GPUPDATE is a vikonannya update of group policies for koristuvach that computer. Yak to speed up the processes of group policy update GPO update

Commentary

Updating nalashtuvan policy group Microsoft Windows Group Policy on a local machine is not even more flexible for the help of such an instrument, such as Gpupdate, al. on remote computers in the domain, it is unfortunate to create ni for an additional console Microsoft management Management Console (MMC), other than Microsoft products available this year. At the end of the statistic, I will tell you about the tricky ones, the scenarios and the toolless tools that allow you to update the group policies on remote computers at the domain.

Entry

Most administrators know the problem of storing policy groups on remote computers. The idea of ​​the establishment of any important policy, in which we would like to, the general policy of the GP group immediately appeared on the client computers. But the problem is that the background image is so called because of the background processing to be deprived in the interval from 90 to 120 hilin (of a kind) - if we want to speed up the process of updating, then we need to do it ourselves. Apparently, there is a reason, through politics, it is simply not possible to develop the skin, but rather to navigate the regime of the real hour. The entanglement of domain controllers and hemlines in a large middle range will be too big to fit in with it. Ale yaksho vinikne need a quick fix an important job for safety for a great number of customers, it would be impossible to get ready for such a situation.

But we really need it, to ensure the possibility for the administrator, to control the policies on the computers Computer1, Computer2 and / or Computer3 - as well as policies for the users A, B and C from the centralized point - the working station of the administrator, Marvel at the little ones 1.

Malunok 1: Scenery

We have a miraculous tool called Gpupdate, which is introduced into the Microsoft Windows XP operating system and new operating systems - and we also have a tool called Secedit for operating systems Windows 2000 - alas, unfortunately, the Gpresult command for Gpupdate and Secedit tools can only be run on local computers. Obviously, we already have an installation system set up, like a server for managing Microsoft Systems Management Server (SMS), we can use a system for transferring small scenarios, as we run the necessary command for a group of computers or computers.

As long as your hedge does not have such a system, you are guilty of trying more creative work - because An alternative to the field is to go to all the necessary computers for an additional tool of the Remote Assistance type (Vidaley pomichnik), or send an electronic sheet to all the criminals with the help of the Gpupdate team ...

Problems

Before Tim, I’m buried in details, I want to guess problems, with which people are stuck when trying out the methods, guessed at the statistics.

Firewall problems:

As i have a problem with other data, such as an installer in hedge, packages, which are in can be repaired with Windows XP with Service Pack 2 and more), as the firewall does not have such a rank, but it allows such incoming traffic (from vibrating subnet, IP, anyway). The firewall is guilty of introducing the Windows operating system into adjustments, how to allow incoming traffic, which is the form of the group’s policy, because it’s not ironic to sound, such a policy is a computer user’s turn it on with a firewall.

Adjustment of the policy, as may be established for all methods that have been guessed at the statistics, є start:

Computer Settings | Administrative Templates | Network | Network Connections | Windows Firewall| Domain Profile | "Windows Firewall: Allow remote administration exception".

The other attachments, such as the role of the firewall, between the central computer and the other computers, are also responsible for the relevant parameters (wonder the Help test, for the guessed policy in GPEDIT.MSC).

Administrator's rights:

Koristuvach, which is the initiation of the process on a remote computer, is guilty of the mother of the local administrator’s right - everything is wrong, as you do it.

In addition, as we have done it, let's see the methods themselves.

Writing scenarios

Scenarios without scaffolding and wide expansion of the middle of the information technologies in the Internet - tse naspravda "Open Source". The Microsoft company has given us a lot of possibilities for expanding the possibilities of the operating system and the middle - in the whole statty we tell you about those, how it is possible to choose the possibilities for the extended update of the policies of the GP groups.

Gpupdate & secedit

With a handful of guilty ones, we could have guessed the Gpupdate and Secedit tools, without these tools, nothing else, from the reinsured below, would not be possible. Scenarios and tools, which are guessed here, try to find out on respect, but one of these tools installed on a remote client, is from the version of the operating system. Yak zgaduvalosya vishche, the Secedit tool to enter the warehouse Windows systems 2000, and the Gpupdate tool was used to learn from the operating system Windows XP and to see the presence in the operating system Longhorn, at the same time, as there is at once. For the upcoming scenarios, I will focus on Gpupdate - we can revise the version of the operating system before launching Gpupdate or Secedit, otherwise the revision can be completed without any special difficulties.

