Are Windows Updates resetting my Advanced Sharing Settings?

For work purposes, I have the following settings in Advanced Sharing Setting

Private > Network Discovery - ON (automatic setup box checked)
> File and Printer Sharing - ON

Guest/Public > Network Discovery - ON (automatic setup box checked)
> File and Printer Sharing - ON

All Networks > Public folder sharing - ON
> File sharing connections - 128 bit encryption
> Password protected sharing - OFF

I am having a problem with Windows continually resetting some of these settings, but there are a couple of peculiarities. Sometimes its just one setting, for example, just network discovery gets turned off, or just password protection gets turned on. Sometimes, its multiple changes - both of the above or one of them and file and printer sharing gets turned off. Sometime, it all three. I have been keeping a diary of when this happens, and it appears to always be after a Windows update, although it does not happen after every Windows update.. Has anyone else noticed this? If so, does anyone have any clues as to how I can stop this from happening?

This is a real nuisance. Our whole system at work relies on five computers and two laptop kiosks being reliably networked together, and this resetting of the network, while its a relatively easy fix, still disrupts the workflow and causes downtime.

Now I have managed to make a script that the staff can run if they encounter problems. The script invokes..


netsh advfirewall firewall set rule group=”Network Discovery” new enable=Yes

and

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes

Which will turn on the two specified settings, but I cannot find a way to turn off password-protected sharing from the command line. I tried netsh advfirewall firewall set rule group="Password-Protected Sharing" new enable=No but that didn't work. It returned No rules match the specified criteria.

There is a "reg add" command I found that is claimed to work, but I am wary of the idea of monkeying with the registry via a script. Too much can go wrong. Also, the reg add fix requires a restart.

Does anyone know of another way to turn off password protection from the command line?

Can you create a backup image of a PC before each patch Tuesday so you can go back to the image if your settings change and confirm that the update is changing the settings by reinstalling the update manually?

steve108 said:

Can you create a backup image of a PC before each patch Tuesday so you can go back to the image if your settings change and confirm that the update is changing the settings by reinstalling the update manually?

I could do that, but it seems a rather going over old ground. Since I have been keeping a diary of these settings changes, I have never yet seen one that didn't follow a backup the night before.

TV2 said:

The only thing I could find is this:
windows 10 - Turn Off Password Protected Sharing via Command Line - Super User
I don't know if it works.

Personally I just go to the setting in Network and Sharing Center directly to check/change. But I remember your environment and I think I understand what you want to do. The above might work, or at least help point in the right direction.

I keep a written list of all my Windows Setting customizations and (usually) make a habit of going down the list and checking after any major updates. Not difficult with 4 PCs, but a pain if it were more.

Yep, that was one of the things I found, but the command...

Net user Guest /Active:YES

...doesn't work for me. IIUC that post, it will be because I haven't made the registry change to...

[HKLM\SECURITY\Policy\Accounts\{GUEST_USER_SID}\ActSysAc]@=hex(0):41,00,00,00

The problem for me is that HKLM\SECURITY appears inaccessible to me - there are no subkeys visible and I can't add any. I'm guessing that might be because, even though my account is Full Admin, I don't have sufficient privileges to see it or to edit it.

- - - Updated - - -

EdTittel said:

@smartcookie: Alas, the answer to your question "Do updates change those defaults?" is "Sometimes yes, sometimes no." After feature upgrades, most definitely yes, but intermittent or occasional effects from Cumulative Updates mean I've gotten in the habit of checking after each one. You'll often see networks reset from "Private" to "Public" as well, FWIW.
HTH,
--Ed--

Thank you for your reply

So I's guessing there is no way around this? Do you know if it is possible to turn password protected sharing off from the command line?