Slashdot Mirror
Ask Slashdot: Make Windows Update Install Only Security Updates Automatically?
An anonymous reader writes: After the news earlier this month about Microsoft forcing the Windows 10 upgrade on people who don't want it, my sizeable extended family has been coming to me for a solution. They don't want to be guinea pigs this early in the Windows 10 release cycle, but it looks like Microsoft may not be giving them a choice. My reading of Woody Leonhard's advice is that the only way to ensure the upgrade doesn't happen is to disable Windows Update, but that seems extreme. I want my family to install security updates, but I don't relish the idea of explaining to them how to install just those and hide the less-desireable updates.
The ideal solution would be to have only security updates install automatically, but it looks like it's easier said than done. I've looked at third-party tools like Autopatcher and Portable Update, but a security-only option doesn't seem to be very standard. From what I've read, Microsoft doesn't even package security updates separately, sometimes mixing merely Important and Recommended updates in the downloaded CAB file. I wish I could get them off Windows, but it's not an option. They use Windows at work or school, and don't want to go through the process of learning another OS. Maybe the current situation with Windows 10 will convince them eventually, but they need something now. I would really like to come up with a solution before the next Patch Tuesday on October 13. Do any of the more knowledgeable Slashdotters out there have any advice?
The ideal solution would be to have only security updates install automatically, but it looks like it's easier said than done. I've looked at third-party tools like Autopatcher and Portable Update, but a security-only option doesn't seem to be very standard. From what I've read, Microsoft doesn't even package security updates separately, sometimes mixing merely Important and Recommended updates in the downloaded CAB file. I wish I could get them off Windows, but it's not an option. They use Windows at work or school, and don't want to go through the process of learning another OS. Maybe the current situation with Windows 10 will convince them eventually, but they need something now. I would really like to come up with a solution before the next Patch Tuesday on October 13. Do any of the more knowledgeable Slashdotters out there have any advice?
If any number of people did this, then Microsoft would just push a "security" update that offered you Windows 10 or installed spying on the basis that they could somehow offer you more security. "KB6666666 - improve security by making windows phone home at every opportunity"
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
But any way I know of of blocking any updates blocks all of them. like pulling the cable or disabling wifi.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
I was going to suggest Debian GNU/Linux as an alternative OS, but then I remembered how I was treated like a filthy guinea pig when Debian decided to transition to systemd. When I upgraded my Debian testing (which, contrary to its name, has little to do with testing and has historically been far more stable than even the stable releases of other Linux distros) workstation and systemd was unexpectedly installed, everything went to hell. My workstation wouldn't boot, the error logging was all fucked up, and all I found when googling for help were many other complaints about various problems from many other victims.
Knowing how frustrating it can be when an operating system provider ends up trashing an existing installation through what should be routine updates, I realized that I could not possibly recommend Debian. Perhaps the submitter could do what I did: switch to FreeBSD. It's a mature, reliable, robust operating system that can still run a wide variety of the software that runs on Linux. Its developers care deeply about not damaging existing installations. FreeBSD has shown itself to be the future.
You'll get what Microsoft wants and like it, or not - they don't care about your preferences anymore.
If you want to send them a message, stop buying their software. This is a less painful option than it used to be, believe it or not.
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
SCCM can push patches whenever the admin feels like it... maybe this would work for you? Although it would require setting up the server somewhere.
Buck Feta. You know what to do.
Unless you wish to become the IT department for your sizeable extended family, don't touch this. The moment you take over patch management is the moment that others (Microsoft, Geek Squad, MS Fixit, etc.) cease being able to fix minor problems when their PCs go goofy.
If you do want to become the IT department, look into Microsoft's Enterprise solutions. They continue to allow personalized patch management there.
But, as Scar told the mouse, "Life isn't fair, is it?".
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The "conventional wisdom" of having automatic updates on is to keep the huge ecosystem of windows desktops and laptops at least reasonably up to date, especially as to security issues, and this has to some extent worked. However, this new policy of trying to cram windows 10 down everyone's throat is beginning to have the opposite effect. Many people I know, myself included, have disabled automatic updates and more will follow. I have been asked many times how to stop upgrading from Windows 7 to Windows 10 and about the only answer I can give is either to turn automatic updates off or switch to Linux. Since few people are willing to move to Linux this change by Microsoft is actually increasing the threat from people using windows platforms.
Now in Windows 10, with no indication of what a given update may contain or do it opens the door to just about anything on those machines. Somehow this makes me think of the recent unpleasantness that Volkswagen has unleashed upon itself. Just trust me to do the right thing. I am not a great admirer of Regan, either as an actor or politician, but one thing he said was on the mark. "Trust but verify."
