Questions on controlling Windows 10 updating

Topic

New Reply

PATCH WATCH By Susan Bradley With the end of free support for Windows 7, there’s a spate of new Win10 users. One of the most common questions I see fr
[See the full post at: Questions on controlling Windows 10 updating]

7 users thanked author for this post.

abbodi86, jburk07, Elly, Seff, rontpxz81, woody

Reply | Quote

Replies

Thanks for the article, Susan. It was particularly timely for me as I upgraded my main home desktop from W7 to W10 at the weekend. All well thus far, but I was especially interested to see your advice on using Defender and not adding any other third party AV/Malware programs – such as MBAM which I had installed under W7 for manual scans. I’ll not reinstall it in the light of your advice.

What I’d also be interested in hearing people’s opinions on is Defender’s Ransomware Protection. Disabled by default, is it worth enabling? Reviews seem to be mixed.

The idea that I should upgrade from Home to Pro is fair enough in theory, as was the original recommendation that nobody should upgrade a machine built for W7 but replace it with a new machine instead. However, in practice there are cost implications of course, and with two home desktops I was looking at circa £2000-3000 to replace both machines, and decided to give the upgrade a chance and see how it turned out – so far so good with the first machine, the other one will follow in a week or two assuming there are no issues in the meantime. Likewise, there are cost implications with upgrading to Pro in that the two machines together will cost £240 and that seems a lot to pay out (in retirement!) for a  benefit in update control that is more marginal than it once was when Home had no update deferral options at all.

 

Reply | Quote

The one thing that Susan forgot to mention is that to use the Group Policy Editor, one must be logged in as an Admin.  If you try to do it from a standard user account, you’ll be told you can’t edit, but the policy editor will come up, I guess so you can see how things are set.  When I forgot, I don’t even bother at that point, I just cancel and switch over to the Admin account and fix things from there.

I try to set up all of my customer’s computers so that they have both an Admin account and a User account.  I explain to them the benefit of operating from the Standard User account, rather than the Admin account.  So far, so good.

I did want to say thank you to Susan for stressing the importance of using Win10 Pro over Home.  I try to get  my clients to “buy” into the built-in safety of being able to control  upgrading, but too many home users are focused simply on cost. 🙁

Reply | Quote

Susan Bradley’s ‘controlling Windows 10 updating’ is too complicated on a Pro PC.
Just set (Advanced Options) Feature updates to 120 days, quality updates to 14-21 days and in GPEdit set Windows Update = 2 Notify but don’t download.
You control when updates should install by just changing the delay days.

Reply | Quote

You control when updates should install by just changing the delay days.

Maybe you mean “you control when updates appear on the WU update screen by just changing the delay days” ?? I say this because when “GPEdit>Automatic Windows Update is set to #2 Notify but don’t download,” you control installation according to whether you decide to click on the download button or not.

Reply | Quote

Would anyone please help me with the steps of getting to the screen of “GPEdit set Windows Update = 2 Notify but don’t download” in 1903 Pro.

Reply | Quote

See these two posts: #1662297 and #2016124.

Reply | Quote

Do you get the AskWoody Newsletter? Instructions are there in Susan Bradley’s article on the subject of “Controlling Windows 10 updating” at https://www.askwoody.com/newsletter/how-to-tell-if-software-truly-needs-updating/#patch-watch-0 (ISSUE 17.9.0 • 2020-03-02). Explicit instructions are there (substitute “#2 – Notify download/install” for #4 – Auto download and schedule the install.”) If not, join the AskWoody membership and you will get this newsletter and others that follow. You will learn a lot!!

In lieu of that, look at PKCano’s #2016124. Be aware that the bottom-most red arrow covers the symbol for a drop-down menu, where “#2 – Notify download/install” will appear as an option. To get to the screen illustrated in #2016124, type “group policy editor” in the Start search box, open the app, then work down the directory tree as follows: Local Computer Policy>Computer Configuration>Administrative Templates>Windows Components>Windows Update and go from there as shown in the image in #2016124.

Reply | Quote

WCHS wrote:

type “group policy editor” in the Start search box,

That doesn’t work on Windows 10 and you’ll get an error that windows can’t find it. You need to type gpedit.msc in the Run box.

It has always been this way in earlier versions of Windows as well as Windows 10. In earlier versions of Windows the command is remembered after being typed one time in the Run box but Windows 10 remembers NO commands typed in the Run box.

1 user thanked author for this post.

Reply | Quote

It works in my Win10, 1909.

Mele20 wrote:

That doesn’t work on Windows 10 and you’ll get an error that windows can’t find it. You need to type gpedit.msc in the Run box.

Typing “group policy editor” in the Start search box works for me, in 1909 (and 1903).

Reply | Quote

WCHS wrote:

It works in my Win10, 1909.

