🐛 Bug: Windows Update Services auto-reactivate every 7 days

Environment

Field	Value
Tool Version	v1.6.0 — Oct 12, 2025 Commit `a02bbd4`
OS	Windows 11 25H2
OS Build	26200.6901
Windows Updates	Never used — fully frozen system
`.reg` pause files	Applied (paused until 2051)

Steps To Reproduce

After running wputility.bat → Disable Updates (Option 1), all services are correctly disabled.
However, after exactly 7 days, the Update services silently reactivate on their own — without any user interaction.

Please refer to the attached video.

Observed symptoms after reactivation:

Taskbar notification: "Updates are ready to install"
Settings → Windows Update shows the normal Update UI again (no longer showing "Something went wrong. Try to reopen Settings later."

Recurrence pattern:

Occurrence	Date
1st	March 8, 2026
2nd	March 15, 2026
3rd	March 22, 2026

Interval is exactly 7 days — consistent and reproducible.

Minor: Build 26200 not recognized

The osCodenameBackup lookup ends at geq 26100 → 24H2. Build 26200 (Windows 11 25H2) falls into this bucket incorrectly.

Suggested addition:

if %osBuild% geq 26200 (
    set "osCodenameBackup=25H2"
    set "osName=11"
) else if %osBuild% geq 26100 (
    ...

Version

v1.6.0

OS / Distro

Windows 11 Pro - 25H2 - 26200.6901

Priority

High

Logs

DxDiag.txt

Referenced Issues

Screenshots

explorer_vNxHyU98SD.mp4

Root Cause — Hypothesis — not final — Updated May 16, 2026

Goal: The intended end state is a fully locked-down Windows Update UI permanently showing "Something went wrong. Try to reopen Settings later." in Settings → Windows Update. This state is already achieved by running wputility.bat → Option 1 alone — however, after exactly 7 days, Windows silently reactivates update components and the UI returns to normal. The purpose of this script is to prevent that reactivation from happening, so the locked-down state persists beyond the 7-day cycle.

I believe wputility.bat already handles services correctly via sc config, net stop, and sc failure reset= 0 actions= "".
However, several things were missing and have been addressed incrementally:

WaaSMedicSvc runs as a Protected Process Light (PPL) via its kernel plugin (WaaSMedicPS.dll) on Windows 11 25H2. This allows it to silently restore disabled services and recreate scheduled tasks — overriding sc config, net stop, and registry writes entirely. Renaming WaaSMedicPS.dll removes its kernel-level privileges.
UpdateOrchestrator scheduled tasks are not neutralized by taskUpdatesDisable. wputility.bat disables telemetry tasks (schtasksDisable0-17) but none of these:
- \Microsoft\Windows\UpdateOrchestrator\Schedule Scan <- 7-day trigger, directly causes reactivation
- \Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task <- fallback scan trigger
- \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker
- \Microsoft\Windows\UpdateOrchestrator\Report policies
- \Microsoft\Windows\UpdateOrchestrator\UUS Failover Task
- \Microsoft\Windows\UpdateOrchestrator\UIEOrchestrator
- \Microsoft\Windows\UpdateOrchestrator\StartInstall
- \Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- \Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- \Microsoft\Windows\UpdateOrchestrator\Schedule Work
- \Microsoft\Windows\UpdateOrchestrator\Start Oobe Expedite Work
- \Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate
- \Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_LicenseAccepted
- \Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_OobeAppReady
- \Microsoft\Windows\WaaSMedic\PerformRemediation <- restores all above tasks
- \Microsoft\Windows\WindowsUpdate\Scheduled Start <- confirmed reactivation vector (April 20, 2026)
- \Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache <- confirmed reactivation vector (April 20, 2026)

Important: These tasks are owned by TrustedInstaller, not SYSTEM or Administrators. schtasks /Change /TN "..." /DISABLE always returns ERROR: Access is denied even from an elevated Administrator shell. The only working approach is takeown + file rename after stopping the Task Scheduler service.