Let us assume Windows is downloading Windows 10 automatically, even if you did not reserve it. Do you get Windows 10 installed by doing the typical "You need to restart your computer in order to get security updates"? If that is not what happens, then the only thing wrong is downloading 3.5GB worth of unwanted data. It is still wrong, though. I do not think people are installing Windows 10 without ever clicking on YES somewhere. I am sure it is the user's fault if they click. It is always the user's fault if they install unwanted/malware software that was bundled with other software by clicking a YES button.
So, do not spread wrong rumours, pretty please. I have not heard of anybody installing Windows 10 without his/her consent.
Of course, you don't have to install Linux. Maybe some people would be happier with Apple. You run into a lot of the same problems with them -- Apple looks out for Apple. I got tired of beating my head against my computer to make it work in the mid 2000s and ran Apple hardware for nearly a decade. You plug their shit in, it just works. It's tempting. But even more than Microsoft, their software thinks it knows how you should be working and it's difficult or impossible to do anything differently. You start banging your head against your computer again, and at least with Linux when you do that, you damn well can make the system do what you want it to. Apple's gaming scene when I was using them was only marginally better than Linux's -- you could make a couple of big MMOs and some decade-old games work with their systems.
You could also go with FreeBSD. I don't know a lot about them, but with the whole systemd debacle, a lot of people are moving in that direction now. I'd have to set it up and run it for a while before I could recommend it to relatives.
So that pretty much leaves me with Linux. If you're moving away from Microsoft because you don't like their agenda, you probably don't want a commercial distribution of Linux, either. Find one with an active community that has politics you like and go with them. Or just decide that maybe you can put up with Microsoft's bullshit after all. That's your choice, right there, and you should be able to talk intelligently with your relatives about it.
You don't have to stay there once you make that move, either. I've just about eliminated all the Apple stuff I had going on -- my old Core 2 Duo Macbook is running Linux and my destop dual boots windows and Linux. I'm still booting back to Windows for the games collection and because getting files off my Android phone is easier with Windows. I prefer Kdenlive in Linux for editing my GoPro videos, but I mostly just clip a bit off the front and back of the video and tweak the contrast and sharpening.
The point is that for all these things you always have that choice. Live with your current vendor's bullshit or find some vendor whose bullshit you can tolerate.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
First, if they are moving from 7 to 10 they are learning a new OS, and if they are on Win8 they have already been under the auto update yoke.
Second, they are more likely locked into a program rather than a OS, consider what it is they have to run on Windows, is there an equivalent in Linux?
If so, the "learn a new OS" complaint (while valid) isn't as hard as they might think these days, there is a sort of "start button" and there is a menu and it should not be that difficult.
The main thing I would stress, if they are on Win 7, is why update? Does it do what you want? Then leave it be and in time there will be a solution offered to make win10 more palatable for them.
Too many people got caught up in the "free upgrade" and I already hear complaints on the gaming servers, lots of regret there and very few "it's better stories".
The whole Win10 thing seems like MS making it easier for themselves while beating up and robbing their customers (of personal data).
"If any question why we died, Tell them because our fathers lied."
They "don't want to go through the process of learning another OS".
What do they think moving to Win 10 will be like?
Move them to Linux Mint Cinnamon, that's more like what they are used to than any of Win 7, Win 8, or Win 10.
"Cock Up Your Beaver" does not mean what you think. This sig is intended to clog filters and annoy do-gooders
"Zorin OS is a multi-functional operating system designed specifically for Windows users who want to have easy and smooth access to Linux."
First off, If there's no reason not to upgrade other than FUD, then they should update. 7 only has a little more than 4 years left and is already in extended support and windows 8/8.1 interface is crap vs 10. If they're worried about being spied on stay with a Local account and don't setup a Microsoft account. It will only take the same telemetry that they've been doing since the customer experience program in vista, which you can then turn off. That being said MS shouldn't have started downloading the OS on PC's without explicit reservations but even that can be disabled.
Easiest method to disable windows 10 from updating is to use the DisableGWX Policy setting. This site's Method 3 will walk you through setting the registry key. Microsoft Also has some other blocking methods as well.
If you just want security patches from that point forward go to windows update settings and uncheck "give me Recommended updates the same way I receive important updates"
In Soviet Russia, Trojan exploits YOU!
Have a look at WSUS Offline. It does more or less what you're asking for, although you do have to run the collector and client manually every post patch Tuesday.
No, there is no more patch Tuesday. And also no, because you cannot trust Microsoft not to put spying or Windows 10 "upgrading" into a security patch.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Can't you pick and choose updates with the corp version? Only home edition forces them on you.
