How block Windows 10/11 permanently from updating OS when installing updates for Microsoft Store applications

Question

Hi,

I have problem to configure properly OS Win10 or Win 11 for permanently block from updating OS version. I have few platforms where need to stay at Windows build version (with UBR) same when installed e.g. for Windows 11 22000.194. I already set some group policies on FirstLogonCommands like:

For Windows Update

• ​Set Configure Automatic Updates to "disabled"
• Set Remove access to use all Windows Update features to "enabled"

For Windows Store

• Set Turn off Automatic Download of updates on Win8 machines to "enabled"
• Set Turn off Automatic Download and Install of updates to "enabled"
• Set Turn off the offer to update to the latest version of Windows to "enabled"

and its working fine until... start updating applications using Microsoft Store. In my case i need to stay on installed OS version and update few applications in Windows but when start updating then randomly OS updating to newest security update (22000.556). I found and tried to block MS update DNS in hosts file using:

0.0.0.0 *.download.windowsupdate.com
0.0.0.0 *.microsoft.com
0.0.0.0 *.update.microsoft.com
0.0.0.0 *.windowsupdate.com
0.0.0.0 *.windowsupdate.microsoft.com
0.0.0.0 download.microsoft.com
0.0.0.0 download.windowsupdate.com
0.0.0.0 ntservicepack.microsoft.com
0.0.0.0 test.stats.update.microsoft.com
0.0.0.0 windowsupdate.microsoft.com
0.0.0.0 wustat.windows.com

Ofc i set Windows Security to exclude folder C:\Windows\System32\drivers\etc from scanning due when changing hosts file Defender instantly block operation.

but also does not blocking OS from updating :(

Is there any other option to permamently block OS from updates? I need to have on installed OS image equals version every time independent of app updates. If any app require newer OS version then i will prefer if application does not update instead updating Windows without my action.

Answer 1

Hi there,

If you really need the OS to not be updated you can try the Long-Term Servicing Channel.

Enterprise LTSC is a long-term support variant of Windows 10 Enterprise released every 2 to 3 years. Each release is supported with security updates for either 5 or 10 years after its release and intentionally receives no feature updates.

Windows 10 Enterprise LTSC https://learn.microsoft.com/en-us/windows/whats-new/ltsc/

--------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 2

I know about LTSC version but for my team where im working this version is not fixing problems coz other team already also testing LTSC Windows versions.
In our test cases we want to test driver in specific (prepared by other team) Windows Image. Before just we disable Windows Updates and always got same testing environment but since Voice Recorder application (which we are also testing if working properly with our driver) start forcing updates we have problems to have identical environment after application updates. Similar things is in application like Media Player (successor of Groove Player).

Thats why i asking for it because for now since some months we are forced to update application that destroying test cases by changing environment (harder to reproduce any bugs and errors) :(