Windows 10: Using Windows Firewall To Block Updates

I have a few PC's and they have multiple connections to the internet. These connections appear on each PC as a different network. One of the connections is very expensive and metered, so I don't want Windows updating when the primary connection is down and the secondary only is available. For most applications, what I have done is created rules in the firewall to block/allow them on specific networks, but the most dangerous application of all is Windows Update. In ten minutes that can use my entire monthly allowance and then run me in to a huge bill! It's essential that I stop Windows Update using the fail-over network. Does anyone know what application should be blocked in the firewall to stop Windows Update?

:)

 

Stop Windows 10 Update Assistant from running

This has to be disabled in task scheduler and I go a step further and block it with the firewall also. Here is the script that I used in my environment:

********************************************

@echo off

REM Stop Update Assistant if running

taskkill -f -im UpdateAssistant.exe

taskkill -f -im UpdateAssistantCheck.exe

taskkill -f -im Windows10Upgrade.exe

taskkill -f -im Windows10UpgraderApp.exe

REM Block Update Assistant with Windows Firewall

netsh advfirewall firewall delete rule name="Windows 10 Update Assistant" dir=in

netsh advfirewall firewall delete rule name="Windows 10 Update Assistant" dir=out

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=in action=block program="C:\Windows\UpdateAssistant\UpdateAssistant.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=out action=block program="C:\Windows\UpdateAssistant\UpdateAssistant.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=in action=block program="C:\Windows\UpdateAssistant\UpdateAssistantCheck.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=out action=block program="C:\Windows\UpdateAssistant\UpdateAssistantCheck.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=in action=block program="C:\Windows\UpdateAssistant\Windows10Upgrade.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=out action=block program="C:\Windows\UpdateAssistant\Windows10Upgrade.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=in action=block program="C:\Windows\UpdateAssistantV2\Windows10Upgrade.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=out action=block program="C:\Windows\UpdateAssistantV2\Windows10Upgrade.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=in action=block program="C:\Windows10Upgrade\Windows10UpgraderApp.exe" enable=yes

netsh advfirewall firewall add rule name="Windows 10 Update Assistant" dir=out action=block program="C:\Windows10Upgrade\Windows10UpgraderApp.exe" enable=yes

REM Disable Update Assistant Scheduled Tasks

c:\windows\system32\schtasks.exe /change /tn "Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE

c:\windows\system32\schtasks.exe /change /tn "Microsoft\Windows\UpdateOrchestrator\UpdateAssistantAllUsersRun" /DISABLE

c:\windows\system32\schtasks.exe /change /tn "Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE

c:\windows\system32\schtasks.exe /change /tn "Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE

REM Remove Upgrader Application

IF EXIST "C:\Windows10Upgrade\Windows10UpgraderApp.exe" (

"C:\Windows10Upgrade\Windows10UpgraderApp.exe" /ForceUninstall

timeout /t 30

)

exit

 

Windows 10 wont connect to internet

I worked out it was my firewall causing the issue. I use Bitdefender and the update for windows 10 blocked the network adapters. Setup a rule to allow the firewall access.

 

The app is svchost.exe, it is used for DNS request, among other things. You could block ports 80/443 or specific IPs related to WU, but it might block some other functionality as well. You could set your connection to metered, that should prevent downloading WU, but you can not check for them or they will start downloading ASAP.

Wireless Network Metered Connection - Set in Windows 10 - Windows 10 Forums

Ethernet Connection - Set as Metered or Unmetered in Windows 10 - Windows 10 Forums

 

I don't know how 'do-able' this is in Windows (bearing in mind I have a Linux background !!) but.....

Windows update depends on the BITS (Background Intelligent Transfer Service) running. If it's not, then it can't check or download updates.

So, I'd be looking to write a script (triggered from task scheduler) that checks if the primary connection is up and if not, turns off BITS. If it is up, it'd just restart the service.

Doing it this way would ensure no updates can occur if the primary connection is unavailable. This is pretty simple to write under a Linux shell but I have no idea (yet !!) if it can be done with a simple batch or powershell script. I would imagine however that it can be.