How To REALLY Block Windows 10 Updates and Upgrades

Here are the abbreviations used in this article:

W10 = original release v15xx
W10AU = Anniversay Update v16xx
W10CU = Creators Update v 17xx
W10A8 = April 2018 Update v18xx

WUP = Windows Update

############

IMPORTANT: I should state UP FRONT that this article is not for the 'casual' home user (anyone not comfortable with other than web browsing and email). It is intended for savvy (home or otherwise) users who want to control what Updates are Installed and when. I have seen 100s if not 1000s of postings from such users who don't want Microsoft deciding for them. IT IS ALSO NOT INTENDED FOR ADMINS WHO MANAGE 100S OR 1000S OF COMPUTERS. 

############

In May 2018, as I was starting to write this guide, Microsoft released W10A8 (formerly Spring Creators Update). As has been all too common in 2018, the first release dropped on people's machines was bug-ridden and was delayed. **DO NOT** upgrade to W10A8 until you are confident it is stable (AskWoody). 

Windows 10 is the best (and most tested) OS Microsoft has ever released; the RTM (Release To Manufacturing) build was ROCKSOLID. However, with W10 Microsoft started two EVIL practices -- Spying and Forced Updates. I can't help you with Spying, but this guide will help you BLOCK (almost) all Windows 10 Updates. Here you will find everything, as far as I know, that you can possibly do. 

Another issue is the QUALITY of these Updates. Microsoft was pretty good with Update quality in W10 and W10AU. Starting in 2018, however, it has been one disaster after another, starting with the Spectre/Meltdown fiasco. I don't want to minimize what a monumental job it is to test these updates against *all* of the different machines out there, but Microsoft can (and must) do better. I suggest you follow the many posts from AskWoody on this subject. 

1. DO Set Your Internet Connection to METERED

If you have a Metered Cxn, WUP will prompt you *BEFORE* starting to download (and install) updates.  Otherwise, when you click [Check for updates] WUP will immediately start to download and install any pending updates. Unfortunately, starting with W10CU, Microsoft MAY ignore this setting and install what it feels are critical updates. 

It is easy to enable a Metered Cxn if you have Wi-Fi: open Settings, click on Network & internet, then click on the Change Connection Properties link; set Metered Connection ON. If you have a Wired Connection and W10CU+, you can use the same method. 

If you have Wired (Ethernet) and W10 or W10AU, it takes some work. You will have to edit the Registry; navigate to

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\DefaultMediaCost

and change the value of Ethernet (DWORD) from 1 to 2. If this fails, you will have to change ownership and set permissions. Here is a link

  http://www.cnet.com/how-to/meter-your-ethernet-connection-in-windows-10/

DISCLAIMER: Editing the Registry is dangerous; don't do this unless you know what you're doing -- or can find someone who does. 

2. DO Use the Microsoft Show Or Hide Updates Tool

Microsoft calls it Show|Hide; think of this as Unblock|Block. 

Install 'wushowhide.diagcab' from
 
http://download.microsoft.com/download/F/2/2/F22D5FDB-59CD-4275-8C95-1BE17BF70B21/wushowhide.diagcab

on your Desktop and use it frequently! It can take considerable time to run but it's worth it. With this Tool you can Show or Hide (Hidden updates will not install) Updates. ALWAYS run the tool before checking for pending updates. 

3. DO NOT Immediately Apply Monthly Patches

This goes double-triple-quadruple for MAJOR UPGRADES! 

Monthly patches come out on the 2nd Tuesday of each month. There can also be what is called OOB (Out-Of-Band) updates that can appear at any time. I make it a RULE to NEVER install these patches for a minimum of 2 weeks. Let others find the bugs. 

When Patch Tuesday arrives, IMMEDIATELY run the Show Or Hide Updates Tool and BLOCK all updates, especially Cumulative Updates. You can install other Windows updates, Office updates, etc. if you want but I recommend: Block 'em, Block 'em All. Make a note of the date and KB# of the CU when it first appears. 

You must then run the Show Or Hide Updates Tool DAILY to make sure a new CU has not appeared; if this happens, make a note of the date and KB# and BLOCK it. DO NOT apply these updates until at least 10 days have elapsed without a NEW CU. In Feb 2018 -- at the time of the Spectre/Meltdown fiasco -- Microsoft released FOUR (4) CUs in one month before they got it kinda right. You can also search for a specific KB# at AskWoody to see if it is safe. 

4. DO NOT Assume Microsoft Will Leave Your Settings Alone

Microsoft assumes they know what you need -- no matter what you want. I have had Microsoft Unblock a Blocked 'Feature update' which is a MAJOR UPGRADE -- more than once. Always use the Show Or Hide Updates Tool BEFORE you [Check for updates] to avoid an unpleasant surprise. 

5. DO Disable the Update Orchestrator Service (UsoSvc) As a Final Line of Defense

This Service is at the heart of WUP -- if it is not Running, Updates cannot be downloaded and installed. You can manage this Service from the command line using SC -- Service Controller. Use SC to Stop and Disable UsoSvc. 

For help type the following at a command prompt:

$ sc /? 

Handy tip: if you want to interrupt WUP after Download/Install has started, just stop this service.  DO NOT DO THIS FOR AN UPGRADE.