Can't kill UpdateAssistant in the scheduler

Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I can't
disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Fokke Nauta wrote:
Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I can't
disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Take a look at this script. It's an example of a way to
disable the reboot after a Patch Tuesday large update comes
in.

"Disable-W10-Update-Reboots.bat"

https://textuploader.com/dsvox

This is an example of interacting with the Task Scheduler.

schtasks /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot" /disable nul 2&1

The "2&1" redirects stderr to stdout.
The " nul" redirects stdout to /dev/null (tosses away textual output).
The author of the script is throwing away feedback from the command
so it doesn't appear on the screen.

The batch file is disabling a line in the Task Scheduler.
A line very close to where you need some work done.

Note that, if virtually any run of the Update Orchestrator EXE
happens, it will refresh the task list and could easily override
what you're attempting to do. You may prepare a small
script that you run at 11PM each night, to kill the item
in question.

That script is great, in that it uses the Task Scheduler to
repeat its own repetitive running, so it keeps pounding
on the Scheduler every day. The above script is a great
template for how to do this kind of thing. The script is
stored in C:\tools so that an OS upgrade will not wipe
out the script.

*******

OK, now that the fun is over, what else do we need to know ?

1) You'll probably want to run the batch file as administrator.
Maybe the items in question are controlled by TrustedInstaller,
but I don't think so.

2) Things run from Task Scheduler, run with SYSTEM account
authority. Which, in the case of the above script, might
be how the schtasks is making changes to the Task Scheduler
on a repetitive basis.

If you remove the redirections on script output and get
the script to dump text to the screen while running it
interactively in Administrator Command Prompt - you may
see that certain lines in the script are failing.

*******

You can elevate a Command Prompt window to run as SYSTEM.
The sysinternals.com site has "PSTOOLS" package, which
contains psexec64.exe. The "whoami" built-in command
indicates your current account authority. The
SYSTEM account is handy for this sort of work...

In this example, I deleted all discovered hardware in
the registry. Which forces the OS to rediscover the
hardware later. This is a technique from the Win2K era.
The ENUM key would not normally be accessible by
using Administrator, but I think SYSTEM worked on it.
The other token you sometimes need, is TrustedInstaller,
but that takes a different recipe.

https://s9.postimg.cc/vwioz43f3/WIN10_delete_ENUM.gif

psexec -hsi cmd === 32 bit OS, opens SYSTEM cmd.exe window
psexec64 -hsi cmd === 64 bit OS, opens SYSTEM cmd.exe window

HTH,
Paul

On 9/25/2018 5:08 AM, Fokke Nauta wrote:
Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I can't
disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into
the "Run" box and click "OK". Don't forget the period between "appwiz"
and "cpl". Then find "Windows 10 Update Assistant" and uninstall it.

Ben

On 26/09/2018 08:04, Paul wrote:
Fokke Nauta wrote:
Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I
can't disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Take a look at this script. It's an example of a way to
disable the reboot after a Patch Tuesday large update comes
in.

"Disable-W10-Update-Reboots.bat"

https://textuploader.com/dsvox

This is an example of interacting with the Task Scheduler.

schtasks /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot"
/disable nul 2&1

The "2&1" redirects stderr to stdout.
The " nul" redirects stdout to /dev/null (tosses away textual output).
The author of the script is throwing away feedback from the command
so it doesn't appear on the screen.

The batch file is disabling a line in the Task Scheduler.
A line very close to where you need some work done.

Note that, if virtually any run of the Update Orchestrator EXE
happens, it will refresh the task list and could easily override
what you're attempting to do. You may prepare a small
script that you run at 11PM each night, to kill the item
in question.

That script is great, in that it uses the Task Scheduler to
repeat its own repetitive running, so it keeps pounding
on the Scheduler every day. The above script is a great
template for how to do this kind of thing. The script is
stored in C:\tools so that an OS upgrade will not wipe
out the script.

*******

OK, now that the fun is over, what else do we need to know ?

1) You'll probably want to run the batch file as administrator.
Maybe the items in question are controlled by TrustedInstaller,
but I don't think so.

2) Things run from Task Scheduler, run with SYSTEM account
authority. Which, in the case of the above script, might
be how the schtasks is making changes to the Task Scheduler
on a repetitive basis.

If you remove the redirections on script output and get
the script to dump text to the screen while running it
interactively in Administrator Command Prompt - you may
see that certain lines in the script are failing.

*******

You can elevate a Command Prompt window to run as SYSTEM.
The sysinternals.com site has "PSTOOLS" package, which
contains psexec64.exe. The "whoami" built-in command
indicates your current account authority. The
SYSTEM account is handy for this sort of work...

In this example, I deleted all discovered hardware in
the registry. Which forces the OS to rediscover the
hardware later. This is a technique from the Win2K era.
The ENUM key would not normally be accessible by
using Administrator, but I think SYSTEM worked on it.
The other token you sometimes need, is TrustedInstaller,
but that takes a different recipe.

https://s9.postimg.cc/vwioz43f3/WIN10_delete_ENUM.gif

psexec -hsi cmd === 32 bit OS, opens SYSTEM cmd.exe window
psexec64 -hsi cmd === 64 bit OS, opens SYSTEM cmd.exe window

HTH,
Paul

Thanks, Paul.
I'll have a look into this.
I'll come back on this issue.

