years
  
  That is manual step. I'm trying to automate this step. This is one of the steps in automation.
- Admin over 7 years
  
  sc config wuauserv start= disabled
- Abhishek over 7 years
  
  @Noodles is disabled == not configured ? Also, how did you found the name of the service? I want to disable few more group policies.
- Admin over 7 years
  
  sc GetDisplayName Servicename and sc getkeyname servicename. Everything is kept under here in the registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.
- Abhishek over 7 years
  
  @Noodles Got it. Thanks. But that didn't changed the group policy. When I restarted the machine, group policy overrided it again :|
- Admin over 7 years
  
  Yes. That is what group policy does. And it will do it every two hours as well. So change group policy or disable the services after boot and every two hours.
- Abhishek over 7 years
  
  @Noodles So, can I change that group policy using a command? Actually, that is my actual question :)
- Admin over 7 years
  
  No. Need to use the GUI.
- Abhishek over 7 years
  
  @Noodles So, I'll have write c++ code.
Abhishek over 7 years

This is for getting the value, right? I need to set them.
Harry Johnston over 7 years

That was just an example, one I could test easily. If you want to set the group policy, use Set-GPRegistryValue instead of Get-GPRegistryValue. You'll have to figure out the exact syntax yourself.
Abhishek over 7 years

It is not working for local group policy, as you said. I need to add the machine to some domain for it to work? :(
Harry Johnston over 7 years

If you have to manipulate local group policy from the command line, you'll need to look for a third-party tool, or write your own. It might be quicker just to use the GUI, depending I guess on just how many machines you're talking about.
Abhishek over 7 years

Can you suggest any 3rd party tool? I've looked on web and found a source code, in a language not known to me. It's extension was .au3
Harry Johnston over 7 years

This answer may be useful, discussing the IGroupPolicyObject COM interface. I believe you can use COM in Powershell, though it would probably be too complicated to turn into a one-liner.
Abhishek over 7 years

Got it. Thanks for the link, it is similar to the links I shared. Logically, a single command should have sufficed, as we are finding a key and setting it's value. I'm not sure why MS didn't gave this feature/command to user.
Harry Johnston over 7 years

That would be the -100 points principle, see technet.microsoft.com/en-us/library/dn167709.aspx ; in short, very few people would use such a feature, so it wouldn't be cost-effective to implement.
Abhishek over 7 years

Nice one. Thanks for making me aware if it.
Glenn Slayden over 7 years

@HarryJohnson regarding "there is no command-line solution for local group policy." -- see blogs.technet.microsoft.com/secguide/2016/01/21/…
Harry Johnston over 7 years

@GlennSlayden: excellent. You should post that as an answer.
Harry Johnston over 7 years

According to the OP, at least, Set-GPRegistryValue doesn't work for local group policy.
Kevin over 7 years

Set-GPRegsitryValue does not work against local policy directly - there are 1) third party options here (search 'automating group policy') and there are 2) 'hacks' where you can take domain based GP data and port it to local policy but I wouldn't not suggest them. the 3) LGPO tool is OK if the local policy piece is required but not super flexible.
Kevin over 7 years

also @HarryJohnston apologies, I didn't see the local policy mention in the OP, I had neglected to expand the comment. My mistake.
Abhishek over 7 years

@Kevin As Set-GPRegistryValue changes registry value, it will be overridden in next restart. Correct?
Kevin over 7 years

Sorry for delay @Abhishek - so set-gpregistryvalue does not change the registry... it changes the registry.pol in the GPO. The actual registry is not updated until the group policy is linked and client system refreshes policy. When the client target updates policy with this new registry.pol file it will store the data in the appropriate place in the registry and will not be overridden on next restart.
Abhishek over 7 years

Great. Let me give it a try and get back.