The file Gpupdate.exe is for the reason to grow in the folder "% windir% \ system32", for that we do not need the nobility of an absolute way until the first time on the next machine. The tool can be wicked with a set of different keys:

Syntax: Gpupdate

In our scripts, “zrobi itself” for HTML Application (HTA) and Windows Management Instrumentations (WMI) add-ons, we will focus on running Gpupdate without keys - or with the keys “/ Taget: Computer” “/ Target: User” (for updating the policy, like the cost of a koristuvach). Some of the parameters can be hidden, the three corrected - what do we need for help “/ Logoff” or “/ Boot”? Tse means that you can go to the consumer (setting software security, change of folders, etc.) or to navigate through the computer to rewrite the computer for an hour. What do we need for you? In any case, we can also use a tool like Shutdown.exe for cih purposes - that's why my thought will not be popular.

PsExec

The first method, about which I want to be flexible, is even simpler for the victorian, which is practically not a program navigation tool. Now it’s vigaduvati, so it’s already got wine, right? The tool is called PsExec by Mark Russinovich, the owner of the Sysinternals company, which was bought by Microsoft from Lipniy 2006. On this day, version 1.73 is available, as you can add Microsoft Technology from the site.

The tool PsExec is monstrous, if there is any information about it, it’s mostly because it’s not about the installation of agents on a remote computer. You do not need to use the computer and command, as you need to run the keys in the command row at once - that's all!

It is not a great trick to place the PsExec.exe file in the "% windir%" directory, because We do not need to send a new path to the file before the hour of launching the command row.

In order to update the group's policies on the back-of-the-way machines, all we need to do is send a 'Computername' (computer name) to the offensive team: “PsExec Computername Gpupdate”. Koristuvach, who’s good on the back of the car, doesn’t know how to trap, but in the background mode, the Gpupdate command to update the policies for the koristuvach and computer and stagnate all ruined adjustments. You may think that the PsExec command needs to be run with the "-i" key to update for all of them, special policies for those who do not need to be shown, but it is not necessary.

Scenario FLEX COMMAND

From the same time, the method of guessing the food, allowing the development of policies for one computer, and how to update all organizational units (Organizational Unit or OU) to the sleeping victorian PsExec and Gpupdate? For all I have created a demonstration scenario, to show the actions of the possibilities, as we can quickly write the scenarios. The scenario is called FLEX COMMAND and you can add the stars. You can easily view the file with HTA extensions for an additional text editor such as Notepad and add some code to the magic.

If you start FLEX COMMAND, you will be connected to the Active Directory (AD) domain of your computer, which will be the one to fail. Tom will be able to visit computers, which is a member of the domain, and will not be known to the organizing unit of the OU.

Viber OU, the tool is guilty of being thrown on machines that are alive (as indicated by WMI requests). It is still necessary to insert a command row, which I would like to visit on a local computer for a skin object, but to be located in the selected organizational unit of the OU. The text row “(C)” needs to be overridden, because won’t be replaced by the name of the computer, for an hour the robot script.

Figure 2: FLEX COMMAND u dії

Supposedly, the organization of one OU under the name MyComputers reveals all 3 computers: Computer1, Computer2 and Computer3. The command, as they typed, "psexec \\ (C) gpupdate" then switch to 3 offensive commands: "psexec \\ computer1 gpupdate", "psexec \\ computer2 gpupdate", "psexec \\ computer3 gpupdate" - after all the commands will be sent (as long as the computers are alive) and the updated policy will be updated.

The tool can be modified in such a rank that the list of computers matches the file (txt, csv, xls only), databases, special groups are safe in AD, with the help of manual selection from the list. It is also possible to change the way of launching a scenario, but not a demonstration scenario, mainly due to a demonstration of the possibility that we have.

The scenarios will be distributed without koshtovat, and you can test, vikoristovuvati and zminyuvati yogo on your own investigation - details.

