Stopping all automatic updates Windows 10

Question

We've upgraded some machines to Windows 10 and realized there were some updates which updated as required. However, I realized there was no option available to stop the download similar to that on Windows 7 and 8.1. The only way I could stop the download was to stop the Windows Update service.

My question is does anyone know of a way to stop auto updates or is stopping the service is the only solution?

If you have Windows 10 Home then this cannot be done. If you have Windows 10 Professional you can defer updates up to 8 months. if you have Windows 10 Enterprise you can defer updates provide you indicated the LSTB you wish to use. There is a tool which you can download that will allow you to defer individual updates if they cause a problem. [This question has already been asked several times now.](http://superuser.com/questions/923186/how-can-i-defer-updates-in-windows-10-home). — Ramhound, Jul 29 '15 at 15:24
Additionally, at the end of the day, in order to receive future security updates your system must have all required updates even if you are running Windows 10 Professional. [KB3073930](https://support.microsoft.com/en-us/kb/3073930) is the tool you want if you want to hide/defer individual updates. — Ramhound, Jul 29 '15 at 15:27
@Ramhound I understand that security updates will be required etc but sometimes you just want to pause them and start them later on. We're running pro version. Would you happen to know where I can get the tool which you mentioned in your comment? — Izzy, Jul 29 '15 at 15:30
I already provided a link twice. Once in a comment to the answer of the linked question and once in my comment to this very question. If you are unable to select which updates you wish to update, then you have not enabled something, and I am far to tired to look for that option for you. — Ramhound, Jul 29 '15 at 15:32
@Ramhound Right, I didn't realise the second link.. Thanks for the help — Izzy, Jul 29 '15 at 15:33
You shouldn't need that tool though if you are actually running Windows 10 Professional though. — Ramhound, Jul 29 '15 at 15:34
[Here is some more information](https://www.thurrott.com/windows/windows-10/4881/windows-10-and-automatic-updates) — Ramhound, Jul 29 '15 at 15:54
@Ramhound Thanks for your help I found the option settings and posted the answer — Izzy, Jul 29 '15 at 16:01
Please note that all of the answers here only cover updates from Windows Update, but it's not clear whether the question is meant to cover that. Windows 10 appears to have two other built-in methods of updating: device driver updates are controlled separately (System → Advanced system settings → Hardware → Device Installation Settings seems to cover this) and automatic updating of Store apps is controlled via the Store (I think this will also stop Candy Crush Soda Saga, for example, from being installed automatically). — doshea, Jul 24 '16 at 09:55
All these answers are overly complex and doesnt fully prevent updating of the system. Also I do not want to install 3rd party software to just disable updates. It's a security risk right there. My solution works: https://superuser.com/questions/1365960/its-2018-october-what-is-the-best-way-to-disable-windows-10-win10-annoying-a?noredirect=1#comment2054244_1365960 as of 2018 October. — Patoshi パトシ, Oct 11 '18 at 17:16

score 46 · Accepted Answer · edited Mar 20 '17 at 10:17

46

if you have the Pro Edition, open group policy editor (gpedit.msc) search for the Configure automatic updates entry, located at:

computer configuration → administrative templates → windows components → windows update

and select Notify for download and notify for install.

When Windows detects new updates it shows a toast notification.

You can also use the troubleshooter from Update KB3073930 to disable some problematic updates, so that they are not installed again.

This is the official way from Microsoft to prevent setup of unwanted updates and drivers.

But there is a 3rd party tool called Windows Update MiniTool which allows to select which updates can be installed and allows to block updates like you could in former Windows versions.

An alternative to the standard Windows Update What you can do:
• Check for updates
• Download updates
• Installing Updates
• Deleting installed updates
• Hiding unwanted updates
• Get direct links to the *.cab / *.Exe / *.Psf update files
• View update history
• Configure Automatic Updates
• This tool is like the external powershell module PSWindowsUpdate, but much more advanced and user-friendly features
• The tool relies and use same WU infrastructure, all downloading are through WU it's not a downloader

The user slavanap posted a 2nd tool in a comment which allows you to selectively install updates. It is called Windows10 Manual Update and is available on github:

.

In the Windows 10 creators Update, there is an option to stop Windows Updates for 35 days:

under Settings App where the Windows Update options are.

edited Mar 20 '17 at 10:17

Community

1

answered Jul 31 '15 at 04:58

magicandre1981

95,704
28
171
240

From the kb307390 link "How to temporarily prevent a Windows or driver update from reinstalling in Windows 10" this does not permanently block the update from installing – Moab Sep 28 '15 at 16:07
It does however prevent it for a while. – Warren P Sep 28 '15 at 17:54
3

What if you have the Home edition? – Colonel Panic Oct 12 '15 at 15:56
1

@ColonelPanic try to set the value **AUOptions** under **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** to **2**. Does this work? – magicandre1981 Oct 12 '15 at 16:02
I used the Group Policy Editor method and it appears to have stopped Windows Update (I have been using this configuration for around 6 months), although I don't just get a "toast notification" as shown above, sometimes I get a dialog in the middle of the screen which doesn't have any kind of close/cancel button, and when I hit the button it opens up the Windows Update tool. However, I can close that to prevent updates from being installed. – doshea Jul 24 '16 at 09:44
@doshea I have no idea which issue you have. I still get the toast notification – magicandre1981 Jul 24 '16 at 17:48
1

I don't think that MiniTool is open source. Please refer this open source the simplest solution how to perform Windows 10 Update maintenance similar to pervious Windows versions https://github.com/slavanap/Windows10ManualUpdate – Vyacheslav Napadovsky Nov 22 '16 at 14:10
@magicandre1981 Creator Update allows an Ethernet connection to be marked as a metered connection. And you know, automatic update does not work over metered connections. – Feb 22 '17 at 13:43
@FleetCommand this is a crappy hack. Use the offered tools to search for updates. And don't don't sabotage the topic by adding softpedia crap links. – magicandre1981 Feb 22 '17 at 16:52
3

@magicandre1981 Sabotage? That is not exactly a "thank you" for repairing a dead and dead-end link. – Feb 22 '17 at 18:04
5

-1 not because it's your fault, but because your answer is now out of date. Windows now turns Windows Update back on even after all the classic workarounds. – user541686 May 29 '18 at 02:50
2

@Mehrdad it still works, you simply can't use WindowsUpdateMiniTool correctly ‍♂️ I've excluded kb4134661 with WindowsUpdateMiniTool and I'm still not updated to 1803 from 1709. Everything works fine. Delete your account and troll somewhere else – magicandre1981 May 29 '18 at 14:44
@magicandre1981 with all due respect, I have one problem with your answer, it emphasises on deferring updates rather than stalling them – xavier_fakerat Aug 02 '18 at 15:29
2

@TrevorBoydSmith the answer still works. I still use Windows Update MiniTool in 1903 home edition without any issues. – magicandre1981 Sep 18 '19 at 14:32
@magicandre1981 thanks for answering. i have retracted my comment. i will try out minitool! and report back (sry for wasting your time... i'm really thankful for your reply and showing that you care!). users like you make stack network amazing :). – Trevor Boyd Smith Sep 18 '19 at 18:27
@magicandre1981 MiniTool is a third-party software. Do you trust MiniTool? If yes, why? – Trevor Boyd Smith Sep 18 '19 at 18:30
@magicandre1981 i looked a little bit into MiniTool author/programmer. found a [reddit that says it works](https://www.reddit.com/r/Windows10/comments/9q2neb/windows_update_minitool_wumt_is_it_safe_and_does/). found a link to [winguru where an article about it writes "As far as I can tell, it involves an un-named Russian translator who maintains and handles the code base on behalf of an even more shadowy principal developer"](https://win10.guru/toolkit-item-windows-update-minitool-wumt/). – Trevor Boyd Smith Sep 18 '19 at 18:40
1

The MiniTool might still work. But development has stopped and so an opensource alternative is available called: [article talking about MiniTool and WuMgr](https://piunikaweb.com/2018/09/20/windows-update-manager-wumgr-windows-10/) at [WuMgr at Github](https://github.com/DavidXanatos/wumgr/). – Trevor Boyd Smith Sep 18 '19 at 18:41
1

I also know the other tool, as long as Mini Tool works I'll use it as it uses WindowsUpdate API. – magicandre1981 Sep 19 '19 at 14:22
I use minitool on all my W7-W10 machines, it just works and is safe, it is just a front end for the built in windows update, nothing nefarious about it. No virus detected either. Its the true solution to controlling Windows updates on W10. – Moab Mar 03 '20 at 15:50
2

seems to be they have removed `notify to download and notify for install` option, only `notify for download and auto-install` left on 1909. Dunno if they are the same – Suncatcher Apr 15 '20 at 12:06
@Moab, are you security expert to say it's safe? Just need to know for sure if it's safe. – Bohdan Kuts Aug 16 '20 at 09:53
1

@BohdanKuts I wouldn't have said it if it wasn't. – Moab Aug 16 '20 at 12:13
Since the original author has pulled his blog an wumt, here is the continued project>>>>>https://www.majorgeeks.com/files/details/wumt_wrapper_script.html – Moab Aug 20 '20 at 15:50
The Group Policy Editor method does not work anymore. I had it configured: `7 - Auto download, notify to install, notify to restart`, but despite it updates are installed silently and windows restarts without my permission :( – Eugene Mala Jun 23 '21 at 19:41
@EugeneMala it works for all my systems (Build 19043, 18363) in VMs and on real devices. I prefer only to notify, bot to download. – magicandre1981 Jun 23 '21 at 21:16

xavier_fakerat · Answer 2 · 2022-02-14T16:33:33.580

One of the most controversial aspect about Windows 10 is Microsoft’s decision to make updates obligatory. If you have Windows 10 Pro, Enterprise or Education editions you can defer updates, but you can’t reject them outright.

