How can I prevent automatic updates?

gamer254rb said:

Hi. Doing this will will turn off automatic updates on your PC. Just go to start menu>type 'services'>look for a service called 'windows update' and double click on it>if it's already running stop it and put its startup type to 'disabled'.

this worked month ago, but not anymore windows is still pushing drivers updates i dont want, and it does not matter how many times i disable that stupid service. Nothing is working and windows is completely ignoring that i NEED APPROVED drivers from MANUFACTURER otherwise my OS is bricked with blackscreen and BSOD problems until I reinstall it again. This problem lasts for around week and half and I must reinstall those drivers every day again and again, because Im not able to stop those stupid updates.

ozkatz said:

Can you spell out what you've finally done on your system exactly from all the tips you've received here to stop the updates?

I would like to know that too.

I've noticed to that even though in 10 Home you are supposed to be able to stop automatic updates of windows store apps
it is STILL automatically installing and updating completely useless games like Candy Crush and Disney Adventures.
I booted up today and noticed on my 768/128k connection that my browser was not even loading pages. I went to
the Windows Store and looked at downloads and updates..and sure enough there they were downloading and updating
MS is really killing themselves with this nonsense! I have the MS store auto updates clearly turned OFF but obviously the system is IGNORING that selection.

One thing I did notice is that when you select the "metered connection" choice it DOES turn off updates from what I can tell...
but it even turns off Windows Defender automatic updates too! I thought that the OS was still supposed to download
critical updates like defender....but it's not in metered mode. Not a big deal (I can manually update) but still an annoyance.

I just upgraded to 10 from 7 and while the basic product is quite good the nuisances are almost totally unbearable.
Bill Gates needs to rejoin the board and start forcing the company to listen once again to customers!

legacy7955 said:

in 10 Home you are supposed to be able to stop automatic updates of windows store apps
it is STILL automatically installing and updating completely useless games like Candy Crush and Disney Adventures.

I use Home Edition, where such automatic installation and updates have NEVER happened.

legacy7955 said:

but it even turns off Windows Defender automatic updates too

I use VBScript scheduled to update definitions at 6-hour intervals.

legacy7955 said:

the nuisances are almost totally unbearable.

I have long since wiped out the nuisances.

legacy7955 said:

Bill Gates needs to rejoin the board and start forcing the company to listen once again to customers!

Phone him up. Perhaps he will listen to you.

ozkatz said:

Can you spell out what you've finally done on your system exactly from all the tips you've received here to stop the updates?

I have done the following:
How to prevent downloading updates? - Windows 10 Forums
Enable or Disable Windows Update Automatic Updates in Windows 10 - Page 48 - Windows Update Activation Tutorials

muchomurka said:

There are two options how to suppress Windows 10 forced updates; either disable privileged scheduled tasks which run at System account, or block their access to needed services by permissions. Both ways are not so easy:

1. You can disable/modify privileged scheduled tasks if you act as System account too. To do this, you have to use freeware PsExec utility from Sysinternals (unzip PsUtils tools somewhere in your Path).

1a) To run Scheduled Tasks snap-in as System account, type at the Elevated Command Prompt:
psexec -i -d -s mmc taskschd.msc
and then you can disable following three tasks interactively in GUI

1b) To disable affected scheduled tasks directly from commandline, type:
psexec -i -d -s schtasks /change /tn "microsoft\windows\updateorchestrator\schedule scan" /disable
psexec -i -d -s schtasks /change /tn "microsoft\windows\windowsupdate\scheduled start" /disable
psexec -i -d -s schtasks /change /tn "microsoft\windows\WaaSMedic\PerformRemediation" /disable

To revert those scheduled tasks back, type:
psexec -i -d -s schtasks /change /tn "microsoft\windows\updateorchestrator\schedule scan" /enable
psexec -i -d -s schtasks /change /tn "microsoft\windows\windowsupdate\scheduled start" /enable
psexec -i -d -s schtasks /change /tn "microsoft\windows\WaaSMedic\PerformRemediation" /enable

These commands may be also run from CMD batch file. Kiitos to TairikuOkami for identifying the 3rd service.

2. Different approach is to block access of System account to underlying services; so the mentioned tasks cannot neither start nor modify them. You may use freeware utilities from Helge Klein.

2a) To block System account access to services interactively:
- install SetACL Studio, run it, enter product key from download page, from menu View select Detailed
- expand Services node, select Windows Update entry
- to change ownership, in right pane click Select, click Advanced, click Find now, select Administrators, click OK
- click on Save button
- in right pane click to Add (it creates new Access Control Entry for service)
- click Advanced, click Find now, select System, click OK
- at newly added line, click on Allow symbol in Type column to change type of Access Control Entry from Allow to Deny
- at the same line, click in Permissions column
- select the following permissions: Change configuration, Start, Stop, Delete, Change permissions, Take ownership
- click on Save button again; System account now cannot manipulate this service
- repeat the same steps as above for Windows Modules Installer service
- using regular Services snap-in in MMC console, set both mentioned services to Disabled.

You need to modify two services this way: wuauserv (Windows Update) and TrustedInstaller (Windows Modules Installer, the name depends on language). All three steps are necessary: setting Administrators as service owner, setting six Deny permissions for System, and disabling the service.

To revert to normal state, in SetACL Studio simply click Deny symbol (it changes to Allow) and Save, then set service start type to Manual in Services snap-in. Do these steps for both services.

