Scheduled task settings not updating based on GPO

[weejie]

I've imported the ADMX files to on-prem AD and created a GPO. I see the GPO applied to the endpoint, but the settings in the scheduled task are not updating.

The endpoint registry shows the settings from the GPO in the key:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Romanitho\Winget-AutoUpdate

When I view the scheduled task it shows the default values from the initial installation.

Any advice where I'm going wrong?

I originally installed on the endpoint using command prompt: winget install Romanitho.Winget-AutoUpdate

Thanks so much

[KnifMelti]

Try running the task (only runs once a day):

[weejie]

That task ran and exited (0x1). I checked the installation file for log, %appdata%, and event viewer and didn't see anything specific to the exit error.

[KnifMelti]

@Romanitho in charge of that part

[weejie]

Disregard. Security app firewall blocking. Rerunning and will update shortly.

[weejie]

That helped!

Only issue is that I see multiple triggers now. My GPO to run daily at 6PM and the default "At log on of any user"

I updated the GPO to disable "Updates at Logon", ran gpupdate /force and rebooted. I'm still seeing multiple triggers.

Any ideas?

[KnifMelti]

The policies tsk only runs once a day and is responsible for the task settings. Run it again after this latest change

[weejie]

I'm all good now. Thanks for the quick response!

I uninstalled, reinstalled, and ran the Winget-AutoUpdate-Policies task. Now my GPO policies are correctly configured.

[KnifMelti]

When running WAU it checks the GPO settings and act upon them except for the settings in the task Winget-AutoUpdate.
Winget-AutoUpdate-Policies does that once a day.
I made a litte mod for this that I use in my work domain (so that WAU act upon those settings also every time it runs).
In mods\_WAU-mods.ps1:

# Use a single call to Get-ScheduledTask and store the result in a variable
#$GPOTask = Get-ScheduledTask -TaskName 'Winget-AutoUpdate-Policies' -ErrorAction SilentlyContinue

# Evaluate GPO settings (and take control of the task "Winget-AutoUpdate-Policies")
if ($($WAUConfig.WAU_ActivateGPOManagement -eq 1)) {
    if ($GPOTask) {
        # Check if the task is disabled
        if ($GPOTask.State -eq 'Disabled') {
            # Enable the task and run it
            Enable-ScheduledTask -TaskName 'Winget-AutoUpdate-Policies' -TaskPath 'WAU' | Out-Null
            Write-ToLog "-> Enable task and evaluate GPO settings..." "Yellow"
            $GPOTask | Start-ScheduledTask | Out-Null
        } else {
            # Run the task
            Write-ToLog "-> Evaluate GPO settings..." "Yellow"
            $GPOTask | Start-ScheduledTask | Out-Null
        }

        # Wait until the task finishes running
        while ((Get-ScheduledTask -TaskName 'Winget-AutoUpdate-Policies' -ErrorAction SilentlyContinue).State -eq 'Running') {
            Start-Sleep -Milliseconds 500
        }

        # Disable the task
        Disable-ScheduledTask -TaskName 'Winget-AutoUpdate-Policies' -TaskPath 'WAU' | Out-Null
        Write-ToLog "-> ...disable task!" "Yellow"
    }
}
Write-ToLog "-> ...Mods for WAU all done!" "Green"

[Romanitho]

Just as a reminder, Winget-AutoUpdate-Policies exists because it's not possible to act on triggers solely through registry settings. So we needed an additional task to check if any changes were made to the main scheduled task's trigger (in case you accidentally removed all triggers 😅).
This way, not only do you get a daily check to ensure that the main task's triggers (configured via GPO) are still in place, but any changes made via GPO are also applied to the main task without having to wait for its next execution cycle.
As for all other settings, they are applied on the fly and are always up to date after a gpupdate.