If you’re unhappy with Microsoft forcefully installing updates on your system without your say, you can block this function using the W10Privacy.

If you haven’t heard of this program before it’s well worth checking out as the software gives you control over Windows 10’s many privacy functions, allowing you to prevent the OS snooping on what you do. Options are color coded so you can see at a glance whether something is safe to change/disable or not.

In W10Privacy 2, you can now set the program to disable Windows 10’s own update mechanism and replace it with its own. Users can choose which updates to install, and which to ignore. This isn't something everyone should do, but you can easily reverse the steps should you need to.

Before you can use this function, you need to download some additional components. Follow these steps:

Download W10Privacy 2 and unzip it to a folder on your hard drive.
Download PsExec (part of PsTools package) and copy it into the W10Privacy folder.
Download the Windows Update PowerShell Module from Technet, and unzip it to a subfolder in the W10Privacy folder.
Right-click W10Privacy.exe and choose Run as administrator from the context menu. Choose to make a system restore point. It’s also worth making a full system backup (just in case).
Go to Extras > Windows Updates to manage the options. There are six different check boxes. None are enabled by default. They are:
PSWindows Update module exists (must be provided previously by user to the W10Privacy folder).
PsExec.exe in W10Privacy folder (must be provided by user). W10Privacy adaption of the PSWindows-Update Module.
Configure fake WSUS server.
W10Privacy is located in a path/folder without spaces. Do not consider drivers in Update Search.
Assuming you want to manage updates manually, check the first five options. The sixth option lets you decide whether to list drivers alongside updates. This is up to you.
Click Set changed settings then click the Start checking for updates button and you’ll be shown any new updates that have yet to be installed and can choose what action to take.

Once you’re in charge of your updates, run the software regularly and check to make sure you don’t miss any important updates;

Update

It appears the link for the Windows Update PowerShell Module is dead, however you can still install install the module in any of the following ways:

You can use PowerShellGet to install using this command:

Install-Module -Name PSWindowsUpdate

or you can

Use a mirror link form Majorgeeks

Credits:

How to get total control over Windows 10's automatic updates

Best solution, since it entirely prevents Windows from seeing updates at all. — Marcus, Dec 25 '17 at 18:50
oh no.. Why there is no single command. Somebody give me door this window is high to walk around. — Mustkeem K, Nov 01 '18 at 18:24
seems a little bit of overkill to bring up own WSUS server just to disable it — Suncatcher, Aug 09 '20 at 19:14

score 6 · Answer 3 · edited Jan 06 '19 at 13:09

For Windows 10 Home Users

Try the following method from Windows Central. Basically, you will disable the reboot service, not the update service. You can then reboot whenever you want. Please note, you need administrator privileges, but I assume you already have it since you are using Windows Home edition.

From a Windows explorer window, rename the file: C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot (assuming your %windir% is C:\) to Reboot.old. Note, you will be asked for administrator access here.
Create a directory named Reboot in C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\. This will prevent windows from recreating a file with the same name. Note, you will be asked for administrator access here.
Reboot the machine. This will reset all of the services, and prevent the reboot service from starting.

Please note, this is not promoted by Microsoft. But then again, neither is controlling you own boot schedule, so take that MS! Seriously, if you don't know what you are doing understand the risks you are taking by following any directions off the Internet. This is certainly simple enough that an understanding of Windows 95 would help explain what is happening here.

score 6 · Answer 4 · edited Mar 20 '17 at 10:17

6

With the help of @Ramhound I have managed to figure out how to stop automatic updates on windows 10.

Please note this applies to Windows 10 Pro as it's the version I am running.

To stop the autmatic updates you can do the following:

Open Settings
Click on Update & security
Click on Advanced options
Ensure Defer upgrades option is checked
Close down the settings window and that's it you're done!

Update

As mentioned in the comments by @Vinayak the defer option is now available for home users too. Further information here

edited Mar 20 '17 at 10:17

Community

1

answered Jul 29 '15 at 15:59

Izzy

1,137
1
8
11

While your in there looking , could you see if there is a windows update service that can just be disabled in services. Wuauserv or wuaueng.dll or something? for those who might use a different method? – Psycogeek Jul 29 '15 at 17:08
1

@Psycogeek `Wuauserv` service is there and can be stopped/disabled. This is how I originally stopped the updates – Izzy Jul 30 '15 at 07:59
6

Much of the web is making it sound as if the world will stop turning , if the windows 10 updates are stopped :-) and how the button does not exist in some editions. I am assuming you did not have any trouble with that? the dream police did not invade your nightmares , the OS did not collapse into a ball, and no pets were harmed in the in the process :-) I think this Q&A here is well done and can be re-used for similar W10 update control questions . – Psycogeek Jul 30 '15 at 08:30
@Psycogeek LOL Love the comment.. I did not have any problem by stoping the service. – Izzy Jul 30 '15 at 08:52
5

Note that Microsoft caved in and now **Defer upgrades** [is available for Windows 10 Home users as well](http://superuser.com/a/968658/167187). – Vinayak Sep 05 '15 at 10:38
1

**defer** stops the upgrade to a newer Version like 1511 (November 2015 Update) or 1607 (anniversary update in July 2016) and keeps you getting automatic updates for the older version. – magicandre1981 May 21 '16 at 09:30
Windows 10 Pro version 1709 does not show a "Defer upgrades" option there. – jk7 Aug 05 '18 at 18:13

score 5 · Answer 5 · answered Jan 17 '19 at 20:35

The state of Windows Update - beginning 2019

Microsoft has been taking great pains to make Windows Update inevitable, which is why the traditional methods don't work anymore, or only work for a limited time.

Microsoft has been adding system services that cannot be disabled whose purpose is to update Windows. Chief among these is the Update Orchestrator Service, tasked with downloading, installing and verifying the updates. If stopped, the computer can no longer download and install the updates, which is why it can only be disabled for the current session, and will be re-enabled on the next reboot.

The service that is charged with making Windows Update unstoppable is the new Windows Update Medic Service, tasked with keeping Windows Update functioning. It is this service that undoes all the traditional methods for blocking Windows Update, so that periodically and unexpectedly one will find out that the Windows Update settings have been reset to their original values and that Windows has gone back to forcing updates upon the user.

The Windows Update Medic Service itself cannot be disabled at all. Any attempt to do so will end with the message of "Access is Denied".

Nevertheless, there exists a third-party product that can totally block Windows Update: Windows Update Blocker. This free product is portable and can disable/enable Windows Update with one click. In fact, it can also block any other unblockable Windows service. It is reported as still working in 2018.

Using a third-party product may in the long run be surer than relying upon Windows semi-documented features which may change without notice. Some more free products may be found in this answer of mine, which use the Windows API that allows any program to veto an impending shutdown.

AveYo · Answer 6 · 2018-05-13T22:42:31.170

Massive rework of previous batch files toggle suite into single script with best practices blocking!
Watch it in action

Desktop right-click context menu dynamic UI with toggles for everything!
Toggle all blocks on/off, Renew (from pastebin) or uninstall script options

Hide / Unhide / Install update lists with counter!
Lists are automatically updated whenever Windows would nag you via MusNotification!

