Replies

Bob, before you clicked the Links button, did you select the single entry for KB5005565 — and only that one single entry?

Also, regardless of what links or info you see for KB5005565, at this point in time I would recommend against running WUMgr, or doing any Windows updating.  As long as Susan is keeping the status here at MS-DEFCON 2 I’m not touching WUMgr at all.  Until she gives the “all clear” (MS-DEFCON 4 or 5), your best and safest bet is to keep your systems locked down as thoroughly as possible.  That means don’t go checking for any updates, regardless of whether you’re using WUMgr or the native Windows Update page in Settings.  In other words, don’t go looking for trouble right now.

1 user thanked author for this post.

Bob1515

Vicki, if you have other Microsoft products to update (e.g., MS Office), then you probably want to select the “Register Microsoft Update” option.  Personally, I’m not using Office or other MS products (besides Windows itself and Defender); so on my systems I don’t have that option checked.  Whether or not to select it depends on your particular situation; although other folks may have their own opinion about it.

One other suggestion I’d add (even though you didn’t ask) is that I also don’t select the “Include Drivers” option.  I generally won’t install any driver software thru Windows Update.  If I need to get driver updates, I’ll go directly to my hardware vendors’ websites (e.g., HP, Dell, etc.).  But again, that’s my personal preference.  Other folks here may have their own opinions about how to handle driver updates.

Vicki, in WUMgr, do you have the option to “Hide WU Settings Page” selected?  If so, you need to un-check it.

** IMPORTANT UPDATE **

Brian, I have some new information on this problem.  After messaging back and forth a couple times with David Xanatos (the WUMgr developer), he indicated that the “Block Access to WU Servers” option is implemented via a GPO (Group Policy Object).  When that option is checked, the program sets a specific GPO to disable access to the WU severs.  However, according to David, that particular GPO is only respected by Windows 10 Pro.  Win 10 Home Edition does not respect it.  Consequently, if the WUMgr program detects that it’s running on Home Edition rather than Pro, the option will always be greyed out; since it wouldn’t work anyway.

That’s one major difference between my systems and yours that I neglected to take into account.  You have Win 10 Home, while my systems are all Pro.  Sorry for not realizing that sooner.  Unfortunately, it looks like the only solution to this problem is to pay the Microsoft “tax” to upgrade your system to Win 10 Pro.  Sad but apparently true.

Bottom line: You can only enable “Block Access to WU Servers” on systems running Windows 10 Pro (or higher).

4 users thanked author for this post.

Cybertooth, vp2006, Peobody, Alex5723

Brian, I appreciate you providing all the details on your settings the way you did here.  Unfortunately, even though I changed my settings to match yours as closely as possible, my systems here don’t have the same problem that you’re seeing.  The option to “Block Access to WU Servers” is never greyed out for me, and is always available to be selected on two different systems where I tried to reproduce the problem.

Now, having said that, there are two differences between my systems and yours.  First, even though a couple other posters here claim that KB4023057 doesn’t make any difference to WUMgr, that is one of the two differences that stands out to me.  None of my systems have that update installed.  And, since my systems are what I would term “production” systems, I didn’t really want to chance installing that update on them just for testing purposes.  But if you’re willing to try uninstalling that update from your system, it would be interesting to see if that has any effect on WUMgr.  (You don’t need to worry about re-installing it, since MS re-publishes it every month anyway; so you’re sure to have it offered to your system again soon, if you really want it.)

The other big difference that I noted between my systems and yours are that both of my systems are on Windows 10 version 21H1, while yours seems to still be on 20H2.  Also the other poster that reported the same problem with the “Block Access…” option (vp2006) said that he’s running 20H2 as well.  So that’s something that the two of you have in common; and (again) is different from my systems.  I doubt that the Windows version actually has anything to do with this; but it is a difference that I noted.

I posted a report of this problem on the WUMgr Github page as a new issue/question.  So we’ll see if I get any response or feedback there.  But in the meantime, if you think of any other details or info to add, please post it here and let me know.

Alex, I keep the “Block Access …” option enabled as added insurance that Microsoft won’t be able to push thru any unwanted updates.  And so far (for over 2 years now) that added layer of protection has worked flawlessly for me.  WUMgr functions just fine; since during the 15 minutes or so each month that I update my systems, I disable that option to allow WUMgr to check for updates.  But then, as soon as the updates get installed, I immediately re-enable it; so that nothing additional can get thru.   For more details on the exact procedure refer back to my previous post: Post-2389329

WUmgr doesn’t function properly probably due to a Windows Update GP settings or some registry hack.

