If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Rate Thread | Display Modes |
#1
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
Hi all,
Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke |
Ads |
#2
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
Fokke Nauta wrote:
Hi all, Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke Take a look at this script. It's an example of a way to disable the reboot after a Patch Tuesday large update comes in. "Disable-W10-Update-Reboots.bat" https://textuploader.com/dsvox This is an example of interacting with the Task Scheduler. schtasks /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot" /disable nul 2&1 The "2&1" redirects stderr to stdout. The " nul" redirects stdout to /dev/null (tosses away textual output). The author of the script is throwing away feedback from the command so it doesn't appear on the screen. The batch file is disabling a line in the Task Scheduler. A line very close to where you need some work done. Note that, if virtually any run of the Update Orchestrator EXE happens, it will refresh the task list and could easily override what you're attempting to do. You may prepare a small script that you run at 11PM each night, to kill the item in question. That script is great, in that it uses the Task Scheduler to repeat its own repetitive running, so it keeps pounding on the Scheduler every day. The above script is a great template for how to do this kind of thing. The script is stored in C:\tools so that an OS upgrade will not wipe out the script. ******* OK, now that the fun is over, what else do we need to know ? 1) You'll probably want to run the batch file as administrator. Maybe the items in question are controlled by TrustedInstaller, but I don't think so. 2) Things run from Task Scheduler, run with SYSTEM account authority. Which, in the case of the above script, might be how the schtasks is making changes to the Task Scheduler on a repetitive basis. If you remove the redirections on script output and get the script to dump text to the screen while running it interactively in Administrator Command Prompt - you may see that certain lines in the script are failing. ******* You can elevate a Command Prompt window to run as SYSTEM. The sysinternals.com site has "PSTOOLS" package, which contains psexec64.exe. The "whoami" built-in command indicates your current account authority. The SYSTEM account is handy for this sort of work... In this example, I deleted all discovered hardware in the registry. Which forces the OS to rediscover the hardware later. This is a technique from the Win2K era. The ENUM key would not normally be accessible by using Administrator, but I think SYSTEM worked on it. The other token you sometimes need, is TrustedInstaller, but that takes a different recipe. https://s9.postimg.cc/vwioz43f3/WIN10_delete_ENUM.gif psexec -hsi cmd === 32 bit OS, opens SYSTEM cmd.exe window psexec64 -hsi cmd === 64 bit OS, opens SYSTEM cmd.exe window HTH, Paul |
#3
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
On 9/25/2018 5:08 AM, Fokke Nauta wrote:
Hi all, Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into the "Run" box and click "OK". Don't forget the period between "appwiz" and "cpl". Then find "Windows 10 Update Assistant" and uninstall it. Ben |
#4
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
On 26/09/2018 08:04, Paul wrote:
Fokke Nauta wrote: Hi all, Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke Take a look at this script. It's an example of a way to disable the reboot after a Patch Tuesday large update comes in. "Disable-W10-Update-Reboots.bat" https://textuploader.com/dsvox This is an example of interacting with the Task Scheduler. schtasks /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot" /disable nul 2&1 The "2&1" redirects stderr to stdout. The " nul" redirects stdout to /dev/null (tosses away textual output). The author of the script is throwing away feedback from the command so it doesn't appear on the screen. The batch file is disabling a line in the Task Scheduler. A line very close to where you need some work done. Note that, if virtually any run of the Update Orchestrator EXE happens, it will refresh the task list and could easily override what you're attempting to do. You may prepare a small script that you run at 11PM each night, to kill the item in question. That script is great, in that it uses the Task Scheduler to repeat its own repetitive running, so it keeps pounding on the Scheduler every day. The above script is a great template for how to do this kind of thing. The script is stored in C:\tools so that an OS upgrade will not wipe out the script. ******* OK, now that the fun is over, what else do we need to know ? 1) You'll probably want to run the batch file as administrator. Maybe the items in question are controlled by TrustedInstaller, but I don't think so. 2) Things run from Task Scheduler, run with SYSTEM account authority. Which, in the case of the above script, might be how the schtasks is making changes to the Task Scheduler on a repetitive basis. If you remove the redirections on script output and get the script to dump text to the screen while running it interactively in Administrator Command Prompt - you may see that certain lines in the script are failing. ******* You can elevate a Command Prompt window to run as SYSTEM. The sysinternals.com site has "PSTOOLS" package, which contains psexec64.exe. The "whoami" built-in command indicates your current account authority. The SYSTEM account is handy for this sort of work... In this example, I deleted all discovered hardware in the registry. Which forces the OS to rediscover the hardware later. This is a technique from the Win2K era. The ENUM key would not normally be accessible by using Administrator, but I think SYSTEM worked on it. The other token you sometimes need, is TrustedInstaller, but that takes a different recipe. https://s9.postimg.cc/vwioz43f3/WIN10_delete_ENUM.gif psexec -hsi cmd === 32 bit OS, opens SYSTEM cmd.exe window psexec64 -hsi cmd === 64 bit OS, opens SYSTEM cmd.exe window HTH, Paul Thanks, Paul. I'll have a look into this. I'll come back on this issue. Fokke |
