Skip to content

Commit 0cf4a1f

Browse files
ChrisTitusTechChrisTitusTech
authored
Install Windows Update Blocker (#3577)
* block updates forever * remove admin checks for updates
1 parent c8dfc52 commit 0cf4a1f

File tree

2 files changed

+199
-11
lines changed

2 files changed

+199
-11
lines changed

‎functions/public/Invoke-WPFUpdatesdefault.ps1‎

Lines changed: 93 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ function Invoke-WPFUpdatesdefault {
55
Resets Windows Update settings to default
66
77
#>
8+
9+
Write-Host "Restoring Windows Update registry settings..." -ForegroundColor Yellow
10+
811
If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU")) {
912
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force | Out-Null
1013
}
@@ -15,17 +18,99 @@ function Invoke-WPFUpdatesdefault {
1518
}
1619
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Type DWord -Value 1
1720

21+
# Reset WaaSMedicSvc registry settings to defaults
22+
Write-Host "Restoring WaaSMedicSvc settings..." -ForegroundColor Yellow
23+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" -Name "Start" -Type DWord -Value 3 -ErrorAction SilentlyContinue
24+
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" -Name "FailureActions" -ErrorAction SilentlyContinue
25+
26+
# Restore update services to their default state
27+
Write-Host "Restoring update services..." -ForegroundColor Yellow
28+
1829
$services = @(
19-
"BITS"
20-
"wuauserv"
30+
@{Name = "BITS"; StartupType = "Manual"},
31+
@{Name = "wuauserv"; StartupType = "Manual"},
32+
@{Name = "UsoSvc"; StartupType = "Automatic"},
33+
@{Name = "uhssvc"; StartupType = "Disabled"},
34+
@{Name = "WaaSMedicSvc"; StartupType = "Manual"}
2135
)
2236

2337
foreach ($service in $services) {
24-
# -ErrorAction SilentlyContinue is so it doesn't write an error to stdout if a service doesn't exist
38+
try {
39+
Write-Host "Restoring $($service.Name) to $($service.StartupType)..."
40+
$serviceObj = Get-Service -Name $service.Name -ErrorAction SilentlyContinue
41+
if ($serviceObj) {
42+
Set-Service -Name $service.Name -StartupType $service.StartupType -ErrorAction SilentlyContinue
43+
44+
# Reset failure actions to default using sc command
45+
Start-Process -FilePath "sc.exe" -ArgumentList "failure `"$($service.Name)`" reset= 86400 actions= restart/60000/restart/60000/restart/60000" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
46+
47+
# Start the service if it should be running
48+
if ($service.StartupType -eq "Automatic") {
49+
Start-Service -Name $service.Name -ErrorAction SilentlyContinue
50+
}
51+
}
52+
}
53+
catch {
54+
Write-Host "Warning: Could not restore service $($service.Name) - $($_.Exception.Message)" -ForegroundColor Yellow
55+
}
56+
}
2557