Windows Management Instrumentation (WMI)

Good, the tool PsExec is really monstrous, but what are the manual methods, for the help of which I can better create solutions for my middle class? So, for good reason! WMI є We’ll even be straining to endure the prostration at the victorian’s letter of birth. As long as you volodyte WMI, and you have all the permissions on the firewall and administrator rights, then you can create practically everything in Windows middleware environment - navigate to the far side of the computer, rewrite and display the remote commands.

I opened this script for demonstration purposes called OU GPUPDATE. The whole scenario of the HTA vikoristovuyu decilka of new technologies - for the sake of it, there is little modification to the scenario of FLEX COMMAND. First, select the structure of the organizational unit of the OU in AD (the top list, which is the type of display), so you can vibrate your computers from the OU, run Gpupdate with the parameter “/ Target: User” or “/ Target: Computer” without adding parameters Only the computers "live" (which are based on WMI requests) are tied up with requests.

Figure 3: Viber, which is required onoviti - adjusting a koristuvach, adjusting a computer or offending

The price of the scenarios will be expanded without koshtovat, and you can test, vikoristovuvati and zmіnyuvati yogo to the authorities of the Court of Justice.

In the past, written scenarios

Krim WMI is powerful enough to provide an extraordinary visual scriptwriting (VBScript). The price can be overridden by the installation of all one meaning in the HKLM part of the computer reestablishment, as well as the mechanism of the script is guilty of the script writing "remote scripting", and from the moment everything is more obvious. The procedure for copying the script file to the computer is removed (the script is guilty of Gpupdate), and then the VBScript command is used to launch the script.

RGPREFRESH

RGPREFRESH - a tse tool, rozrobleniy Darren Mar-Elem. Yogo іnkoristovu WMI and launchє Secedit or Gpupdate is stored in the operating system on a remote computer, with keys, vibrated by a corkscrew. These keys will give you the same possibilities, as well as with a local victorian tool.

The whole tool can be used to process one machine at a time, but it can be used spirally with a tool called FLEX COMMAND (as an obolonka). with the same utilities, which work from the command row, for more than one computer at a time.

Figure 4: Parameters for RGPREFRESH

The whole tool can be secured from the central side of the site.

Specops Gpupdate

Special Operations Software, Specops, is an international virobnik of software security, promoting products from Active Directory management based on the technology of policy groups. The company has issued its own solution for the general improvement of policies, and it’s a miracle, it’s absolutely no-brainer. The streaming version of Specops Gpupdate is 1.0.2.13 (2006-10-25) and the utility itself can be added to users. The whole tool is not only lacking in functionality, as they have been broken into scenarios, guesswork, and also given a number of possibilities from management. Let's see the miracle utility.

Installing Specops Gpupdate

Installing MSI with programs is even simpler - everything that is required for it is Active Directory Users & Computers (ADUC) MMC, as well as Microsoft .NET Framework version 2.0.

Figure 5: The installation process is as simple as installing MSI packages (onslaught on next, next, next)

If the MSI file is installed in the graphical interface, there is nothing to change the GUI, and if you do not use the “Add / Remove Programs” option, you can be familiar with our Specops installation machines. Tom mi maєmo viconati dodatkova robot for a magical transformation.

Extension for Active Directory User & Computers

When the Specops Gpupdate is installed at the AD Forest, a special team is required

"% CommonProgramFiles% \ Specopssoft \ Specops ADUC Extension \ SpecopsAducMenuExtensionInstaller.exe" / add

It’s not an updated scheme, I want you to blame the rights of the corporate administrator to launch the command chain. The qia command is absolutely reversible, just run it more times with the "/ remove" key. Everything that’s going to be broken is so called “Display Specifiers” for expanding the look behind the ADUC help.

Let's press the right mouse button on the object of the organization unit of the OU or the computer, and start, now there are new commands: Gpupdate, Restart, Shut down and Start. Є The possibility of changing the vibration of several computers and OUs by pressing the keys and pressing the right button of the Misha on the necessary objects.

