Update Windows with WUA Manager

I forgot that I'd unblocked updates for testing. Anyway when I block updates (hard block) I get this:

** Saturday 17/04/2021 18:05:09 **
Launched SU10Guard.exe[7140] « services.exe[860] « wininit.exe[788]
Windows Startup Settings
Registry Key hkey_local_machine\software\microsoft\windows\currentversion\policies\explorer
Value NoWindowsUpdate (N) will be a new value with data
1
=======================================================
** Saturday 17/04/2021 18:05:18 **
Change Accepted
=======================================================
** Saturday 17/04/2021 18:05:18 **
Other Windows Settings
Registry Key hkey_local_machine\software\microsoft\windows\currentversion\windowsupdate
Value OSUpgrade (N) will be a new value with data
0
Value ReservationsAllowed (N) will be a new value with data
0
=======================================================
** Saturday 17/04/2021 18:05:22 **
Change Accepted
=======================================================
** Saturday 17/04/2021 18:05:22 **
Other Windows Settings
Registry Key hkey_local_machine\software\policies\microsoft\windows\windowsupdate
Value DisableOSUpgrade (N) will be a new value with data
1
Value DisableWindowsUpdateAccess (N) will be a new value with data
1
=======================================================
** Saturday 17/04/2021 18:05:23 **
Change Accepted
=======================================================
** Saturday 17/04/2021 18:05:23 **
Additional Security
Registry Key hkey_local_machine\software\microsoft\windows nt\currentversion\image file execution options
Subkey EOSNOTIFY.EXE has been added
Subkey InstallAgent.exe has been added
Subkey MusNotification.exe has been added
Subkey MUSNOTIFICATIONUX.EXE has been added
Subkey remsh.exe has been added
Subkey SIHClient.exe has been added
Subkey UpdateAssistant.exe has been added
Subkey UPFC.EXE has been added
Subkey UsoClient.exe has been added
Subkey WaaSMedic.exe has been added
Subkey WaasMedicAgent.exe has been added
Subkey Windows10Upgrade.exe has been added

Interestingly it's using IFEO to pass executables listed above to debugger with a value of "*"

NOTE: This post is nothing to do with WAU Manager. These entries are created by other software.

Hello Matthew,

Matthew Wai said:

Do you know how to check whether the hijackers have been disabled?

I tried quite a few things at the time, but it was over a year ago and I did NOT keep the notes. I just uninstalled WAU Manager in the end.

Matthew Wai said:

How do you get the log? Where is the log file?

It's created by other third party software.

Matthew Wai said:

Note that Sledgehammer will not disable Microsoft Update Health Tools (KB4023057). https://www.tenforums.com/windows-10...ml#post2158800
Do you know how to check whether the hijackers have been disabled?

I uninstalled that program (Microsoft Health Tools)

As for checking update hijackers I leave that to Sledgehammer. It runs a vbs script to disable them by changing permissions. I just checked one.

Hello Matthew,

Matthew Wai said:

More conveniently, you may create a desktop shortcut to the following target:

"D:\The folder\bin\wumt_x64.exe" -update

I did actually do that on my OS, without the -update, in case I decided I wanted to include Drivers. I didn't put that option in my post above because I did NOT want to confuse things because the OP is asking about WAU Manager.

Matthew Wai said:

To anyone who is interested, run the following command via elevated Command Prompt:

Start "" %WinDir%\System32\UsoClient.exe

Code:

Microsoft Windows [Version 10.0.19042.746]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\Windows\system32>Start "" %WinDir%\System32\UsoClient.exe
Access is denied.

C:\Windows\system32>

If it outputs Access is denied as shown above, the hijacker has been disabled.

That is an easy way to check. Thanks.

Regarding the %WinDir%\System32\UsoClient.exe, you might find this interesting . . .

> What is UsoClient.exe in Windows 10

This also applies and works in CMD Script and VBScript to Control Windows Update in Windows 10.