Installation via Node.JS Permanently Disables Windows Update

[runewake2]

What You Are Seeing?

I have been enrolled in a group policy that has forcibly disabled all Windows Updates after Node.JS invoked Boxstarter. This policy continues to exist after Boxstarter has completed and no obvious option to revert this change is apparent.

What is Expected?

Boxstarter should not have any permanent effects on my PC including state changes. This current behavior is what I would expect from a Virus or other malicious software.

How Did You Get This To Happen? (Steps to Reproduce)

• Installed Node.JS
• Boxstarter forcibly restarted PC multiple times (this is awful behavior btw)
• After install script completed a Group Policy had been created and Windows Updates have now been completely disabled.
• My personal PC is now enrolled in a group policy.

This issue has also been mentioned multiple other times on the Node.JS page.

[runewake2]

Seems to be tied to this PR: nodejs/node#22645

[pauby]

@runewake2 Have you checked Group Policy to ensure it is in there? Have you also tried to use Enable-WindowsUpdate assuming you still have Boxstarter.WinConfig installed?

[runewake2]

To be completely honest, I have no idea what I'm doing in Group Policy. I don't know what it should look like because I'm not a systems administrator and have no knowledge of what this should look like "normally". I only know that an application (Node.JS) used this tool to apply a group policy that disabled UAC and Automatic Updates. I do not want these changes.

I was told this would install python and visual studio tooling using chocolaty. Group Policy modifications were not mentioned as part of this. Maybe there was a prompt, but the entire process was forced and included multiple hard-restarts that made following any information in real-time largely impossible.

I don't know how to manually change this back because I have no idea how to tell what has been changed or the extent of the changes (short of manually parsing a 9000 line log file). I would expect I could uninstall or revert these changes but I don't know how to do that either. The only uninstall option I've seen is deleting a folder from %appdata% and I don't see how that could remove group policy or address any of the other hidden changes these scripts had on my PC (the only file in the %appdata% folder is a log file).

I really don't want to reinstall my OS because Node.JS misused this tool. Is there a way to revert these changes that is less drastic?

[pauby]

@runewake2 Did you run the command I asked you to? Your issue was raised because you said Windows Updates were permanently disabled.

[runewake2]

That command does not exist. I have not taken any steps to remove Boxstarter yet.

[pauby]

@runewake2 Is there a BoxStarter Shell option under your Start Menu -> Programs -> Boxstarter? If so, click that and type Enable-WindowsUpdate

[runewake2]

This is what I see. Did you mean: Enable-MicrosoftUpdate? That does exist.

[pauby]

@runewake2 Apologies it is Enable-MicrosoftUpdate - I was confusing myself with the names as I'm looking at Install-WindowsUpdate!

[runewake2]

Boxstarter now reports that updates are enabled, but Windows reports that Updates are disabled and the setting continues to be locked behind a group policy.

[pauby]

@runewake2 Have you rebooted?

[runewake2]

Yes, the updates on my system are in the same state per Windows Settings as the original bug. This is what Boxstarter reports now though:

C:\> Enable-MicrosoftUpdate
Boxstarter: Microsoft Update is already enabled, no action will be taken.

[pauby]

@runewake2 Okay, from the same command prompt try and run Start-UpdateServices.

[runewake2]

That command had no output. Is that expected. I had to run it with a full path.

C:\ProgramData\Boxstarter\Boxstarter.Bootstrapper\Start-UpdateServices

After running this updates are still disabled and my user is still controlled by a group policy.

[gep13]

@runewake2 said...
After running this updates are still disabled and my user is still controlled by a group policy.

Can you please confirm what process you are using to confirm this?