Do you have MSE by any chance? If you’ve switched Microsoft Update or Windows Update to “Notify but don’t download” or “Download but don’t install,” running the MSE installer switches Windows over to Automatic Updates without any notification and without asking for permission.

There is a loophole sometimes in that WU can update itself automatically; so, it checks, finds an update for itself and installs it, that in turn allows it to switch to automatic updates for everything and you get them all…should find it switched to full automatic in settings though.
Make sure nothing underneath is checked either, like allow all users to install updates or allow other Microsoft updates such as for Office.
Also, a better setting is to check for updates but do not download or install without further approval.

Easy way to remove unwanted updates [from the registry] AFTER they’ve been installed is just rollback with a system restore.

I’m assuming (never changed WU settings) that the setting only applies to Important Updates. Four of the updates provided yesterday were Critical.

November Security Bulletin – https://technet.microsoft.com/library/security/ms14-nov

I’ve also just noticed this on the settings page:

38401-WU-Settings

Could it suggest that it may have changed the settings after you checked?

Why is it that the numbers identifying the Windows Updates (7×64) never match those quoted by Susan Bradley in her update column?

Windows Update can only run if the service is running. On my Windows 7 system, the service is called “Windows Update” and has the service name “wuauserv”. To put Windows Update completely under your control, you an set up a batch file containing the following lines:

sc config wuauserv start= auto (enables the service)
net start wuauserv (starts it running)
C:WINDOWSSystem32wuapp.exe startmenu (fires up the application, where you can “Check for updates” and select those you want to install))
pause (to not allow the next commands until finished)
net stop wuauserv (stops the service when you are finished with it)
sc config wuauserv start= disabled (disables the service until next time you run this)
pause (so you can see what happened before you quit)

You may get some issues with UAC, but basically this only allows Windows Update to run when you want it to. For example, you can run it on the Friday after Patch Tuesday. You will also need to set Windows Update to “Off” in Action Center > Security, otherwise it may start to download updates immediately when you run this.

The reason why the KBnnnnnnn numbers you see sometimes don’t match the numbers quoted by Susan is that there may be multiple fixes for a given problem, and the one offered to you will depend on your particular software configuration. You can check this out by following the “more information” link for an update, and looking at the list of systems affected.

Invoking above batch ideas! Bundeberra, do you run the batch file as a text file within a admin DOS-box?
Years ago, I ran many many BAT files; however, now, since I have no idea how to get Windows 7 to see BATchfiles and run BATchfile, I open an admin-level DOS box and run the appropriate text files — is that what you do?

After posting above, I got my own answer. After making the text files as given by Bundeberra, I copy’d them, renamed them as bat files, desktop shortcutted the processing one — right-clicked on it, and it awhile, but, it ran exactly as bb said it would! Pleriche, you and I received our solution, from bundeberra.

Windows Defender signature updates use the WU architecture/software but are not bound by the general WU settings. Defender has its own settings. As long as the WU service and associated services are running Defender will update signatures on its schedule. If your machine were left on all the time the Defender updates would be done in the background and you’d most likely never see them.

Joe