Author Topic: How to REALLY stop ******* Windows Update on Win10? (Read 15566 times)

f0dder · « **on:** July 25, 2018, 01:04 PM »

Hi,

This morning I woke up to a computer that was turned on - "oh great, Windows Update resumed from standby again, and even did it in spite of me turning off wake timers". That would have been a minor annoyance to start the day with, unfortunately it also turned out the image file backing my persistent ramdisk had been corrupted, and I had forgotten to add the folders on it I cared about to my backup set.

I'm sick and tired of the forced reboots in general, it's ******* bad attitude of Microsoft not allowing power users to turn them off, and that they're forced even when applications have unsaved data and tell Windows that they're not ready to shut down really ought to bring a class action lawsuit. Oh, and the

I could almost live with the forced reboots, except that windows update ******* resumes the device from standby in order to do the reboots. Yes, even though I've modified the power plan settings to not allow wake timers. This is... I mean, it's beyond contempt for us users.

I've tried several solutions in the past, like disabling orchestration services, deleting the UpdateOrchestrator task files, deleting the content of the task files and removing ACLs for even the SYSTEM user to the files, et cetera -they always get recreated at some point in time during a system update.

So... are there any existing solutions to bloody STOP this insanity from happening? Any gpedit policies (that don't require enterprise edition of Win10) and actually work?

Or do I have to write a tool that continually scan for the task files and delete them if they're re-added, check for the reboot dialog box and try to cancel it, etc?

Yeah, I guess Windows only resumes from standby, not poweroff - but I prefer standby for my desktop machine, so I can just pick up where I left off.

wraith808 · « **Reply #1 on:** July 25, 2018, 01:25 PM »

Yeah... I looked into this a while ago. The only ways are (a) by policy because businesses wouldn't put up with this and MS knows it or (b) some 3p solution. I've tried a few. The only one that sticks is deleting the task. I even tried using their settings in the registry- and they changed them. I was getting close to creating some custom way to monitor for those tasks, as I saw that they'd been added even after I removed them, added a bogus task and then locked that one from access. I think the task removal is all that's required from my use of it, but who knows.

f0dder · « **Reply #2 on:** July 25, 2018, 01:28 PM »

I believe the necessary policies only work on enterprise versions, not even pro versions >_<

Removing the task files are not enough, they get re-created. The same goes for setting all ACLs to deny access, Windows will eventually go "Lol, I'm LOCALSYSTEM, bitch, what are you gonna do about it?" and reset/recreate the ACLs.

Deozaan · « **Reply #3 on:** July 25, 2018, 03:27 PM »

I have two computers running Windows 10.

One of them, from the beginning of time, has always woken up from sleep at the same time every day, ground the hard drive for several minutes, and then gone back to sleep.
The other one has never been woken up from sleep to install updates or whatever, as far as I can tell.

I have no idea what the difference is between the two machines to explain why it would happen on one but not the other.

KodeZwerg · « **Reply #4 on:** July 25, 2018, 04:51 PM »

Hello Sir, did you tried all THIS methods?

In my (bad english) words:
Turn Auto-Updates OFF from System Settings and Configure Network Connection as "metered" <<< MOST IMPORTANT!
More is not needed and works 100% for me since day 1.

If above does for some reason do not work for you, i can search my eMails for a "block all microsoft" firewall rule.
Afterwards no telemetry etc is sended and you can not argue with Microsoft Services anymore (like Cortana and such)

wraith808 · « **Reply #5 on:** July 25, 2018, 09:51 PM »

I believe the necessary policies only work on enterprise versions, not even pro versions >_<

Removing the task files are not enough, they get re-created. The same goes for setting all ACLs to deny access, Windows will eventually go "Lol, I'm LOCALSYSTEM, bitch, what are you gonna do about it?" and reset/recreate the ACLs.

-f0dder (July 25, 2018, 01:28 PM)

I mean making something to run resident that checks for the task files being created, and deleting them again. It worked for a while; I had that folder locked down and had created another bogus task with the same name that did nothing, and locked that down. It worked until one of the big updates, but hasn't worked since then.

Hello Sir, did you tried all THIS methods?
-KodeZwerg (July 25, 2018, 04:51 PM)

I've tried all of them other than the metered connection bit. I was just skeptical about other ramifications and not fed up enough to do it. I'm trying it now, though.

4wd · « **Reply #6 on:** July 25, 2018, 10:42 PM »

FWIW, my main computer that's turned off overnight and is at v1803, (with pending updates from June):

How to REALLY stop ******* Windows Update on Win10?

I only seem to get notifications for updates, (well, I used to, all notifications have been turned off), and every so often I'll go through the list of pending downloads and install them with WUMT.

I have another that's on 24/7 and is still sitting at v1709, No deferrals set and on the Semi-Annual Channel (Targeted), (it's got updates for v1709 and v1803 as pending downloads):

How to REALLY stop ******* Windows Update on Win10?

wraith808 · « **Reply #7 on:** July 25, 2018, 11:28 PM »

But you have to have Pro to do that, don't you?

