Google how to disable windows update service permanently from the computer management console.

You'll also need the ffg paid software.

1. Du Meter

2. NetLimiter &/OR Glasswire

DU Meter

After installing it, right-click taskbar and activate the du-meter toolbar. It'll will show you upload/download speed at all times.

In other words, if you're online, doing absolutely nothing. Yet, your Internet's doing 1MB/s+, you get suspicious.

NetLimiter/Glasswire

Once you see suspicious internet activity, you open any of these two. It'll allow you to block the offending program. Glasswire has a nice UI but all it does is block or unblock.

Blocking windows processes - esp svchost might cut off your internet so NetLimiter is important. Allows you to rate limit the process. Basically, windows update temporarily stops trying if download speed's 1KB/s or less.

NOTE:

Some spy blocking software for Windows 10 help you to block MS's ad-servers, tracking and windows update. However, this is a cat and mouse game - hence, the above tools are your best bet.

I think there is something like that already. Look for "metered connections".

There is, but Windows 10 will disable this functionality after a month so you have to keep logging in to reset it. We had problems using a remote PC with a 4G dongle - programs like Office kept downloading updates even when Windows update was disabled. Having turned on metering, we didn't even think about it until the bill came through.

The link:

http://www.itprotoday.com/management-mobility/q-how-can-i-di...

That must be a new feature. The registry keys are still set on my only Windows 10 machine to make all possible network connections metered.

It won't install the newest update anyway so I'm probably safe.

This is unfortunately not reliable. The only way to completely stop Windows 10 and certain other recent MS products from updating (for bandwidth cost or not-wanting-to-reboot-right-now reasons) is to not let the machine connect to the Internet at all which probably makes it useless for many situations.

You could try running a server version of Windows instead, but you might find yourself unsupported in other ways (some hardware drivers, some software deliberately refusing to run or accidentally doing so due to using a broken compatibility check) in that case. The license will also cost a chunk more currency.

In the Pro version you also can set it to "always ask before downloading updates", and that has worked reliably for me so far.

Pro licences here. Can't say as I've found an option like that. Is it relatively new? I've not dug around terably recently. Everything else people have suggested either hasn't worked or did for a while then changed after an update.

Group Policy for Windows Update "configure automatic updates" can be set to "notify for download".

I'm pretty sure I've tried that and it reset itself a time later.

Looking again now, there seems to be no such option. I can defer updates for a fixed number of days (with separate settings for quality updates and feature updates), which might be useful if the defer is cancelled by a manual "check and install updates" rather than having to reset the setting to get them to install at a convenient time rather than waiting for them to go in at Windows' will at the end of the defer period.

Force connection through a VPN, deny the VPN access to anything microsoft related.

I did it by not leaving enough free space on the machine for windows to download anything.

You can make another partition for your actual data if needed.

The answer for this type of edge case configuration in Windows is usually "use Linux".

Some people are running Windows XP on that network, since that is what the instrument was certified with, and have less problems. Since my software is tested and does not run in Linux I'd rather say run Windows XP and keep very frequent backups and software ready in case somebody is careless and the network contracts malware. (None of the data is particularly sensitive, so.. )

GPO: Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings\turn off access to all windows update feature