Today I got the following message:

enter image description here

Computer was frozen and the only button available was "Get Updates".

I don't need this feature, I need to work, not serve my machine the time she wants.

Currently I did cold reboot and had time to open task manager and process explorer on different screens before the message appears again. Due to the bug in the application, I was able to kill MusNotification.exe process.

Unfortunately, I am unable to restrict system access to musnotification.exe and musnotificationux.exe files, or add them to antivirus blacklist.

How to ban this feature?

  • 2
    see superuser.com/questions/946957/… – Tetsujin Sep 12 '15 at 12:54
  • Allowing it to download is not "serving your machine", but if it's for work, surely you have Pro and can just defer them? – Sami Kuhmonen Sep 14 '15 at 6:12
  • 2
    I don't like disturbance while thinking. I agree to setup either automatic or manual download / install. I disagree to setup annoying messages. Imagine 100 programs asking for download each day -- when you would work? – Dims Sep 14 '15 at 10:01
  • Do you want to stop the updates or just stop the notifications? – fixer1234 Sep 15 '15 at 0:34
  • 1
    @fixer1234 I agree with notifications, but they should not block my screen – Dims Sep 15 '15 at 12:48
up vote 61 down vote accepted

Unfortunately, I am unable to restrict system access to musnotification.exe and musnotificationux.exe files

From my observations, "restrict system access to musnotification.exe and musnotificationux.exe files" is an effective method of blocking that message, if you have administrator privilege.

Paste these lines to elevated cmd to deny Everyone from executing the two files:

cd /d "%Windir%\System32"
takeown /F MusNotification.exe
icacls MusNotification.exe /deny Everyone:(X)
takeown /F MusNotificationUx.exe
icacls MusNotificationUx.exe /deny Everyone:(X)
rem

I have managed to create a Hyper-V virtual machine that can test this "feature".

  1. Clean install Windows 10 Enterprise LTSB
  2. In gpedit.msc change Windows Update to Notify download
  3. Check for updates, but reboot when it begins to download.
  4. Run usoclient StartScan and wait for the CPU usage to drop to normal. Save a virtual machine checkpoint.

Now, changing the system date to one month later (!) will 100% immediately trigger the "Updates are available" message.

However, if I restore the checkpoint and paste the commands above, changing the date will do nothing special.


Edit:

To undo the changes, run the following commands:

cd /d "%Windir%\System32"
icacls MusNotification.exe /remove:d Everyone
icacls MusNotification.exe /grant Everyone:F
icacls MusNotification.exe /setowner "NT SERVICE\TrustedInstaller"
icacls MusNotification.exe /remove:g Everyone
icacls MusNotificationUx.exe /remove:d Everyone
icacls MusNotificationUx.exe /grant Everyone:F
icacls MusNotificationUx.exe /setowner "NT SERVICE\TrustedInstaller"
icacls MusNotificationUx.exe /remove:g Everyone
rem

This removes the execution restriction first, and temporarily grants Everyone full access to the relevant two files, so that you are able to change the owner of the files back to Windows (TrustedInstaller). After the ownership change, the temporary full access is removed. This is tested on Windows Server 2016 TP4 and does bring back the awful dialog, if I change the system date to 1 month later.

  • 2
    When I am testing the undo commands, I notice that 2 new permissions have been set (possibly by Windows Update) on the mentioned files: Deny Everyone from changing permissions and Deny Everyone from taking ownership. They are not effective against Administrators, but I suspect Microsoft is aware of this workaround now, and this is a failed attempt to block it. @mpen see the edit. – jingyu9575 Jan 13 '16 at 8:03
  • 4
    in my case icacls MusNotification.exe /deny Everyone:(X) fails with the error Everyone: No mapping between account names and security IDs was done. Successfully processed 0 files; Failed processing 1 files. Seemed that I had to translate Everyone to Dutch: Iedereen. – Dediqated Apr 19 '16 at 15:35
  • 5
    @Dediqated Can confirm this. German version is: Jeder – Jens Jun 22 '16 at 8:04
  • 1
    Hum, why the "rem" at the end? That's just a comment. – Jacque Goupil Mar 23 '17 at 2:46
  • 3
    @JacqueGoupil If you copy the code altogether and paste it on cmd, all lines except the last are immediately executed, but the last line is not executed without pressing "Enter", because there is no "Enter" after it. I put a rem comment to ensure that all commands above are executed upon paste. – jingyu9575 May 9 '17 at 17:10

The only way i found around this crap is to switch the MusNotificationUx.exe for something less annoying, lets say cmd.exe or somesuch. Sure, a window still opens, but it's not blocking the entire machine.

To do this make sure you change the owner of the file appropriately (away from TrustedInstaller) and set file access accordingly. Then replace the file.

This "feature" is a slap in the face for anyone using Windows 10.

  • A big slap. MSFT, you almost redeemed yourself. – Bruno Brant Sep 26 '16 at 23:48

When the window opens, clicking anything will open the update panel and it will set a restart time for the updates to apply. This is fully undesirable.

There is a simpler trick to close the window without touching it:

  • Hit Ctrl+Shift+Esc, the task anager appears in the background
  • Hit Ctrl+Tab to navigate to the Details tab
  • Hit Tab to focus the processes list
  • Hit M, U, S, N or the keyboard arrows to reach the MusNotificationUx.exe item
    • Killing MusNotification.exe does not do anything
  • Hit Del to end the task
  • Hit Enter to confirm. The window gets killed.

If you want to get out of this lock screen, you should left-click on any part of notification that's not the button and press ESC. Makes the notification disappear for me

  • This opens the update center here. – allo Jan 29 at 8:36

protected by Community Feb 18 '17 at 17:36

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.