Yeah, I thought I had it disabled, too. I've tried all sorts of tricks, many of them posted in this thread, with the most recent a utility called "Windows Update Blocker" that Elder III mentioned. I ran "WUB" on 3 of the 5 rigs to see if it made any difference and it didn't. All 5 rigs began pestering me to reboot to finish installing updates, which means the little fuckers already began the update.

Blocking the M$ domains is basically the nuclear option, but I honestly can't think of anything else to try besides ditching W10 completely and going with SMOS or the like.