Blocking Windows x with Never10

Many Windows 7 and 8.1 users have no interest in Windows 10. Merely, Microsoft is adamant to spread their latest OS far and wide. Resistance, however, is not futile. In that location are a number of means to inoculate Windows 7 and 8.1 from being infected with Windows 10.

Steve Gibson has just released Never10, the newest Windows 10 blocker. Earlier going into it, however, some background.

GWX CONTROL PANEL

gwx.ctl.panel

GWX Control Panel by Josh Mayfield

In the beginning, in that location was Josh Mayfield's GWX Control Panel (originally called GWX Stopper) and information technology was good, according to every article always written about it.

Simply yesterday, an article at Neowin listed seven reasons why GWX Control Console (GWX = Become Windows X, a.one thousand.a. 10) is better than other Windows x blockers. Just, the commodity as well points out twelve changes in the latest release. That feels similar an atrocious lot to assimilate and deal with, only to block Windows 10. Not to mention, the constant stream of new versions/releases.

Noesis Base of operations 3080351

Microsoft Cognition Base KB3080351

Dorsum in July of 2015, Microsoft added a new option to Windows Update that would block it from invading your PC with Windows ten. The good news is that information technology's a onetime thing, set up a flag and you're done. The bad news is everything else.

For 1 thing, it flew under the radar for a while. Woody Leonhard claims that Microsoft get-go documented this in August 2015, while Ed Bott reports that it was first written up in January of this year. Microsoft puts a "Final Review" date on their Knowledge Base manufactures, just, even after all these decades, they have however not learned how to put a creation date on them.

To me, the documentation on this is written in an unhelpful mode. Opinions aside, it has also been wrong. According to Woody Leonhard, Josh Mayfield "... analyzed the descriptions in KB 3080351 and found several errors in Microsoft's documentation...".

Ed Bott has a great article on the subject: How to block Windows 10 upgrades on your concern network (and at home, too). A disclaimer at the beginning says "This article has been updated multiple times since its initial publication to incorporate up-to-date information." In other words, Microsoft's own documentation stinks.

group.policy.edit.blockwinten

Group Policy Editor can block Windows 10

Although the new Windows 10 blocking feature exists in Windows Update, we don't configure Windows Update straight. Instead, nosotros employ the Group Policy Editor (gpedit.msc). Equally shown above, y'all block Windows 10 past enabling the selection that "Turns off the upgrade to the latest version of Windows through Windows Update".

But, the low terminate editions of Windows 7 and viii.1 do not include the Group Policy Editor. Anyone with a Home edition of Windows has to manually update the registry in the nearly dangerous way - by creating new keys.

Either approach is beyond the power of many Windows users, which, I assume, is just fine with Microsoft.

RECOMMENDED UPDATES

Configuring Windows Update to not install recommended updates

The side by side pick for blocking Windows ten was to disable recommended updates in Windows Update. This became necessary when Microsoft inverse the status of Windows 10 from an optional update, to a recommended one.

This conversion started at the outset of February. At the time, Woody Leonhard wrote in InfoWorld that

"Upgrade to Windows 10" has moved from an occasionally sighted Optional update to the much more than common Recommended. Many Windows seven and 8.1 users report the upgrade now appears as a checked item in Windows Update, clearing the way for the installer to launch automatically -- typically when the organization reboots.

At least Microsoft warned techies ahead of fourth dimension. Many non-techies were, no doubt, assimilated into the Windows 10 collective.

STEVE GIBSON's NEVER10

neverten.screenshot

Never10 by Steve Gibson reporting good news

At present nosotros have a new generation of Windows x blocking software, Steve Gibson'southward Never10.

Like his cracking Wizmo program, Never10 is portable. That is, no formal installation is needed, y'all only run the never10.exe file. As you might expect, Never10 requires Administrator access.

What Gibson has done, is have Microsoft'southward complicated techie instructions for blocking Windows 10 and boil them down to a single push click.

He also does the hard piece of work of checking pre-reqs. That is, he offset insures that your edition of Windows is advisable for this, and then he besides checks that the necessary version of Windows Update is installed. If Windows Update is non up to spec, so he automates its installation (I take not yet experienced this showtime hand). Cheers, Steve.

Personally, I had been modifying all the Windows vii and 8.1 computers that I ran across using the Group Policy Editor instructions from Microsoft. Only, I had just encountered a Windows Dwelling house machine, which would take meant editing the registry of someone else'south calculator. Never10 arrived just in fourth dimension for me.

But the first fourth dimension I ran it, I was surprised.

