Blocking Windows 10 with Never10

Many Windows 7 and eight.ane users have no interest in Windows 10. Simply, Microsoft is adamant to spread their latest OS far and wide. Resistance, yet, is not futile. There are a number of means to inoculate Windows seven and 8.one from beingness infected with Windows 10.

Steve Gibson has just released Never10, the newest Windows 10 blocker. Earlier going into it, however, some background.

GWX CONTROL PANEL

gwx.ctl.panel

GWX Control Panel by Josh Mayfield

In the showtime, in that location was Josh Mayfield's GWX Control Panel (originally called GWX Stopper) and it was skilful, co-ordinate to every article ever written nearly it.

Just yesterday, an article at Neowin listed vii reasons why GWX Control Console (GWX = Get Windows X, a.g.a. ten) is better than other Windows 10 blockers. But, the article also points out twelve changes in the latest release. That feels like an awful lot to digest and bargain with, merely to cake Windows x. Not to mention, the constant stream of new versions/releases.

Cognition BASE 3080351

Microsoft Knowledge Base KB3080351

Back in July of 2015, Microsoft added a new choice to Windows Update that would block it from invading your PC with Windows 10. The good news is that it's a one-fourth dimension thing, set a flag and y'all're done. The bad news is everything else.

For one thing, it flew nether the radar for a while. Woody Leonhard claims that Microsoft first documented this in August 2015, while Ed Bott reports that it was beginning written upwardly in Jan of this yr. Microsoft puts a "Terminal Review" appointment on their Knowledge Base of operations manufactures, merely, even after all these decades, they have nonetheless not learned how to put a creation engagement on them.

To me, the documentation on this is written in an unhelpful manner. Opinions aside, it has also been wrong. According to Woody Leonhard, Josh Mayfield "... analyzed the descriptions in KB 3080351 and found several errors in Microsoft'south documentation...".

Ed Bott has a dandy article on the subject: How to block Windows ten upgrades on your business organization network (and at dwelling, likewise). A disclaimer at the beginning says "This article has been updated multiple times since its initial publication to comprise up-to-date data." In other words, Microsoft's ain documentation stinks.

group.policy.edit.blockwinten

Group Policy Editor tin can block Windows 10

Although the new Windows ten blocking characteristic exists in Windows Update, nosotros don't configure Windows Update direct. Instead, we employ the Grouping Policy Editor (gpedit.msc). As shown above, you block Windows 10 by enabling the option that "Turns off the upgrade to the latest version of Windows through Windows Update".

Simply, the low end editions of Windows vii and viii.1 practice not include the Grouping Policy Editor. Anyone with a Home edition of Windows has to manually update the registry in the well-nigh dangerous mode - by creating new keys.

Either approach is beyond the ability of many Windows users, which, I assume, is just fine with Microsoft.

RECOMMENDED UPDATES

Configuring Windows Update to not install recommended updates

The next option for blocking Windows 10 was to disable recommended updates in Windows Update. This became necessary when Microsoft inverse the condition of Windows ten from an optional update, to a recommended one.

This conversion started at the commencement of Feb. At the time, Woody Leonhard wrote in InfoWorld that

"Upgrade to Windows 10" has moved from an occasionally sighted Optional update to the much more mutual Recommended. Many Windows 7 and 8.i users report the upgrade now appears as a checked detail in Windows Update, immigration the way for the installer to launch automatically -- typically when the system reboots.

At to the lowest degree Microsoft warned techies ahead of time. Many non-techies were, no doubt, assimilated into the Windows 10 collective.

STEVE GIBSON's NEVER10

neverten.screenshot

Never10 past Steve Gibson reporting good news

At present we have a new generation of Windows 10 blocking software, Steve Gibson'due south Never10.

Like his bully Wizmo program, Never10 is portable. That is, no formal installation is needed, you just run the never10.exe file. As you might wait, Never10 requires Ambassador access.

What Gibson has done, is have Microsoft's complicated techie instructions for blocking Windows 10 and boil them downward to a single button click.

He also does the hard work of checking pre-reqs. That is, he kickoff insures that your edition of Windows is appropriate for this, so he also checks that the necessary version of Windows Update is installed. If Windows Update is not upward to spec, so he automates its installation (I take non nevertheless experienced this start paw). Cheers, Steve.

Personally, I had been modifying all the Windows 7 and 8.1 computers that I ran across using the Group Policy Editor instructions from Microsoft. But, I had just encountered a Windows Home machine, which would accept meant editing the registry of someone else's reckoner. Never10 arrived merely in time for me.

Only the first time I ran it, I was surprised.