Baby 6: ADUC MMC expanded

As long as you, like and me, have gotten the food, and if you can change the stasis for non-DC domain controllers, then it’s okay! Pislya Windows installations Server 2003 Admin Pack Service Pack 1 Administration Tools Pack on Windows XP Professional, .NET Framework 2.0 and Specops Gpupdate, Viewer Management Console, as well as on DC domain controllers, and great power.

Gpupdate Parameters

The first parameter, which is my maєmo, allows us to run the command Gpupdate from a distance on vibrating computers. If you send the Gpupdate vibor, you must confirm the vibe, as shown on little 7, and put a tick in the use force option box, if you want to get the best out of it.

Malunok 7

By pushing the OK button, a dynamic graph will appear, div. Figure 8, as well as the standard.

Malunok 8

Restart and Shutdown parameters

The next two parameters 'Restart' and 'Shutdown' є are even more important for keruvannya, so we need the stench right in ADUC. We can run the restart command, or shutdown, and also set the interval to an hour in seconds, as if it were necessary to shutdown everything running programs... To write a script, which is robust for those same, not even neatly behind the aid of WMI, or if you have installed the Shutdown.exe command with the correct keys, and if you have specified Specops Gpupdate, we will accept the functionality absolutely without vitrates for an hour.

Figure 9: Dialogue screen for re-engaging updates

The Start parameter The rest of the parameters are called 'Start', and for the sake of the Wake on LAN functionality or WOL (wake up by fingering), inserted into ADUC. If you send the selection and confirm the parameter, marvel at Malunok 10, so called magic packets (Magic packet) will be sent to the MAC addresses of client computers, and you will be rewarded. For WOL robots, the functionality of the WOL adapts BIOS of computers... Specops Gpupdate interacts with Microsoft DHCP servers at the corporation, for the information necessary to launch this process, that is, the ability to wake up DHCP clients and is deprived of the installed servers Microsoft DHCP.

Figure 10: Please confirm the launch of the remote WOL

Before the speech, for WOL it is also possible to play scripts, put such a code outside the scope of the statistics.

Visnovok

We looked at a number of ways, for the help of which it is possible to store the policies of groups on remote computers. A different method from being overwhelmed is more beautiful to go for you, to lie in the middle. Particularly for me is the writing of the scripts, ale the most diligently pratsyuvati over that, how did the other people shoot it? At the same time, two types of power are supplied. The first hour is the writing of such scenarios, we are working, and the other one is special, or prepared for replacement. Writing scenarios will paint our tips as a specialty from information technologies, and also allow setting up solutions for more accurate satisfaction of specific minds.

The Specops company has broken down even better utility-free utilities, as a vison of the main functions of updating the policy on hemlock clamps... I recommend you squirt її!

Dzherelo www.windowsecurity.com

The GPUPDATE team is victorious for updating the group policies for the computer.

Command row format:

GPUpdate

Command row parameters:

/ Target: (Computer | User)- Updating the parameters of the policy, whether it is koristuvach (User) or a computer (Computer). It is not specified, the parameters of both policies are not specified.

/ Force- storing all parameters of the policy. It’s not stated, it’s impossible to become stagnant if the parameters of the policy have changed.

/ Wait: value- The hour of cleaning up (in seconds) the completion of the revision of the policy. For replacement - 600 seconds. The value "0" - without ochіkuvannya. The value "-1" means that it is not deceived. At the time of the change to the hour, it’s again active in the command line, a little bit of a policy of triviality.

/ Logoff- Vykonannya to the output of the update of the parameters of the group policy. It is necessary for quiet client extensions of group policy, as they do not change the policy in the background mode, but they do it when they enter a koristuvach, such as installing programs for koristuvach or redirecting folders. The parameter is not injected, if the expansion does not occur, it is in the way of the koristuvach.

/ Boot- Determination of re-assignment for storing the parameters of the group policy. It is necessary for the client's extensions of the group policy, which do not change the policy in the background mode, but change it at startup, such as, for example, the installation of a program for a computer. The whole parameter is not injected, since the expansion does not occur, but it causes the system to restart.

/ Sync- On the way, actively zasosuvannya polіtiki maє vikonuvatis synchronously. Actively storing the policy of being re-installed when the computer is re-installed or the log-in of the system. This parameter can be vikoristovuvati for a koristuvach, a computer or both, by pulling / Target. With a whole set of parameters / Force and / Wait, if the stench is indicated, it is skipped.

