Update Control Desktop

A Windows desktop interface for controlling automatic OS updates, keeping Microsoft Store available, and removing this tool's blocker reliably.

Security notice — 2026-10-09: Microsoft Defender detected a file named Update-Control 4.2.2.exe as Trojan:Win32/Sabsik.FL.A!ml on a user's PC. The affected copy's hash and the cause are not yet verified; a false positive has not been established. Do not run or allow the reported build while this remains unresolved. The earlier negative scan is historical evidence, not clearance. Read the notice and containment steps.

Release status and historical assets — neither the portable scripts nor older releases are a verified workaround for this detection.

4.3.1 Preview is available with stronger verification and a simpler unblock action. Download Update-Control-4.3.1.exe or read the release notes. This is a public prerelease; publication does not resolve the 4.2.2 Defender report or establish antivirus clearance. See validation and limitations and release review status.

Use at your own risk. Changing update settings can delay security fixes or interrupt Store downloads. Keep antivirus protection enabled; do not add an exclusion to bypass a detection. This disclaimer does not resolve the reported detection above.

Actual WPF interface rendered with sample status. The screenshot is not proof of a live Windows Update block.

Start here

These instructions describe the 4.3.1 preview. Review the reported Defender detection and known limitations before use. If security software detects a file, keep it quarantined; do not use exclusions or script launchers to bypass the detection.

1. Download Update-Control-4.3.1.exe and open it on the PC you want to manage. Accept the administrator prompt.
2. If you used the old script, select Unblock updates, then Unblock & remove tasks. Follow any restart message.
3. Click the Store Friendly card, then Apply Store Friendly to keep automatic Windows updates disabled by policy while allowing Store downloads, including apps such as ChatGPT.
4. To block shared update services, select Hard Block, review the warning about Store downloads and the watchdog, and confirm. Wait for Verified; Restart required and Needs attention are not a completed verification.
5. To remove the block later, select Unblock updates, then Unblock & remove tasks. Success requires zero known tasks and removal of the installed watchdog script.

The entire card is clickable. Its outline and radio marker show your selection; Windows changes only after you press the separate action button. Hard Block adds a confirmation step. Saved mode shows the requested configuration; the separate Verified / Awaiting verification / Needs attention result shows what current checks established. A saved Hard Block setting alone is not proof that the block is effective.

You download one EXE. It automatically extracts its embedded components into a protected version folder under %ProgramFiles%\Kareer Update Control. It uses Windows PowerShell 5.1 and .NET Framework already present on standard Windows 10/11 desktop installations. It does not require Python, Node, or a separate setup wizard.

For release identity and warning details, see Windows security warnings. Compare any download with the release's SHA256SUMS.txt; a matching hash confirms the file matches the published artifact, not that it is safe to run.

For source access, the portable ZIP contains the same components. Extract everything and open Update-Control.cmd. Both WindowsUpdateManager.bat and the older WU-ManagerFinal.bat filename now launch the GUI. A keyboard menu remains available in Update-Control-Console.cmd.

Choose a mode

Mode	Automatic Windows updates	Microsoft Store	Watchdogs
Store Friendly	Manual-update policy on supported editions	Shared download/install services available	None
Hard Block	Stops and disables shared update services; best effort	Downloads may fail	One task, with startup and minute triggers
Unblock & remove tasks	Restores the saved settings from before this tool's current blocking session	Removes this tool's restrictions	All recognized legacy/current tasks removed

Store Friendly is the recommended mode for keeping app installation available. It sets NoAutoUpdate=1; it is not a complete lock on every kind of update. Manual updates and already pending installations are not cancelled. Organization or MDM settings can override local policy, and known deadline/WSUS conflicts are refused. Windows Home is not offered this policy mode; use Windows Settings' pause controls on Home.

Hard Block also affects BITS and Delivery Optimization, which other applications use. Windows servicing or other administrative software may counteract service blocking. The application does not promise permanent suppression of all updates.

How the watchdog is verified

Version 4.3.1 waits up to two minutes per service, shows progress while a service starts or stops, and retries a transient 1061 response. It asks for a restart only when a saved startup setting still differs from Windows' live configuration, naming the affected services. A configuration command's warning alone does not trigger a restart. A service that remains stuck reports an incomplete operation and triggers attempted rollback.

Hard Block installs one POS-WU-Guardian-v4 task running as SYSTEM, with startup and one-minute triggers. Apply checks the executable path, arguments, identity, enabled triggers and installed-script hash, then starts the task and waits for a check tied to this particular blocking session. A task that registers but cannot run causes failure and attempted rollback. If service changes need a restart, the app explicitly reports that verification is incomplete.

During the initial check, Apply holds the operation lock and the watchdog only verifies the already-applied settings. Normal scheduled runs acquire the lock, enforce the block and verify it. A failed run, stale/missing check, changed watchdog file or service drift is visible in System details → Verification checks. Checks older than three minutes do not count as current proof.

Reliable removal and recovery

The controller disarms its saved state before removing watchdogs. It searches every Task Scheduler folder for the exact names used by previous releases:

• WU-Guardian, WU-Guardian_Startup, WU-Guardian_Hourly
• POS-WU-Guardian, POS-WU-Guardian_Startup, POS-WU-Guardian_Hourly
• POS-WU-Guardian-v4

It attempts disable, stop, and deletion independently; retries with the native Task Scheduler command; stops matching old guardian command processes; and verifies that no matching tasks remain. It then removes the installed watchdog script and its health record. An incomplete removal is an error, not a success message. This removes the app's tasks, not Windows Task Scheduler itself or unrelated tasks.

A protected baseline preserves original service startup settings and the original automatic-update policy across mode switches. An exclusive operation lock prevents simultaneous mode changes and guardian enforcement. A missing, corrupt, or transitional state never authorizes enforcement. Failed transitions attempt rollback and show Needs attention. Successful restoration keeps the archived baseline, and subsequent status checks can compare current settings with it.

Exact original-setting restoration applies to changes first made by version 4. The earlier batch scripts did not save full originals; their migration repair removes recognized restrictions and returns disabled dependencies to runnable settings. Existing unrelated administrator settings are preserved where identifiable.

Interface

Overview separates the current mode from your pending selection. Click any part of a mode card, then use the action bar that stays visible at the bottom. Radio controls support keyboard and accessibility navigation. Read-only access, a running operation, missing status and an unsupported Store edition explain why Apply is unavailable. Selections survive automatic status refreshes.

System details shows individual verification results, service status and task details. Activity provides progress, logs, backups, and diagnostic reports. Hard Block has a confirmation dialog that explains the watchdog and prevents interaction with the underlying page until you confirm or cancel. Failure and restart results are distinct. No restart or Windows Update scan is issued automatically.

System details	Activity and recovery

Documentation

• Reported Defender detection and containment steps
• Build and package from source
• Publisher signing and Windows security warnings
• Validation coverage and known limitations
• Troubleshooting and removing the application
• Changes in this release
• Quick start included with the application

Windows 10/11 desktop, Windows PowerShell 5.1, administrator access for changes. Store Friendly supports Pro, Enterprise, Education and IoT Enterprise. This project does not change your Windows edition's lifecycle or security support.

Data and backups: %ProgramData%\POSUpdateControl. Legacy repair backups: %ProgramData%\POS_WU_Repair. Preserve these backups during investigation. If security software has flagged the application, follow the containment notice instead of launching it to run Restore.

Policy references

• Microsoft: configure Windows Update client policies
• Microsoft: update policy applicability and deadlines
• Microsoft: troubleshooting Store download failures

MIT licensed. See LICENSE.