26-
Write-Host "Setting $service StartupType to Automatic"
27-
Get-Service -Name $service -ErrorAction SilentlyContinue | Set-Service -StartupType Automatic
58+
# Restore renamed DLLs if they exist
59+
Write-Host "Restoring renamed update service DLLs..." -ForegroundColor Yellow
60+
61+
$dlls = @("WaaSMedicSvc", "wuaueng")
62+
63+
foreach ($dll in $dlls) {
64+
$dllPath = "C:\Windows\System32\$dll.dll"
65+
$backupPath = "C:\Windows\System32\${dll}_BAK.dll"
66+
67+
if ((Test-Path $backupPath) -and !(Test-Path $dllPath)) {
68+
try {
69+
# Take ownership of backup file
70+
Start-Process -FilePath "takeown.exe" -ArgumentList "/f `"$backupPath`"" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
71+
72+
# Grant full control to everyone
73+
Start-Process -FilePath "icacls.exe" -ArgumentList "`"$backupPath`" /grant *S-1-1-0:F" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
74+
75+
# Rename back to original
76+
Rename-Item -Path $backupPath -NewName "$dll.dll" -ErrorAction SilentlyContinue
77+
Write-Host "Restored ${dll}_BAK.dll to $dll.dll"
78+
79+
# Restore ownership to TrustedInstaller
80+
Start-Process -FilePath "icacls.exe" -ArgumentList "`"$dllPath`" /setowner `"NT SERVICE\TrustedInstaller`"" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
81+
Start-Process -FilePath "icacls.exe" -ArgumentList "`"$dllPath`" /remove *S-1-1-0" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
82+
}
83+
catch {
84+
Write-Host "Warning: Could not restore $dll.dll - $($_.Exception.Message)" -ForegroundColor Yellow
85+
}
86+
}
2887
}
88+
89+
# Enable update related scheduled tasks
90+
Write-Host "Enabling update related scheduled tasks..." -ForegroundColor Yellow
91+
92+
$taskPaths = @(
93+
'\Microsoft\Windows\InstallService\*'
94+
'\Microsoft\Windows\UpdateOrchestrator\*'
95+
'\Microsoft\Windows\UpdateAssistant\*'
96+
'\Microsoft\Windows\WaaSMedic\*'
97+
'\Microsoft\Windows\WindowsUpdate\*'
98+
'\Microsoft\WindowsUpdate\*'
99+
)
100+
101+
foreach ($taskPath in $taskPaths) {
102+
try {
103+
$tasks = Get-ScheduledTask -TaskPath $taskPath -ErrorAction SilentlyContinue
104+
foreach ($task in $tasks) {
105+
Enable-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
106+
Write-Host "Enabled task: $($task.TaskName)"
107+
}
108+
}
109+
catch {
110+
Write-Host "Warning: Could not enable tasks in path $taskPath - $($_.Exception.Message)" -ForegroundColor Yellow
111+
}
112+
}
113+
29114
Write-Host "Enabling driver offering through Windows Update..."
30115
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -Name "PreventDeviceMetadataFromNetwork" -ErrorAction SilentlyContinue
31116
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DriverSearching" -Name "DontPromptForWindowsUpdate" -ErrorAction SilentlyContinue
@@ -39,6 +124,7 @@ function Invoke-WPFUpdatesdefault {
39124
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" -Name "BranchReadinessLevel" -ErrorAction SilentlyContinue
40125
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" -Name "DeferFeatureUpdatesPeriodInDays" -ErrorAction SilentlyContinue
41126
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" -Name "DeferQualityUpdatesPeriodInDays" -ErrorAction SilentlyContinue
127+
42128
Write-Host "==================================================="
43129
Write-Host "--- Windows Update Settings Reset to Default ---"
44130
Write-Host "==================================================="
@@ -62,4 +148,6 @@ function Invoke-WPFUpdatesdefault {
62148
Write-Host "==================================================="
63149
Write-Host "--- Windows Local Policies Reset to Default ---"
64150
Write-Host "==================================================="
151+
152+
Write-Host "Note: A system restart may be required for all changes to take full effect." -ForegroundColor Yellow
65153
}

‎functions/public/Invoke-WPFUpdatesdisable.ps1‎

Lines changed: 106 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,30 +6,130 @@ function Invoke-WPFUpdatesdisable {
66
77
.NOTES
88
Disabling Windows Update is not recommended. This is only for advanced users who know what they are doing.
9+
This function requires administrator privileges and will attempt to run as SYSTEM for certain operations.
910
1011
#>
12+
13+
Write-Host "Configuring registry settings..." -ForegroundColor Yellow
14+
1115
If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU")) {
1216
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force | Out-Null
1317
}
1418
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoUpdate" -Type DWord -Value 1
1519
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "AUOptions" -Type DWord -Value 1
20+
1621
If (!(Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config")) {
1722
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Force | Out-Null
1823
}
1924
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" -Name "DODownloadMode" -Type DWord -Value 0
25+
26+
# Additional registry settings
27+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" -Name "Start" -Type DWord -Value 4 -ErrorAction SilentlyContinue
28+
$failureActions = [byte[]](0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x14,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xc0,0xd4,0x01,0x00,0x00,0x00,0x00,0x00,0xe0,0x93,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)
29+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" -Name "FailureActions" -Type Binary -Value $failureActions -ErrorAction SilentlyContinue
2030

31+
# Disable and stop update related services
32+
Write-Host "Disabling update services..." -ForegroundColor Yellow
33+
2134
$services = @(
2235
"BITS"
2336
"wuauserv"
37+
"UsoSvc"
38+
"uhssvc"
39+
"WaaSMedicSvc"
2440
)
2541

