Disable windows update in windows 10 pro x64 1909

Question

Hello,
I would like to know if it is possible to disable windows update on a windows 10 x64 1909.
I have to disable it as these machines go into a sandbox to identify any malware and don't need to be updated.
Is it enough to create the following gpo?

Open Start.
Search for gpedit.msc and click the top result to launch the Local Group Policy Editor.
Navigate to the following path:

Computer Configuration> Administrative Templates> Windows Components> Windows Update

Double-click the Configure Automatic Updates policy on the right side.

Windows Update group policy settings
Source: Windows Central

Check the Disabled option to turn off the policy and disable automatic updates permanently.

Group Policy disable Windows Update
Source: Windows Central

Click the Apply button.
Click the OK button.

Thank you

Greeting

Answer 1

Hi,

I haven't noticed this before. I have disabled Windows Update service and will come back if it turns itself on.

By disabling the mentioned group policy, security updates and other important downloads won't be downloaded automatically. The definitions of windows defender is a special kind of Windows update. For more information, please see Description of the standard terminology that is used to describe Microsoft software updates.

Definition update
A widely released and frequent software update that contains additions to a product's definition database. Definition databases are often used to detect objects that have specific attributes, such as malicious code, phishing websites, or junk mail.

Maybe it's not included in "other important downloads" or is too important to be disabled.

Even in Windows Update for Business, we cannot disable Windows update permanently. There is a Maximum deferral period for updates.

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Maybe changing the service-account will prevent it from auto-enable:
Time will tell :-/

Answer 3

Okay, next day it was enabled again :-(
I even changed the command-line for the service! It seems it's getting completely recreated.
For now I have managed to prevent updates by using the firewall-whitelistning-approach, i.e. block everything and only whitelist what your need.

Another way is to disable the service and then disable "UpdateOrchestrator" and "WindowsUpdate" schedule tasks (located in Microsoft/Windows/UpdateOrchestrator). I assume this is the one that restore the Windows update service. As I recall I had to disable the task directly on the filesystem and in registry, something like::

Give yourself access-permissions to the related files/folders:
takeown /f "C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /A
takeown /f "C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /A

And then delte, rename or zip the folders

Related registry keys:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{641AADC0-14E9-4280-9F18-ADB2461E1E1D}
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Scan