Blocking Windows 10 update on the router?

[Claghorn]

Anyone have any convenient scripts I could run in the command line (or even connect to buttons in the gui somehow) to block and unblock all the IP addresses associated with windows update?

Since Microsoft won't let Windows 10 home edition users prevent updates, I thought it might be possible to block them in the router till I'm actually willing to install them. (This became higher priority for me when I had to sit on my thumbs waiting for windows to update in the middle of doing my taxes a few weeks ago .

Seems like it would be a useful feature for folks who are tired of Microsoft running their lives.

 

[ColinTaylor]

If you're connecting over Wi-Fi you could set it as a "metered connection". That will stop it downloading updates. Doesn't work for wired connections though (unless you edit the registry).

 

[bbunge]

Get the Creators Update of Win 10. It allows Ethernet to be set as metered. I have a test pc set that way and it has not gotten the usual patch Tuesday updates. Am waiting to see when it prompts for updates.

Sent from my P01M using Tapatalk

 

[sfx2000]

Since Microsoft won't let Windows 10 home edition users prevent updates, I thought it might be possible to block them in the router till I'm actually willing to install them

If that were the case - you'd miss out on the Window Defender fix sent out today...

(Defender runs above root level, it has to as a anti-virus to detect root attacks - MSFT was pretty good about pushing that out for Win7/8/10 there)

 

[Vexira]

if your trying to block the tracking i suggest, a raspberry pi 3, and pi hole software. Also blocking updates is not advisable.

 

[thelonelycoder]

if your trying to block the tracking i suggest, a raspberry pi 3, and pi hole software. Also blocking updates is not advisable.

Some telemetry data, and maybe other data, is sent out via IP address and not by domain.
Pi-Hole and my ad-blocker cannot cover that. You need firewall rules to block these cases.

 

[Vexira]

Some telemetry data, and maybe other data, is sent out via IP address and not by domain.
Pi-Hole and my ad-blocker cannot cover that. You need firewall rules to block these cases.

OK then how does all the blocking via hosts files work, for telemetry, cause all the ip's are attached to domains. I've blocked the domains, and the ip's associated with them stopped working. Well at least in my case that is. If there are ip's I'm not blocking then I'll find a way to neutralise them if that's the case. I'm not saying that your wrong, I'm just saying that I've never encountered the case you presented, that's all.

 

[thelonelycoder]

OK then how does all the blocking via hosts files work, for telemetry, cause all the ip's are attached to domains. I've blocked the domains, and the ip's associated with them stopped working. Well at least in my case that is. If there are ip's I'm not blocking then I'll find a way to neutralise them if that's the case. I'm not saying that your wrong, I'm just saying that I've never encountered the case you presented, that's all.

The way Pi-Hole and AB-Solution work is to prevent LAN clients from resolving domains to real world IP with dnsmasq. They get resolved to a local IP where they dead end, the 'Hole' in Pi-Hole is the blocking IP. In AB this is either 0.0.0.0 or the pixelserv-tls IP if installed.
To circumvent this, some Apps use a hard coded or dynamic IP in the software to circumvent this.
In Dnsmasq, you cannot block by IP, only by domains.

 

[Vexira]

The way Pi-Hole and AB-Solution work is to prevent LAN clients from resolving domains to real world IP with dnsmasq. They get resolved to a local IP where they dead end, the 'Hole' in Pi-Hole is the blocking IP. In AB this is either 0.0.0.0 or the pixelserv-tls IP if installed.
To circumvent this, some Apps use a hard coded or dynamic IP in the software to circumvent this.
In Dnsmasq, you cannot block by IP only by domains.

I understand what you mean, so just a question is there any too that can be used to block ips, ive been looking at stuff for the pi, since im useless at working out router scripts.
Havent had the time to reaearch all the tutorals in that regard.

 

[thelonelycoder]

I understand what you mean, so just a question is there any too that can be used to block ips, ive been looking at stuff for the pi, since im useless at working out router scripts.
Havent had the time to reaearch all the tutorals in that regard.

As all the ipset scripts are out of the question posted here, you might want to look out for similar blockers for your Raspberry. They all involve the firewall and might not be of the 'click and install' nature.

 

[pege63]

See if this helps

Navigate to Computer Configuration\Administrative Templates\Windows Components\Windows Update.

Locate the “Configure Automatic Updates” setting in the right pane and double-click it. Set it to “Enabled,” and then select your preferred setting. For example, you can choose “Auto download and notify for install” or “Notify for download and notify for install.” Save the change.

Visit the Windows Update pane, click “Check for updates,” and then select “Advanced options.” You should see your new setting enforced here. You’ll also see a note saying “Some settings are managed by your organization,” informing you that these options can only be changed in Group Policy.

To disable this later, go back to the Group Policy editor, double-click the “Configure Automatic Updates” setting, and then change it from “Enabled” to “Not configured.” Save your changes, visit the Windows Update pane again, click “Check for updates,” and then select “Advanced options.” You’ll see everything change back to the default setting. (Windows Update only seems to notice the setting change after you click “Check for updates.”)