We experienced in the last weeks that win updates have been installed without user input on our critical systems. We already set GPO's that Winupdates are only allowed to be installed with user input and not outside of working hours. We set those to 12am - 12 pm, just in case.
Those systems receive their updates once every month via WSUS. It can happen that the updates are downloaded but wont be installed for 2-3 weeks
After some investigation have we found out that the NT Authority \System account is forcing the installation of those restarts. Is it possible to prevent this system account to install the updates on its own?
The systems are running on LTSB and LTSC versions