Independently block Build upgrades, Automatic Installs, Downloads, Service
IFEO safe blocking with no destructive changes of ownership, deleting files or removing tasks

Focus set on Defender updates working independently
Toggling off windows mayhem automatic updates will not sacrifice built-in protection layer,
unlike any other -DIY- updates "management"

windows_update_toggle.bat

@set @version=10.0 /* &title Windows Update Toggle
@echo off &set "verbose="
echo.
echo      ---------------------------------------------------------------------
echo     :                  Windows Update Toggle v10.0 final                  :
echo     :---------------------------------------------------------------------:
echo     :      Block/Enable Upgrades, Installs, Downloads(!), Service(!)      :
echo     :         Disable/Enable Reporting, Speech, SearchUI, Defender        :
echo     :        Hide/Unhide/Apply update lists with count and max size       :
echo     :       Preset for Defender updates and Store downloads working       :
echo     :                                                                     :
echo     :     Toggle from the comfort of Desktop right-click context menu     :
echo      ---------------------------------------------------------------------
echo.
:: AveYo, 2018-05-13

if %1.==. timeout /t 10 &call wscript /e:JScript "%~f0" runas setup &exit/b &rem : no arguments, run setup elevated
if %1.==shift. shift &shift &rem : if loaded by WScript, shift args to prevent loop and restore %0
if %1.==. echo ERROR! &timeout /t 5 &exit/b : must have at least one arg

:: Setup executable blocking via ifeo
set notifier=EOSNotify MusNotification
set upgrader=Windows10UpgraderApp Windows10Upgrade WindowsUpdateBox SetupHost setupprep
set installer=wuauclt
set reporter=wermgr wsqmcons DiagTrackRunner DiagnosticsHub.StandardCollector.Service CompatTelRunner
set speecher=SpeechRuntime SpeechModelDownload
set searcher=SearchUI

set "exe=%notifier% %upgrader% %installer% %reporter%"
set "noop=%SystemRoot%\system32\systray.exe"
set "ifeo=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
set "menu=HKCR\DesktopBackground\shell\WUT"
set "f0=%SystemRoot%\windows_update_toggle.bat"
set "task=wscript.exe /e:JScript \"%f0%\" schtasks WUT"
set "DefMUS={MicrosoftUpdateServer|MMPC|InternalDefinitionUpdateServer}"
set "DefMMPC={MMPC|MicrosoftUpdateServer|InternalDefinitionUpdateServer}"
set ".=>nul 2>nul"
for /f "tokens=2 delims=1234567890" %%# in ('shutdown /?^|findstr /bc:"E"') do set "[T]=%%#" &rem : cosmetic usage in menus
if defined verbose (echo on &set ".=" &set "window=") else set "window=hide"
call :%~1 %2 %3 %4 %5 %6 %7 %8 %9 &rem : launch secondary functions below dinamically, passing next args
echo.
echo Done! Use the Desktop right-click context menu to toggle, renew or uninstall
if "%~1"=="setup" (pause) else if defined verbose timeout /t 5
exit/b : End of main script, functions below

:refresh context menu
echo %0 %*
call :reg_query "HKLM\SOFTWARE\WUT.bat" NoBlock noblock
if "%noblock%"=="Enable" exit/b
call :reg_query "%menu%0pending" MUIVerb pending
if defined pending exit/b
for %%# in ("1hide" "2unhide" "3apply") do reg delete "%menu%%%~#" /f %.%
reg add "%menu%0pending" /v MUIVerb /d "Pending.." /f %.%
reg add "%menu%0pending" /v SubCommands /d "" /f %.%
call :reg_query "HKLM\SOFTWARE\WUT.bat" NoRefresh norefresh
if "%norefresh%"=="Disable" start "WUT" wscript /e:JScript "%f0%" WUTRefresh
call :status SetupHost
reg add "%menu%\shell\3Upgrades"   /v MUIVerb /d "Upgrades %[T]% [setuphost]    %toggle%" /f %.%
reg add "%menu%\shell\3Upgrades\command" /ve /d "%task%\upgrades" /f %.%
call :status wuauclt
reg add "%menu%\shell\4Installs"   /v MUIVerb /d "Installs %[T]% [wuauclt]    %toggle%" /f %.%
reg add "%menu%\shell\4Installs\command" /ve /d "%task%\installs" /f %.%
for /f "tokens=3" %%# in ('sc qc TrustedInstaller ^| find /I "WUTblocked"') do set "blocked=%%#"
if /i "%blocked%"=="[WUTblocked]" (set "toggle=blocked") else set "toggle=enabled"
reg add "%menu%\shell\5Downloads"  /v MUIVerb /d "Downloads ( ! ) %[T]% [trustedinstaller]    %toggle%" /f %.%
reg add "%menu%\shell\5Downloads\command" /ve /d "%task%\downloads" /f %.%
for /f "tokens=3" %%# in ('sc qc wuauserv ^| find /I "WUTblocked"') do set "blocked=%%#"
if /i "%blocked%"=="rpcss[WUTblocked]" (set "toggle=blocked") else set "toggle=enabled"
reg add "%menu%\shell\6Service"    /v MUIVerb /d "Service ( ! ) %[T]% [wuauserv]    %toggle%" /f %.%
reg add "%menu%\shell\6Service\command" /ve /d "%task%\service" /f %.%
call :status wermgr
reg add "%menu%\shell\81Report"    /v MUIVerb /d "Report    %[T]% %toggle%" /f %.%
reg add "%menu%\shell\81Report\command" /ve /d "%task%\report" /f %.%
call :status SpeechRuntime
reg add "%menu%\shell\82Speech"    /v MUIVerb /d "Speech    %[T]% %toggle%" /f %.%
reg add "%menu%\shell\82Speech\command" /ve /d "%task%\speech" /f %.%
call :status SearchUI
reg add "%menu%\shell\83Search"    /v MUIVerb /d "SearchUI  %[T]% %toggle%" /f %.%
reg add "%menu%\shell\83Search\command" /ve /d "%task%\search" /f %.%
set "defstatus=if((Get-MpPreference).DisableRealtimeMonitoring){write-host stopped}else{write-host enabled}"
for /f "delims=" %%# in ('call powershell.exe -c "%defstatus%;"') do set "toggle=%%#"
reg add "%menu%\shell\84Defender"  /v MUIVerb /d "Defender  %[T]% %toggle%" /f %.%
reg add "%menu%\shell\84Defender\command" /ve /d "%task%\defender" /f %.%
if "%norefresh%"=="Enable" reg delete "%menu%0pending" /f %.%
exit/b

:toggle WUT
echo %0 %*
call :reg_query "HKLM\SOFTWARE\WUT.bat" NoBlock noblock
if "%noblock%"=="Disable" (set "toggle=Enable") else set "toggle=Disable"
for %%# in (NoBlock NoRefresh) do reg add "HKLM\SOFTWARE\WUT.bat" /v %%# /d "%toggle%" /f %.%
:: Generate WUT main context menu
for %%# in ("" "0pending" "1hide" "2unhide" "3apply") do reg delete "%menu%%%~#" /f %.%
reg add "%menu%" /v MUIVerb /d "Windows Update Toggle" /f %.%
reg add "%menu%" /v Icon /d "appwiz.cpl,5" /f %.%
reg add "%menu%" /v SubCommands /d "" /f %.%
reg add "%menu%\shell\9Setup" /v MUIVerb /d "windows_update_toggle.bat v10.0" /f %.%
reg add "%menu%\shell\9Setup" /v SubCommands /d "" /f %.%
reg add "%menu%\shell\9Setup\shell\1Toggle" /v MUIVerb /d "%toggle%" /f %.%
reg add "%menu%\shell\9Setup\shell\2Renew"  /v MUIVerb /d "Renew" /f %.%
reg add "%menu%\shell\9Setup\shell\3Remove" /v MUIVerb /d "Remove" /f %.%
reg add "%menu%\shell\9Setup\shell\1Toggle\command" /ve /d "%task%\toggle" /f %.%
reg add "%menu%\shell\9Setup\shell\2Renew\command"  /ve /d "%task%\renew" /f %.%
reg add "%menu%\shell\9Setup\shell\3Remove\command" /ve /d "%task%\remove" /f %.%
if "%toggle%"=="Disable" (
 reg add "%menu%\shell\1Refresh" /v MUIVerb /d "Refresh" /f %.%
 reg add "%menu%\shell\1Refresh\command" /ve /d "%task%\refresh" /f %.%
 reg add "%menu%\shell\2Lists" /v MUIVerb /d "Hide / Unhide / Apply %[T]% enabled" /f %.%
 reg add "%menu%\shell\2Lists\command" /ve /d "%task%\lists" /f %.%
 reg add "%menu%\shell\7Repair"     /v MUIVerb /d "Troubleshooter" /f %.%
 reg add "%menu%\shell\7Repair\command" /ve /d "%task%\repair" /f %.%
)
:: Disabling automatic updates hinders Defender, so get definitions from MMPC first
if "%toggle%"=="Enable" ( set "DefSig=%DefMUS%" ) else set "DefSig=%DefMMPC%"
start "WUT:MpPref" wscript /e:JScript "%~f0" cmd "powershell.exe -c `Set-MpPreference -SignatureFallbackOrder %DefSig%;`"
:: Default services
sc config wuauserv type= share depend= rpcss %.%
sc config TrustedInstaller type= own depend= / %.%
:: Toggle ifeo exe blocking
for %%# in (%exe% %speech% %search%) do reg delete "%ifeo%\%%#.exe" /f %.%
if "%toggle%"=="Enable" exit/b WUT disabled, so skip the code below
for %%# in (%exe%) do reg add "%ifeo%\%%#.exe" /v Debugger /d "%noop%" /f %.% &taskkill /im "%%#.exe" /t /f %.%
:: WUTRefresh hijacking
for %%# in (MusNotification EOSNotify) do reg add "%ifeo%\%%#.exe" /v Debugger /d "%SystemRoot%\WUTRefresh.bat" /f %.%
call :refresh menu
exit/b

