Windows 11 API call to prevent Windows Update during critical test

[Andrey_Dmitriev]

---

@Station8 wrote:

I wonder, with Windows 11, if disconnecting from the internet will actually prevent the automatic reboot. I'll have to experiment. I believe that Windows Update downloads the update packages in the background in the hours prior, and then the actual installation action that includes the reboot may not need an internet connection.

---

In theory this could happened only if you have adjusted "working hours" and then outside of these hours Windows will perform "postponed" upgrade. Just keep computer running for 24 hours, and if PC will not reboot, then will not do that in next 20 hours with very high probability.

We delivering industrial systems and if they should work in 24/7 mode, then local IT department usually perform some adjustments (in GPO, I believe), then systems running without any interruptions days and weeks, and still connected to rhe network (behind firewall). Usually when I performing 24 hours- or over weekend- manufacturing test, then I keep PC connected to the network, because I would like to have status, it is just very convenient.

I'll start tomorrow a simple experiment. I have one unused PC with fresh installed Win11 (was definitivily rebooted in the past during updates). I will stop windows update service, turn on metered connection, disable updates in GPO, then keep it running and connected to the internet and check maximal reachable uptime, just for fun.

[Andrey_Dmitriev]

---

@Andrey_Dmitriev wrote:

---

I'll start tomorrow a simple experiment. I have one unused PC with fresh installed Win11 (was definitivily rebooted in the past during updates). I will stop windows update service, turn on metered connection, disable updates in GPO, then keep it running and connected to the internet and check maximal reachable uptime, just for fun.

---

Okay, the Experiment was started today. Three things was changed — Windows Update Service Disabled, GPO modified to prevent updates and restart and Ethernet Connection set to Metered.

Screenshots under Spoiler (in German, sorry about that):

Spoiler

This is all about Windows 11 Enterprise LTSC 24H2 26100.2033 installed three months ago:


Windows Service Disabled:



GPO:



This one:



and this one:



I general I see in GPO lot of configuration possibilities, in theory it should be enough to adjust all of them here without additional actions.

Anyway, Metered connection is enabled:


This disabled, and grayed out, because was configured in GPO:



Latest updates was downloaded and installed:




After these manipulations above I checked the Registry Key NoAutoUpdate and this was set to 1 as expected (can be added manually if needed):




Finally restarted:



One small thing - the Windows Update Service was started again, I deactivated this one more time (needs to found setting how to disable it completely), then added scheduled task with call "net stop "Windows Update" with Admin privileges at logon:


PC is connected to Internet:


Current uptime - 12 miniutes

will see how long this PC can run without restart.

[LLindenbauer]

Nice job documenting your steps. I share the concern about updates being pre-downloaded and being scheduled outside working hours, but I remember using the same settings. There might be more services running that might trigger interruptions. For example, I remember a forced update from IE to MS Edge (triggered by a separate background service) restarting the regular update services as well.

[Eric1977]

Perhaps you have already done this, but, if not, it might be worthwhile to contact your local Microsoft rep and ask them how to disable Windows Updates for just like a scenario you have. The Sales Division certainly won't know so ask for a Windows OS Engineer.

[Kyle97330]

For anyone who doesn't have access to Group Policy but does have a firewall or router under their control, you can also block the Windows Update sites themselves.

Microsoft was nice enough to provide troubleshooting guides on how to be sure that your Windows updates work, such as this one:

https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/wind...

If you go about halfway down the page you can see they provide a nice list of sites and protocols.  So if you do require network access but want to stop updates, you can simply deliberately block all those sites instead of allowing them.

You should still periodically (monthly?) unblock them to get updates.  Just... not in the middle of a test.

[Andrey_Dmitriev]

---

@Andrey_Dmitriev wrote:

---

@Andrey_Dmitriev wrote:

---

I'll start tomorrow a simple experiment. I have one unused PC with fresh installed Win11 (was definitivily rebooted in the past during updates). I will stop windows update service, turn on metered connection, disable updates in GPO, then keep it running and connected to the internet and check maximal reachable uptime, just for fun.

---

Okay, the Experiment was started today. Three things was changed — Windows Update Service Disabled, GPO modified to prevent updates and restart and Ethernet Connection set to Metered.will see how long this PC can run without restart.

---

The experiment continues successfully, the PC is still up and running since 11th Oct, stays connected to the Internet all the time and was not restarted (who said the Windows is not stable OS?). Current uptime is over fifty days and counting, so I can confirm that the steps introduced above does the job pretty well:

49,71 days was most critical milestone, because every 4294967295 seconds the 32.bit tick counter resetted to zero (remember old WinNT bug). Anyway, I think from this point the computer can run indefinitely long (as long as the electronic components will allow, someday capacitors will dry and the motherboard or drive will die). Unfortunately can't keep this PC running for years, because we have e-check time to time, this will expire soon for this PC, then it must be down, in additional running long time without critical security updates is also not a good idea. And I guess, the metered connection was most important and fully sufficient to prevent updates, this single option is most easiest way to keep PC running without restart.