Micros · production domain
PowerShell fleet automation and WSUS operations
Mass-enabling remote management across a domain — including the machines you cannot reach remotely yet — plus a WSUS patch pipeline on SSL covering roughly 150 machines.
- Automation
- PowerShell
- Windows
01 Problem
Rolling out configuration and remote management across a domain of workstations by hand does not scale, and several tasks hit the classic chicken-and-egg problem where you need remote access to enable remote access.
02 Approach
Wrote PowerShell to mass-enable PSRemoting across an organizational unit, using PsExec, WMIC, and a GPO immediate scheduled task as fallbacks for machines where WinRM was not yet reachable.
Diagnosed a recurring failure where machines booting before the domain controller responded fell back to the Public network profile and silently blocked SMB on 445, and corrected it via network-profile policy.
Set up WSUS on SSL — port 8531, CNAME wsus.micros.uz — and diagnosed update failures including error 0x80244010 and a Windows 10 versus Windows 11 product-category mismatch in the update metadata.
Authored GPOs for wallpaper, RDP, and lock-screen policy.
03 Stack
- PowerShell
- PsExec / WMIC
- Active Directory
- Group Policy
- WSUS
- Windows Server
04 Result
Repeatable fleet configuration across the domain and a working patch pipeline covering roughly 150 machines through WSUS.
05 What broke, and what fixed it
-
Silent SMB blocking
Machines booting ahead of the DC fell back to the Public profile and blocked
445— fixed via network-profile policy. -
Bootstrapping remote access
PsExec, WMIC, and a GPO immediate scheduled task as fallbacks where WinRM was not yet reachable.
-
0x80244010Traced to a Windows 10 versus Windows 11 product-category mismatch in the WSUS update metadata.