You can pick and choose updates in the home version, too. By default, you get all updates, including recommended ones. But you can tell it to just notify you and not download or install updates. Then you can run windows update manually, and click on each patch, then click the link for more info, then read about it in your web browser. If you don't want an update, you can hide it in windows update, and it will no longer appear and you will no longer be nagged to install it. All very straightforward, except that useful patch descriptions aren't actually given in the windows update app, you have to keep going to the browser. And microsoft will no longer give you that information without enabling javascript for their domain, their basic site functionality now requires javascript, either because they want to run malicious code on your PC or because they are completely incompetent and forgot how to put content into a webpage without javascript, take your pick.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Or Slackware -- just about any distro would make a good replacement for most people, but the few times I did that, all I heard "not like windows, windows is better" and the whining begins :) Now I do not care what people want to run, just do not call me.
Microsoft has two versions of Windows 10 for volume license users: CB and LTSB.
CB (Current Branch) is the same as what the home users have to deal with.
LTSB (Long Term Service Branch) however does things differently.
"For example, systems powering hospital emergency rooms, air traffic control towers, financial trading systems, factory floors, just to name a few, may need very strict change management policies, for prolonged periods of time. To support Windows 10 devices in these mission critical customer environments we will provide Long Term Servicing branches at the appropriate time intervals. On these branches, customer devices will receive the level of enterprise support expected for the mission critical systems, keeping systems more secure with the latest security and critical updates, while minimizing change by not delivering new features for the duration of mainstream (five years) and extended support (five years)."
Source: Windows 10 for Enterprise: More secure and up to date
https://blogs.windows.com/busi...
The only other solution I can think of would rely on setting up a WSUS server, and managing the updates from there. The OP would then just need to change some registry settings on his family's computers to point to his WSUS server for updates.
Instructions: Configure Automatic Updates using Registry Editor
https://technet.microsoft.com/...
So, in other words, because you're incompetent at Windows, Trabant, and 1960s VW Beetle.
It little behooves the best of us to comment on the rest of us.
The three registry keys to disable GWX and the GWX advert in Windows Update are these...
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\GWX]
"DisableGwx"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DisableOSUpgrade"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade]
"ReservationsAllowed"=dword:00000000
Then open an elevated command prompt (search for cmd in the start menu, right click and Run as Administrator) and uninstall the following telemetry KBs...
wusa /uninstall /kb:3068708 /norestart /uninstall /kb:3022345 /norestart /uninstall /kb:3075249 /norestart /uninstall /kb:3080149 /norestart
wusa
wusa
wusa
In Control Panel > Windows Update > Change Settings, untick "Give me recommended updates the same way as I receive important updates" as some optional updates have been used to send down unwanted GWX/Telemetry updates.
Also in Control Panel > Windows Update, search for updates, then view the optional ones, then hide three of those KBs above (3022345 shouldn't appear as it's superseded) by right-clicking on them and choosing the hide option.
Now reboot the computer, search for CEIP in the start menu, run it, and change the setting to disable telemetry to MS.
If the C:\$WINDOWS.~BT then your computer is downloading Windows 10 in the background. Search for CleanMgr in the start menu and run it to remove the "Windows Update temporary files" category. Although that may unhide those three KBs above and you many need to rehide them.
Telemetry info from http://www.ghacks.net/2015/08/28/microsoft-intensifies-data-collection-on-windows-7-and-8-systems/
Unless MS send a recommended update which adds more GWX or Telemetry stuff to Windows 7/8, your extended family's computers will look after themselves from now on.
If staying on Windows is a must, simply get the Enterprise version. It allows to manage the updates the updates the way it was in Windows 7.
What do they think moving to Win 10 will be like?
A piece of cake?
In Steam's August Hardware and Software Survey,16% of Steam gamers were running 64 Bit Win 10, a bare 0.92% Linux. Steam Hardware and Software Survey: August 2015
Worldwide usage of Windows 10 in its first calendar month (August) was 4.9% compared to 1% for Windows 8 and 4.1% for Windows 7 after their first complete month.
Windows 10 first month worldwide usage well ahead of that recorded by Windows 8
Or not.
Any reason beyond out of control paranoia why you'd think Microsoft would do something so outrageously destructive? Remember: forced updates mean forced incompatibilities. A sizable minority of the population will find their PCs unfit for purpose the moment Windows 10 is installed on it.
The lawsuits would bankrupt Microsoft in a matter of weeks.
You are not alone. This is not normal. None of this is normal.
Just an FYI, as this is a Windows update thread which is trying to avoid Win10 nagware + telemetry. These are the updates I've identified so far. Feel free to add/update the list:
KB 2952664
Compatibility update for upgrading Windows 7
https://support.microsoft.com/...
KB 2976978
Compatibility update for Windows 8.1 and Windows 8
https://support.microsoft.com/...
KB 3022345
Update for customer experience and diagnostic telemetry
https://support.microsoft.com/...
KB 3035583
Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1
https://support.microsoft.com/...
KB 3068708
Update for customer experience and diagnostic telemetry
https://support.microsoft.com/...
KB 3075249
Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7
https://support.microsoft.com/...
KB 3080149
Update for customer experience and diagnostic telemetry
https://support.microsoft.com/...