Put on the vicarystanny:

gpupdate /?- Imagine a fairy tale command.

gpupdate- To see the update of the policy of the computer and the policy of the koristuvach. To become stagnant if the policy has changed.

gpupdate / Target: computer- Visually update the policy only for the computer.

gpupdate / Force- To see the update of all politicians.

gpupdate / Boot- update of group policies from re-provisioning of the computer.

Adjustment of the policy of updating Windows 10 The price of adjusting the way of removing the update from Windows 10. In Windows 10, the parameters for the center of the update were transferred from the Keruvannya Panel to the System Parameters. Windows 10 doesn’t have such adjustments in the Keruvannia Panel, and it didn’t become possible to turn it on, or to select the way it was rejected. However, with the help of the Editor of the register and the Editor of the local group policy, it is possible to see the update and to establish the ways of rejecting it.

Adjustment of the update with the assistance of the Local Group Policy Editor

Launched by the Editor of Local Group Policy, having drawn on the keyboard at once two buttons WIN + R gpedit.msc that push OK.

Windows 10 Group Policy Update

Computer Config - Administrative Templates - Windows Components - Windows Update... Onslaught stop point Windows Update, and then at the right side know the item Nalashtuvannya automatic updating that change yogo nalashtuvannya.

For the whole of the window, it is necessary to put a speck at the top of the window at the top, and then lower it to the adjustment of the update. Press the OK button. So, why don't you fix it, you got it right? System parameters - Updating and bezpeka - Windows Update press the button Reversal of the obviousness of the new.

Writing in the editor of local group policy to get a dignity.

Nalashtuvannya update for the help of the Editor of the reєstru

Launching the Resource Editor by nudging the keyboard into two keys at once WIN + R... See the Viconati window in the yak, enter the command regedit that push OK.

At the left part of the editor's window HKEY_LOCAL_MACHINE - SOFTWARE - Policies - Microsoft - Windows... Hover the cursor over the stop Windows item and click the mouse button to the right. From the context menu, select Stvority - Rozdil. New razdil name WindowsUpdate.
Then hover the cursor over only those that open the WindowsUpdate partitions and again open the partitions what name AU.
Then hover the cursor over only to open the AU section and press the mouse button to the right of the Vibrate menu Create - Parameter DWORD (32-bit)... A new parameter will appear at the right side of the window, name it AUOptions... In the same order, put the cursor on the AU section, open three more parameters and name the first NoAutoUpdate, other ScheduledInstallDay and the third ScheduledInstallTime(optional NoAutoRebootWithLoggedOnUsers). Now, for cichs, new parameters are required to change the value.

For the AUOptions parameter

• 2 - Otrimuvate the help before the instalation of the new ones.
• 3 - Automatically trim the update and help you get started.
• 4 - Automatically trim and install after distribution.
• 5 - Allow local administrators to select the update and promotion mode by themselves.

For the NoAutoUpdate parameter

• 0 - Umkneno automatically establishing Update, as it will be blocked, it will be in the presence of broken ones, adjusting the parameters of AUOptions.
• 1 - Vimkneno is automatically re-installed.

For the ScheduledInstallDay parameter

• 0 - the update will be carried out every day with 4 AUOptions parameters.
• 1 - the update will be carried out automatically if the AUOptions parameter is 4.
• 2 - an update will be carried out when the AUOptions parameter is set to 4.
• 3 - the update will be carried out in front of the 4 AUOptions parameter.
• 4 - the update will be carried out on the fourth day when the AUOptions parameter is set to 4.
• 5 - the update will be carried out on Friday if the AUOptions parameter is 4.
• 6 - the update will be carried out every day if the AUOptions parameter is 4.
• 7 - the installation of the update will be carried out every time when the AUOptions parameter is 4.

For the ScheduledInstallTime parameter

From 0 to 23, the update takes place in the style of years in the presence of the set parameter і when the AUOptions parameter is 4.

