Quote from: MagicSmoker on May 21, 2018, 07:18:06 PM

Quote from: vapourminer on May 21, 2018, 05:28:05 PM

...
i also have windows update totally disabled anyway.
...

Yeah, I thought I had it disabled, too. I've tried all sorts of tricks, many of them posted in this thread, with the most recent a utility called "Windows Update Blocker" that Elder III mentioned. I ran "WUB" on 3 of the 5 rigs to see if it made any difference and it didn't. All 5 rigs began pestering me to reboot to finish installing updates, which means the little fuckers already began the update.

Blocking the M$ domains is basically the nuclear option, but I honestly can't think of anything else to try besides ditching W10 completely and going with SMOS or the like.

I run my own WSUS (windows update) server so I don't have that problem. I approve all updates that my windows hosts can install. So, one thing that you may want try (that is a lot easier that blocking MSFT domains) is to configure your hosts to use a WSUS server that does not exist. Basically, you just modify a local group policy setting on each machine.

To do this, run the local group policy editor - "gpedit.msc". Then under Computer Configuration, open Administrative Templates, then Windows Components, and Windows Update. Under Windows Update, there is a setting "Specify intranet Microsoft update service location". Modify this setting to enable it and then enter bogus entries for the top 2 boxes (intranet update service and intranet statistics server) like "http://myserv:8530", and click Ok and close the editor. Now, if you go into Windows Update, you will see in red text "*Some settings are managed by your organization" and if you click "Check for Updates", you will get an error connecting to the update service. If you want to update anyway, you can use the link just below the button - "Check online for updates from Microsoft Update."

I hope this helps.