Alex, I doubt that KB4023057 is responsible for the WUMgr problem too.  But by asking about it I’m trying to eliminate all the possible variables that at least potentially could be contributing to the problem.  Personally, I’ve been keeping KB4023057 off all my systems just as a precautionary measure.  But it’s encouraging to know that you haven’t seen any issues with it on your systems — especially with WUMgr.

Having said that though, Brian still has an issue with not being able to select the “Block Access to WU Servers” option.  That’s what I’m interested in helping him solve.  Do you have any suggestion as to what specific GP or Registry setting might cause that?  Also, have you seen any reports from anyone else complaining about the same problem?  This is the first such report that I’m aware of.

Brian, it’s really strange that the “Block Access…” option is greyed out.  I’ve never seen that happen on any of my systems.  Here’s some additional questions then.

First, a couple basic questions.  Are you running WUMgr version 1.1b?  And did you download the zip file directly from the WUMgr release page on Github, which would be here: Github-WUMgr-Releases

Did your system somehow get the infamous KB4023057: (Update for Windows 10 Update Service / “Microsoft Update Health Tools”)?  If so, have you tried removing that update, rebooting, and then re-running WUMgr?

On the WUMgr “Auto Update” tab, is any option currently selected in the top or bottom section — other than “Automatic Update (default)”?  If so, which ones?

On the WUMgr “Options” tab (with “Windows Update” in the drop down menu) are any options there currently selected (top or bottom section)?  If so, which ones?

On the standard MS Windows Update Settings page, is there a message at the top of that page that “Some settings are managed by your organization”?  If so, what are the configured update policies listed there?

Also on Windows Update Settings does it indicate updates are currently Paused?

Under Windows Update Advanced Options, are any Update Options selected?

Under Advanced Options Delivery Optimization, do you currently “Allow downloads from other PCs”?

Other than WUMgr, are you using any other third-party software to block or control Windows updating?

Have you made any customizations to Windows yourself in an attempt to block or control Windows updating?  For example, disabling a service or task, renaming a DLL or EXE file, blocking any service or port or EXE file via an outbound Firewall rule, etc.?

Finally, do you have more than one Windows 10 system available there to try running WUMgr on to see if the same behavior occurs with it?

…my problem is that all of the options in the upper section of the WuMgr Auto Update tab are greyed out except Disable Automatic Update and Automatic Update (default). The Automatic Update one is selected.

That’s basically normal.  When you have “Automatic Update” selected, the following options will be greyed out:

• Disable Update Facilitators
• Notification Only
• Download Only
• Scheduled Installation

That’s how WUMgr is supposed to work.  The reason I qualified that with “basically” though is that one other option should not be greyed out.  That’s the checkbox option to “Block Access to WU Servers“.  That one option should still be selectable.  Can you confirm whether or not you’re able to select the “Block Access…” option?

 

Another unknown is whether WuMgr works differently on Win10 Home vs. Pro.

As far as I can tell, WUMgr appears to work the same regardless of whether the system is Home or Pro.  But keep in mind that on the systems where I’m using WUMgr, I always keep the Windows Update setting un-paused.  So I don’t know what effect pausing updates in Home vs Pro might have on how WUMgr operates.  In my experience, it’s safer to let WUMgr handle the blocking (or pausing), not Windows Update.

1 user thanked author for this post.

Cybertooth

It seems WuMgr will do nothing if updates are paused. If I unpause updates, even with being set to metered, W10 will begin downloading some updates and upgrades.

That’s why I never use the Windows Update settings page to pause updates — ever.  I keep the Windows Update setting un-paused at all times.  I rely on WUMgr to block and confirm which updates are available, and which updates I choose to allow thru.  My normal WUMgr options are set to:

• Block Access to WU Servers
• Hide WUSettings Page
• Disable Store Auto Update
• Disable Automatic Update
• Disable Update Facilitators

Only once a month — when the MS-DEFCON level drops to 4 or 5 — do I ever touch those settings.  And at that point, for just the short period of time needed, I’ll change the WUMgr setting to “Automatic Update (default)”; so that I can manually search for updates and decide which ones I want installed.  As soon as I’ve gotten the desired updates installed (usually around 10 to 15 minutes), I revert the WUMgr settings back to their normal mode to block and disable everything again until the following month.

Attached is a PDF of the detailed procedure that I’ve been using for over the past couple years on multiple Windows 10 systems.  And, at least so far (fingers crossed), I have never yet had an update get downloaded and installed that I didn’t explicitly allow to get thru.