:hide update
echo %0 %*
call :reg_query "%menu%1hide\shell\%~1" MUIVerb updatefound
echo -%updatefound%
if not defined updatefound exit/b
call wscript /e:JScript "%f0%" hide "%updatefound%"
exit/b

:unhide update
echo %0 %*
call :reg_query "%menu%2unhide\shell\%~1" MUIVerb updatefound
echo -%updatefound%
if not defined updatefound exit/b
call wscript /e:JScript "%f0%" unhide "%updatefound%"
exit/b

:apply update
echo %0 %*
call :reg_query "%menu%3apply\shell\%~1" MUIVerb updatefound
echo -%updatefound%
if not defined updatefound exit/b
:: Temporarily unblock downloads and installs
call :reg_query "%ifeo%\wuauclt.exe" Debugger installs_blocked
for /f "tokens=3" %%# in ('sc qc TrustedInstaller ^| find /I "WUTblocked"') do set "downloads_blocked=%%#"
call wscript /e:JScript "%f0%" apply "%updatefound%"
:: Restore block
if defined installs_blocked reg add "%ifeo%\wuauclt.exe" /v Debugger /d "%noop%" /f %.% &taskkill /im "wuauclt.exe" /t /f %.%
if defined downloads_blocked sc config TrustedInstaller type= own depend= [WUTblocked] %.%
exit/b

:lists
echo %0 %*
call :reg_query "HKLM\SOFTWARE\WUT.bat" NoRefresh norefresh
if "%norefresh%"=="Disable" ( set "norefresh=Enable" &set "toggle=disabled") else set "norefresh=Disable" &set "toggle=enabled"
reg add "HKLM\SOFTWARE\WUT.bat" /v NoRefresh /d "%norefresh%" /f %.%
reg add "%menu%\shell\2Lists" /v MUIVerb /d "Hide / Unhide / Apply %[T]% %toggle%" /f %.%
reg add "%menu%\shell\1Refresh" /v MUIVerb /d "Refresh" /f %.%
reg add "%menu%\shell\1Refresh\command" /ve /d "%task%\refresh" /f %.%
if "%norefresh%"=="Enable" (
 reg delete "%menu%0pending" /f %.% &reg delete "%menu%1hide" /f %.% &reg delete "%menu%2unhide" /f %.%
 reg delete "%menu%3apply" /f %.% &reg delete "%menu%\shell\1Refresh" /f %.%
)
call :refresh lists
exit/b

:upgrades
echo %0 %*
call :flip SetupHost
reg add "%menu%\shell\3Upgrades"   /v MUIVerb /d "Upgrades %[T]% [setuphost]    %toggle%" /f %.%
for %%# in (%upgrader%) do if defined block (
 reg delete "%ifeo%\%%#.exe" /f %.%
) else (
 reg add "%ifeo%\%%#.exe" /v Debugger /d "%noop%" /f %.% &taskkill /im "%%#.exe" /t /f %.%
)
exit/b

:installs
echo %0 %*
call :flip wuauclt
reg add "%menu%\shell\4Installs"   /v MUIVerb /d "Installs %[T]% [wuauclt]    %toggle%" /f %.%
for %%# in (%installer%) do if defined block (
 do reg delete "%ifeo%\%%#.exe" /f %.% &start "wt" wscript /e:JScript "%f0%" WUTRefresh
) else (
 reg add "%ifeo%\%%#.exe" /v Debugger /d "%SystemRoot%\WUTRefresh.bat" /f %.% &taskkill /im "%%#.exe" /t /f %.%
)
exit/b

:downloads
echo %0 %*
call :reg_query "%menu%3apply" MUIVerb pending
set "reboot=%pending:reboot=%"
if defined pending if "%pending%"=="%reboot%" set "pending="
if defined pending (
 sc config TrustedInstaller type= own depend= / %.%
 reg add "%menu%\shell\5Downloads" /v MUIVerb /d "Downloads ( ! ) %[T]% [trustedinstaller]    reboot?" /f %.%
 exit/b
)
for /f "tokens=3" %%# in ('sc qc TrustedInstaller ^| find /I "WUTblocked"') do set "blocked=%%#"
if /i "%blocked%"=="[WUTblocked]" (set "blocked=/") else set "blocked=[WUTblocked]"
net stop TrustedInstaller /y %.%
for /f "tokens=3" %%# in ('sc queryex TrustedInstaller ^| find /i "PID"') do set "pid=%#"
if not "%pid%"=="0" taskkill /pid %pid% /f %.%
sc config TrustedInstaller type= own depend= %blocked% %.%
tasklist /svc | find /i "TrustedInstaller" %.%
if errorlevel 1 net start TrustedInstaller /y %.%
if errorlevel 1 (set "toggle=blocked") else set "toggle=enabled"
reg add "%menu%\shell\5Downloads" /v MUIVerb /d "Downloads ( ! ) %[T]% [trustedinstaller]    %toggle%" /f %.%
if "%toggle%"=="enabled" start "WUT" wscript /e:JScript "%f0%" WUTRefresh
exit/b

:service
echo %0 %*
for /f "tokens=3" %%# in ('sc qc wuauserv ^| find /I "WUTblocked"') do set "blocked=%%#"
if /i "%blocked%"=="rpcss[WUTblocked]" (set "blocked=rpcss") else set "blocked=rpcss[WUTblocked]"
net stop wuauserv /y %.%
for /f "tokens=3" %%# in ('sc queryex wuauserv ^| find /i "PID"') do set "pid=%#"
if not "%pid%"=="0" taskkill /pid %pid% /f %.%
sc config wuauserv type= share depend= %blocked% %.%
tasklist /svc | find /i "wuauserv" %.%
if errorlevel 1 net start wuauserv /y %.%
if errorlevel 1 (set "toggle=blocked") else set "toggle=enabled"
reg add "%menu%\shell\6Service" /v MUIVerb /d "Service ( ! ) %[T]% [wuauserv]    %toggle%" /f %.%
if "%toggle%"=="enabled" start "WUT" wscript /e:JScript "%f0%" WUTRefresh
exit/b

:repair
echo %0 %*
:: Restore services (undo only the changes made by this script, not whatever blocking was done by other means)
sc config wuauserv type= share depend= rpcss %.%
sc config TrustedInstaller type= own depend= / %.%
:: Remove any IFEO blocking done by past scripts
set eo=DiagnosticsHub.StandardCollector.Service WindowsUpdateElevatedInstaller LocationNotificationWindows InstallAgentUserBroker
set eo=%eo% UpdateNotificationMgr DataUsageLiveTileTask Windows10UpgraderApp WindowsActionDialog SpeechModelDownload WerFaultSecure
set eo=%eo% GetCurrentRollback WindowsUpdateBox Windows10Upgrade TrustedInstaller MusNotification DiagTrackRunner CompatTelRunner
set eo=%eo% WinREBootApp64 WinREBootApp32 UNPUXLauncher SpeechRuntime MusNotifyIcon PilotshubApp InstallAgent dstokenclean wsqmcons
set eo=%eo% disksnapshot osrssupdate wuapihost WaaSMedic UsoClient UNPUXHost SIHClient setupprep SetupHost osrssinst EOSNotify wusa
set eo=%eo% WerFault TiWorker SearchUI DWTRIG20 dusmtask dmclient appidtel wuauclt wermgr DFDWiz remsh reach HxTsr DWWIN DW20 GWX
for %%# in (%eo%) do reg delete "%ifeo%\%%#.exe" /f %.%
:: Restore notification hijacking
>"%SystemRoot%\WUTRefresh.bat" echo/@start "WUTRefresh" /min wscript.exe /e:JScript "%f0%" WUTRefresh
for %%# in (MusNotification EOSNotify) do reg add "%ifeo%\%%#.exe" /v Debugger /d "%SystemRoot%\WUTRefresh.bat" /f %.%
:: Remove pending instance safeguard
reg delete "HKLM\SOFTWARE\WUT.bat" /v Pending /f %.%
:: Refresh menu
call :refresh repair
:: Open Update Diagnostic
start "wud" msdt.exe /id WindowsUpdateDiagnostic %.%
:: Open official update troubleshooter page
start https://support.microsoft.com/en-us/help/4027322/windows-update-troubleshooter %.%
exit/b

