操作之前先做快照，以备不时之需
操作之前先做快照，以备不时之需
操作之前先做快照，以备不时之需
代码语言：javascript复制一、禁用或卸载defender，它自动更新自身不受windows update限制
参考https://cloud.tencent.com/developer/article/2345683 开头的【禁止或卸载Microsoft Defender】
一般只建议禁用，卸载要谨慎
二、禁止windows update相关服务开机启动
#查询update相关服务
Get-Service "UsoSvc", "WUAUSERV", "WaaSMedicSvc" -ErrorAction SilentlyContinue
Stop-Service -Name UsoSvc -ErrorAction SilentlyContinue
Stop-Service -Name WUAUSERV -ErrorAction SilentlyContinue
Stop-Service -Name WaaSMedicSvc -ErrorAction SilentlyContinue
Get-Service "UsoSvc", "WUAUSERV", "WaaSMedicSvc" -ErrorAction SilentlyContinue
#禁用update相关服务
Set-Service -Name UsoSvc -StartupType Disabled -ErrorAction SilentlyContinue
Set-Service -Name WUAUSERV -StartupType Disabled -ErrorAction SilentlyContinue
Set-Service -Name WaaSMedicSvc -StartupType Disabled -ErrorAction SilentlyContinue
#禁用update相关计划任务
Get-ScheduledTask -TaskPath "MicrosoftWindowsUpdateOrchestrator","MicrosoftWindowsWindowsUpdate" 2>$null | Disable-ScheduledTask 2>$null | ft -auto
三、禁止自动更新NVIDIA显卡驱动
reg add "HKLMSoftwarePoliciesMicrosoftWindowsWindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /d 1 /t REG_DWORD /f
reg add "HKLMSoftwareMicrosoftPolicyManagerdefaultUpdate" /v "ExcludeWUDriversInQualityUpdate" /d 1 /t REG_DWORD /f
reg add "HKCUSOFTWARENVIDIA CorporationGlobalGFExperience" /v "NotifyNewDisplayUpdates" /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINESOFTWARENVIDIA CorporationGlobalCoProcManager" /v "AutoDownload" /t REG_DWORD /d 0 /f
四、禁止Edge浏览器、Chrome浏览器自动更新
Get-Service MicrosoftEdge*, edgeupdate* | Set-Service -StartupType Disabled
Get-Service GoogleChrome*, gupdate* | Set-Service -StartupType Disabled
Get-ScheduledTask | Where-Object { $_.TaskName -like "MicrosoftEdgeUpdateTaskMachine*"} | Disable-ScheduledTask 2>&1 >$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "GoogleUpdateTaskMachine*"} | Disable-ScheduledTask 2>$null
五、禁止ProgramDataUpdater
reg add "HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsAppCompat" /v DisablePCA /t REG_DWORD /d 1 /f
Stop-Service -Name PcaSvc 2>$null
Set-Service -Name PcaSvc -StartupType Disabled 2>$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "*ProgramDataUpdater*"}| Disable-ScheduledTask 2>$null
六、禁止visual studio相关计划任务BackgroundDownload
Get-ScheduledTask | Where-Object { $_.TaskName -like "*BackgroundDownload*"}| Disable-ScheduledTask 2>$null
七、禁止windows update相关计划任务（需要提权）
参考https://cloud.tencent.com/developer/article/2323248
八、卸载可能操控windows update的第三方系统管家软件比如iOA等上面powershell代码如果执行了没有效果，应该是权限不够，正确的办法应该是提权后执行命令，完整的powershell命令如下（我提前把AdvancedRun.exe放到C:Windows了），提权参考我的这篇文档：https://cloud.tencent.com/developer/article/2285183
代码语言：javascript复制先在cmd执行这句命令，打开一个powershell窗口
提权有2种，可以2个级别都试试
【提权到trustedinstaller】
AdvancedRun.exe /Clear /EXEFilename "C:WindowsSystem32WindowsPowerShellv1.0powershell.exe" /StartDirectory "C:" /CommandLine "" /RunAs 8 /Run
【提权到system】
AdvancedRun.exe /Clear /EXEFilename "C:WindowsSystem32WindowsPowerShellv1.0powershell.exe" /StartDirectory "C:" /CommandLine "" /RunAs 4 /Run
然后上一步打开的powershell窗口里执行第2句
Get-ScheduledTask -TaskPath "MicrosoftWindowsUpdateOrchestrator","MicrosoftWindowsWindowsUpdate" | Disable-ScheduledTask 2>$null提权执行后重启机器生效
