# Telling Microsoft to Shove-It

opt out of Microsoft's auto-updating your windows pc with this two part fix!

the first halve is the totally inconspicuous 'tell-off-Microsoft.bat' file, it needs to make changes to your device in order to remove the primary files and installers used by windows and multiple servers to force the packets to preinstall onto your device and than eventually force install (typically while restarting the pc, most common after the battery has died and the user is forced to fully restart the pc, but it happens practically whenever it f_cking feels like it)

you run it like any basic batch file or executable, a mere double click and it will prompt you to give it admin permissions (this is so it can actually make the changes to your device)

rows 10-to-14 of the batch script will show this if opened;

echo Stopping Windows Update Services...
net stop wuauserv /y
net stop bits /y
net stop cryptSvc /y
net stop msiserver /y

this shuts down the operations so they can be changed/deleted, similarly to how a game can;t be moved from its folder while open, it must be disabled before you can make any changes to the system (this is essentially step one but not really since the real first step is admin privileges)

rows 16-to-18 have the software removal line required to remove the packets preinstalled by windows without user permissions;

if exist "C:\Windows\SoftwareDistribution" (
    rd /s /q "C:\Windows\SoftwareDistribution"
)

it just clears the amount of space that has most likely been taken from main storage or allocated space needed for system running (if you have removed allocated space than these are both the same storage capacity and there's no real difference here

rows 20 and 21 have the finishing touches to the lines found in 16-to-18, it makes sure that the update cannot be installed when the pc shuts off;

takeown /f "%WINDIR%\System32\UsoClient.exe" /a >nul 2>&1
icacls "%WINDIR%\System32\UsoClient.exe" /inheritance:r /grant:r Administrators:RX /grant:r system:RX >nul 2>&1

we essentially cut out the orchestrator and the configurator needed to set the update for running, but windows will repair this on restart using the medic, so its technically only temporary here.

rows 23-to-25 make sure that the disabling of wuauserv and bits is as official and permanent as possible in this first step;

echo Disabling Restart For Windows Update Services...
sc config wuauserv start= disabled
sc config bits start= disabled

this sums up part one, and this is all completely un-doable with minimum to absolutely no complications or repercussions (this is mostly a temp fix here)


the second part will be going over permanent or mostly permanent changes to the system configurations and permissions, we essentially choose to make the user top boss on update packages which strips the servers and windows' systems of their ability to change the differences we made, back to their defaults, which would/will allow the update packages to be reinstalled and the blocks to fail (making part one practically redundant imo but im biased so like don't take my word completely on it or nth)


what we are doing is disabling the windows update medic service (WaaSMedicSvc) so it can't undo part one, this makes part one a permanent fix rather than a temp patch

the first step is locating the registry that allows the medic to start in the first place

locate the registry editor by pressing the 'Windows key + R' shortcut and than type 'regedit' and use 'Ctrl + Shift + Enter' to open the registry editor in admin mode (needed for making changes in permissions)

travel down the path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" or search it in the searchbar

see the 'Start' file and double click to open the context menu (must highlight blue or whatever other color), than click 'modify' to change its value to 3(manual) or 4(disabled)  (im unsure of the differences)

to prevent the value from being changed we have to revoke the permissions from "ALL APP PACKAGES" (this is a group ran alongside the update installer, we want this to be set to read mode)

without leaving the current panel, click the WaaSMedicSvc folder to open the context menu, and than click permissions, once open, locate "ALL APP PACKAGES" and set its permissions to 'read', this will prevent it from reenabling the medic to turn wuauserv and bits back on (rearming the next update)

once the permission is set to read we need to stop the medic from inheriting permissions from the folder it resides in (\services\). this is done by clicking advanced in the permissions menu and pressing the 'disable inheritance' button and selecting 'convert inherited objects' (DO NOT REMOVE COMPLETELY) (you will immediately notice all the inherited permissions clear out leaving the ones that were already there and keeping the read state we just forced) 

TO BE CONTINUED/FINISHED (im unsure if there's any more steps here and cannot remember anything else to put here yet)