🐛 Bug: Windows Update Services auto-reactivate every 7 days

[sonnyxq]

---

Environment

Field	Value
Tool Version	v1.6.0 — Oct 12, 2025 Commit a02bbd4
OS	Windows 11 25H2
OS Build	26200.6901
Windows Updates	Never used — fully frozen system
.reg pause files	Applied (paused until 2051)

---

Steps To Reproduce

After running wputility.bat → Disable Updates (Option 1), all services are correctly disabled.
However, after exactly 7 days, the Update services silently reactivate on their own — without any user interaction.

Please refer to the attached video.

Observed symptoms after reactivation:

• Taskbar notification: "Updates are ready to install"
• Settings → Windows Update shows the normal Update UI again (no longer showing "Something went wrong. Try to reopen Settings later.")

Recurrence pattern:

Occurrence	Date
1st	March 8, 2026
2nd	March 15, 2026
3rd	March 22, 2026

Interval is exactly 7 days — consistent and reproducible.

---

Minor: Build 26200 not recognized

The osCodenameBackup lookup ends at geq 26100 → 24H2. Build 26200 (Windows 11 25H2) falls into this bucket incorrectly.

Suggested addition:

if %osBuild% geq 26200 (
    set "osCodenameBackup=25H2"
    set "osName=11"
) else if %osBuild% geq 26100 (
    ...

Version

v1.6.0

OS / Distro

Windows 11 Pro - 25H2 - 26200.6901

Priority

High

Logs

DxDiag.txt

Referenced Issues

Screenshots

explorer_vNxHyU98SD.mp4

[sonnyxq]

Root Cause — Hypothesis — not final

I believe the script already handles services correctly via sc config, net stop, and sc failure reset= 0 actions= "".
However, three things appear to be missing:

1. WaaSMedicSvc runs as a Protected Process Light (PPL) via its kernel plugin (WaaSMedicPS.dll) on Windows 11 25H2. This allows it to silently restore disabled services and recreate scheduled tasks — overriding sc config, net stop, and registry writes entirely. Renaming WaaSMedicPS.dll removes its kernel-level privileges.

2. UpdateOrchestrator scheduled tasks are not neutralized by taskUpdatesDisable. The script disables telemetry tasks (schtasksDisable0–17) but none of these:

   • \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan ← 7-day trigger, directly causes reactivation
   • \\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task
   • \\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker
   • \\Microsoft\\Windows\\UpdateOrchestrator\\Report policies
   • \\Microsoft\\Windows\\UpdateOrchestrator\\UUS Failover Task
   • \\Microsoft\\Windows\\UpdateOrchestrator\\UIEOrchestrator
   • \\Microsoft\\Windows\\WaaSMedic\\PerformRemediation

   Important: These tasks are owned by TrustedInstaller, not SYSTEM or Administrators. schtasks /Change /TN "..." /DISABLE always returns ERROR: Access is denied even from an elevated Administrator shell. The only working approach is takeown + file rename after stopping the Task Scheduler service.

3. Task Scheduler Registry TaskCache is not cleared. Even after renaming task files, Task Scheduler rebuilds them on next boot from its internal registry cache at:
   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\
   Both the task files and the corresponding registry keys must be removed together, otherwise Task Scheduler silently recreates the files on every reboot.