Task Scheduler Registry TaskCache is not cleared. Even after renaming task files, Task Scheduler rebuilds them on next boot from its internal registry cache at:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\
Both the task files and the corresponding registry keys must be removed together, otherwise Task Scheduler silently recreates the files on every reboot.
\Microsoft\Windows\WindowsUpdate\ tasks are not neutralized. These tasks exist outside the UpdateOrchestrator folder and are not covered by any existing fix. On Windows 11 25H2, Scheduled Start and Refresh Group Policy Cache were confirmed to trigger a reactivation notification every 7 days - even with all UpdateOrchestrator tasks renamed and all services disabled. They must be treated identically: takeown + file rename + TaskCache deletion + Deny ACE.
UsoSvc, WaaSMedicSvc, and wuauserv are not explicitly disabled. Even with WaaSMedicPS.dll renamed, all three services start on boot via Delayed Auto Start or on-demand SCM triggers. UsoSvc is the direct trigger for MusNotificationUx.exe (the update popup). Both must be explicitly set to Start=4 (Disabled) with FailureActions cleared — confirmed effective on Windows 11 25H2 (April 29, 2026).
Service registry Start values revert to DEMAND_START (3) after boot. Even after setting Start=4, Windows SCM rewrites its own service config through an internal path that bypasses Registry ACLs. A standard reg add from an elevated Administrator shell is insufficient — the write must be performed as SYSTEM via a Scheduled Task. Additionally, sc sdset must be applied to UsoSvc and wuauserv to deny Write DAC (WD) for both SYSTEM and TrustedInstaller at the SCM security descriptor level — confirmed required on Windows 11 25H2 (May 9, 2026).
WaaSMedicPS.dll still existed in WinSxS (component store) and could be reintroduced by servicing. Earlier versions only renamed the System32 copy. The PPL plugin WaaSMedicPS.dll also lives under %SystemRoot%\WinSxS\...WaaSMedic... and can be used by servicing/repair routines as a source of truth. The current script additionally enumerates all *WaaSMedicPS.dll matches under %SystemRoot%\WinSxS (via dir /s /b) and deletes every instance after takeown + icacls /grant + del. After this change, dir /s /b "%SystemRoot%\WinSxS\*WaaSMedicPS.dll" returns File Not Found while the Windows Update UI remains in the "Something went wrong" state.
WaaSMedicPS.dll.bak ACL in System32 still contained NT SERVICE\TrustedInstaller. Even when the DLL only exists as .bak, a future repair routine could still try to restore it as long as TrustedInstaller has write access. The current script also removes any WaaSMedicPS.dll.bak2–.bak5 copies in %SystemRoot%\System32 and strips the NT SERVICE\TrustedInstaller ACE from WaaSMedicPS.dll.bak, so TrustedInstaller no longer has a straightforward path to bring it back.

Note on sc sdset WaaSMedicSvc: sc sdset WaaSMedicSvc returns [SC] SetServiceObjectSecurity FAILED 5: Access is denied — this is expected and known behavior. SCM internally protects the WaaSMedicSvc security descriptor and does not allow external modification, even as Administrator. The Start=4 lock via SYSTEM Scheduled Task is sufficient since WaaSMedicPS.dll is already renamed, which removes PPL kernel-level self-repair capability.

Note on UpdateModelTask: A registry-only entry (Tree\UpdateOrchestrator\UpdateModelTask) with no corresponding file or Tasks\{GUID} entry reappears after every Task Scheduler restart. This is hardcoded Windows behavior and is confirmed harmless - no executable content, no trigger possible.

Note on boot timing: After a reboot, Task Scheduler may take between 1 and 7 minutes before all task-related registry entries and folder contents are fully initialized. For safety, status checks on task files and TaskCache entries should only be performed after at least 10 minutes of uptime.