4wd · « **Reply #8 on:** July 26, 2018, 12:04 AM »

But you have to have Pro to do that, don't you?
-wraith808 (July 25, 2018, 11:28 PM)

If you mean to run the Group Policy Editor then yes, all my computers run Pro, (Home doesn't have RDP Host).

However, all the settings are available in the registry for which MS have made available an Excel spreadsheet for lookup.

Whether Home will honour the settings or not I can't tell you but you can try - best case is it works, worst case is it ignores them.

2018-07-26 14_53_16-Local Group Policy Editor.png

How to REALLY stop ******* Windows Update on Win10?

KodeZwerg · « **Reply #9 on:** July 26, 2018, 01:40 AM »

Hello again, i did not found eMail, but a link with similar content to block Microsoft Servers.
Stop Windows 10 spying on you using just Windows Firewall

Hope it helps, take care!

edit
Attention!
Above is not mentioned to be (mis-)used by beginners since it go systemdeep without restore!! You must know what you do!

Shades · « **Reply #10 on:** July 26, 2018, 09:35 AM »

Hello again, i did not found eMail, but a link with similar content to block Microsoft Servers.
Stop Windows 10 spying on you using just Windows Firewall

Hope it helps, take care!

edit
Attention!
Above is not mentioned to be (mis-)used by beginners since it go systemdeep without restore!! You must know what you do!
-KodeZwerg (July 26, 2018, 01:40 AM)

Firewall rules? Those are not "systemdeep" and they can be disabled or removed with a few mouse clicks when you use the standard Windows Firewall interface. There are 3rd party tools that make working with the Windows Firewall even simpler.

Generally speaking, do understand that blocking rules in a firewall can have consequences for some functionality in the operating system. The article in the link above discusses a list of IP addresses and domain names that Microsoft uses for all their telemetry and provides a batch script to create and apply Windows firewall block rules. Not more, not less.

However, Microsoft cycle through their (pretty extensive) list of IP addresses and domains, so this list needs very frequent updates. Because an IP address may block a telemetry server today, but could be blocking access to Cortana or Bing or Windows Update or Skype tomorrow.

That last part causes confusion with lots of users, especially those who are not too familiar with networking/use of firewalls. As it is, these firewall block rules are not that effective as a solution, because of the IP address cycling, but also because because services with a domain name the starts with 'telemetry' can just as well handle (some) traffic from Skype or any other cloud service provided by Microsoft for that matter.

If you are not entrenched in those services and have a local user account on your Windows 10 installation, you can more or less safely use the provided Firewall block rule list, disable those rules once a month for doing Windows updates and when your system is up to date, enable the block rules again.

It would even be better if you have a hardware based dedicated firewall device where you apply these block rules. Than you can be sure those rules are not circumvented by anything Microsoft alters on your Windows system. A simple spare/old PC with at least 2 network cards, in combination with software like 'OPNSense' or 'pfSense' can already be used as a hardware based dedicated firewall device. Both software packages provide much, much more services than just a firewall, but you don't have to use these. Best of all, 'OPNSense' and 'pfSense' are open source and can be used free of charge, have active forums that provide a lot of help and if you require it, offer their support for a fee. 'pfSense' even sells hardware boxes with their software pre-installed and configured.

KodeZwerg · « **Reply #11 on:** July 26, 2018, 11:22 AM »

I wanted to give a warning out before bad things happen to unexperienced Windows Users. In past that point i missed to write, so take care what you do.
Unexperienced run blind the batch and wonder why certain Windows-Things may suck afterwards.

For me it was always enough to configure No-Auto-Update with metered Network setting.

wraith808 · « **Reply #12 on:** July 26, 2018, 05:37 PM »

As if by magic:

https://www.ghacks.n...cted-update-reboots/

However, I'd still rather have control rather than a DS Model predicting my behavior...

f0dder · « **Reply #13 on:** July 26, 2018, 06:02 PM »

Right,

Disabling updates is not an option. Making updates non-automatic might work, but is a poor option.
I don't want to have to remember to go and check for + install updates - I want it to be a fairly automatic process.

wraith808: that link is just Microsoft really, really, REALLY not getting what people are complaining about >_<

rgdot · « **Reply #14 on:** July 26, 2018, 07:18 PM »

Realized Win10 (Pro only?) has a setting to defer updates for 35 days. MS really have no clue, what's the point of 35 days specifically...

wraith808 · « **Reply #15 on:** July 26, 2018, 10:25 PM »

wraith808: that link is just Microsoft really, really, REALLY not getting what people are complaining about >_<
-f0dder (July 26, 2018, 06:02 PM)

Oh, I know. I guess I should have put /s on the end of my statement. $:-\$

KodeZwerg · « **Reply #16 on:** July 26, 2018, 11:48 PM »

