Permanently Disable Windows Updates

FreeBooter said:

In this video, i will show you how to enable or disable automatic updates in Windows Update for all users in Windows 10.

The tool is making the changes you can manuallly make at the registry level. How does it keep and enforce the services stay disabled after reboot? I've also questioned if Windows Installer is needed to be disabled, seems like it would cause more trouble than it is worth and if the update can't be downloaded it can't be installed. Renaming of the installer files will cause boot errors from past experimentation.

I don't think this will work unless it is constant running in the background. I'm not a fan of this solution when a simple startup script will disable the services run once and not use any resources.

- - - Updated - - -

dalchina said:

Enable or Disable Windows Update Automatic Updates in Windows 10
Using CMD script and VBScript to control Windows Update

I used Sledgehammer (a script) to do this some years ago. The above are more current.

Trivial DIY hacking is usually unsuccessful.

The second link with the CMD and VBScript is not valid can you please check the link. Curious here what those scripts entail. I have a script but would like to avoid having to use it each time on startup

- - - Updated - - -

Try3 said:

I set all network connections as metered and only one small, useless, non-disruptive update [KB4023057] gets through once or twice each year.
I use a script to update Defender a couple of times a day.
I do my Windows updates manually when it suits me. I don't avoid them altogether.

I check my metered status automatically at every startup.
It has been a few years since any Version update changed them but I like to be certain.



All the best,
Denis

Hi Denis,

I would perfer to just not have it run period in the background. On some of the older machines it just sucks up resources and i manually update as I see fit.

- - - Updated - - -

RickC said:

I've been using the portable freeware Windows Update Blocker for years now without any issues.

It just works... and it allows Microsoft Defender definition updates through.

Usage is simplicity itself:
Attachment 404766

No scripting, no rebooting. Just fire and forget.

Hope this helps...

This doesn't work, it needs to be applied again after a reboot. It doesn't run in the background unlike some other 3rd part tools that wait for a trigger of the service changing state. Even in the comments section you can see it was reported. You might not even know it is happening.

TairikuOkami said:

Be creative. Do not disable windows update, but things it depends on, like Network Store Interface Service. If you do not use other MS services, like store, you can simply block svchost.exe in the firewall, ports 80/443, so DNS and DHCP will keep working. Or create a nonexistent symlink, windows update check will work, but downloads will fail.

Code:

rd "%WINDIR%\SoftwareDistribution\Download" /s /q
mklink /d "%WINDIR%\SoftwareDistribution\Download" "X:\Download"

I don't use store so i'm looking to keep update from running period until i want to manually patch.

I just confirmed the WSUS reg edit provided above seems to do the trick by tricking windows into thinkthing there is WSUS server. I don't know how frequently it will try polling the server for an update but this is easy enough to undo.

I don't use the native windows FW, i run Eset IS, the symlink is pretty creative but the update as you said is still running in the background. Woud like to just disable it all together.

I need to do a few reboots to see if this WSUS reg edit stays. Maybe change the Pause duration in the registry which will keep it from running for a few years as opposed to the max ~30 days what ever you can set now.

Here's the truth: simpler is better.

W10 & later have intertwined WU services and configs, and some Update blockers work better or worse depending on the exact Windows build. And everyone has a totally different approach. Some use configs, some disable services.

If you manually install a Monthly Update (by downloading it from MS Catalog), it's likely the update can partially undo some of your Update blocker's changes as part of rolling out fixes.

The one thing MS always respects, because it favors enterprise clients more than you, is Windows will always keep your WSUS settings. No matter what happens in Windows, it won't tamper with them. Since there's existing code to gracefully handle errors talking to WSUS, pointing it to a non-existent server is really simple and preserves the rest of Windows from tacky changes.

To pause Updates for longer than 30 days, use:

Code:

Windows Registry Editor Version 5.00

; Start > Settings > Update & Security > Windows Update > Advanced options > Pause updates > Up to 4 years
[HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\UX\Settings]
"FlightSettingsMaxPauseDays"=dword:000005b4

; Start > Settings > Update & Security > Windows Update > Advanced options > Pause updates > Until January 1st, 2026
[HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\UX\Settings]
"PauseFeatureUpdatesStartTime"="2022-07-01T20:00:00Z"
"PauseQualityUpdatesStartTime"="2022-07-01T20:00:00Z"
"PauseFeatureUpdatesEndTime"="2026-01-01T20:00:00Z"
"PauseQualityUpdatesEndTime"="2026-01-01T20:00:00Z"
"PauseUpdatesExpiryTime"="2026-01-01T20:00:00Z"

Feel free to adjust the EndTime's to any point in the future, and StartTime's as now (current time).

garlin said:

Here's the truth: simpler is better.

W10 & later have intertwined WU services and configs, and some Update blockers work better or worse depending on the exact Windows build. And everyone has a totally different approach. Some use configs, some disable services.

If you manually install a Monthly Update (by downloading it from MS Catalog), it's likely the update can partially undo some of your Update blocker's changes as part of rolling out fixes.

The one thing MS always respects, because it favors enterprise clients more than you, is Windows will always keep your WSUS settings. No matter what happens in Windows, it won't tamper with them. Since there's existing code to gracefully handle errors talking to WSUS, pointing it to a non-existent server is really simple and preserves the rest of Windows from tacky changes.

To pause Updates for longer than 30 days, use:

Code:

Windows Registry Editor Version 5.00

; Start > Settings > Update & Security > Windows Update > Advanced options > Pause updates > Up to 4 years
[HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\UX\Settings]
"FlightSettingsMaxPauseDays"=dword:000005b4

; Start > Settings > Update & Security > Windows Update > Advanced options > Pause updates > Until January 1st, 2026
[HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\UX\Settings]
"PauseFeatureUpdatesStartTime"="2022-07-01T20:00:00Z"
"PauseQualityUpdatesStartTime"="2022-07-01T20:00:00Z"
"PauseFeatureUpdatesEndTime"="2026-01-01T20:00:00Z"
"PauseQualityUpdatesEndTime"="2026-01-01T20:00:00Z"
"PauseUpdatesExpiryTime"="2026-01-01T20:00:00Z"

Feel free to adjust the EndTime's to any point in the future, and StartTime's as now (current time).

I agree, keeping it simple is the best approach. I was just about to change the durations myself same keys you posted. I have a slightly different set of reg keys as well which include:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings]
"PausedFeatureStatus"=dword:00000000
"PausedQualityStatus"=dword:00000000


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings]
"PauseUpdatesStartTime"="<date>"

arf8 said:

The second link with the CMD and VBScript is not valid can you please check the link.

The link is correct. You have no right to access it because you are not a VIP member. You may ask an administrator for VIP access.

No need WSUS works along with delay