:report
echo %0 %*
call :flip wermgr
reg add "%menu%\shell\81Report"    /v MUIVerb /d "Report    %[T]% %toggle%" /f %.%
for %%# in (%reporter%) do if defined block ( reg delete "%ifeo%\%%#.exe" /f %.% ) else (
 reg add "%ifeo%\%%#.exe" /v Debugger /d "%noop%" /f %.% &taskkill /im "%%#.exe" /t /f %.%
)
exit/b

:speech
echo %0 %*
call :flip SpeechRuntime
reg add "%menu%\shell\82Speech"    /v MUIVerb /d "Speech    %[T]% %toggle%" /f %.%
for %%# in (%speecher%) do if defined block ( reg delete "%ifeo%\%%#.exe" /f %.% ) else (
 reg add "%ifeo%\%%#.exe" /v Debugger /d "%noop%" /f %.% &taskkill /im "%%#.exe" /t /f %.%
)
exit/b

:search
echo %0 %*
call :flip SearchUI
reg add "%menu%\shell\83Search"    /v MUIVerb /d "SearchUI  %[T]% %toggle%" /f %.%
for %%# in (%searcher%) do if defined block ( reg delete "%ifeo%\%%#.exe" /f %.% ) else (
 reg add "%ifeo%\%%#.exe" /v Debugger /d "%noop%" /f %.% &taskkill /im "%%#.exe" /t /f %.%
)
exit/b

:defender
echo %0 %*
set "s10=$t=1;$toggle='stopped'; if((Get-MpPreference).DisableRealtimeMonitoring){$t=0;$toggle='enabled';}"
set "s11=Set-MpPreference -DisableRealtimeMonitoring $t"
set "s12=Set-MpPreference -DisableBehaviorMonitoring $t"
set "s13=Set-MpPreference -DisableIOAVProtection $t"
set "s14=write-host $toggle"
for /f "delims=" %%# in ('call powershell.exe -c "%s10%;%s11%;%s12%;%s13%;%s14%;"') do set "toggle=%%#"
reg add "%menu%\shell\84Defender"  /v MUIVerb /d "Defender  %[T]% %toggle%" /f %.%
exit/b

:update_defender - triggered from WScript to get definitions from MMPC, regardless of updates being blocked
tasklist /FI "IMAGENAME eq MpCmdRun.exe" | find ".exe" %.%
if not errorlevel 1 exit/b
pushd %ProgramFiles%\Windows Defender
call MpCmdRun.exe -removedefinitions -dynamicsignatures
call MpCmdRun.exe -SignatureUpdate -MMPC
exit/b

:setup
echo %0 %*
pushd %SystemRoot%
if /i "%~f0"=="%f0%" (set "initial_setup=") else copy /y "%~f0" "%f0%" %.%
:: Create WUTUndo for emergencies
 >WUTUndo.bat echo/pushd %%~dp0system32\config
>>WUTUndo.bat echo/reg load HKLM\WUTUndo1 SOFTWARE
>>WUTUndo.bat echo/set "koff=HKLM\WUTUndo1\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" ^&set "kon=%ifeo%"
>>WUTUndo.bat echo/for %%%%B in (%exe%) do for %%%%K in ("%%koff%%" "%%kon%%") do reg delete "%%%%~K\%%%%B.exe" /f 2^>nul
>>WUTUndo.bat echo/reg unload HKLM\WUTUndo1
>>WUTUndo.bat echo/reg load HKLM\WUTUndo2 SYSTEM
>>WUTUndo.bat echo/for %%%%K in (WUTUndo2 SYSTEM) do (
>>WUTUndo.bat echo/ reg delete "HKLM\%%%%~K\ControlSet001\Services\TrustedInstaller" /v DependOnService /f 2^>nul
>>WUTUndo.bat echo/ reg delete "HKLM\%%%%~K\CurrentControlSet\Services\TrustedInstaller" /v DependOnService /f 2^>nul
>>WUTUndo.bat echo/)
>>WUTUndo.bat echo/reg unload HKLM\WUTUndo2
:: Create WUTRefresh to hijack update notifications and refresh context menu in addition to preventing forced reboots
>WUTRefresh.bat echo/@start "WUTRefresh" /min wscript.exe /e:JScript "%f0%" WUTRefresh
:: Create tasks to run context menu entries with proper access and no output window
start "WUT" wscript /e:JScript "%~f0" cmd "call `%~f0` setup_schtasks"
:: WUT options
for %%# in (NoBlock NoRefresh) do reg add "HKLM\SOFTWARE\WUT.bat" /v %%# /d "Enable" /f %.%
call :toggle blocking
exit/b

:setup_schtasks - no stalling separate process
set "strun=wscript.exe /e:JScript \"%f0%\" run%window%"
for %%t in (refresh lists upgrades installs downloads service repair report speech search defender toggle renew remove) do (
 schtasks /create /ru "%username%" /sc once /tn "WUT\%%t" /tr "%strun% %%t" /st "00:00:00" /it /rl highest /f %.%
)
for %%t in (hide unhide apply) do for /l %%n in (101,1,116) do (
 schtasks /create /ru "%username%" /sc once /tn "WUT\%%t\%%n" /tr "%strun% %%t %%n" /st "00:00:00" /it /rl highest /f %.%
)
exit/b

:renew
echo %0 %*
echo Renewing from internet - old version saved as %SystemRoot%\WUT.old
pushd %SystemRoot%
if exist WUT.new del /f /q WUT.new %.%
call wscript /e:JScript "%~f0" renew "https://pastebin.com/raw/gNsLEWJe" "%SystemRoot%\WUT.new"
if exist WUT.new copy /y "%f0%" WUT.old %.% &copy /y WUT.new "%f0%" %.% &del /f /q WUT.new %.%
start "WUT" "%f0%" setup renew %.%
exit/b

:remove
echo %0 %*
for %%# in (NoBlock NoRefresh) do reg add "HKLM\SOFTWARE\WUT.bat" /v %%# /d "Disable" /f %.%
call :toggle off
reg delete "HKLM\SOFTWARE\WUT.bat" /f %.%
for %%# in ("" "0pending" "1hide" "2unhide" "3apply") do reg delete "%menu%%%~#" /f %.%
for %%t in (refresh lists upgrades installs downloads service repair report speech search defender toggle renew remove) do (
 schtasks /delete /tn "WUT\%%t" /f %.%
)
for %%t in (hide unhide apply) do for /l %%n in (101,1,116) do schtasks /delete /tn "WUT\%%t\%%n" /f %.%
for %%t in (hide unhide apply) do schtasks /delete /tn "WUT\%%t" /f %.%
schtasks /delete /tn "WUT" /f %.%
sc config wuauserv type= share depend= rpcss %.%
sc config TrustedInstaller type= own depend= / %.%
pushd %SystemRoot%
del /f /q WUT.bat WUT.old DefenderManualUpdate.bat WUTRefresh.bat WUTUndo.bat "%f0%" %.%
exit/b

:flip %1:exe
call :reg_query "%ifeo%\%~1.exe" Debugger block
if defined block (set "toggle=enabled") else set "toggle=blocked"
exit/b

:status %1:exe
call :reg_query "%ifeo%\%~1.exe" Debugger block
if defined block (set "toggle=blocked") else set "toggle=enabled"
exit/b

:reg_query %1:KeyName %2:ValueName %3:OutputVariable %4:other_options[example: "/t REG_DWORD"]
setlocal & for /f "skip=2 delims=" %%s in ('reg query "%~1" /v "%~2" /z 2^>nul') do set "rq=%%s" & call set "rv=%%rq:*)    =%%"
endlocal & set "%~3=%rv%" & exit/b &rem                                         AveYo: call :reg_query "HKCU\MyKey" "MyValue" MyVar

::---------------------------------------------------------------------------------------------------------------------------------
:JScript_functions                                                                 AveYo: Switch syntax highlighter to 'javascript'
::-------------------------------------------------------------------------------------------------------------------------------*/
f0=WSH.ScriptFullName; run=WSH.Arguments(0); args=''; for(i=1;i<WSH.Arguments.length;i++) args+=' "'+WSH.Arguments(i)+'"';
function sex(exe,args){WSH.CreateObject('Shell.Application').ShellExecute(exe,args,'','',0);}; function reg(s){ sex('reg.exe',s); }

// Open external commands in new hidden cmd instance - backquotes replaced to quotes
if (run=='cmd') sex('cmd','/c '+args.replace(/`/g,'"'));

// Context menu entries trigger - elevated with no popups
if (run=='schtasks') sex('SCHTASKS.EXE','/Run /TN '+args);