Fokke

On 26/09/2018 10:20, Ben Myers wrote:
On 9/25/2018 5:08 AM, Fokke Nauta wrote:
Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I
can't disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into
the "Run" box and click "OK". Don't forget the period between "appwiz"
and "cpl". Then find "Windows 10 Update Assistant" and uninstall it.

Ben

Thanks, Ben.
Found it! It's gone.
It's gone from the scheduler as well. So, see what's going to happen
tonight.

Fokke

Fokke Nauta wrote:
On 26/09/2018 10:20, Ben Myers wrote:
On 9/25/2018 5:08 AM, Fokke Nauta wrote:
Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I
can't disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into
the "Run" box and click "OK". Don't forget the period between "appwiz"
and "cpl". Then find "Windows 10 Update Assistant" and uninstall it.

Ben

Thanks, Ben.
Found it! It's gone.
It's gone from the scheduler as well. So, see what's going to happen
tonight.

Fokke

This is a third party software ?

I thought you were referring to USO.

Paul

On 26/09/2018 14:41, Paul wrote:
Fokke Nauta wrote:
On 26/09/2018 10:20, Ben Myers wrote:
On 9/25/2018 5:08 AM, Fokke Nauta wrote:
Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I
can't disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into
the "Run" box and click "OK". Don't forget the period between "appwiz"
and "cpl". Then find "Windows 10 Update Assistant" and uninstall it.

Ben

Thanks, Ben.
Found it! It's gone.
It's gone from the scheduler as well. So, see what's going to happen
tonight.

Fokke

This is a third party software ?

I thought you were referring to USO.

Paul

No, Paul. It was the Windows Update Assistant. It seemed to be installed
on our server, but not on my W10 pc.

Fokke

On 26/09/2018 08:04, Paul wrote:
Fokke Nauta wrote:
Hi all,

Our file server is running W10 Pro 64b. An application is installed,
which turns the server into hibernation mode at 23.00, and it wakes up
again at 7.00. Lately I found that the server is up and running at
night. In the event viewer I noticed that it was woken op by the
UpdateAssistant. I found it in the scheduler (under Windows) but I
can't disable it, not even in the admin account.
What can I do to stop this? Automatic updates are disabled.

Thanks beforehand.

Fokke

Take a look at this script. It's an example of a way to
disable the reboot after a Patch Tuesday large update comes
in.

"Disable-W10-Update-Reboots.bat"

https://textuploader.com/dsvox

This is an example of interacting with the Task Scheduler.

schtasks /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot"
/disable nul 2&1

The "2&1" redirects stderr to stdout.
The " nul" redirects stdout to /dev/null (tosses away textual output).
The author of the script is throwing away feedback from the command
so it doesn't appear on the screen.

The batch file is disabling a line in the Task Scheduler.
A line very close to where you need some work done.

Note that, if virtually any run of the Update Orchestrator EXE
happens, it will refresh the task list and could easily override
what you're attempting to do. You may prepare a small
script that you run at 11PM each night, to kill the item
in question.

That script is great, in that it uses the Task Scheduler to
repeat its own repetitive running, so it keeps pounding
on the Scheduler every day. The above script is a great
template for how to do this kind of thing. The script is
stored in C:\tools so that an OS upgrade will not wipe
out the script.

*******

OK, now that the fun is over, what else do we need to know ?

1) You'll probably want to run the batch file as administrator.
Maybe the items in question are controlled by TrustedInstaller,
but I don't think so.

2) Things run from Task Scheduler, run with SYSTEM account
authority. Which, in the case of the above script, might
be how the schtasks is making changes to the Task Scheduler
on a repetitive basis.

If you remove the redirections on script output and get
the script to dump text to the screen while running it
interactively in Administrator Command Prompt - you may
see that certain lines in the script are failing.

*******

You can elevate a Command Prompt window to run as SYSTEM.
The sysinternals.com site has "PSTOOLS" package, which
contains psexec64.exe. The "whoami" built-in command
indicates your current account authority. The
SYSTEM account is handy for this sort of work...

In this example, I deleted all discovered hardware in
the registry. Which forces the OS to rediscover the
hardware later. This is a technique from the Win2K era.
The ENUM key would not normally be accessible by
using Administrator, but I think SYSTEM worked on it.
The other token you sometimes need, is TrustedInstaller,
but that takes a different recipe.

https://s9.postimg.cc/vwioz43f3/WIN10_delete_ENUM.gif

psexec -hsi cmd === 32 bit OS, opens SYSTEM cmd.exe window
psexec64 -hsi cmd === 64 bit OS, opens SYSTEM cmd.exe window

HTH,
Paul

Thanks, Paul.

Interesting script. I modified it and turned it into a BTM script. I ran
it from an elevated TCC/LE promtp.
Now wait and see ...

Fokke