I. The official Microsoft way to stop all automatic updates
Press WinKey+i > Update & Security >
Advanced options (in the right pane).
Under Pause updates, it says :
Temporarily pause updates from being installed on this device for up
to 35 days.
When you reach the pause limit, your device will need to get new
updates before you can pause again.
The reason I don't use the Microsoft official way to stop all
automatic updates,
is that I prefer my own unofficial way, which I will dedicate the
rest of this answer to.
Disclaimer.
If you try any of the tips below, it's all at your own responsibility.
II. My method to permanently stop all automatic updates
My method: block the wuauserv
and WaaSMedicSvc
services
by renaming them in the registry.
1
This has served me well for many years.
2
It's the closest I can get to that on/off switch that
Microsoft stubbornly refuses to give us.
For more details on how to do this, read on.
1. Precautionary actions. (Don't skip! – Better safe than sorry.)
Before moving on, I strongly recommend saving a copy of the Windows
Services registry settings.
Press WinKey+r, type (or paste) regedit
and
hit Enter.
In the navigation bar, paste HKLM\SYSTEM\CurrentControlSet\Services
and press Enter.
Right-click Services
and choose Export.
Make sure you save the backup .reg
file in a safe place where
you will remember how to find it – should you ever need it.
Expect the file size to be just below 8 MB.
3
The most vulnerable registry key in this context is :
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
so it's a good idea to also export that key into its own .reg
file.
Remember where you keep it!
2. Block the wuauserv
and WaaSMedicSvc
services in the registry
Next scroll down to HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
.
Right-click wuauserv
, click Rename and add the suffix
-BLOCKED!!
so that the key's new name becomes wuauserv-BLOCKED!!
.
Likewise, rename
HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc
to WaaSMedicSvc-BLOCKED!!
.
Now press WinKey+i, click Update & Security,
and then Check for updates.
Expect to get an Error encountered as in the screenshot below.
If you see this error, it confirms that you have successfully disabled
Windows Update.
The error was immediate when I tried this, but you may have to
restart the computer for the change to take effect.
Possible error numbers include 0x80040154
, 0x80070002
,
0x80070005
, 0x80070424
, 0x80080005
.
3. How to enable Windows Update again
When you later want to enable Windows Update again,
just rename the registry key back to its original name wuauserv
.
(You shouldn't need to rename/unblock WaaSMedicSvc-BLOCKED!!
.)
Before renaming back, you have to delete the wuauserv
key if it
exists.
Don't delete wuauserv-BLOCKED!!
or WaaSMedicSvc-BLOCKED!!
4
After renaming back, you need to make a software restart
(WinKey+x followed by u and
r) to activate Windows Update again.
Note!
A hardware restart – just shutting down and then restarting by
pressing the physical power button – will not start Windows
Update.
What if you still get Error encountered?
What if you unblocked the wuauserv
registry key, restarted the
computer (WinKey+x, u, r),
and still get Error encountered when trying to run Windows Update?
Remedy: check that the Windows Update (wuauserv) service is
running, as follows.
Open Windows Services, press WinKey+r,
type services.msc
(and hit Enter).
Sort by name, look for Windows Update and double-click that service.
If the wuauserv service is disabled, you need to set it to
Manual.
4. The wuauserv
registry key will be automatically recreated
If you block wuauserv
as describe in Section 2 above, Windows will
automatically and silently recreate the wuauserv
and WaaSMedicSvc
registry keys as shown in the screenshot below.
This is not enough to make Windows Update run again.
5. Windows Update may display as if it works, even when it doesn't
The surest way to know if Windows Update has suddenly started to
run again (without your consent), is to go to Settings >
Update & Security > Windows Update.
If you see an error, then Windows Update is still successfully
blocked.
But even if you see a green checkmark as in the screenshot below,
Windows Update might still be blocked.
You could click Check for updates to see if there is an error
or not.
However, if there isn't an error, Windows Update will start to
download any new updates and install them on the next restart.
This might not be what you want.
To gain more control, run wushowhide.diagcab
which allows
to prevent (hide) any updates that you don't want.
6. Some caveats
If you decide to block Windows Update, beware that any action that
depends on it will fail.
To restore it, all you need to do is remove the BLOCKED!!
suffix
from the wuauserv
registry key,
and restart the computer
(WinKey+x, u, r).
The following list is not comprehensive.
System File Check (SFC
) fails.
– I once ran sfc /VERIFYONLY
,
and the Trusted Installer
hijacked my laptop for about 45 minutes. (!)
5
wsl.exe --install
fails with 0x80070005
.
DISM.exe /Online /Cleanup-Image /Restorehealth
fails.
7. System Restore
I disable the System Restore feature because when it kicks in,
it can (temporarily) make the system slow and unresponsive.
– System Restore has prevented me from using my computer for about
half an hour or even longer.
That's why I prefer disabling System Restore altogether.
Press WinKey+r and paste
systempropertiesprotection
and press Enter.
Click Configure... and check Disable system protection.
Click OK twice.
8. What do wuauserv, WaaSMedicSvc, UsoSvc stand for?
The letters in wuauserv stand for windows update
automatic service.
WaaSMedicSvc stands for Windows Update Medic Service.
UsoSvc stands for Update Orchestrator Service.
References
1
Never, ever run sc delete
!
– It will destroy your registry.
2
For example, in 2018 I updated to version 1803 (build 17134).
I didn't let Windows Update run again until April 2022, when it
installed version 21H2 (build 19044.1682).
That's almost four years without a single update.
3
You can store the .reg
file wherever you want.
I store it in C:\Downloads\Win10\RegBkp\HKLM\services
under the name HKLM%SYSTEM%CurrentControlSet%Services.reg
.
4
If you delete it by mistake, I sure hope you still have the backup
I asked you to save by exporting to a .reg
file!
Deleting the key is exactly what sc delete
does.
That's why I advise you never to run it.
5
I have also tried disabling the TrustedInstaller
by replacing
TiWorker.exe
with an empty file, but that's not an option.
Windows cannot even restart normally when the TrustedInstaller
is turned off.