Solved

Turn on and off a specific group policy in Active Directory via batch, script, or some other scheduled option?

Posted on 2016-09-16
6
31 Views
Last Modified: 2016-10-17
I have hosted servers at a colocation facility, Windows 2012 R2 active directory domain.  I have a policy that helps prevent things from installing as part of our malware defense, and it works fine.

But when I need to run windows updates, they fail.  I would like to be able to set a specific time and date for the servers to run windows update, but in order for this to happen, I'd also have to be able to somehow, programmatically, disable this one particular group policy object.  

I can set the servers to stagger their automatic updates and reboots over a Saturday early morning and a Sunday early morning to keep them from interfering with normal business operations, but unless I'm awake to manually turn off the group policy at that time (or turn it off much earlier the previous day and let it be disabled until I turn it back on) the updates would fail.

Is there some way I can script powershell, or a batch file, or something so that I can, for example, turn off the specified group policy object at X:XX time, and another to re-enable it at y:yy time?

Thanks for any suggestions
0
Comment
Question by:networkspecialists
  • 3
  • 2
6 Comments
 
LVL 5

Accepted Solution

by:
Manuel Flores earned 250 total points (awarded by participants)
ID: 41802951
You can apply the GPObject to a given groups, users and devices using the gpmc.msc at Scope -> Filtering, so a given user (an admin) would be not affected for the policy.

I would try and investigate that options.

..MFlores..
0
 
LVL 24

Assisted Solution

by:NVIT
NVIT earned 250 total points (awarded by participants)
ID: 41803151
See the post by Dale, at the bottom... "After going through the whole threads, the error is due to..."

Your case would be like:

Import-Module GroupPolicy
Set-GPLink –Name myGPO –Target “ou=MyOU,dc=contoso,dc-com” –LinkEnabled No

Open in new window


https://social.technet.microsoft.com/Forums/scriptcenter/en-US/92100b09-4a5b-4b66-8903-fdd786a58f5e/enablingdisabling-a-gpo?forum=winserverpowershell

In that post, the solution worked using the GUID instead of the Name. So you may need to use GUID if Name doesn't work.

After you confirm it works manually, you can add it to a scheduled task to automate it. Your task action would be like:
powershell.exe -ExecutionPolicy Bypass -File c:\foldername\filename.ps1

Open in new window

0
 

Author Comment

by:networkspecialists
ID: 41818314
Thanks, never got the notification that this question had answers, so I'll be trying this stuff this week!

John
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 5

Expert Comment

by:Manuel Flores
ID: 41846302
Both solution would probably fix the question.  The requester should try both to see which is more convenient.
0
 

Author Comment

by:networkspecialists
ID: 41846799
Flores' shouldn't have been marked as an answer, since simply telling me that group policies can be applied to specific things did nothing to answer my actual question.  

NVIT, your answer was perfect.  Created two batch files to run a powershell.exe command with PS1 files, one to turn on, one to turn off, and it does exactly what I needed.  Thanks!
0
 
LVL 5

Expert Comment

by:Manuel Flores
ID: 41846835
Hi networkspecialists,

Please, instead of giving a condescending response, you should have given that points to the people you agree with... on time!.  Your last comment was 2016-09-27.  Time enough to award the points to the person that gave the correct answer.  Like it or not, I gave some answer to your question spending my own time, please keep this in mind.

I agree if it is possible to revert the points awarded to me.

Regards,
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question