Same here (domain-joined and not), and on my 1903 box.

1 user thanked author for this post.

Reply | Quote

anonymous wrote:

Would anyone please help me with the steps of getting to the screen of “GPEdit set Windows Update = 2 Notify but don’t download” in 1903 Pro.

GPEdit : Computer Configuration > Administrative Templates > Windows Components > Windows Update
Double-click Configure Automatic Update – set Enabled and 2

Reply | Quote

#2 on 1903 is to notify for download and auto install.  You get to it by Computer configuration, administrative templates, windows components, windows update.  Then look for Configure automatic updates.

Susan Bradley Patch Lady

Reply | Quote

I have yet to follow the automatic steps to allow Win10 Updates, instead manually installing according to the Master Patch list.  I have 4 other relatives PC (all win10 Pro) that I am also manually updating.

Is that suitable or am I missing anything else not on the Master Patch list.  I have Office 2019 so that is not usable for manual patches. They have a mix of Office 365 or Open Office.

I have just made my Macrium backup and was about to finally follow the auto steps just so I do it correctly (Wushowhide etc) but thought I should ask first if manually avoids the hassles in the first place (keeping the PCs locked down from Update in between All Clear from Woody).

• This reply was modified 3 years ago by .

Reply | Quote

[WCHS]

This is a great article. The information about controlling Windows 10 updating, some of it scattered here and there in various AskWoody posts, is in one place and is explained in an easy-to-understand order

Also, I noticed your statement here (in the AskWoody Plus Newsletter 17.9.0 (2020-03-02)) that “Later this month, I’ll be discussing my backup and recovery strategy for Windows 10 devices. Stay tuned…”

I am REALLY looking forward to this. Bits and pieces about the subject are in AskWoody posts, but I need some coherency.

• This reply was modified 3 years ago by WCHS.

Reply | Quote

Great info Susan. but I can currently pause updates for up to to 35 days (Advanced Options without the 7 day pause )  on my two machines with 1909 and 1903 builds.

Reply | Quote

You might find AKB2000016 informative/helpful.

Reply | Quote

Since the topic here is “Questions on controlling Windows 10 updating“, I think this would be an appropriate place to mention WuMgr (Windows Update Manager):

https://www.ghacks.net/2019/10/19/windows-update-manager-wumgr-1-0-released/
https://www.majorgeeks.com/files/details/wumgr.html
https://github.com/DavidXanatos/wumgr

I just started testing this software on one of my Win 10 Home 1903 systems, and it seems to work fairly well there.  I’m wondering if anyone else has experience using WuMgr, and if you’ve had (or heard about) any problems with it.  If WuMgr works as well as it seems to for me (at least so far), I’m not sure why I should give $99 each to Microsoft — for each Home system — when WuMgr seems to provide the same (or better) control for free.

What does Win 10 Pro buy me that WuMgr doesn’t?  Any feedback or opinions about this would be greatly appreciated.

Reply | Quote

WuMgr (Windows Update Manager) has been discussed at length on this site. Just use the Search box and you will get multiple hits. Or look in the Tools Forum.

The Forum structure can be accessed via the “Forums” button in the site top menubar.

Reply | Quote

It’s true that a site search here turns up lots of posts that mention WuMgr.  But only a few posts discuss the tool in much detail.  Most people just mention it in passing (e.g., “I use WuMgr to prune updates if needed“, or “I use 3rd party apps like WUMT or WuMgr“).  Most postings (with admittedly a few exceptions) don’t really discuss WuMgr itself in much detail.  And it’s hard to gauge from those posts how stable or reliable WuMgr is currently.

Also, the forum for WuMgr (Forums->Tools->WuMgr) doesn’t seem to get much activity or attention.  In the last 16 months there’s been only 2 postings added there.  Most of the forum activity is back from 2018.  That doesn’t inspire a lot of confidence that anything posted there is currently relevant in 2020.

And Susan Bradley’s newsletter article on controlling Windows 10 updating doesn’t mention WuMgr even once.  Susan’s only real recommendation for Home users is pretty much just “do not buy Windows 10 Home“, even though that’s what the majority of retail OEM systems come with as their standard configuration.

So, between a lack of activity in the WuMgr forum here, and Susan’s reluctance to recommend WuMgr (or any other third-party update blocker/manager), it seems reasonable to ask for feedback or opinions from whoever might be actively using WuMgr these days.  I’d like to find out if WuMgr is still considered a viable recommended solution for controlling and blocking updates with the latest Win 10 versions (1903 and 1909).  That’s why I’m asking here.

Reply | Quote

I just don’t block updates.  I push them off.  I don’t block.  That said I have used WuMgr on a test server and I’m satisfied with it.