Reactivation timeline observed:

Date Event

March 8, 2026 Reactivation - wputility.bat used again

March 15, 2026 Reactivation - wputility.bat used again

March 22, 2026 Reactivation - wputility.bat used again

March 30, 2026 Reactivation - v1 applied

April 6, 2026 Reactivation - v1 failed - v2 applied (correct Deny ACE, WaaSMedicPS.dll, still no TaskCache)

April 13, 2026 Reactivation - v2 failed - v3 applied (+ TaskCache deletion)

April 20, 2026 Reactivation - v3 failed - v4 applied - v3 did not cover \Microsoft\Windows\WindowsUpdate\Scheduled Start and \Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache - these triggered a reactivation notification every 7 days, independently of all services and UpdateOrchestrator tasks

April 29, 2026 Reactivation - v4 failed - v5 applied - added explicit disable of UsoSvc, WaaSMedicSvc and wuauserv via Start=4 + FailureActions cleared - all three confirmed STOPPED (EXIT 1077) after reboot with 10 min uptime

May 4, 2026 Manual check revealed Windows Update UI had returned - all three services (UsoSvc, WaaSMedicSvc, wuauserv) were RUNNING despite Start=4 set by v5 - root cause: SCM was rewriting START_TYPE back to DEMAND_START (3) on boot through an internal path that bypasses Registry ACLs

May 9, 2026 v6 applied - fixed START_TYPE reverting to DEMAND_START (3) after boot: Start=4 rewritten for all three services as SYSTEM, sc sdset Deny WD applied to UsoSvc and wuauserv - sc sdset WaaSMedicSvc returns Access is denied (expected, SCM-protected) - all three confirmed STOPPED (EXIT 1077) + START_TYPE: 4 DISABLED + reg query Start returns ERROR: Access is denied after 10+ min uptime - Windows Update UI remains on "Something went wrong" state

May 16, 2026 Reactivation - v6 failed - v7 applied - extended WaaSMedic hardening: all WaaSMedicPS.dll copies removed from %SystemRoot%\WinSxS, WaaSMedicPS.dll.bak ACL cleaned to remove NT SERVICE\TrustedInstaller; verification shows only .bak under System32, no WaaSMedicPS.dll under WinSxS, all three services stay DISABLED / STOPPED, and all UpdateOrchestrator/WindowsUpdate tasks remain .bak after reboot + 10 min uptime

Note: This script (v7) is a work in progress - long-term effectiveness is still being monitored.

@echo off
setlocal enabledelayedexpansion
net session >nul 2>&1
if %errorlevel% neq 0 (echo [ERROR] Run as Administrator! & pause & exit /b 1)

echo.
echo ============================================================
echo STEP 1: Stop Task Scheduler
echo ============================================================
net stop Schedule /y >nul 2>&1
echo [OK] Task Scheduler stopped

echo.
echo ============================================================
echo STEP 2: WaaSMedicPS.dll - Rename
echo ============================================================
takeown /F "%SystemRoot%\System32\WaaSMedicPS.dll" /A >nul 2>&1
icacls "%SystemRoot%\System32\WaaSMedicPS.dll" /grant Administrators:F >nul 2>&1
if exist "%SystemRoot%\System32\WaaSMedicPS.dll" (
    ren "%SystemRoot%\System32\WaaSMedicPS.dll" "WaaSMedicPS.dll.bak" >nul 2>&1
    echo [OK] WaaSMedicPS.dll renamed to .bak
) else (
    echo [--] WaaSMedicPS.dll already .bak
)

echo.
echo ============================================================
echo STEP 2b: WaaSMedicPS.dll - WinSxS Store Cleanup (all copies)
echo ============================================================
set "WINSXS_FOUND=0"
for /f "delims=" %%P in ('dir /s /b "%SystemRoot%\WinSxS\*WaaSMedicPS.dll" 2^>nul') do (
    set "WINSXS_FOUND=1"
    echo [INFO] WinSxS candidate: %%P
    takeown /F "%%P" /A >nul 2>&1
    icacls "%%P" /grant Administrators:F >nul 2>&1
    del /f "%%P" >nul 2>&1
    if not exist "%%P" (
        echo [OK] Deleted %%P
    ) else (
        echo [WARN] Could not delete %%P
    )
)
if "!WINSXS_FOUND!"=="0" echo [--] No WaaSMedicPS.dll found under %SystemRoot%\WinSxS