#5
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
On 26/09/2018 10:20, Ben Myers wrote:
On 9/25/2018 5:08 AM, Fokke Nauta wrote: Hi all, Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into the "Run" box and click "OK". Don't forget the period between "appwiz" and "cpl". Then find "Windows 10 Update Assistant" and uninstall it. Ben Thanks, Ben. Found it! It's gone. It's gone from the scheduler as well. So, see what's going to happen tonight. Fokke |
#6
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
Fokke Nauta wrote:
On 26/09/2018 10:20, Ben Myers wrote: On 9/25/2018 5:08 AM, Fokke Nauta wrote: Hi all, Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into the "Run" box and click "OK". Don't forget the period between "appwiz" and "cpl". Then find "Windows 10 Update Assistant" and uninstall it. Ben Thanks, Ben. Found it! It's gone. It's gone from the scheduler as well. So, see what's going to happen tonight. Fokke This is a third party software ? I thought you were referring to USO. Paul |
#7
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
On 26/09/2018 14:41, Paul wrote:
Fokke Nauta wrote: On 26/09/2018 10:20, Ben Myers wrote: On 9/25/2018 5:08 AM, Fokke Nauta wrote: Hi all, Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke Press the Windows and "R" keys simultaneously, type "appwiz.cpl" into the "Run" box and click "OK". Don't forget the period between "appwiz" and "cpl". Then find "Windows 10 Update Assistant" and uninstall it. Ben Thanks, Ben. Found it! It's gone. It's gone from the scheduler as well. So, see what's going to happen tonight. Fokke This is a third party software ? I thought you were referring to USO. Paul No, Paul. It was the Windows Update Assistant. It seemed to be installed on our server, but not on my W10 pc. Fokke |
#8
|
|||
|
|||
Can't kill UpdateAssistant in the scheduler
On 26/09/2018 08:04, Paul wrote:
Fokke Nauta wrote: Hi all, Our file server is running W10 Pro 64b. An application is installed, which turns the server into hibernation mode at 23.00, and it wakes up again at 7.00. Lately I found that the server is up and running at night. In the event viewer I noticed that it was woken op by the UpdateAssistant. I found it in the scheduler (under Windows) but I can't disable it, not even in the admin account. What can I do to stop this? Automatic updates are disabled. Thanks beforehand. Fokke Take a look at this script. It's an example of a way to disable the reboot after a Patch Tuesday large update comes in. "Disable-W10-Update-Reboots.bat" https://textuploader.com/dsvox This is an example of interacting with the Task Scheduler. schtasks /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot" /disable nul 2&1 The "2&1" redirects stderr to stdout. The " nul" redirects stdout to /dev/null (tosses away textual output). The author of the script is throwing away feedback from the command so it doesn't appear on the screen. The batch file is disabling a line in the Task Scheduler. A line very close to where you need some work done. Note that, if virtually any run of the Update Orchestrator EXE happens, it will refresh the task list and could easily override what you're attempting to do. You may prepare a small script that you run at 11PM each night, to kill the item in question. That script is great, in that it uses the Task Scheduler to repeat its own repetitive running, so it keeps pounding on the Scheduler every day. The above script is a great template for how to do this kind of thing. The script is stored in C:\tools so that an OS upgrade will not wipe out the script. ******* OK, now that the fun is over, what else do we need to know ? 1) You'll probably want to run the batch file as administrator. Maybe the items in question are controlled by TrustedInstaller, but I don't think so. 2) Things run from Task Scheduler, run with SYSTEM account authority. Which, in the case of the above script, might be how the schtasks is making changes to the Task Scheduler on a repetitive basis. If you remove the redirections on script output and get the script to dump text to the screen while running it interactively in Administrator Command Prompt - you may see that certain lines in the script are failing. ******* You can elevate a Command Prompt window to run as SYSTEM. The sysinternals.com site has "PSTOOLS" package, which contains psexec64.exe. The "whoami" built-in command indicates your current account authority. The SYSTEM account is handy for this sort of work... In this example, I deleted all discovered hardware in the registry. Which forces the OS to rediscover the hardware later. This is a technique from the Win2K era. The ENUM key would not normally be accessible by using Administrator, but I think SYSTEM worked on it. The other token you sometimes need, is TrustedInstaller, but that takes a different recipe. https://s9.postimg.cc/vwioz43f3/WIN10_delete_ENUM.gif psexec -hsi cmd === 32 bit OS, opens SYSTEM cmd.exe window psexec64 -hsi cmd === 64 bit OS, opens SYSTEM cmd.exe window HTH, Paul Thanks, Paul. Interesting script. I modified it and turned it into a BTM script. I ran it from an elevated TCC/LE promtp. Now wait and see ... Fokke |
Thread Tools | |
Display Modes | Rate This Thread |
|
|