Susan Bradley Patch Lady

1 user thanked author for this post.

Tom-R

Reply | Quote

[Cybertooth]

Tom-R wrote:

[…]it seems reasonable to ask for feedback or opinions from whoever might be actively using WuMgr these days.

I use WuMgr on a Windows 10 test system. Using the tool is not unlike being “Group A” for Windows 7 patching. For Windows 10, it’s the closest thing I have found to the Windows 7 updating experience.

There’s a brief discussion of WuMgr in the section “Forced Windows Updates” at the second link in my signature below.

Keep Running Windows 7 Safely for Years to Come  
Make Windows 10 look and work like Windows 7

• This reply was modified 3 years ago by Cybertooth.

1 user thanked author for this post.

Tom-R

Reply | Quote

Tom-R wrote:

What does Win 10 Pro buy me that WuMgr doesn’t?

WuMgr is no different or better then Microsoft’s wushowhide.diagcab, Windows Update Blocker v1.5 and a mired of other 3rd party like tools.
These give you the option to block/unblock all or single updates.

The Pro version gives you option to pause Quality update and/or Feature updates in edition of using GPEdit for more control over your system.

1 user thanked author for this post.

Tom-R

Reply | Quote

RE: “under Configure automatic updating […] select 4 – Auto download and schedule the install”

What happens if an update has been downloaded, but not has not yet been installed, and Microsoft either recalls the downloaded update or replaces it with a newer version before it is actually installed?  Will the already-downloaded update be deleted automatically, or is manual intervention required?

Also, I notice that drivers are being automatically updated.  Is it a good idea to let Microsoft update drivers for other manufacturer’s products?  If not, is there a way to prevent it?

Reply | Quote

It’s risky to let Microsoft update your hardware drivers. (I speak from experience.) One way to prevent it is to use Windows Update Manager, as discussed upthread: in the Auto Update tab down on the left, there is a box to “Include Drivers” that you can check or uncheck.

I like Windows Update Manager because the interface is similar to that of Windows Update in Vista and Windows 7. But if for any reason you’d rather not use it, then if you have Windows 10 Pro, you can set a blanket block of all driver updates in the Group Policy Editor. If you have Windows 10 Home instead, you can still block driver updates individually with the Microsoft tool wushowhide.diagcab.

 

Keep Running Windows 7 Safely for Years to Come  
Make Windows 10 look and work like Windows 7

Reply | Quote

Bruce wrote:

Also, I notice that drivers are being automatically updated.  Is it a good idea to let Microsoft update drivers for other manufacturer’s products?  If not, is there a way to prevent it?

Drivers are automatically installed if you let them and its a bad idea.
Download drivers directly from hardware OEM.
Disable Automatic Driver Downloads

Reply | Quote

I set my Windows Update group policies as advised in your 3/2/20 column “Questions on controlling Windows 10 updating”.

I have a few follow-up questions:

1. If, in addition to the recommended policy settings, I go to “Update & Security | Windows Update | Advanced Options | Pause Updates” and set a specific date, and later (but sometime prior to the selected date) I elect to “Resume Updates”, what is the expected result?  (For example, when updates resume, will Windows Updates adhere to my group policy settings, or will those settings be overridden?)
2. When I resumed updates in order to obtain the July updates just prior to the August patch Tuesday releases, I received KB4562900 (a .NET preview update).  I would like to prevent receipt of preview updates if possible.  Is there a policy setting that will prevent these kinds of preview updates from being installed?
3. Is there a way to display (prior to installation) a list of what updates are being offered, along with some way to prevent installation of any undesired update?

Reply | Quote

1. When you resume updates from Pause, it does not adhear to Group Policy settings. Resume updates from Pause initiates an immediate download/install of available (pending) updates.
2. Yes, there is a policy for Preview update control. But KB4562900 may be the exception to the rule. We had many reports that MS was pushing it down.
3. For some explanations and suggestions on controlling Windows Update, see AKB2000016 Guide for Windows Update settings in Win10. There are screenshot below for illustration of how to do the settings.

Reply | Quote

@PKCano,

(Still sorta new here.)

Thanks, but I’m confused by that link. When I right-click, it shows me this:

https://www.askwoody.com/forums/topic/2000016-guide-for-windows-update-settings-for-windows-10/

?

Best regards,

Reply | Quote

Ooops! My bad link. I corrected it.  Left click on it and try again.

Reply | Quote

I’m helping two friends with Systems that were Upgraded from Win 7 – 64 to Win 10 -64. The most recent friend, has what I would call, a Non-off-the-shelf Windows 10 install/configuration.