2b) To block System account access to services from elevated command line or from CMD batch file:
- download SetACL utility from Helge Klein website, place it on your Path
- test it using commands:
setacl -on "wuauserv" -ot srv -actn list
setacl -on "trustedinstaller" -ot srv -actn list

- change owner using commands:
setacl -on "wuauserv" -ot srv -actn setowner -ownr "n:Administrators"
setacl -on "trustedinstaller" -ot srv -actn setowner -ownr "n:Administrators"

- set blocking ACE entries:
setacl -on "wuauserv" -ot srv -actn trustee -trst "n1:system;ta:remtrst;w:dacl"
setacl -on "wuauserv" -ot srv -actn ace -ace "n:system;p:full;m:grant;w:dacl"
setacl -on "wuauserv" -ot srv -actn ace -ace "n:system;p:SERVICE_CHANGE_CONFIG,SERVICE_START,SERVICE_STOP,WRITE_OWNER,WRITE_DAC,DELETE;m:deny;w:d acl"
sc config wuauserv start=disabled
setacl -on "trustedinstaller" -ot srv -actn trustee -trst "n1:system;ta:remtrst;w:dacl"
setacl -on "trustedinstaller" -ot srv -actn ace -ace "n:system;p:full;m:grant;w:dacl"
setacl -on "trustedinstaller" -ot srv -actn ace -ace "n:system;p:SERVICE_CHANGE_CONFIG,SERVICE_START,SERVICE_STOP,WRITE_OWNER,WRITE_DAC,DELETE;m:deny;w:d acl"
sc config trustedinstaller start=disabled
...please treat two strings "d acl" as "dacl", forum formats long lines erratically

- delete blocking ACE entries for allowing Windows Update temporarily:
setacl -on "wuauserv" -ot srv -actn trustee -trst "n1:system;ta:remtrst;w:dacl"
setacl -on "wuauserv" -ot srv -actn ace -ace "n:system;p:full;m:grant;w:dacl"
sc config wuauserv start=demand
setacl -on "trustedinstaller" -ot srv -actn trustee -trst "n1:system;ta:remtrst;w:dacl"
setacl -on "trustedinstaller" -ot srv -actn ace -ace "n:system;p:full;m:grant;w:dacl"
sc config trustedinstaller start=demand

3. Recommended workflow, i.e. How to survive periodic patch parties:
Once a month (probably after Black Tuesday) it is proper to patch Windows systems in a controlled way. It is relatively simple but time consuming activity:
- image system partition(s) using Macrium Reflect Free, or at least create Restore Point
- unblock Windows Update mechanism according to blocking method used (enable scheduled tasks, or clear Deny permissions and set services to Manual start)
- run wushowhide.diagcab immediately to block unwanted patches and drivers
- run Windows Update
- revert Windows Update back to blocked state
- image system partition(s) again.

That's all, for now. And, of course, many thanks sent to Redmond with love.

thanks for info.
i have 2 question on option #2:
1. before i create a new system line i have seen a "old"system line.
i was removed it and create a new one with deny entry
its ok ?
2.when i was open permissions column: i have seen only Start, Stop.
i have not seen: Start, Stop Delete, Change permissions, Take ownership
so i put it on "start,stop"
its ok ?
note: These two questions happened to me in both services(Windows Update,Windows Modules Installer)

and on more question on option #1
i was open the task scheduleder with PsExec tool and Before I changed the first two tasks you said(schedule scan, scheduled start), I saw that they were already on disabled.And the third task (WaaSMedic\PerformRemediation) is not even there.how is it possible ?(I ran the registry file through safe mode before and canceled the services you said)

Option one: I curently don't use and don't recommend scheduled tasks blocking because they vary from system to system; I identified two more dangerous tasks (rempl\shell and windowsdefender\verification). It is almost impossible to block all that tasks that try to kill our systems by enabling windows update.

Option two (my current recommendation):

2.when i was open permissions column: i have seen only Start, Stop.
- as written above, from menu View select Detailed

1. before i create a new system line i have seen a "old"system line.
- it was ok; one permanent line "Allow All for System" and one "Deny Some for System" which can be easily changed to "Allow Some for System" by one click to temporarily allow updates. Remember that Deny takes precedence over Allow.

Set service owner, permissions (first line is Deny) & startup type exactly as shown:

thanks for it.
i do it and i will give answer more few days about it.

one more thing.
I deleted all scheduled tasks for:
microsoft \ windows \ updateorchestrator and microsoft \ windows \ windowsupdate
Will I have a problem with this?
Also, do you know of any other update-related tasks?

Will I have a problem with this?

I don't know. Make image of system disk, then do in-place upgrade, see if these task are re-created. Or perform clean install. Then you may block updates by service permissions, it is much easier.

muchomurka said:

Will I have a problem with this?

I don't know. Make image of system disk, then do in-place upgrade, see if these task are re-created. Or perform clean install. Then you may block updates by service permissions, it is much easier.

update:
I created a new Windows 10 system and performed Method 2I added here photos of the changes I set in the setACL softwareI changed the services: wuauserv (Windows Update) and TrustedInstaller (Windows Modules Installer) to disabled too.But again, wuauserv has returned to be activated.







here you can see that windows update service back to work



and here the windows 10 assistant - back to work.



Still in troubleIdeas?