Managing Windows updates… for regular people

Just got a great question from a new Plus member:

I’ve just read a bunch of your articles providing detailed steps on how to manage the Windows Update process through what to me amounts to controlled postponements. But from your articles it sounds like with Windows 10 you’re only delaying the inevitable – that you can postpone them but can’t avoid eventually relinquishing control to a forced update at some point in the relatively near future.

And that’s where I have a disconnect. Because there are numerous articles on the Web advising how one can ‘disable Windows 10 Updates permanently.’ I have followed the most commonly offered advice – basically to disable the Windows Update through the policy editor. I did that immediately after purchasing my first Windows 10 computer last week (running Windows Pro V1809).

And it appears to have worked. The computer still has version 1809 on it, and I have not experienced any forced updates or even received any notifications from Microsoft about available updates. So I’m really confused at the moment about this: have I really turned off Windows Update permanently? Or am I going to wake up one morning only to discover that my copy of Windows was updated overnight, and that I was living under a false expectation?

By the way, don’t take any of this to mean that I don’t EVER want to update my computer. I just would like to be able to turn Windows Update on only when I choose – namely after receiving a MS-DEFCON 4 or MS-DEFCON 5 alert from you!

I bet a whole bunch of folks have the same question. There are lots and lots of opinions about controlling updates (and I’m sure more than a few alternative recommendations will appear in the comments to this post!). Many ways to thread the needle. Here’s what I’ve found works best for me and the folks I help all the time….

First of all, you have to install patches sooner or later. There have been (rare) occasions when the patches are so bad I’ve advised folks to skip a month, but almost always you should install one month’s patches before the next Patch Tuesday rolls around. If you’re setting up a new machine, I recommend that you install all of the outstanding patches right away, even if they’re known to create problems.

Second, I never turn off the Windows Update service (wuauserv). Disabling Windows Updates permanently is potentially fraught with all sorts of problems. Even if you’re fastidious about re-enabling the Windows Update service from time to time, there’s no telling what might slip through the cracks. I don’t know all of the ramifications of turning off wuauserv, and I doubt that anybody does.

Third, I don’t recommend third-party utilities that block patches simply because I’d hate to recommend something that ends up messing up your system. There are several excellent Windows Update blockers out and about, and many people here use them. I’m just skittish about recommending something that could be used to blast away your PC. (Kind of like Windows Update, if you know what I mean.)

Which leaves me with the patchwork of recommendations that I publish every month in Computerworld.

Fortunately, Win10 version 1903 (finally!) has the tools for everyone to delay patches according to a rational schedule. There are tricks — for example, if you pause updates for 35 days, you’ll get stuck with the next month’s cumulative updates shortly after they’re released — but by and large, the settings in Win10 1903 make the labyrinthine techniques I’ve cobbled together obsolete. Assuming Microsoft sticks to their promises, anyway.

We still don’t know exactly how the 1903 settings will be implemented — how, precisely, do you block a new version that’s disguised as a cumulative update? when a version hits end of life, how do you get kicked off? will we always see a polite offer to “download and install now”? and many more — but they’re a huge improvement over the blind Win10 patch pushing we’ve suffered for four years.

The Win10 1903 settings aren’t as good as Win7 and 8.1’s simple choices, but I guess that’s progress.