The Windows 7 arrangement in question had already been inoculated from Windows x using the Group Policy Editor, still (as shown beneath) Never10 reported in bold red messages that "Windows 10 OS Upgrade is ENABLED for this system!".

never10.enabled.screenshot

Never10 reports that Windows 10 can still be installed even after using Group Policy Editor to forestall it

The reason for this lies in the title of the Microsoft Cognition Base article: "How to manage Windows 10 notification and upgrade options". There is one registry modification for "notification" and i for "upgrade".

"Notification" refers to hiding the icon for the Get Windows 10 app that would otherwise appear in the notification area. Notification is controlled here:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Gwx

If the subkey DisableGwx is set to one, notification is disabled.

Stopping Windows Update from installing Windows ten

Upgrading to Windows 10 via Windows Update is controlled hither

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

If the subkey DisableOSUpgrade is set to 1 (shown higher up in regedit), upgrading is disabled.

Clicking on the "Disable Win10 Upgrade" push button in Never10, sets both these registry keys.

Using the Group Policy Editor, as per Microsoft'due south instructions, only changes the DisableOSUpgrade key. Information technology does not change the DisableGwx (notification) key. This, despite Microsoft's tough talk that "Computers that have this Grouping Policy Setting enabled will never detect, download, or install an upgrade to the latest version of Windows."

So, if y'all were Steve Gibson, what would yous do if you establish the DisableOSUpgrade key set but not the DisableGwx key? He chose to treat this as if the upgrade was enabled. I suppose its best to err on the side of caution.

This explains my initial surprise. Gibson has not documented this, but unless both  registry keys are in their disabled state, Never10 warns that Windows 10 tin can be upgraded.

To be sure of this, I tested with the DisableGwx key set to 1 just not the DisableOSUpgrade key. In this case likewise, Never10 reported that the OS Upgrade is enabled (which information technology mostly is).

The most important signal is that when Never10 says things are disabled, they truly are.

In an earlier turn to the dark side, Microsoft has been surreptitiously downloading Windows 10 to computers running Windows 7 or eight for a long fourth dimension. The downloaded bits can be up to six gigabytes.

GWX Command Console volition actively remove this un-requested copy of Windows 10. Never10 does not actively delete anything, only Gibson has reported that after both registry keys are gear up to 1, Windows does somewhen remove a downloaded copy of Windows 10 on its own.

Some other nice matter that Gibson does when blocking Windows ten is make the 2 registry keys read-only. It's not perfect protection from someone or something else changing them in the futurity, but it helps.

Update: March 31, 2016 9PM ET: According to Gibson, version 1.2, released just as I was finishing this, removes the read-only protection of the two registry keys. While it worked fine for 66,000 people, it seems to have caused a problem for i person.

COMPARE and Dissimilarity

The reason why GWX Command Panel is then complicated, is that its fighting an octopus. Microsoft'due south system for assimilating Windows 7 and eight.1 machines into the Windows x commonage is complicated. The concluding fourth dimension I looked at the Task Scheduler, there were roughly a one-half dozen scheduled tasks involving GWX, including a few that could not be disabled, even past an Ambassador.

Never10 does non engage the octopus in paw to hand gainsay. It just sets two registry keys that Microsoft created to control the octopus.

Back in January, Woody Leonhard did a detailed test of how these registry keys modify the behavior of the octopus and reported that

... although the Registry entries succeed in keeping the almost visible part of GWX from appearing ... they exercise absolutely nothing to go on GWX off of Windows 7 and 8.1 PCs. In fact, the phalanx of programs, settings, scheduled tasks, and automatic Registry-changers go on to work behind the scenes no affair how y'all jigger those settings.

A few days before, he wrote:

The DisableGWX value, which GWX Control Console has been setting since version 1.0, does ane thing, and one thing only: When the scheduled GWX.EXE chore runs, information technology checks for that registry value, and if information technology's set, GWX.EXE quits itself. That'southward how yous remove the icon from your notification area. Simply this doesn't exercise annihilation almost the several groundwork tasks that Microsoft installs forth with GWX.EXE.

In his recent article comparison GWX Command Panel to Never10, Woody over again looked at the octopus in detail and reported that:

Never10 performs precisely equally advertised ... If you click the Disable Win10 Upgrade push, the Windows 10 upgrade routine refuses to run, even if you manually effort to run it. The Get Windows x routines that run behind the scenes stop running.

Anyone wanting to totally remove the proverbial octopus should opt for Josh Mayfield'south GWX Control Console, but, with the realization that Microsoft creates new tentacles all the fourth dimension and the program has to be constantly revised to gainsay this.

Personally, I adopt Never10, especially on Windows machines that take nonetheless to be infected with the octopus.

Michael Horowitz is an independent consultant who has long been focused on Defensive Computing.

Copyright © 2016 IDG Communications, Inc.