echo.
echo ============================================================
echo STEP 2c: WaaSMedicPS.dll .bak cleanup + remove TrustedInstaller
echo ============================================================
for %%F in ("%SystemRoot%\System32\WaaSMedicPS.dll.bak2" "%SystemRoot%\System32\WaaSMedicPS.dll.bak3" "%SystemRoot%\System32\WaaSMedicPS.dll.bak4" "%SystemRoot%\System32\WaaSMedicPS.dll.bak5") do (
    if exist "%%F" (
        del /f /q "%%F" >nul 2>&1
        echo [OK] Cleaned up %%~nxF
    )
)
set "MEDIC_BAK=%SystemRoot%\System32\WaaSMedicPS.dll.bak"
if exist "%MEDIC_BAK%" (
    icacls "%MEDIC_BAK%" /remove "NT SERVICE\TrustedInstaller" >nul 2>&1
    rem Verify that TrustedInstaller ACE is really gone, but keep output short
    icacls "%MEDIC_BAK%" | find "NT SERVICE\TrustedInstaller" >nul 2>&1
    if !errorlevel! equ 0 (
        echo [WARN] WaaSMedicPS.dll.bak still contains NT SERVICE\TrustedInstaller ACE
    ) else (
        echo [OK] WaaSMedicPS.dll.bak ACL OK - no NT SERVICE\TrustedInstaller ACE
    )
)

echo.
echo ============================================================
echo STEP 3: UpdateOrchestrator Tasks - Take Ownership + Rename
echo ============================================================
takeown /F "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /R /D Y >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /grant Administrators:(OI)(CI)F /T >nul 2>&1

if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" "Schedule Scan.bak" >nul 2>&1 & echo [OK] Schedule Scan) else echo [--] Schedule Scan already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" "Schedule Scan Static Task.bak" >nul 2>&1 & echo [OK] Schedule Scan Static Task) else echo [--] Schedule Scan Static Task already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" "USO_UxBroker.bak" >nul 2>&1 & echo [OK] USO_UxBroker) else echo [--] USO_UxBroker already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies" "Report policies.bak" >nul 2>&1 & echo [OK] Report policies) else echo [--] Report policies already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UUS Failover Task" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UUS Failover Task" "UUS Failover Task.bak" >nul 2>&1 & echo [OK] UUS Failover Task) else echo [--] UUS Failover Task already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UIEOrchestrator" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UIEOrchestrator" "UIEOrchestrator.bak" >nul 2>&1 & echo [OK] UIEOrchestrator) else echo [--] UIEOrchestrator already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartInstall" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartInstall" "StartInstall.bak" >nul 2>&1 & echo [OK] StartInstall) else echo [--] StartInstall already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work" "Schedule Maintenance Work.bak" >nul 2>&1 & echo [OK] Schedule Maintenance Work) else echo [--] Schedule Maintenance Work already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" "Schedule Wake To Work.bak" >nul 2>&1 & echo [OK] Schedule Wake To Work) else echo [--] Schedule Wake To Work already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work" "Schedule Work.bak" >nul 2>&1 & echo [OK] Schedule Work) else echo [--] Schedule Work already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Start Oobe Expedite Work" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Start Oobe Expedite Work" "Start Oobe Expedite Work.bak" >nul 2>&1 & echo [OK] Start Oobe Expedite Work) else echo [--] Start Oobe Expedite Work already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate" "StartOobeAppsScanAfterUpdate.bak" >nul 2>&1 & echo [OK] StartOobeAppsScanAfterUpdate) else echo [--] StartOobeAppsScanAfterUpdate already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_LicenseAccepted" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_LicenseAccepted" "StartOobeAppsScan_LicenseAccepted.bak" >nul 2>&1 & echo [OK] StartOobeAppsScan_LicenseAccepted) else echo [--] StartOobeAppsScan_LicenseAccepted already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_OobeAppReady" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_OobeAppReady" "StartOobeAppsScan_OobeAppReady.bak" >nul 2>&1 & echo [OK] StartOobeAppsScan_OobeAppReady) else echo [--] StartOobeAppsScan_OobeAppReady already .bak