// Shift to CMD if loaded by WScript - pass arguments, prevent loop, run as admin at setup, hide window at context-menu
function cmd(adm,win){WSH.CreateObject('Shell.Application').ShellExecute('cmd','/c call "'+f0+'" shift "'+f0+'"'+args,'',adm,win);}
if (run=='run') cmd('',1); if (run=='runhide') cmd('',0); if (run=='runas') cmd('runas',1); if (run=='runashide') cmd('runas',0);

if (run=='renew') {
  // renew script over internet
  try{
  downloader=WSH.CreateObject("WinHttp.WinHttpRequest.5.1");
  if (downloader===null) downloader=WSH.CreateObject("WinHttp.WinHttpRequest");
  if (downloader===null) downloader=WSH.CreateObject("MSXML2.ServerXMLHTTP");
  if (downloader===null) downloader=WSH.CreateObject("Microsoft.XMLHTTP");
  downloader.Open("GET",WSH.Arguments(1),false); downloader.Send(); oASI=downloader.ResponseBody(); downloader=undefined;
  oASO=WSH.CreateObject("ADODB.Stream"); oASO.type=1; oASO.Mode=3; oASO.Open; oASO.Write(oASI); oASI=undefined;
  oASO.SaveToFile(WSH.Arguments(2)); oASO.Close();
  }catch(e){} // supress all errors since we're working with com objects
}

// WUT Hide/Unhide/Apply lists
if (run=='WUTRefresh' || run=='hide' || run=='unhide' || run=='apply') {
  SRP=GetObject("winmgmts:StdRegProv"); pending=SRP.GetStringValue(2147483650,'SOFTWARE\\WUT.bat','Pending');
  if (pending===0) WSH.quit(); else SRP.SetStringValue(2147483650,'SOFTWARE\\WUT.bat','Pending','yes'); // prevent instances
  k='HKCR\\DesktopBackground\\shell\\WUT'; hk=k+'1hide'; uk=k+'2unhide'; ik=k+'3apply'; pk=k+'0pending';           // set list keys
  reg('delete "'+hk+'" /f'); reg('delete "'+uk+'" /f'); reg('delete "'+ik+'" /f');                               // delete previous
  reg('add "'+pk+'" /v MUIVerb /d "Pending.." /f'); reg('add "'+pk+'" /v SubCommands /d "" /f');             // add Pending.. entry
  // Check for updates
  count=0; wuthide=[]; wutunhide=[];
  try{
  session=WSH.CreateObject("Microsoft.Update.Session"); reboot=WSH.CreateObject("Microsoft.Update.SystemInfo").RebootRequired;
  searcher=session.CreateUpdateSearcher();
  sresult=searcher.Search("IsInstalled=0"); Updatelist=sresult.Updates; count=sresult.Updates.Count;
  for(i=0;i<count;i++) {
    itemTitle=Updatelist.Item(i).Title;
    minsize=Updatelist.Item(i).MinDownloadSize; maxsize=Updatelist.Item(i).MaxDownloadSize; wutsize='';
    if (maxsize > 1073741824) wutsize=' ['+Math.round(minsize/10737418.24)/100+' - '+Math.round(maxsize/10737418.24)/100+'GB]';
    else if (maxsize > 1048576) wutsize=' ['+Math.round(minsize/10485.76)/100+' - '+Math.round(maxsize/10485.76)/100+'MB]';
    else if (maxsize > 1024) wutsize=' ['+Math.round(minsize/10.24)/100+' - '+Math.round(maxsize/10.24)/100+'KB]';
    else if (maxsize > 0) wutsize=' ['+(minsize)+' - '+(maxsize)+'B]';
    wutTitle=Updatelist.Item(i).Title + wutsize;
    if (run=='apply' && WSH.Arguments(1).indexOf(itemTitle) > -1) {
      // Add matching entry to UpdateColl
      UpdateColl=WSH.CreateObject("Microsoft.Update.UpdateColl"); UpdateColl.Add(Updatelist.Item(i));
      // Download update
      downloader=session.CreateUpdateDownloader(); downloader.Updates=UpdateColl; dresult=downloader.Download();
      if (dresult.ResultCode==2) {
        // Unblock apply
        sex('sc','config TrustedInstaller type= own depend= /');
        KeyPath='SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wuauclt.exe';
        SRP.DeleteKey(2147483650,KeyPath);
        WSH.Sleep(1000);
        //Apply update
        installer=session.CreateUpdateInstaller(); installer.Updates=UpdateColl; iresult=installer.Install();
        if (iresult.ResultCode==2) continue;
      }
    }
    // hide and unhide are very simple bool flip compared to apply
    if (run=='hide' && WSH.Arguments(1).indexOf(itemTitle) > -1) {
      Updatelist.Item(i).IsHidden=true; wutunhide.push(wutTitle); continue;
    }
    if (run=='unhide' && WSH.Arguments(1).indexOf(itemTitle) > -1) {
      Updatelist.Item(i).IsHidden=false; wuthide.push(wutTitle); continue;
    }
    // Trigger :update_defender to manually refresh definitions from MMPC
    if (Updatelist.Item(i).IsHidden===false && itemTitle.indexOf('(Definition') > -1) {
      sex('cmd','/c call "'+f0+'" update_defender');
    }
    // Sorting lists
    if (Updatelist.Item(i).IsHidden) wutunhide.push(wutTitle); else wuthide.push(wutTitle);
  }
  // Generate Hide context menu
  if (wuthide.length>0){
    for(i=101,n=wuthide.length+101;i<n;i++) {
      reg('add "'+hk+'\\shell\\'+i+'" /v MUIVerb /d "'+wuthide[i-101]+'" /f');
      reg('add "'+hk+'\\shell\\'+i+'\\command" /ve /d "wscript.exe /e:JScript \\"'+f0+'\\" schtasks WUT\\hide\\'+i+'" /f');
    }
    reg('add "'+hk+'" /v SubCommands /d "" /f');
    reg('add "'+hk+'" /v MUIVerb /d "Hide '+"\t"+wuthide.length+'" /f');
  }
  // Generate Unhide context menu
  if (wutunhide.length>0){
    for(i=101,n=wutunhide.length+101;i<n;i++) {
      reg('add "'+uk+'\\shell\\'+i+'" /v MUIVerb /d "'+wutunhide[i-101]+'" /f');
      reg('add "'+uk+'\\shell\\'+i+'\\command" /ve /d "wscript.exe /e:JScript \\"'+f0+'\\" schtasks WUT\\unhide\\'+i+'" /f');
    }
    reg('add "'+uk+'" /v SubCommands /d "" /f');
    reg('add "'+uk+'" /v MUIVerb /d "Unhide '+"\t"+wutunhide.length+'" /f');
  }
  // Generate Apply context menu
  if (wuthide.length>0){
    for(i=101,n=wuthide.length+101;i<n;i++) {
      reg('add "'+ik+'\\shell\\'+i+'" /v MUIVerb /d "'+wuthide[i-101]+'" /f');
      reg('add "'+ik+'\\shell\\'+i+'\\command" /ve /d "wscript.exe /e:JScript \\"'+f0+'\\" schtasks WUT\\apply\\'+i+'" /f');
    }
    reg('add "'+ik+'" /v SubCommands /d "" /f');
    reg('add "'+ik+'" /v MUIVerb /d "Apply '+"\t"+((reboot) ? 'must reboot' : wuthide.length)+'" /f');
  }
  }catch(e){} // supress all errors since we're working with com objects
  reg('delete "'+pk+'" /f'); SRP.DeleteValue(2147483650,'SOFTWARE\\WUT.bat','Pending'); // Remove Pending.. temporary entry
}
//

Last updated for v10.0 final. Up-to-date code on pastebin link above.

Any chance you could tell me how you got your windows menus to have a black background?! — wayofthefuture, May 31 '18 at 21:18
That's a high-contrast-based theme, available here: https://pastebin.com/fA3t5Sd2 — AveYo, Jun 03 '18 at 08:00

Jackary Smith · Answer 7 · 2018-10-13T19:49:07.320

Finally found a permanent fix that just works

After trying literally every trick in the book, I have always been bested by Windows Update. I've tried every solution here plus tons of other sources, and Windows constantly found ways to thwart my plans.

Until about 6 months ago...

I have found a permanent solution for disabling ALL windows updates FOREVER regardless of whether the service or anything else is running. I have figured out this method with the help of many different sources that had to do with many different things. Overall, I found this method myself with the use of bits and pieces of other information used to do things that were not all related to this, but it works. And it works absolutely beautifully.

Install Acrylic DNS Proxy from here

It is basically a souped up version of the windows hosts file that allows you to add functions like wildcards, which is necessary in our case because of the many sources windows gets its updates from.

Follow the instructions here to make Acrylic start doing its job in Win 10. Pretty simple stuff.
Go to your start menu, and click "Edit Acrylic Hosts File" under All Programs, shown here
Add these lines to the bottom of the hosts file, with no # signs in front.

