I. The official Microsoft way to stop all automatic updates
Press Win-key+i > Update & Security > Advanced options (in the right pane).
Under Pause updates, it says :
Temporarily pause updates from being installed on this device for up to 35 days.
When you reach the pause limit, your device will need to get new updates before you can pause again.
The reason I don't use the Microsoft official way to stop all automatic updates,
is that I prefer my own unofficial way, which I will dedicate the rest of this answer to.
Disclaimer
Although I've been using this method for years, I have no indication that anyone but myself is using it.
If you try any of the tips below, it's all your own responsibility.
My method prevents Windows from working as Microsoft intends it to work.
For example, you'll have to temporarily suspend my method if you want to install software via Microsoft Store.
Read Section 3 on how to restore Windows to its normal state.
II. My method to permanently stop all automatic updates
My method: block the wuauserv
and WaaSMedicSvc
services by renaming them in the registry. 1
This has served me well for many years. 2
It's the closest I can get to that on/off switch that Microsoft stubbornly refuses to give us.
For more details on how to do this, read on.
1. Precautionary actions. (Don't skip! – Better safe than sorry.)
Before moving on, I strongly recommend saving a copy of the Windows Services registry settings.
Press Win-key+r, type (or paste) regedit
and hit Enter.
In the navigation bar, paste HKLM\SYSTEM\CurrentControlSet\Services
and press Enter.
Right-click Services
and choose Export.
Make sure you save the backup .reg
file in a safe place that you remember – should you ever need it.
Expect the file size to be just below 8 MB. 3
The most vulnerable registry key in this context is :
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
so it's a good idea to also export that key into its own .reg
file.
Remember where you keep it!
2. Block the wuauserv
and WaaSMedicSvc
services in the registry
Next scroll down to HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
.
Right-click wuauserv
, click Rename and add the suffix -BLOCKED!!
so that the key's new name becomes wuauserv-BLOCKED!!
.
Likewise, rename HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc
to WaaSMedicSvc-BLOCKED!!
.
Now press Win-key+i, click Update & Security, and then Check for updates.
Expect to get an Error encountered as in the screenshot below.
If you see this error, it confirms that you've successfully disabled Windows Update.
The error was immediate when I tried this, but you may have to restart the computer for the change to take effect.
A non-comprehensive list of possible error numbers include 0x80040154
, 0x80070002
, 0x80070005
, 0x80070424
, 0x80080005
, 0x8a15005e
.
3. How to enable Windows Update again
When you later want to enable Windows Update again, just rename the registry key back to its original name wuauserv
.
(You shouldn't need to rename/unblock WaaSMedicSvc-BLOCKED!!
.)
Before renaming back, you have to delete the wuauserv
key if it exists.
Don't delete wuauserv-BLOCKED!!
or WaaSMedicSvc-BLOCKED!!
4
After renaming back, you need to make a software restart (Win-key+x followed by u and r) to activate Windows Update again.
Note!
A hardware restart – shutting down and then restarting by pressing the physical power button – will not start Windows Update.
What if you still get Error encountered?
What if you unblocked the wuauserv
registry key, then restarted the computer (Win-key+x, u, r), and still get Error encountered when trying to run Windows Update?
Remedy: check that the Windows Update (wuauserv) service is running, as follows.
Open Windows Services, press Win-key+r, type services.msc
(and hit Enter).
Sort by name, look for Windows Update and double-click that service.
If the wuauserv service is disabled, you need to set it to Manual.
4. The wuauserv
registry key will automatically be recreated
If you block wuauserv
as described in Section 2 above, Windows will automatically and silently recreate the wuauserv
and WaaSMedicSvc
registry keys as shown in the screenshot below.
This is not enough to make Windows Update run again.
5. Windows Update may display as if it works, even when it doesn't
The surest way to know if Windows Update has suddenly started to run again (without your consent), is to go to Settings > Update & Security > Windows Update.
If you see an error, then Windows Update is still successfully blocked.
But even if you see a green checkmark as in the screenshot below, Windows Update might still be blocked.
You could click Check for updates to see if there is an error or not.
However, if there isn't an error, Windows Update will start to download any new updates and install them on the next restart.
This might not be what you want.
To gain more control, run wushowhide.diagcab
which allows to prevent (hide) any updates that you don't want.
6. Some caveats (!)
If you decide to block Windows Update, beware that any action that depends on it will fail!
To restore it, you'll need to remove the -BLOCKED!!
suffix from the wuauserv
registry key,
and restart the computer (Win-key+x, u, r).
The following list of failures is not comprehensive.
System File Check (SFC
) fails.
– I once ran sfc /VERIFYONLY
,
and the Trusted Installer hijacked my old slow laptop for about 45 minutes. (!) 5
wsl.exe --install
fails with 0x80070005
.
DISM.exe /Online /Cleanup-Image /Restorehealth
fails.
Anything related to Microsoft Store fails with 0x8a15005e
.
This is true even if you are using for example WingetUI/UnigetUI.
7. Disable System Restore
I disable the System Restore feature because when it kicks in, it can (temporarily) make the system slow and unresponsive.
– System Restore has prevented me from using my computer for about half an hour or even longer.
That's why I prefer disabling the System Restore altogether.
Press Win-key+r, paste systempropertiesprotection
and press Enter.
Click Configure... and check Disable system protection.
Click OK twice.
8. What do wuauserv, WaaSMedicSvc, UsoSvc stand for?
The letters in wuauserv stand for windows update automatic service.
WaaSMedicSvc stands for Windows Update Medic Service.
UsoSvc stands for Update Orchestrator Service.
References
1
Never, ever run sc delete
!
– It will destroy your registry.
2
For example, in 2018 I updated to version 1803 (build 17134).
I didn't let Windows Update run again until April 2022, when it installed version 21H2 (build 19044.1682).
That's almost four years without a single update.
3
You can store the .reg
file wherever you want.
I store it in C:\Downloads\Win10\RegBkp\HKLM\services
under the name HKLM%SYSTEM%CurrentControlSet%Services.reg
.
4
If you delete it by mistake, I sure hope you still have the backup
I asked you to save by exporting to a .reg
file!
Deleting the key is exactly what sc delete
does.
That's why I advise you never to run it.
5
I have also tried disabling the TrustedInstaller
by replacing TiWorker.exe
with an empty file, but that's not an option.
Windows cannot even restart normally when the TrustedInstaller
is turned off.