For the NoAutoRebootWithLoggedOnUsers parameter

• 0 - After the completion of the update, the computer will automatically reload, just for 4 AUOptions parameters.
• 1 - After the completion of the update, the computer does not automatically rewire itself, just for 4 AUOptions parameters.

The statistics show a simple way of updating group policies on clients (computers and servers) to the Active Directory domain without the need to access the console of the remote machine and without registering the gpupdate command.

One of the most common problems in the management of AD group policies is to test the policy "at ease", without reassigning the computer or access to the local computer and launching the command.

The Remote Group Policy Update function allows users to use one GPO server console (GPMC.msc) for updating, changing, and storing and testing group policies.

Functionality of the group policy update for the first time appearing at Microsoft Windows Server 2012, in all upcoming versions (Windows Server 2016, Microsoft Windows 10), the whole functionality and its stability are steadily changing.

Vimogi to Robotics Remote Group Policy Update:

Vimogi to server-side development:

• Windows Server 2012 i vishche
• Abo Windows 10 due to the installation of management tools RSAT (Management tools)

Vimogi to clients:

• Windows 7 that vische

Vimogi to fancy communication (firewalls) with server and clients

• Guilty butti TCP Port 135
• Included windows service Management Instrumentation
• Task Scheduler service

As soon as your report is displayed to your computer, open the Keruvanny console with group policies (GPMC.msc), select an OU (container), in any way you need to install computers, on which you need a GPO.

Click the right mouse button on the required container and select the item Group Policy Update.

You will receive information about the number of objects at the same OU, on which the updated GPO will be updated. To confirm, press the "Yes" button.

In the Remote Group Policy update results window, check the status of the updated policy, as well as the status of the operation (success / pardon, pardon code). Naturally, as the computer is vimkneno, or access to new encirclement with a firewall, there will be a grave.

For a GPO change, it is necessary for a day (90 hvili +/- 30) to expand on the other systems, but if it is necessary to fix the term, the administrator is reestablishing the add-on system and the command “ gpupdate”. At great number The PC process takes a ten hour, and the process itself is not handy. Now you can forget about it. At the console management group policy(GPMC) a new item “ Group Policy Update”(Group Policy Update) allows you to update system policies on Windows Vista / 2008 with two clicking bears. After activating the factory, the list of computers will be edited out and the registered koristuvachiv, for which the factory will start " Gpupdate.exe / force”. If you will be able to unite the new heels, you will be able to see the vipadkovy zatrimkoy in the interval of 0-10 chilines. The result of the application is visible at the close of the screen, the success of the update can be based on the help of the master of the result policy.
The new function has rendered its own cmdlet. Invoke-GPUpdate, which allows you to see the new GP and give you more options, but not the GPMC. Before the speech, now for the groups of policies, 27 cmdlets were presented, tobto. one more (trim re-list you can enter “ Get-Command -Module GroupPolicy«).
It is not safe to update policies on a specific system with sufficient viconati:

PS> Invoke-GPUpdate -Computer< имя компьютера>

Dodatkovy key –RandomDelayInMinutes Allowing to set the interval to cleanup, it’s okay, if the command will be viconan on decile systems.
Ale smudge, in the GPMC console you can vibrate without podrozdil, there is no computer around the container. The axis is here and the Invoke-GPUpdate, which at once from the Get-ADComputer cmdlet, allows you to view the system for any criterion:

PS> Get-ADComputer -filter * -Searchbase "cn = computers, dc = example, dc = org" | foreach (Invoke-GPUpdate –computer $ _. name –force –-RandomDelayInMinutes 5)

An even more important point on client systems is to display several ports of the firewall. To forgive life to the admin in MS, 2 new policies (up to 8 explicit ones) were propagated, so that they can quickly expand and expand required adjustment:

- port the firewall for more advanced group policy;
- Port firewall for group policy stars.

Appointment їх soundly from the name. Us tsіkavit persha. Recommended to visit new object group policy and move it to the ear, having given such a rank a greater priority, below the subject of group policy to the domain for the suggestions.
The process of downtime. Vibiraєmo domain і in the menu the item "Create object of group policy for the whole domain". At the top of the list, I will name it and select it from the list "Port the firewall for a complete update of the group policy." You can use PowerShell as a variant.