<#
.SYNOPSIS
Reset Windows Update Settings - Remediation Script
OS Support: Windows 7 and above
Powershell: 2.0 and above
Run Type: Evaluation or OnDemand (Recommended)
.DESCRIPTION
This script will reset all of the Windows Updates components to DEFAULT SETTINGS, clean-up some files related
to Windows Update, and notify the user that a reboot will occur in 15 minutes (this can be modified) and provide
a final warning at 5 minutes.

Five variables are used to define the messages for user notifications as well as the timers associated with them.

$rebootimer: This is the first reboot countdown timer in seconds. Default setting is 900 seconds (15 min). This
timer should be set long enough for users to save and close applications.

$message1: This is the message displayed to the user regarding the reboot. Include the amount of time set (in minutes)
for $rebootimer.

$message2wait: This is the amount of time to wait before displaying the second notification message (in seconds).

$rebootimer2: This is the second and final reboot timer. By default the value is set to 300 seconds (5 minutes).

$message2: This is the final message displayed to the user before forcefully restarted. Include the amount of time
set (in minutes) for $rebootimer2.

.EXAMPLE
$rebootimer = 900
$message1 = "Automox will automatically reboot your computer in 15 minutes. Please take time to save and close any open documents."
$message2wait = 600
$message2 = "Automox will automatically reboot your computer in 5 minutes. Please take time to save and close any open documents."
$rebootimer2 = 300
.NOTES
Author: twiese
Date: March 22, 2021

>

# EDIT WITHIN THIS BLOCK

$rebootimer = 900
$message1 = "Automox will automatically reboot your computer in 15 minutes. Please take time to save and close any open documents."
$message2wait = 600
$message2 = "Automox will automatically reboot your computer in 5 minutes. Please take time to save and close any open documents."
$rebootimer2 = 300

$is64 = [System.Environment]::Is64BitOperatingSystem

Stopping Windows Update Services

Stop-Service -Name BITS
Stop-Service -Name wuauserv
Stop-Service -Name appidsvc
Stop-Service -Name cryptsvc

Remove QMGR Data file

Remove-Item "$env:allusersprofile\Microsoft\Network\Downloader\qmgr*.dat" -ErrorAction SilentlyContinue -Force

Renaming the Software Distribution and CatRoot Folder

Remove-Item $env:systemroot\SoftwareDistribution.bak -Recurse -ErrorAction SilentlyContinue -Force
Rename-Item $env:systemroot\SoftwareDistribution SoftwareDistribution.bak -ErrorAction SilentlyContinue -Force

This may not work if the folder is locked by having a contained file being accessed

if($is64)
{
Remove-Item $env:systemroot\sysnative\Catroot2.bak -Recurse -ErrorAction SilentlyContinue -Force
Rename-Item $env:systemroot\sysnative\Catroot2 catroot2.bak -ErrorAction SilentlyContinue -Force
}
else
{
Remove-Item $env:systemroot\System32\Catroot2.bak -Recurse -ErrorAction SilentlyContinue -Force
Rename-Item $env:systemroot\System32\Catroot2 catroot2.bak -ErrorAction SilentlyContinue -Force
}

Removing old Windows Update log

Remove-Item $env:systemroot\WindowsUpdate.log -ErrorAction SilentlyContinue -Force

Resetting the Windows Update Services to default settings

if($is64)
{
Set-Location "$env:systemroot\sysnative"
}
else
{
Set-Location "$env:systemroot\system32"
}
Start-process -FilePath "sc.exe" -ArgumentList "sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)" -Wait
Start-process -FilePath "sc.exe" -ArgumentList "sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)" -Wait

Registering some DLLs

regsvr32.exe /s atl.dll
regsvr32.exe /s urlmon.dll
regsvr32.exe /s mshtml.dll
regsvr32.exe /s shdocvw.dll
regsvr32.exe /s browseui.dll
regsvr32.exe /s jscript.dll
regsvr32.exe /s vbscript.dll
regsvr32.exe /s scrrun.dll
regsvr32.exe /s msxml.dll
regsvr32.exe /s msxml3.dll
regsvr32.exe /s msxml6.dll
regsvr32.exe /s actxprxy.dll
regsvr32.exe /s softpub.dll
regsvr32.exe /s wintrust.dll
regsvr32.exe /s dssenh.dll
regsvr32.exe /s rsaenh.dll
regsvr32.exe /s gpkcsp.dll
regsvr32.exe /s sccbase.dll
regsvr32.exe /s slbcsp.dll
regsvr32.exe /s cryptdlg.dll
regsvr32.exe /s oleaut32.dll
regsvr32.exe /s ole32.dll
regsvr32.exe /s shell32.dll
regsvr32.exe /s initpki.dll
regsvr32.exe /s wuapi.dll
regsvr32.exe /s wuaueng.dll
regsvr32.exe /s wuaueng1.dll
regsvr32.exe /s wucltui.dll
regsvr32.exe /s wups.dll
regsvr32.exe /s wups2.dll
regsvr32.exe /s wuweb.dll
regsvr32.exe /s qmgr.dll
regsvr32.exe /s qmgrprxy.dll
regsvr32.exe /s wucltux.dll
regsvr32.exe /s muweb.dll
regsvr32.exe /s wuwebv.dll

Removing WSUS client settings

if($is64)
{
$hklm64 = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,[Microsoft.Win32.RegistryView]::Registry64)
$hklm64.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate","bool").DeleteValue("AccountDomainSid")
$hklm64.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate","bool").DeleteValue("PingID")
$hklm64.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate","bool").DeleteValue("SusClientId")
$hklm64.close()
}
else
{
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
}

Resetting the WinSock

netsh winsock reset
netsh winhttp reset proxy

Delete all BITS jobs

Get-BitsTransfer | Remove-BitsTransfer

Attempting to install the Windows Update Agent

if($is64)
{
wusa Windows8-RT-KB2937636-x64 /quiet
}
else
{
wusa Windows8-RT-KB2937636-x86 /quiet
}

Starting Windows Update Services

Start-Service -Name BITS
Start-Service -Name wuauserv
Start-Service -Name appidsvc
Start-Service -Name cryptsvc

Forcing discovery

start-process -FilePath "wuauclt" -ArgumentList "/resetauthorization /detectnow" -Wait

Shutdown timers and messaging

shutdown /a
shutdown /r /t $rebootimer /d p:4:1 /c "$message1"
Start-Sleep -Seconds $message2wait
shutdown /a
shutdown /r /t $rebootimer2 /d p:4:1 /c "$message2"

Edit
Pub: 15 Jun 2022 19:41 UTC
Views: 21