echo.
echo ============================================================
echo STEP 4: WaaSMedic Task - Take Ownership + Rename
echo ============================================================
takeown /F "%SystemRoot%\System32\Tasks\Microsoft\Windows\WaaSMedic" /R /D Y >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\WaaSMedic" /grant Administrators:(OI)(CI)F /T >nul 2>&1
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\WaaSMedic\PerformRemediation" (
    ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\WaaSMedic\PerformRemediation" "PerformRemediation.bak" >nul 2>&1
    if not exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\WaaSMedic\PerformRemediation" (
        echo [OK] PerformRemediation
    ) else (
        echo [ERROR] PerformRemediation - rename failed
    )
) else (
    echo [--] PerformRemediation already .bak
)

echo.
echo ============================================================
echo STEP 5: WindowsUpdate Tasks - Take Ownership + Rename
echo ============================================================
takeown /F "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate" /R /D Y >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate" /grant Administrators:(OI)(CI)F /T >nul 2>&1

if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start" "Scheduled Start.bak" >nul 2>&1 & echo [OK] Scheduled Start) else echo [--] Scheduled Start already .bak
if exist "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache" (ren "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache" "Refresh Group Policy Cache.bak" >nul 2>&1 & echo [OK] Refresh Group Policy Cache) else echo [--] Refresh Group Policy Cache already .bak

echo.
echo ============================================================
echo STEP 6: TaskCache - UpdateOrchestrator
echo ============================================================
for %%T in (
"Schedule Scan"
"Schedule Scan Static Task"
"USO_UxBroker"
"Report policies"
"UUS Failover Task"
"UIEOrchestrator"
"StartInstall"
"Schedule Maintenance Work"
"Schedule Wake To Work"
"Schedule Work"
"Start Oobe Expedite Work"
"StartOobeAppsScanAfterUpdate"
"StartOobeAppsScan_LicenseAccepted"
"StartOobeAppsScan_OobeAppReady"
"UpdateModelTask"
) do (
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\%%~T" >nul 2>&1
    if !errorlevel! equ 0 (
        reg copy "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\%%~T" "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\%%~T.bak" /s /f >nul 2>&1
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\%%~T" /f >nul 2>&1
        echo [OK] TaskCache: %%~T removed
    ) else echo [--] TaskCache: %%~T not present
)

echo.
echo ============================================================
echo STEP 7: TaskCache - WindowsUpdate
echo ============================================================
for %%T in (
"Scheduled Start"
"Refresh Group Policy Cache"
"sihboot"
"Automatic App Update"
) do (
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\%%~T" >nul 2>&1
    if !errorlevel! equ 0 (
        reg copy "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\%%~T" "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\%%~T.bak" /s /f >nul 2>&1
        reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\%%~T" /f >nul 2>&1
        echo [OK] TaskCache: %%~T removed
    ) else echo [--] TaskCache: %%~T not present
)

echo.
echo ============================================================
echo STEP 8: Deny ACE - UpdateOrchestrator + WindowsUpdate
echo ============================================================
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /remove:d SYSTEM /T >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /remove:d "NT SERVICE\TrustedInstaller" /T >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate" /remove:d SYSTEM /T >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate" /remove:d "NT SERVICE\TrustedInstaller" /T >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /deny SYSTEM:(OI)(CI)(WD,AD) >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /deny "NT SERVICE\TrustedInstaller":(OI)(CI)(WD,AD) >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate" /deny SYSTEM:(OI)(CI)(WD,AD) >nul 2>&1
icacls "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate" /deny "NT SERVICE\TrustedInstaller":(OI)(CI)(WD,AD) >nul 2>&1
echo [OK] Deny ACE set