0.0.0.0 windowsupdate.microsoft.com
0.0.0.0 *.windowsupdate.microsoft.com
0.0.0.0 *.update.microsoft.com
0.0.0.0 windowsupdate.com
0.0.0.0 *.windowsupdate.com
0.0.0.0 download.windowsupdate.com
0.0.0.0 download.microsoft.com
0.0.0.0 *.download.windowsupdate.com
0.0.0.0 wustat.windows.com
0.0.0.0 ntservicepack.microsoft.com
0.0.0.0 stats.microsoft.com

Now the bottom of the file should look like this. Save and close the file.

Open task manager, go to services tab, click "Open Services" at the bottom, select Acrylic DNS Proxy and click this button with the red circle to restart the service.

FINISHED

Now your Acrylic buddy should have your back and constantly keep an keen eye on Microsoft's Big Brother tactics to make sure they can't force poor old you to install updates that mess up your PC completely which they have at least a fourth of the time they did it on both my home PC and my Surface Pro which is supposed to be the PC BUILT for Windows, right??? Cmon, Microsoft!

Check to make sure it's working by pinging any one of the websites in the code above. Open cmd and type

ping windowsupdate.microsoft.com

If these are your results, you will be golden from now on!!

Note: in my experience, this has not slowed my PC at all. It also does not reroute any Internet traffic besides requests to the sources Windows uses to update or check for updates, so very similar to the hosts file. It also uses basically the same format as the hosts file. This has also successfully disabled the reinstall of junk that windows keeps placing on my computer that gives that giant colored screen saying something like "you must update or your computer will implode". Obviously I don't remember what the warning said since it's been so long since I've gotten it (due to completely successful blocking 6 months or so ago), but it was the most annoying thing I've ever seen.

hahahaha. oh man. this answer is just. wow. smart. very smart. i just can't emphasize how good this answer is. millions of people come at the front door where there is hundreds of defenses. but this solution comes at the side where there are no defenses and building defenses would not really be possible because of the design of the internet. — Trevor Boyd Smith, Sep 18 '19 at 01:02
if you have a fancy router/gateway/home-networking-box with fancy DNS features... then you could IMO do something similar. — Trevor Boyd Smith, Sep 18 '19 at 01:02

score 2 · Answer 8 · edited Jun 20 '22 at 17:34

Disabling windows updates requires you to disable:

Windows Update (wuauserv)
Windows Update Medic Service (WaaSMedicSvc)
Update Orchestrator Service (UsoSvc)

And possibly this task:

schtasks /Change /TN "Microsoft\Windows\WindowsUpdate\Automatic App Update" /Disable

Things change with each version of Windows, but I think these should do. For changing the services' startup option to disabled, you need appropriate permissions in registry (you cannot do it manually through Services GUI). You can get the needed permissions with SetACL tool. Startup parameters for services in registry can be found in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The value for "disabled" is dword:4.

score 1 · Answer 9 · edited Jun 12 '20 at 13:48

1

Disable Update Service

Win+R > services.msc
Double click Windows Update and change the Startup Type to Disabled. To re-enable, go back to services and change it to automatic.

Source: How To Control Windows 10 Updates

edited Jun 12 '20 at 13:48

Community

1

answered Dec 04 '17 at 04:10

Ooker

1,781
2
19
45

score 1 · Answer 10 · answered Jul 21 '18 at 20:04

For my case, I want not only to control when Windows Updates go, but also to limit all installed applications from out of control on their online updates.

So my simple one stop solution is : 1. Bloc the internet access for the host on router side. None of programs or services installed on the host can access internet. Of-cause Windows Updates is blocked too.

Install a Squid Proxy Server on local network and give the proxy to those applications that you allow them to go internet. Do not set proxy on Control Panel | Internet Option, cause that is global OS wide proxy which voids the step 1 at all.

Most applications support per application based proxy setting, such as Chrome, Firefox, All kind of Games etc.

For those applications that don't support local proxy setting, use NAS cloud fold as Cloud Proxy. For example, Office 365 suits doesn't support per program proxy. You can then setup a NAS Cloud Sync (for example, Synology NAS has Cloud sync to sync OneDrive) to sync conents in a NAS fold, then you use that fold as Office 365's local fold. Extra benefits of this way is you get really fast response on big files, cause you are using local network speed to access OneDrive.

By doing these, your computer's internet accessing is greatly controlled by yourself, no one can mess you up.

Whenever you want update Windows, set Control Panel | Internet Option to use your local proxy, hence Windows can update your OS. After that, turn off the global proxy immediately to set your computer into a peace, quite world again.

Avatar · Answer 11 · 2017-09-15T08:48:51.643

0

2 years later and billions of unsaved works lost by the update mechanism of Microsoft, there is finally a major update that solves the problem.

Windows 10 Creators Update now available (Direct Download)

After installing the update the user will finally asked again (like those insignificant 20+ years before) if s/he wants the update to be applied:

Sometimes I wonder who is behind those decisions...

After the update you have more options regarding the update times. For stopping them, go to Windows Update Settings > Advanced Options > Pause Updates > ON.

Under Restart Options you also find a new option for update notifications:

edited Sep 15 '17 at 08:48

answered Jul 14 '17 at 06:50

Avatar

2,407
4
34
48

2

how does this answer the question? – magicandre1981 Jul 14 '17 at 15:31
"a way to stop auto updates" - This is one way to get rid of the forced auto updates. And for stopping them, go to Windows Update Settings > Advanced Options > Pause Updates > ON. I have added this to the answer. (You have even more options after the Windows Update.) – Avatar Jul 15 '17 at 05:57

score 0 · Answer 12 · answered Sep 18 '19 at 07:55

While I disabled update in Services and Group Policy Editor, it still turns back on from time to time. Then I have to manually turn them off in Services. Doing this via the GUI is troublesome, so I wrote a batch script. It stops and disables Background Intelligent Transfer Service and Windows Update.

@echo off

net stop wuauserv
net stop BITS

sc config wuauserv start= disabled
sc config BITS start= disabled

pause

I'm also using (not specifically for this) a light network monitor tool (Bandwidth Monitor), so I know when there's an activity (an icon at the system tray). If I see an activity when there shouldn't be any, I know Windows Update turned back on. Then I run the script and it's off.

score 0 · Answer 13 · answered Aug 07 '20 at 15:51

0

Here is solution for Windows 10 Home:

https://github.com/WereDev/Wu10Man

this is up to date (2020) open source program that can disable the Windows Update service.

answered Aug 07 '20 at 15:51

Zombo

1
21
116
156

score 0 · Answer 14 · answered Sep 05 '21 at 19:09

I believe I have found a solution to this issue. I am on Windows 10 Home Edition version 1909. The only thing that works is running the following Batch Script repeatedly via Task Scheduler:

sc stop "BITS"
sc config "BITS" start= disabled
sc config "BITS" obj= ".\Guest" password= ""
sc stop "UsoSvc"
sc config "UsoSvc" start= disabled
sc config "UsoSvc" obj= ".\Guest" password= ""
sc stop "wuauserv"
sc config "wuauserv" start= disabled
sc config "wuauserv" obj= ".\Guest" password= ""
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v START /t REG_DWORD /d 0x0000004 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v ObjectName /t REG_SZ /d .\Guest /f

Put the above in a .bat file and run it on Task Scheduler on a 5 minute schedule. This will repeatedly disable all processes Windows keeps enabling automatically (Background Intelligent Transfer Service, Update Orchestrator Service, Windows Update, and Windows Update Medic Service). It's necessary to keep these processes disabled for updates to be suppressed. Admittedly, this is not a nice solution but it gets the job done. I've been running this for over a year without any issues now.

Henke · Answer 15 · 2022-08-24T16:28:01.277

I. The Microsoft official way to stop all automatic updates

Press WinKey+i > Update & Security > Advanced options (in the right pane).

Under Pause updates, it says :
Temporarily pause updates from being installed on this device for up to 35 days. When you reach the pause limit, your device will need to get new updates before you can pause again.

One thing you could try – after 33 or 34 days – is to pause for another 35 days (without prior resuming of the updates) and see what happens. I haven't tried it myself, so I cannot tell if it works.

The reason I don't use the Microsoft official way to stop all automatic updates, is that I use my own unofficial way, which I will dedicate the rest of this answer to.

Disclaimer.
If you try any of the tips below, it's all at your own risk.

II. My method to permanently stop all automatic updates

My method: block the wuauserv and WaaSMedicSvc services by renaming them in the registry. ¹
This has served me well for many years. ²
It's the closest I can get to that on/off switch that Microsoft stubbornly refuses to give us.
For more details on how to do this, read on.

1. Precautionary actions. (Don't skip this – better safe than sorry!)

Before moving on, I strongly recommend saving a copy of the Windows Services registry settings.

Press WinKey+r, type (or paste) regedit and hit Enter.
In the navigation bar, paste HKLM\SYSTEM\CurrentControlSet\Services and press Enter.

