Puppet Class: windows::update

Defined in:

manifests/update.pp

Overview

Class: windows::update

Configures settings for automatic Windows Updates.

Parameters

For more information on these parameters, consult:

http://technet.microsoft.com/en-us/library/cc708449%28v=ws.10%29.aspx

ensure

Defaults to ‘enabled’, if set to ‘disabled’ or ‘absent’ automatic windows updates are disabled.

all_users

Whether all users (instead of just Administrators) are allowed to install and approve/disapprove updates. Defaults to false.

type

How windows updates are installed, defaults to ‘2’:

2 => Notify before download or installation.
3 => Automatically download and notify of installation.
4 => Automatic download and scheduled installation.
5 => Automatic Updates is required, but end users can configure it.

detection_frequency

Time between detection cycles, in hours (1-22). Default is undefined.

day

Scheduled install day, 1-7 (Sunday-Monday), or 0 for every day. Defaults to 0 (every day). Only valid if options parameter is 4.

time

Scheduled install time, 0-23 corresponding to hour (in 24-hour format). Defaults to 3 (3:00AM). Only valid if options parameter is 4.

reboot_required

Whether any logged-on users get to choose whether or not to restart their computer, defaults to true.

reboot_warning_time

Length, in minutes, of the restart warning countdown after installing updates with a deadline or scheduled updates. Default is undefined.

recommended_updates

Give recommended updates the same way as important updates, defaults to false.

reschedule_wait_time

Time, in minutes, that Automatic Updates should wait at startup before applying updates from a missed scheduled installation time. Default is undefinded.

server

WSUS server to use, default is undefined.

status_server

WSUS Status server to use, defaults to value of ‘server` parameter.

key

Advanced use only; registry key for WindowsUpdate settings, defaults to: ‘HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate’

service

Advanced use only; Windows update service, defaults to ‘wuauserv’.

Parameters:

• ensure (Any) (defaults to: 'enabled')
• type (Any) (defaults to: '2')
• all_users (Any) (defaults to: false)
• detection_frequency (Any) (defaults to: undef)
• day (Any) (defaults to: '0')
• time (Any) (defaults to: '3')
• reboot_required (Any) (defaults to: true)
• reboot_relaunch_time (Any) (defaults to: undef)
• reboot_warning_time (Any) (defaults to: undef)
• recommended_updates (Any) (defaults to: false)
• reschedule_wait_time (Any) (defaults to: undef)
• server (Any) (defaults to: undef)
• status_server (Any) (defaults to: undef)
• key (Any) (defaults to: 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate')
• service (Any) (defaults to: 'wuauserv')

# File 'manifests/update.pp', line 66

class windows::update(
  $ensure               = 'enabled',
  $type                 = '2',
  $all_users            = false,
  $detection_frequency  = undef,
  $day                  = '0',
  $time                 = '3',
  $reboot_required      = true,
  $reboot_relaunch_time = undef,
  $reboot_warning_time  = undef,
  $recommended_updates  = false,
  $reschedule_wait_time = undef,
  $server               = undef,
  $status_server        = undef,
  $key                  = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate',
  $service              = 'wuauserv',
) {
  validate_re($ensure, '^(enabled|present|disabled|absent)$')
  validate_bool($all_users)
  validate_re($type, '^[2-5]$')
  validate_re($day, '^[0-7]$')
  validate_re($time, '^(\d|1\d|2[0-3])$')
  validate_bool($reboot_required)

  # Windows Update service.
  #  In newer Windows versions the service is started on-demand (Trigger Start) and
  #   stopped after 10 mins. To workaround it this module won't set ensure => running
  #  Ref.: https://tickets.puppetlabs.com/browse/MODULES-2420
  if (versioncmp($::kernelmajversion, '6.3') >= 0) {
    service { $service:
      enable => true,
    }
  } else {
    service { $service:
      ensure => 'running',
      enable => true,
    }
  }

  # Have any `registry_value` resources here refresh Windows Update service.
  Registry_value {
    notify => Service[$service],
  }

  # AutoUpdate settings registry key, ensure it and it's parent
  # are present.
  $au_key = "${key}\\AU"
  registry_key { [$key, $au_key]:
    ensure => present,
  }

  # Allow all users to install updates?
  if $all_users {
    $elevatenonadmins = 1
  } else {
    $elevatenonadmins = 0
  }
  registry_value { "${key}\\ElevateNonAdmins":
    ensure => present,
    type   => 'dword',
    data   => $elevatenonadmins,
  }

