No Stupid Questions

Is moving the drive to another computer as a secondary drive an option? Or put it in a separate USB enclosure? That way you don't need to boot it at all, unless it's encrypted or something.

I tried every suggested way of disabling Windows Updates, including changing dedicated settings in Windows Update, registry, group policy, disabling services, blocking it in firewall, adding WU domains to HOST file and some other tricks I can no longer remember - Windows just ignores it all and updates itself anyway.

The only thing that seems to have worked is to set your internet connection as metered and then set WU not to update over metered connections.

Chris Titus? https://christitus.com/windows-tool/

Bonus points if Anyone can link me to the page I used a few years back that had all sorts of privacy enhancing and telemetry disabling option on the left side and would create a reg file for applying those changes on the right

Sounds like https://privacy.sexy/ might be the answer?

Everyone here is dramatically overcomplicating the solution. Simply:

1. Turn on the PC without an Internet connection
2. From an elevated cmd, run net stop wuauserv
3. Connect the network and copy your files

This stops the update service and will absolutely prevent windows updates from running. BUT it reverts at the next boot, so be careful.

If you want a more permanent solution, you can edit a regkey to trick the system into looking for a local wsus server, which will prevent it from reaching out to the web. Read this for a rundown: https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/21669493

Source: More than a decade as a sysad with a focus on endpoint patching

InControl by Steve Gibson allows you to set a specific Windows release version and prevent further feature updates, but does allow security updates:

InControl controls Windows automatic updating/upgrading system by targeting it to a specific major version and feature update release. By default, the current release will be used. So if you “Take Control” with the major version and feature release shown in the boxes in the lower left, Windows will remain right where it is – only installing monthly security updates – until you “Release control”.

Also:

Like all of GRC's ultra lightweight freeware utilities, no setup or installation is required. Just run the utility with administrative rights. InControl's operation can be scripted from the command line, and full technical details about the Registry keys it changes is provided.

Download and install sysinternals suite: https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

then run:

psexec -i -s services.msc

and disable Windows Update, Update Orchestrator, and WaaSmedic if it's there.

Alternatively, do the same psexec but regedit instead of services, navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services, find those same services I listed above, change the Start value to 4 to disable. I went to the next step and neutered all the registry entries for each of those services to make sure they stayed dead.

There are programs like net limiter that you can use to just block access entirely for windows updates, every time one pops up to use data you can just block it, i think there's like 6 processes windows will try to use to update various things. It's not exactly what you are looking for, but it should solve your problem anyway.

Put it behind a PiHole that drops all traffic to Microsoft servers?

One thing that has worked for over a year on ky backup laptop at least, is to use the only setting Microsoft seems to not be able to take away without being in trouble: Windows Update Setting: Don't download over metered connections. Then, any network you connect to go into the networks settings and set as a metered network. The only thing that has made it through from updater was a tiny security update that it was able to download cause I was a bit forgetful once, pretty easy if u ask me

Disable through gpedit.msc

https://monovm.com/blog/disable-windows-update-from-group-policy/

I just install DoNotSpy after a fresh install of Windows and have never had an issue with Windows Update ignoring me and doing whatever it wanted.

Obviously the system has to be offline until it is installed and probably restarted, but after that you can plug in a cable and be fine, to my experience. Mind you I am still using an old, old, copy of 10 Pro as the installer, so I am uncertain how newer, fresh installs or home edition will handle it.

O & O Shutup on a thumbdrive

Windows comes with a secret option to turn off updates with group policies, so you don't need to modify anything or use a script. It works just fine for me. No updates (unless I manually click update).

The option for automatic updates is several layers deep in a nested menu tree, and I don't fully recall what the path to get there is. But you should be able to find it online.

Use something like NextDNS and block the update-domains.

I'm not sure what the purple app was.

But disabling the relevant services should be enough or modifying your host file to block all the Microsoft domains for it.

I am curious why you need it to go online at all.

If you're looking to copy files just use your phone or USB drive?

Just disable the windows update services.

You could also use a allowlist firewall rule to restrict access to what you need.

Also why the paranoia? What do you have against windows updates?