2 users thanked author for this post.

Bob1515, Cybertooth

Brian, on the Auto Update tab which radio button do you currently have selected?  Did you select “Automatic Update (default)“?  Or “Disable Automatic Update“?  Or did you select one of the other radio buttons (“Notification Only“, “Download Only“, “Scheduled Installation“)?

Also, do you have any of the other Auto Update options currently selected — i.e., “Disable Update Facilitators“, “Hide WU Settings Page“, “Disable Store Auto Update“, “Include Drivers“?

I’m guessing that some combination of those options may be causing the option for “Block Access to WU Servers” to be unavailable.  I can try duplicating your settings on one of my test systems to see if the same issue occurs.  Just let me know what your Auto Update settings (in WUMgr) currently are.

They chose to be sure the user experience would not suffer too horrendously.

Based on how Microsoft seems to have shown very little regard for much of the user feedback to Windows 10 over the past few years, I doubt that they care very much at all about the “user experience“.

From that same PCWorld article:

There’s also the larger question of why Microsoft won’t simply let people turn off those security features if they slow down the computers so much, but that’s a different discussion around how forward Microsoft wants to move the chain on improving the baseline security of every Windows 11 PC.

And if your (somewhat) recently purchased PC is incompatible with Windows 11, well that’s just too darn bad.  Users are clearly not smart enough to decide for themselves if those new security features are worthwhile enough to justify scrapping and replacing their current systems.  So instead of providing an option for users to choose how to balance security versus performance, we’ll just make the decision for you.  How user-friendly.

In other words, MS knows what’s best for you. You will be assimilated!

2 users thanked author for this post.

lanceboil, Cybertooth

I am pretty sure that Windows Update can not be blocked simply by disabling the WU service … Windows 10 has many services involved in making sure the updates get installed. Some are just watchdog services that make sure the other services are running.

That’s absolutely correct.  However, it is possible to block Windows Update from within Windows if you’re determined enough to do it.  I successfully blocked Windows Update for well over a year; but it required disabling or otherwise neutering all the following services and/or tasks:

• Windows Update Service (wuauserv)
• Update Orchestrator Service (UsoSvc)
• Windows Update Medic Service (WaaSMedicSvc)
• Windows Remediation Service (sedsvc)
• Windows 10 Update Facilitation Service (osrss)
• AC Power Download Task
• Maintenance Install Task
• MusUx_UpdateInterval Task
• Reboot Task
• USO_Broker_Display Task
• Schedule Scan Task
• Schedule Retry Scan Task
• Maintenance Install Task
• Scheduled Start Task
• SIH Task
• PerformRemediation Task

Initially I disabled these services and tasks manually, experimenting with which ones were essential to blocking Windows Update.  Once I found a formula that worked I automated things by queuing up all the necessary commands in the proper sequence in a couple script files — one to disable Windows Update, and one to temporarily enable Windows Update (for once-a-month updating under my control).  It’s definitely possible to do this; and I can confirm that it worked reliably for well over a year — once I neutered all the updating tasks and services that Microsoft throws into the mix.

Eventually though I gave WUMgr a try; and compared it to my own method of blocking updates.  And it seemed to work just as well as my own script files.  For me, WUMgr just seems simpler and more straightforward; and it’s been blocking updates just as reliably as my custom scripts.  So for nearly 2 years now I’ve been using WUMgr to handle the updating of my Win 10 systems; and I’ve never yet had an unwanted update from MS sneak past it.  The only updates that get installed are the ones I explicitly allow thru.

On the other hand, I’m always open to adding additional defenses.  And your method sounds worthwhile:

Blocking Windows Update from within Windows is a losing game of wack-a-mole. It needs to be blocked in the router by blocking the 6 or 7 or 8 domains that it tries to access. I have done that for quite a while and it works.

I’d be curious to know which specific domains it is that you’re blocking, especially since it sounds like your router method has been working pretty well for you even without WUMgr or other blocking methods within Windows.  If you wouldn’t mind sharing that list of domains, there’s probably a number of people here that would like to set up similar blocking in their routers.  I know I would.  You can never have enough defenses against unwanted or untested updates from MS.

 

1 user thanked author for this post.

rc primak

John, you can get full drive encryption at no cost with VeraCrypt.  If you’re interested, there’s a good article on How-To Geek with step-by-step instructions.

• How to Encrypt Your Windows System Drive with VeraCrypt

If BitLocker is the only thing missing for you in Home Edition, then this could be an easy and free solution for adding that feature.  Just FYI.