2642
foreach ($service in $services) {
27-
# -ErrorAction SilentlyContinue is so it doesn't write an error to stdout if a service doesn't exist
43+
try {
44+
Write-Host "Stopping and disabling $service..."
45+
$serviceObj = Get-Service -Name $service -ErrorAction SilentlyContinue
46+
if ($serviceObj) {
47+
Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
48+
Set-Service -Name $service -StartupType Disabled -ErrorAction SilentlyContinue
49+
50+
# Set failure actions to nothing using sc command
51+
Start-Process -FilePath "sc.exe" -ArgumentList "failure `"$service`" reset= 0 actions= `"`"" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
52+
}
53+
}
54+
catch {
55+
Write-Host "Warning: Could not process service $service - $($_.Exception.Message)" -ForegroundColor Yellow
56+
}
57+
}
58+
59+
# Rename critical update service DLLs (requires SYSTEM privileges)
60+
Write-Host "Attempting to rename critical update service DLLs..." -ForegroundColor Yellow
61+
62+
$dlls = @("WaaSMedicSvc", "wuaueng")
63+
64+
foreach ($dll in $dlls) {
65+
$dllPath = "C:\Windows\System32\$dll.dll"
66+
$backupPath = "C:\Windows\System32\${dll}_BAK.dll"
67+
68+
if (Test-Path $dllPath) {
69+
try {
70+
# Take ownership
71+
Start-Process -FilePath "takeown.exe" -ArgumentList "/f `"$dllPath`"" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
72+
73+
# Grant full control to everyone
74+
Start-Process -FilePath "icacls.exe" -ArgumentList "`"$dllPath`" /grant *S-1-1-0:F" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
75+
76+
# Rename file
77+
if (!(Test-Path $backupPath)) {
78+
Rename-Item -Path $dllPath -NewName "${dll}_BAK.dll" -ErrorAction SilentlyContinue
79+
Write-Host "Renamed $dll.dll to ${dll}_BAK.dll"
80+
81+
# Restore ownership to TrustedInstaller
82+
Start-Process -FilePath "icacls.exe" -ArgumentList "`"$backupPath`" /setowner `"NT SERVICE\TrustedInstaller`"" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
83+
Start-Process -FilePath "icacls.exe" -ArgumentList "`"$backupPath`" /remove *S-1-1-0" -Wait -WindowStyle Hidden -ErrorAction SilentlyContinue
84+
}
85+
}
86+
catch {
87+
Write-Host "Warning: Could not rename $dll.dll - $($_.Exception.Message)" -ForegroundColor Yellow
88+
}
89+
}
90+
}
2891

29-
Write-Host "Setting $service StartupType to Disabled"
30-
Get-Service -Name $service -ErrorAction SilentlyContinue | Set-Service -StartupType Disabled
92+
# Delete downloaded update files
93+
Write-Host "Cleaning up downloaded update files..." -ForegroundColor Yellow
94+
95+
try {
96+
$softwareDistPath = "C:\Windows\SoftwareDistribution"
97+
if (Test-Path $softwareDistPath) {
98+
Get-ChildItem -Path $softwareDistPath -Recurse -Force | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
99+
Write-Host "Cleared SoftwareDistribution folder"
100+
}
31101
}
32-
Write-Host "================================="
33-
Write-Host "--- Updates ARE DISABLED ---"
34-
Write-Host "================================="
102+
catch {
103+
Write-Host "Warning: Could not fully clear SoftwareDistribution folder - $($_.Exception.Message)" -ForegroundColor Yellow
104+
}
105+
106+
# Disable update related scheduled tasks
107+
Write-Host "Disabling update related scheduled tasks..." -ForegroundColor Yellow
108+
109+
$taskPaths = @(
110+
'\Microsoft\Windows\InstallService\*'
111+
'\Microsoft\Windows\UpdateOrchestrator\*'
112+
'\Microsoft\Windows\UpdateAssistant\*'
113+
'\Microsoft\Windows\WaaSMedic\*'
114+
'\Microsoft\Windows\WindowsUpdate\*'
115+
'\Microsoft\WindowsUpdate\*'
116+
)
117+
118+
foreach ($taskPath in $taskPaths) {
119+
try {
120+
$tasks = Get-ScheduledTask -TaskPath $taskPath -ErrorAction SilentlyContinue
121+
foreach ($task in $tasks) {
122+
Disable-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
123+
Write-Host "Disabled task: $($task.TaskName)"
124+
}
125+
}
126+
catch {
127+
Write-Host "Warning: Could not disable tasks in path $taskPath - $($_.Exception.Message)" -ForegroundColor Yellow
128+
}
129+
}
130+
131+
Write-Host "=================================" -ForegroundColor Green
132+
Write-Host "--- Updates ARE DISABLED ---" -ForegroundColor Green
133+
Write-Host "===================================" -ForegroundColor Green
134+
Write-Host "Note: Some operations may require a system restart to take full effect." -ForegroundColor Yellow
35135
}

0 commit comments

Comments
 (0)