  # Do we want to set a custom WSUS server?
  if $server {
    validate_re($server, '^http(s)?')

    registry_value { "${key}\\WUServer":
      ensure => present,
      type   => 'string',
      data   => $server,
    }

    if $status_server {
      validate_re($status_server, '^http(s)?')
      $status_server_data = $status_server
    } else {
      $status_server_data = $server
    }

    registry_value { "${key}\\WUStatusServer":
      ensure => present,
      type   => 'string',
      data   => $status_server_data,
    }

    registry_value { "${au_key}\\UseWUSServer":
      ensure => present,
      type   => 'string',
      data   => 1,
    }
  } else {
    registry_value { ["${key}\\WUServer",
                      "${key}\\WUStatusServer",
                      "${au_key}\\UseWUServer"]:
      ensure => absent,
    }
  }

  # Whether Windows Update is enabled.
  if $ensure in ['enabled', 'present'] {
    $noautoupdate = 0
    $auoptions = $type
  } else {
    $noautoupdate = 1
    $auoptions = 1
  }

  registry_value { "${au_key}\\NoAutoUpdate":
    ensure => present,
    type   => 'dword',
    data   => $noautoupdate,
  }

  registry_value { "${au_key}\\AUOptions":
    ensure => present,
    type   => 'dword',
    data   => $auoptions,
  }

  # Install recommended updates same way as important updates?
  if $recommended_updates {
    $includerecommendedupates = 1
  } else {
    $includerecommendedupates = 0
  }

  registry_value { "${au_key}\\IncludeRecommendedUpdates":
    ensure => present,
    type   => 'dword',
    data   => $includerecommendedupates,
  }

  if $auoptions == '4' {
    registry_value { "${au_key}\\ScheduledInstallDay":
      ensure => present,
      type   => 'dword',
      data   => $day,
    }

    registry_value { "${au_key}\\ScheduledInstallTime":
      ensure => present,
      type   => 'dword',
      data   => $time,
    }
  } else {
    registry_value { ["${au_key}\\ScheduledInstallDay",
                      "${au_key}\\ScheduledInstallTime"]:
      ensure => absent,
    }
  }

  if $reboot_required {
    # Automatic Updates notifies user computer will restart in 5 minutes.
    $reboot_data = 0
  } else {
    # Logged-on user gets to choose whether or not to restart their computer.
    $reboot_data = 1
  }

  registry_value { "${au_key}\\NoAutoRebootWithLoggedOnUsers":
    ensure => present,
    type   => 'dword',
    data   => $reboot_data,
  }

  # Detection frequency.
  if $detection_frequency {
    registry_value { "${au_key}\\DetectionFrequencyEnabled":
      ensure => present,
      type   => 'dword',
      data   => 1,
    }

    registry_value { "${au_key}\\DetectionFrequency":
      ensure => present,
      type   => 'dword',
      data   => $detection_frequency,
    }
  } else {
    registry_value { "${au_key}\\DetectionFrequencyEnabled":
      ensure => present,
      type   => 'dword',
      data   => 0,
    }

    registry_value { "${au_key}\\DetectionFrequency":
      ensure => absent,
    }
  }

  # Reboot relaunch timeout.
  if $reboot_relaunch_time {
    registry_value { "${au_key}\\RebootRelaunchTimeoutEnabled":
      ensure => present,
      type   => 'dword',
      data   => 1,
    }

    registry_value { "${au_key}\\RebootRelaunchTimeout":
      ensure => present,
      type   => 'dword',
      data   => $reboot_relaunch_time,
    }
  } else {
    registry_value { "${au_key}\\RebootRelaunchTimeoutEnabled":
      ensure => present,
      type   => 'dword',
      data   => 0,
    }

    registry_value { "${au_key}\\RebootRelaunchTimeout":
      ensure => absent,
    }
  }

  # Reboot warning timeout.
  if $reboot_warning_time {
    registry_value { "${au_key}\\RebootWarningTimeoutEnabled":
      ensure => present,
      type   => 'dword',
      data   => 1,
    }

    registry_value { "${au_key}\\RebootWarningTimeout":
      ensure => present,
      type   => 'dword',
      data   => $reboot_warning_time,
    }
  } else {
    registry_value { "${au_key}\\RebootWarningTimeoutEnabled":
      ensure => present,
      type   => 'dword',
      data   => 0,
    }

    registry_value { "${au_key}\\RebootWarningTimeout":
      ensure => absent,
    }
  }

  # Reschedule wait time.
  if $reschedule_wait_time {
    registry_value { "${au_key}\\RescheduleWaitTimeEnabled":
      ensure => present,
      type   => 'dword',
      data   => 1,
    }

    registry_value { "${au_key}\\RescheduleWaitTime":
      ensure => present,
      type   => 'dword',
      data   => $reschedule_wait_time,
    }
  } else {
    registry_value { "${au_key}\\RescheduleWaitTimeEnabled":
      ensure => present,
      type   => 'dword',
      data   => 0,
    }

    registry_value { "${au_key}\\RescheduleWaitTime":
      ensure => absent,
    }
  }
}