Right-click Services and choose Export.
Make sure you save the backup .reg file in a safe place where you will remember how to find it – should you ever need it. Expect the file size to be just below 8 MB. ³

The most vulnerable registry key in this context is :
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
so it's a good idea to also export that key into its own .reg file. Remember where you keep it!

2. Block the `wuauserv` and `WaaSMedicSvc` services in the registry

Next scroll down to :
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv

Right-click wuauserv, click Rename and add the suffix -BLOCKED!! so that the key's new name becomes wuauserv-BLOCKED!!.

Likewise, rename HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc
to WaaSMedicSvc-BLOCKED!!.

Now press WinKey+i, click Update & Security, and then Check for updates. Expect to see an error as in the screenshot below.
Possible error numbers include 0x80070002, 0x80070424, 0x80080005, 0x80040154.

If you see this error, it confirms that you have successfully disabled Windows Update in the registry. The error was immediate when I tried this, but you may have to restart the computer for the change to take effect.

How to enable Windows Update again

When you later want to enable Windows Update again, just rename the registry key back to its original name wuauserv. (You shouldn't need to rename/unblock WaaSMedicSvc-BLOCKED!!.)

Before renaming back, you have to delete the wuauserv key if it exists.
Don't delete wuauserv-BLOCKED!! or WaaSMedicSvc-BLOCKED!! ⁴

After renaming back, you need to make a software restart (WinKey+x followed by u and r) to activate Windows Update again.

Note!
A hardware restart – just shutting down and then restarting by pressing the physical power button – will not start Windows Update.

3. Windows Update may display as if it works even when it doesn't

The surest way to know if Windows Update has suddenly started to run again (without your consent), is to go to Settings > Update & Security > Windows Update.
If you see an error, then Windows Update is still successfully blocked.

But even if you see a green checkmark as in the screenshot below, Windows Update might still be blocked. You could click Check for updates to see if there is an error or not. However, if there isn't an error, Windows Update will start to download any new updates and install them on the next restart.

This might not be what you want. To gain more control over what updates to install, run wushowhide.diagcab which allows you to prevent (hide) any updates that you don't want to download.

4. Optionally also block the `UsoSvc` registry key

If you take no further action, expect Windows to automatically and silently recreate the wuauserv and WaaSMedicSvc registry keys as shown in the screenshot below.

From my experience, this is not enough to make Windows Update run again.

Still, if you feel uncomfortable with the wuauserv and WaaSMedicSvc keys being recreated (I do), then you can prevent this by also blocking the UsoSvc registry key.
As with the other keys, just rename it toUsoSvc-BLOCKED!!.
As opposed to the other two keys, I have never seen the UsoSvc registry key get recreated.

If you do this, and then go to Settings > Update & Security > Windows Update, now expect to see : Something went wrong. Try to reopen Settings later.

5. Check the status in `services.msc`

To take a look in Windows Services, press WinKey+r, type services.msc (and hit Enter).
Sort by name, look for Windows Update and double-click that service.

If the Service name is wuauserv-BLOCKED!! (or you get an error), things are looking good.
Also check in a similar way that Windows Update Medic Service is blocked.

^{^ click to enlarge}

6. Don't run System File Check (`SFC`)

Don't run SFC unless you first restore Windows Update!
I once ran sfc /VERIFYONLY with the result that the Trusted Installer hijacked my laptop for about 45 minutes. (!) ⁶

7. Remember what you changed!

One day you may find yourself wanting to undo the changes you made here. To reset your computer to a normal state (one in which Windows Update functions normally), there are two keys to reset in the registry.

Press WinKey+r, type (or paste) regedit and hit Enter. In the navigation bar, paste :
HKLM\SYSTEM\CurrentControlSet\Services\WudfPf

Right-click wuauserv-BLOCKED!! (you should see it on the second last line in the Registry Editor).
Rename it to wuauserv.

Next scroll up to :
HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc-BLOCKED!! and rename that key to UsoSvc.

If you press WinKey+x followed by u and r to restart the computer, expect Windows Update to be fully functional again. ⁷

8. I recommend disabling System Restore

I recommend disabling the System Restore feature because when it kicks in, it can (temporarily) make your system slow and unresponsive. – System Restore may prevent you from using your computer for about half an hour or even longer. That's why I disable System Restore altogether.

Press WinKey+r and paste systempropertiesprotection and press Enter.
Click Configure... and check Disable system protection. Click OK twice.

9. What do `wuauserv`, `WaaSMedicSvc`, `UsoSvc` stand for?

I guess the letters in wuauserv stand for windows update automatic service. WaaSMedicSvc is somehow short for Windows Update Medic Service. And UsoSvc stands for Update Orchestrator Service.

References

^{¹ Never, ever run sc delete! – It will destroy your registry.
²
For example, in 2018 I updated to version 1803 (build 17134).
I did not let Windows Update run again until April 2022, when it
installed version 21H2 (build 19044.1682).
That's almost four years without a single update.
³
You can store the .reg file wherever you want.
Personally I store it in

C:\Downloads\Win10\RegBkp\HKLM\services
under the name HKLM%SYSTEM%CurrentControlSet%Services.reg.
⁴
If you delete it by mistake, I sure hope you still have the backup
I asked you to save by exporting to a .reg file!

Deleting the key is exactly what sc delete does.
That's why I advise you never to run it.
⁵ Holding down Ctrl+Shift makes the
command prompt open as administrator.
⁶
I tried disabling the TrustedInstaller by replacing TiWorker.exe
with an empty file, but that's not an option.

Windows cannot even restart normally when the the TrustedInstaller
is turned off.
⁷
If not, let me know in a comment below.}

score -1 · Answer 16 · answered Apr 12 '18 at 07:57

Disable all windows updates by PowerShell

(run PowerShell as Administrator)

Clear-Host

$WindowsUpdatePath = "HKLM:SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\"
$AutoUpdatePath = "HKLM:SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

If(Test-Path -Path $WindowsUpdatePath) {
    Remove-Item -Path $WindowsUpdatePath -Recurse
}

New-Item $WindowsUpdatePath -Force
New-Item $AutoUpdatePath -Force

Set-ItemProperty -Path $AutoUpdatePath -Name NoAutoUpdate -Value 1

Get-ScheduledTask -TaskPath "\Microsoft\Windows\WindowsUpdate\" | Disable-ScheduledTask

takeown /F C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator /A /R
icacls C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator /grant Administrators:F /T

Get-ScheduledTask -TaskPath "\Microsoft\Windows\UpdateOrchestrator\" | Disable-ScheduledTask

Stop-Service wuauserv
Set-Service wuauserv -StartupType Disabled

Write-Output "All Windows Updates were disabled"

doesn't work, service is restarted anyway – Suncatcher Apr 14 '20 at 05:52 — Suncatcher, Apr 14 '20 at 05:52
Seems like you missed taking out the Medic... – Malady Aug 27 '20 at 14:23 — Malady, Aug 27 '20 at 14:23

Stopping all automatic updates Windows 10

16 Answers16

Finally found a permanent fix that just works

Disable Update Service

I. The Microsoft official way to stop all automatic updates

II. My method to permanently stop all automatic updates

1. Precautionary actions. (Don't skip this – better safe than sorry!)

2. Block the `wuauserv` and `WaaSMedicSvc` services in the registry

How to enable Windows Update again

3. Windows Update may display as if it works even when it doesn't

4. Optionally also block the `UsoSvc` registry key

5. Check the status in `services.msc`

6. Don't run System File Check (`SFC`)

7. Remember what you changed!

8. I recommend disabling System Restore

9. What do `wuauserv`, `WaaSMedicSvc`, `UsoSvc` stand for?

References

Disable all windows updates by PowerShell

Linked

Related

Stopping all automatic updates Windows 10

16 Answers16

Finally found a permanent fix that just works

Disable Update Service

I. The Microsoft official way to stop all automatic updates

II. My method to permanently stop all automatic updates

1. Precautionary actions. (Don't skip this – better safe than sorry!)

2. Block the wuauserv and WaaSMedicSvc services in the registry

How to enable Windows Update again

3. Windows Update may display as if it works even when it doesn't

4. Optionally also block the UsoSvc registry key

5. Check the status in services.msc

6. Don't run System File Check (SFC)

7. Remember what you changed!

8. I recommend disabling System Restore

9. What do wuauserv, WaaSMedicSvc, UsoSvc stand for?

References

Disable all windows updates by PowerShell

Linked

Related

2. Block the `wuauserv` and `WaaSMedicSvc` services in the registry

4. Optionally also block the `UsoSvc` registry key

5. Check the status in `services.msc`

6. Don't run System File Check (`SFC`)

9. What do `wuauserv`, `WaaSMedicSvc`, `UsoSvc` stand for?