Right,

Disabling updates is not an option. Making updates non-automatic might work, but is a poor option.
I don't want to have to remember to go and check for + install updates - I want it to be a fairly automatic process.

wraith808: that link is just Microsoft really, really, REALLY not getting what people are complaining about >_<
-f0dder (July 26, 2018, 06:02 PM)

In my case (Auto-Update OFF / metered connection) i use WSUS Offline Update to do such action.
= How to REALLY stop ******* Windows Update on Win10? = solved with that. Or am i wrong?

wraith808 · « **Reply #17 on:** July 30, 2018, 08:06 AM »

Right,

Disabling updates is not an option. Making updates non-automatic might work, but is a poor option.
I don't want to have to remember to go and check for + install updates - I want it to be a fairly automatic process.

wraith808: that link is just Microsoft really, really, REALLY not getting what people are complaining about >_<
-f0dder (July 26, 2018, 06:02 PM)
In my case (Auto-Update OFF / metered connection) i use WSUS Offline Update to do such action.
= How to REALLY stop ******* Windows Update on Win10? = solved with that. Or am i wrong?
-KodeZwerg (July 26, 2018, 11:48 PM)

I tried that, and found that there are side effects that aren't immediately obvious. The one that I saw (thankfully before it became an issue) is that my syncing software for my backups stopped syncing because of the change. With this in mind, I switched mine back.

wraith808 · « **Reply #18 on:** September 13, 2018, 09:19 AM »

I woke up again to my machine being restarted. To make it worse, I had a VM open as I was going to have an early meeting and wanted to make sure I didn't have to start the VM before the meeting. To make it even worse, the VM showed aborted as the status. I started the VM, and it was thankfully fine, but I just knew I had to do something at this point.

Apparently, Microsoft introduced a Windows Update Medic Service in 1803- I'm guessing this is what broke my workaround. This service is apparently meant to repair Windows Update if something happens to it. The service itself has the description, "Enables remediation and protection of Windows Update components." That protection part means that this re-enables the Windows Update Service if you disable it- I found that out the hard way. To make it even worse, you can't disable this service. You get access is denied if you attempt to do so. I suppose you could attempt to take ownership, but I found a tool that does it for you before I even tried, and figured I'd mention it here, as I don't see any mentions on a search.

Windows Update Blocker (https://www.sordum.o...update-blocker-v1-1/) is a portable tool that allows you to disable both. It does require a bit to get it to disable the medic service that you have to do manually, though it does have a protect service settings that would seem to handle that also.

How to REALLY stop ******* Windows Update on Win10?

The struggle is real- how long can this continue before they learn that their customers don't want this?

Carol Haynes · « **Reply #19 on:** September 13, 2018, 09:47 AM »

One way that seems to work is to change the permissions on the windows update service and explicitly deny access to SYSTEM

I haven't tried this but have read reports that it works.

Having said that I guess MS will one day reset the permissions.

You could try replacing the windows update service file with another file of the same name.

Alternatively go back to Windows 7!

Deozaan · « **Reply #20 on:** September 13, 2018, 10:36 AM »

Here's what I've done that has been working for me so far. Note that I'm using Windows 10 Pro so this may not be available in the "basic" version(s) of Windows 10.

In Windows Update -> Advanced Options I enable the "Pause Updates" toggle, which will "temporarily pause updates from being installed on this device for up to 35 days. When updates resume, this device will need to get the latest updates before it can be paused again."

This seems to do the trick.

Then sometime within the 35 days when I know I have the time to install updates, I un-pause, install updates, and then pause it again.

No more surprise reboots.

If you can't find some free time once a month to install updates then obviously this solution may not be ideal for you. But it's working great for me so far in the past ~2 months since I decided to attempt this on a machine that needs to have reliable, high up-time.

EDIT: Rereading this thread, I see that rgdot already mentioned this option.

And that was probably about the time I started using the feature, so maybe his post was the reason and I just forgot about it.

Carol Haynes · « **Reply #21 on:** September 13, 2018, 11:29 AM »

The other approach is to say your connection is metered - although it will still pester but should not download without permission

wraith808 · « **Reply #22 on:** September 13, 2018, 12:35 PM »

The other approach is to say your connection is metered - although it will still pester but should not download without permission
-Carol Haynes (September 13, 2018, 11:29 AM)

That has other side effects as I said above. And they are very much bad effects for me. Dropbox, Onedrive, my backup service, and others stopped updating because it was metered. Make sure that you know what those side effects are, or you could be surprised as I was when I found out (they don't proactively warn you).

Here's what I've done that has been working for me so far. Note that I'm using Windows 10 Pro so this may not be available in the "basic" version(s) of Windows 10.
-Deozaan (September 13, 2018, 10:36 AM)

Unfortunately, I have windows 10 home, and apparently, it doesn't have that option.