Configure maintenance windows for automatic updates

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' {
            $actualBits = if ($actual -is [uint64]) { $actual } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$actual), 0) }
            $expectedBits = if ($Expected -is [uint64]) { $Expected } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$Expected), 0) }
            return $actualBits -eq $expectedBits
        }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Configure maintenance windows for automatic updates
# Name: MaintenanceWindow
# Scope: Machine
# State: Enabled
# Source: WindowsUpdate.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowEnabled' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowEnabled') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowUpdateActions' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowUpdateActions') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowStartDate' -Kind 'String' -Expected ''
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowStartDate') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowStartTime' -Kind 'String' -Expected ''
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowStartTime') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowDurationHours' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowDurationHours') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowRepeatScheduleOption' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowRepeatScheduleOption') | Out-Null
}

$exists = Test-RegistryValueExists -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklySunday'
if ($exists) {
    $reasons.Add('Value should be absent: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowWeeklySunday') | Out-Null
}

$exists = Test-RegistryValueExists -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyMonday'
if ($exists) {
    $reasons.Add('Value should be absent: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowWeeklyMonday') | Out-Null
}

$exists = Test-RegistryValueExists -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyTuesday'
if ($exists) {
    $reasons.Add('Value should be absent: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowWeeklyTuesday') | Out-Null
}

$exists = Test-RegistryValueExists -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyWednesday'
if ($exists) {
    $reasons.Add('Value should be absent: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowWeeklyWednesday') | Out-Null
}

$exists = Test-RegistryValueExists -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyThursday'
if ($exists) {
    $reasons.Add('Value should be absent: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowWeeklyThursday') | Out-Null
}

$exists = Test-RegistryValueExists -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyFriday'
if ($exists) {
    $reasons.Add('Value should be absent: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowWeeklyFriday') | Out-Null
}

$exists = Test-RegistryValueExists -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklySaturday'
if ($exists) {
    $reasons.Add('Value should be absent: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowWeeklySaturday') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlySchedule' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowMonthlySchedule') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlyMonthBasedDayOfMonth' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowMonthlyMonthBasedDayOfMonth') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlyWeekBasedOccurrenceInMonth' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowMonthlyWeekBasedOccurrenceInMonth') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlyWeekBasedDayOfTheWeek' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\MaintenanceWindowMonthlyWeekBasedDayOfTheWeek') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure maintenance windows for automatic updates
# Name: MaintenanceWindow
# Scope: Machine
# State: Enabled
# Source: WindowsUpdate.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowEnabled' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowUpdateActions' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowStartDate' -PropertyType 'String' -Value ''

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowStartTime' -PropertyType 'String' -Value ''

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowDurationHours' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowRepeatScheduleOption' -PropertyType 'DWord' -Value 2

Remove-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklySunday'

Remove-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyMonday'

Remove-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyTuesday'

Remove-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyWednesday'

Remove-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyThursday'

Remove-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklyFriday'

Remove-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowWeeklySaturday'

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlySchedule' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlyMonthBasedDayOfMonth' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlyWeekBasedOccurrenceInMonth' -PropertyType 'DWord' -Value 2

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'MaintenanceWindowMonthlyWeekBasedDayOfTheWeek' -PropertyType 'DWord' -Value 2