echo.
echo ============================================================
echo STEP 9: Start Task Scheduler
echo ============================================================
net start Schedule >nul 2>&1
echo [OK] Task Scheduler started

echo.
echo ============================================================
echo STEP 10: Disable UsoSvc + WaaSMedicSvc + wuauserv
echo ============================================================
sc stop UsoSvc >nul 2>&1
sc config UsoSvc start= disabled >nul 2>&1
sc failure UsoSvc reset= 0 actions= "" >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1
sc qc UsoSvc | findstr "START_TYPE" | find "4" >nul 2>&1
if !errorlevel! equ 0 (echo [OK] UsoSvc Start=4 disabled) else echo [WARN] UsoSvc - verify START_TYPE after reboot

reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1
sc stop WaaSMedicSvc >nul 2>&1
echo [OK] WaaSMedicSvc - Start reg set to 4, FailureActions cleared

sc stop wuauserv >nul 2>&1
sc config wuauserv start= disabled >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f >nul 2>&1
echo [OK] wuauserv - Start reg set to 4

echo.
echo ============================================================
echo STEP 11: Lock Service Start=4 via SYSTEM Scheduled Task
echo ============================================================
set "FIXBAT=%TEMP%\wu-fix-svc-start.bat"
echo reg add "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f > "%FIXBAT%"
echo reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >> "%FIXBAT%"
echo reg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f >> "%FIXBAT%"
schtasks /Create /TN "WuFixSvcStart" /TR "cmd.exe /c \"%FIXBAT%\"" /SC ONCE /ST 00:00 /RU SYSTEM /RL HIGHEST /F >nul 2>&1
schtasks /Run /TN "WuFixSvcStart" >nul 2>&1
for /l %%i in (10,-1,1) do (
    <nul set /p ="[..] STEP 11: waiting for SYSTEM task... %%i sec   "
    timeout /t 1 /nobreak >nul
    echo.
)
schtasks /Delete /TN "WuFixSvcStart" /F >nul 2>&1
del /f /q "%FIXBAT%" >nul 2>&1
sc qc UsoSvc | findstr "START_TYPE" | find "4" >nul 2>&1
if !errorlevel! equ 0 (echo [OK] UsoSvc Start=4 locked via SYSTEM) else echo [WARN] UsoSvc - verify START_TYPE after reboot
sc qc WaaSMedicSvc | findstr "START_TYPE" | find "4" >nul 2>&1
if !errorlevel! equ 0 (echo [OK] WaaSMedicSvc Start=4 locked via SYSTEM) else echo [WARN] WaaSMedicSvc - verify START_TYPE after reboot
sc qc wuauserv | findstr "START_TYPE" | find "4" >nul 2>&1
if !errorlevel! equ 0 (echo [OK] wuauserv Start=4 locked via SYSTEM) else echo [WARN] wuauserv - verify START_TYPE after reboot

echo.
echo ============================================================
echo STEP 12: Lock SCM Security Descriptor - UsoSvc + wuauserv
echo ============================================================
sc sdset UsoSvc "D:(D;;WD;;;SY)(D;;WD;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)" >nul 2>&1
if !errorlevel! equ 0 (echo [OK] UsoSvc sdset Deny WD) else echo [ERROR] UsoSvc sdset failed
sc sdset wuauserv "D:(D;;WD;;;SY)(D;;WD;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)" >nul 2>&1
if !errorlevel! equ 0 (echo [OK] wuauserv sdset Deny WD) else echo [ERROR] wuauserv sdset failed
echo [--] WaaSMedicSvc sdset - Access is denied expected (SCM-protected)