The Windows seven system in question had already been inoculated from Windows 10 using the Group Policy Editor, withal (as shown below) Never10 reported in bold scarlet letters that "Windows 10 Bone Upgrade is ENABLED for this system!".

never10.enabled.screenshot

Never10 reports that Windows ten can all the same be installed even after using Group Policy Editor to forbid it

The reason for this lies in the title of the Microsoft Knowledge Base article: "How to manage Windows x notification and upgrade options". At that place is one registry modification for "notification" and one for "upgrade".

"Notification" refers to hiding the icon for the Get Windows 10 app that would otherwise appear in the notification area. Notification is controlled here:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Gwx

If the subkey DisableGwx is set to 1, notification is disabled.

Stopping Windows Update from installing Windows 10

Upgrading to Windows 10 via Windows Update is controlled here

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

If the subkey DisableOSUpgrade is set to 1 (shown to a higher place in regedit), upgrading is disabled.

Clicking on the "Disable Win10 Upgrade" button in Never10, sets both these registry keys.

Using the Group Policy Editor, every bit per Microsoft'south instructions, merely changes the DisableOSUpgrade primal. It does not alter the DisableGwx (notification) key. This, despite Microsoft's tough talk that "Computers that accept this Grouping Policy Setting enabled will never observe, download, or install an upgrade to the latest version of Windows."

Then, if you lot were Steve Gibson, what would you do if yous found the DisableOSUpgrade cardinal set merely not the DisableGwx cardinal? He chose to treat this every bit if the upgrade was enabled. I suppose its best to err on the side of circumspection.

This explains my initial surprise. Gibson has not documented this, just unless both  registry keys are in their disabled country, Never10 warns that Windows 10 can be upgraded.

To be certain of this, I tested with the DisableGwx key set to 1 but not the DisableOSUpgrade key. In this case besides, Never10 reported that the OS Upgrade is enabled (which information technology mostly is).

The most important point is that when Never10 says things are disabled, they truly are.

In an earlier turn to the dark side, Microsoft has been surreptitiously downloading Windows 10 to computers running Windows 7 or viii for a long fourth dimension. The downloaded bits tin can be upwards to 6 gigabytes.

GWX Control Panel will actively remove this united nations-requested copy of Windows 10. Never10 does not actively delete anything, only Gibson has reported that after both registry keys are set to i, Windows does eventually remove a downloaded copy of Windows 10 on its ain.

Some other squeamish thing that Gibson does when blocking Windows 10 is make the 2 registry keys read-only. It's not perfect protection from someone or something else changing them in the future, but it helps.

Update: March 31, 2016 9PM ET: According to Gibson, version 1.two, released only as I was finishing this, removes the read-only protection of the two registry keys. While it worked fine for 66,000 people, information technology seems to have caused a problem for one person.

COMPARE and CONTRAST

The reason why GWX Control Console is so complicated, is that its fighting an octopus. Microsoft's system for assimilating Windows 7 and 8.i machines into the Windows 10 collective is complicated. The last time I looked at the Task Scheduler, in that location were roughly a half dozen scheduled tasks involving GWX, including a few that could not be disabled, even past an Ambassador.

Never10 does not engage the octopus in hand to hand combat. It simply sets two registry keys that Microsoft created to control the octopus.

Back in January, Woody Leonhard did a detailed examination of how these registry keys change the behavior of the octopus and reported that

... although the Registry entries succeed in keeping the most visible part of GWX from appearing ... they exercise absolutely cipher to keep GWX off of Windows 7 and viii.1 PCs. In fact, the phalanx of programs, settings, scheduled tasks, and automatic Registry-changers proceed to work behind the scenes no thing how y'all jigger those settings.

A few days earlier, he wrote:

The DisableGWX value, which GWX Command Panel has been setting since version 1.0, does one thing, and one matter but: When the scheduled GWX.EXE job runs, it checks for that registry value, and if it's gear up, GWX.EXE quits itself. That'southward how you remove the icon from your notification expanse. Merely this doesn't do anything about the several groundwork tasks that Microsoft installs along with GWX.EXE.

In his recent commodity comparing GWX Control Panel to Never10, Woody again looked at the octopus in detail and reported that:

Never10 performs precisely every bit advertised ... If you click the Disable Win10 Upgrade push button, the Windows 10 upgrade routine refuses to run, even if you manually try to run it. The Get Windows ten routines that run behind the scenes terminate running.

Anyone wanting to totally remove the proverbial octopus should opt for Josh Mayfield'due south GWX Control Panel, simply, with the realization that Microsoft creates new tentacles all the time and the program has to be constantly revised to combat this.

Personally, I prefer Never10, specially on Windows machines that have yet to exist infected with the octopus.

Michael Horowitz is an contained consultant who has long been focused on Defensive Computing.

Copyright © 2016 IDG Communications, Inc.