Chris Titus?

There are programs like net limiter that you can use to just block access entirely for windows updates, every time one pops up to use data you can just block it, i think there’s like 6 processes windows will try to use to update various things. It’s not exactly what you are looking for, but it should solve your problem anyway.

What I’ve done is to go to group policies and edit the policy for updates to turn off automatic updates. It works just fine for me. No updates (unless I manually click update).

The option for automatic updates is several layers deep in a nested menu tree, and I don’t fully recall what the path to get there is. But you should be able to find it online.

Is moving the drive to another computer as a secondary drive an option? Or put it in a separate USB enclosure? That way you don’t need to boot it at all, unless it’s encrypted or something.

Just disable the windows update services.

You could also use a allowlist firewall rule to restrict access to what you need.

Also why the paranoia? What do you have against windows updates?

Put it behind a PiHole that drops all traffic to Microsoft servers?

I’m not sure what the purple app was.

But disabling the relevant services should be enough or modifying your host file to block all the Microsoft domains for it.

I am curious why you need it to go online at all.

If you’re looking to copy files just use your phone or USB drive?

InControl by Steve Gibson allows you to set a specific Windows release version and prevent further feature updates, but does allow security updates:

InControl controls Windows automatic updating/upgrading system by targeting it to a specific major version and feature update release. By default, the current release will be used. So if you “Take Control” with the major version and feature release shown in the boxes in the lower left, Windows will remain right where it is – only installing monthly security updates – until you “Release control”.

Download and install sysinternals suite: learn.microsoft.com/en-us/…/sysinternals-suite

then run:

psexec -i -s services.msc

and disable Windows Update, Update Orchestrator, and WaaSmedic if it’s there.

Alternatively, do the same psexec but regedit instead of services, navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services, find those same services I listed above, change the Start value to 4 to disable. I went to the next step and neutered all the registry entries for each of those services to make sure they stayed dead.

I tried every suggested way of disabling Windows Updates, including changing dedicated settings in Windows Update, registry, group policy, disabling services, blocking it in firewall, adding WU domains to HOST file and some other tricks I can no longer remember - Windows just ignores it all and updates itself anyway.

The only thing that seems to have worked is to set your internet connection as metered and then set WU not to update over metered connections.

O & O Shutup on a thumbdrive

One thing that has worked for over a year on ky backup laptop at least, is to use the only setting Microsoft seems to not be able to take away without being in trouble: Windows Update Setting: Don’t download over metered connections. Then, any network you connect to go into the networks settings and set as a metered network. The only thing that has made it through from updater was a tiny security update that it was able to download cause I was a bit forgetful once, pretty easy if u ask me

Bonus points if Anyone can link me to the page I used a few years back that had all sorts of privacy enhancing and telemetry disabling option on the left side and would create a reg file for applying those changes on the right

privacy.sexy

I just install DoNotSpy after a fresh install of Windows and have never had an issue with Windows Update ignoring me and doing whatever it wanted.

Obviously the system has to be offline until it is installed and probably restarted, but after that you can plug in a cable and be fine, to my experience. Mind you I am still using an old, old, copy of 10 as the installer, so I am uncertain how newer fresh installs will handle it.

Use something like NextDNS and block the update-domains.

Everyone here is dramatically overcomplicating the solution. Simply:

Turn on the PC without an Internet connection

From an elevated cmd, run > net stop wuauserv

Connect the network and copy your files

This stops the update service and will absolutely prevent windows updates from running. BUT it reverts at the next boot, so be careful.

Source: More than a decade as a sysad with a focus on endpoint patching

Disable through gpedit.msc

https://monovm.com/blog/disable-windows-update-from-group-policy/