echo.
echo ============================================================
echo RESULT - Task files only
echo ============================================================
echo.
echo [UpdateOrchestrator] - No entry without .bak = OK
dir "%SystemRoot%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator" /B 2>nul
echo.
echo [WindowsUpdate] - No entry without .bak = OK
dir "%SystemRoot%\System32\Tasks\Microsoft\Windows\WindowsUpdate" /B 2>nul
echo.
echo [WaaSMedic] - No entry without .bak = OK
dir "%SystemRoot%\System32\Tasks\Microsoft\Windows\WaaSMedic" /B 2>nul
echo.
echo [WaaSMedicPS.dll] - Only .bak = OK
dir "%SystemRoot%\System32\WaaSMedicPS*" /B 2>nul
echo.
echo [Services START_TYPE]
sc qc UsoSvc | findstr START_TYPE
sc qc WaaSMedicSvc | findstr START_TYPE
sc qc wuauserv | findstr START_TYPE
echo.
echo [Services STATE]
sc query UsoSvc | find "STATE"
sc query WaaSMedicSvc | find "STATE"
sc query wuauserv | find "STATE"
echo.
pause

Hey, I'm having this problem too. Do you know how to fix it? I tried to make sense of your comment, but its a bit too advanced for me.

This issue has been happening more frequently. It reactivated as usual on Saturday, and I turned the update services off again, and then just now on Sunday it did it again.

@themiraculousEC I am still working on it on weekly basis as the 7-day-cycle comes back. It's complex and cant share now. But soon. Actually there is no "more frequently". It's exactly 7-days. Just relax. At some point there will be solution for this.

There is a 'more frequently'. It just happened to me. Yesterday (Saturday), it was due, so I checked it with the bat file to see if the update services were back on. They all were and I turned them off. Today (Sunday), I got the 'update available' pop up and checked update services again. They were all back on again and I had to turn them off again.

I'd like to report that it just happened again today (Wednesday). It was another 'We have an update for you' pop up. The one that goes all the way across the screen.

@themiraculousEC Just for protocol, have you run v7 script even once?

I'm not sure what you mean by v7 script. If you mean the script you posted, I'm not sure how to do that. That's what the comment I made on June 13th meant: I didn't know how to run the script you provided.

When the bug happened the first time, around the same time you posted your first encounter with the bug (May 16), I re-downloaded the most updated bat file. Until two weeks ago, I was only getting the bug once a week like you. It used to happen on Saturdays, but now it's been bothering me on Sundays and Wednesdays.

To play it out right:

1.) wputility press (1) 2.) try this .bat below out:

I'm sorry, I'm still very new to running code that doesn't come pre-packaged in its own file. I can't really visualize what you mean. Can you make a short video of you doing what you want me to do? Or maybe even just pictures.

@sonnyxq

@sonnyxq The video is broken for me, sorry

@sonnyxq

@sonnyxq I'm on desktop (acer nitro 5 gaming laptop, windows 11, fully updated firefox), it's just saying there's no video file or MIME format? Also, now I'm not seeing any of your comments in this thread and I only know you replied via my email. That's so strange.

@themiraculousEC

@themiraculousEC

I've given this deep thought and concluded that patience is needed here.
I'd rather not spend my time on an extensive walkthrough, so my recommendation is:

Either downgrade to 23H2 and stay there, since 25H2 / 24H2 has introduced new protection mechanisms that are quite tricky to work around
Or wait patiently until the program's author or someone in the community (other GitHub author) finds a solution

Additionally, since what I'm doing is quite experimental and modifies the system more heavily than the author's approach, there's usually no way back — a fresh reinstall is typically required. With the .bat author's method, there is a way back. Given that your technical knowledge here seems limited, I'd prefer not to go down that path, as it could cause problems on your side.

That said, I'm still trying to figure out a "minimal set" — a way to achieve this with far fewer modifications.

PS: Would it be possible for you to remove your previous comments as well, so the thread stays clean? I'd really appreciate that.

@sonnyxq

@sonnyxq I'm currently on 24H2 and I'm still having these problems. I stopped updating before the update that supposedly unmounted your ssd. I have all my files backed up on an external harddrive, too. Let me know when you get that minimal set, I guess.

I don't think deleting our comments is a good idea. The entire point of a thread is to serve as a record for other people who might be having the same problem.