It was setup with the use of the Local Admin login, so the Microsoft Account and One-Drive are not configured. The C-drive is on a 64 GB SSD with the 500 GB HDD used for the feature of “Filehistory” in its’ default configuration. Also there has been no space allowed for “Restore Points” AND it doesn’t seem that Windows Updating has been turned – On because it shows only one KB applied in the Control Panel’s Programs List. The version of Win 10 Home is 1904.1 …

What would either Susan’s or Tacey’s advise be to bring this version of Win 10 up to a safe and usable Updated version prior to this Win 11 Upgrade ? ?

The other issue has to deal with the loss of the Normal operation of Win 10’s selection of Shutdown from the Menu. Instead of truly Shutting Down, Win 10 instead acts like a Restart was selected, and this happened some time after Upgrading from Win 7 – 64 to Win 10 – 64. So now, it can only Truly accomplish “shutdown” via the Command-line. This can be addressed a bit later.

Reply | Quote

Chances are it won’t make the cut to Windows 11 if it started as a Windows 7.  It’s possible that the shut down was blocked in group policy or the registry?

https://www.intowindows.com/fix-shut-down-restart-sleep-options-missing-from-start-menu/

Susan Bradley Patch Lady

Reply | Quote

Dear Susan,   I thank you for your suggestion, but I found several months back,  that unlike your provided link, that the issue was Not that the Shutdown selection was Missing.

I learned that somehow the process of the Hybrid Shutdown was changed to a Looping “Restart”.

When your Hybrid Shutdown (Menu Shutdown) ends-up somehow being changed to a “Restart”.  I found that the Hybrid Shutdown mode needed to be changed in-order to regain the normal “Shutdown” process.

This may cause your Start-up to take a bit longer,  but at least when you select Shutdown, your system WILL cancel all processes and power-off your PC instead of going into a “Restart” Looping.

Hybrid shutdown is enabled by default on Windows 10, so I can’t be sure why migrating to Windows 10 made it problematic for your setup. (or after applying an Update)

[information from TechRepublic]

<u>A shut down operation</u>

As you can imagine, a shut down operation essentially works in reverse of a cold Booting operation. But for the sake of being complete, let’s cover it anyway. When you shut down Windows, the user session shuts down first, then the kernel session shuts down, and finally the hardware session shuts down.

<u>A Hibernate operation</u>

Since a big part of Fast Boot builds upon the Hibernate feature, let’s take a brief look at how the Hibernate feature works.  If you used the Hibernate feature in previous versions of Windows,  then you know that a system coming out of hibernation boots up faster than a system that is performing a cold boot, i.e. a system that starting up from scratch after being completely shut down.  (see graphic below)

The reason for this is that when you hibernate your computer,  the operating system doesn’t really shut down.  Instead, it saves the current system state and the contents of memory to a file called hiberfil.sys and then it shuts down the computer – the hardware.  Later, when you turn on, or resume, the computer, rather than performing a cold boot of the entire system, the operating system reads the contents of the hiberfil.sys and then restores the system state and memory to the exact same condition they were in when the system went into hibernation. This restoration, or resume, operation can occur much faster than a computer can boot up from a complete shut down.

Of course, resuming from hibernation comes with a “your mileage may vary” clause. The reason being that the speed with which the system resumes depends on how big the hiberfil.sys file is. And the size of the hiberfil.sys depends on how many applications were running and how much data was in memory at the time that the system went into hibernation. For example,  if you hibernate your system when you have Word, Excel, and PowerPoint running and files open in each application, the hiberfil.sys file is going to be larger than if you closed all your apps before you hibernate your system. If the hiberfil.sys file is larger, resuming is going to take longer. Even so,  resuming from hibernation is generally faster than booting up from a complete shut down.

Thanks to the Hybrid Boot feature that changed the way Windows used to shutdown and restart. That said, if, for any reason, you want to switch to non-hybrid mode to shutdown or restart Windows instead of Fast Boot,  here is how to disable or enable Hybrid Boot in Windows 10. It was also called Fast Startup.

[Here is the Power Options screen via Control panel’s selection, that presents this change]

Here are two links that talk about this, at the time, newly implemented Window’s 8 function that was carried over into Windows 10 :

< https://www.technospot.net/blogs/disable-enable-hybrid-boot-fast-startup-windows-10/ >

 

< https://www.techrepublic.com/article/how-windows-8-hybrid-shutdown-fast-boot-feature-works/ >

To this day,  I do not know why a normal Windows 10 update and/or which one caused this change of a Normal Hybrid Shutdown to change into a looping “Restart”,  but I found that this change to the type of Shutdown brought back being able to Select Shutdown and it would Actually Stop All processes And Power-Off, again.

I hope that this information brings a different perspective to your suggestion and also helps others to gain back the Shutdown function as it is expected to work and power-off their PC.

Sincerely,

xNavy73DP

1 user thanked author for this post.

Cybertooth

Reply | Quote