KB4023814 was literally a trap I fell into. If I had known KB4023814 denoted Update Assistant, I would not have manually installed it, and version 1803 would not have been installed unexpectedly.
What do you mean by "more limited value"? Do you mean its effect is more limited?
BTW, this Chinese guy would not start a question with "How to", which denotes a noun phrase rather than a question.
I understand it used to be the case that using metered connections was more effective in inhibiting WU than now- hence the advent of tools such as the one in this thread.
(Patterns like that depend on your language background and exposure- it's entirely understandable when L1 structures are borrowed into a less familiar language. Using 'How to...?' is almost a symptom of a program having a Chinese origin if you look at FAQs on Chinese origin programs, for example. zenme... is a natural start to 'How' questions in Chinese, and using 'How do you' doesn't have a direct equivalent in Chinese. I was always intrigued as to where these patterns came from- and incredibly impressed at the confidence and ability many students displayed in English).
If you don't want to use the wrapper script, you can just use the part that removes the update assistant.
Run as admin after every update:
UpdateAssistantRemoval.cmd - Pastebin.com
Of course without using the script it could possibly install itself again at any time so I don't know how good just using the update assistant removal section would actually work in the long term.
From the research I've done on Update Assistant, "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" can be created by a few different updates (I don't have a list, sorry). Then "UpdateAssistant.exe" is run by a task which then creates "%systemdrive%\Windows10Upgrade\Windows10UpgraderApp.exe" that is run to force an upgrade. The murky details of this isn't important (from the way I approach this problem). What's important is to prevent "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" from ever running in the first place. I handle this problem by first uninstalling Update Assistant if it exists and deleting "UpdateAssistant.exe", then disable the "Update Hijacker" files that safely disables the services and files that start this process (among many others) if it somehow gets created again.
But to get to the point: If you only want to make sure Update Assistant never runs without considering any other forced upgrade parts of Windows 10, I would create the following folder with a dummy file "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" and remove read and write access to the file by all users including System and TrustedInstaller with takeown and icacls as shown below. If you run sfc you'll get an error with this file since the system can't read it, but just use the second set of commands to regain ownership before you run sfc:
Regain access to the file like this:Code:takeown /f "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" /a icacls "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" /reset icacls "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
Code:takeown /f "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" /a icacls "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" /reset icacls "%systemroot%\UpdateAssistantV2\UpdateAssistant.exe" /setowner *S-1-5-18
That's why I disable a lot of useless cr*p like usoclient.exe and osrss.exe, and lots of dll's, which are responsible for starting "Update Orchestrator" "Remediation Services" "WassMedic" and others which triggers the whole Update Assistant chain of events after a set amount of time has passed. Many tasks are set to trigger these few files so instead of wasting time disabling the tasks that start them I disable what the tasks try to run. When a new one comes along, then that gives me time to discover what the new hijacker KB's are doing before they can start the new 1803 Update Assistant v3 or whatever it will be since Update Assistant (so far) doesn't start right away after the new unknown KB is installed. It usually waits a few months and that's plenty of time for me to prepare a defense.
You're right, it can't be predicted what will come next. That's why I go after the currently known update hijacker subsystem. I do my best to keep my eye on the new hijacker KB's and what they do. Looking at task scheduler to look for any suspicious tasks, then determining what those tasks run gives me lots of clues of what's about to happen, along with info on the net, tips sent in to me and things I discover on my own.
So, as you know, it's complicated - like my script and the research behind it. And it's why just stopping update assistant by only removing update assistant will never work because it'll just get re-created again by a service, a task, or another KB. And like you said, there will be a new version of this type of thing in the future.
There are many ways of addressing this issue, and mine is only one of many. Very early on I saw that Microsoft was removing control of the update process and I never trusted metered connections or a lot of other methods people were using, like GPO, registry tricks, etc. I decided to disable anything not needed to manually update by disabling files that force updates. And I wanted it to work on Home versions too.
Sorry if I'm rambling. I'm really tired right now from lack of sleep but hopefully I've at least partially explained the way I approach this problem.
I do know one thing for sure, if you had been using my script, you'd still be on 1709 unless you chose to update to 1803. You could also choose to never update again. I'm not saying another method won't accomplish the same thing because I don't know. It's just that I take a completely different approach to this than any other method I've seen and I've only been using my script exclusively since windows 10 was released.
With that said, it's up to you to decide the update control method that's right for you.
Martin Brinkman at ghacks.net wrote this story about two other update blockers I'd never heard of in December 2015: Two Windows 10 tools to block automatic updates - gHacks Tech News. Anybody know anything about these?
TIA for your feedback and info.
--Ed--
I am using wushowhide (from MS) to stop Windows from inexplicably trying to revert to a 2016 Intel GPU driver on the machine instead of the 2018 one currently from Intel (why does it do this...does it not see that a later driver is installed)? Both are non-OEM.
Anyway, my question is should I be using WUMT to block this one update properly (any other updates I am fine with) or is that overdoing it and the MS tool is okay and proper (not some hack). I am thinking WUMT may be for users who want complete control over all automatic updating.
Quote