@themiraculousEC

@themiraculousEC
Oh, apologies for the small typo — I actually meant 23H2, since 24H2 and 25H2 both use the same "Germanium" codebase and share the same servicing branch.

Navigation Menu

Repository navigation

🐛 Bug: Windows Update Services auto-reactivate every 7 days #34

Environment

Steps To Reproduce

Please refer to the attached video.

Minor: Build 26200 not recognized

Version

OS / Distro

Priority

Logs

Referenced Issues

Screenshots

Root Cause — Hypothesis — not final — Updated May 16, 2026

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Date	Event
March 8, 2026	Reactivation - wputility.bat used again
March 15, 2026	Reactivation - wputility.bat used again
March 22, 2026	Reactivation - wputility.bat used again
March 30, 2026	Reactivation - v1 applied
April 6, 2026	Reactivation - v1 failed - v2 applied (correct Deny ACE, WaaSMedicPS.dll, still no TaskCache)
April 13, 2026	Reactivation - v2 failed - v3 applied (+ TaskCache deletion)
April 20, 2026	Reactivation - v3 failed - v4 applied - v3 did not cover `\Microsoft\Windows\WindowsUpdate\Scheduled Start` and `\Microsoft\Windows\WindowsUpdate\Refresh Group Policy Cache` - these triggered a reactivation notification every 7 days, independently of all services and UpdateOrchestrator tasks
April 29, 2026	Reactivation - v4 failed - v5 applied - added explicit disable of `UsoSvc`, `WaaSMedicSvc` and `wuauserv` via `Start=4` + `FailureActions` cleared - all three confirmed STOPPED (EXIT 1077) after reboot with 10 min uptime
May 4, 2026	Manual check revealed Windows Update UI had returned - all three services (`UsoSvc`, `WaaSMedicSvc`, `wuauserv`) were RUNNING despite `Start=4` set by v5 - root cause: SCM was rewriting `START_TYPE` back to `DEMAND_START (3)` on boot through an internal path that bypasses Registry ACLs
May 9, 2026	v6 applied - fixed `START_TYPE` reverting to `DEMAND_START (3)` after boot: `Start=4` rewritten for all three services as SYSTEM, `sc sdset` Deny WD applied to `UsoSvc` and `wuauserv` - `sc sdset WaaSMedicSvc` returns Access is denied (expected, SCM-protected) - all three confirmed STOPPED (EXIT 1077) + `START_TYPE: 4 DISABLED` + `reg query Start` returns `ERROR: Access is denied` after 10+ min uptime - Windows Update UI remains on `"Something went wrong"` state
May 16, 2026	Reactivation - v6 failed - v7 applied - extended WaaSMedic hardening: all `WaaSMedicPS.dll` copies removed from `%SystemRoot%\WinSxS`, `WaaSMedicPS.dll.bak` ACL cleaned to remove `NT SERVICE\TrustedInstaller`; verification shows only `.bak` under `System32`, no `WaaSMedicPS.dll` under `WinSxS`, all three services stay `DISABLED` / `STOPPED`, and all UpdateOrchestrator/WindowsUpdate tasks remain `.bak` after reboot + 10 min uptime

🐛 Bug: Windows Update Services auto-reactivate every 7 days #34

Description

Environment

Steps To Reproduce

Please refer to the attached video.

Minor: Build 26200 not recognized

Version

OS / Distro

Priority

Logs

Referenced Issues

Screenshots

Activity

sonnyxq commented on May 16, 2026

Root Cause — Hypothesis — not final — Updated May 16, 2026

themiraculousEC commented on Jun 14, 2026

themiraculousEC commented on Jul 5, 2026

themiraculousEC commented on Jul 6, 2026

themiraculousEC commented on Jul 8, 2026

themiraculousEC commented on Jul 21, 2026

themiraculousEC commented on Jul 22, 2026

themiraculousEC commented on Jul 23, 2026

themiraculousEC commented on Jul 23, 2026

sonnyxq commented on Jul 23, 2026

themiraculousEC commented on Jul 24, 2026

sonnyxq commented on Jul 24, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions