Once upon a time, Windows Update could be trusted only to provide updates to the current operating system that introduced genuinely useful new functionality or (more likely) stability and security improvements. This is no longer the case. In June 2015, Microsoft decided that they would use the Windows Update system to install a program that inserted a system tray icon begging you to get your free upgrade to Windows 10:
One update also silently downloaded GIGABYTES of Windows 10 installation files to a hidden folder on your hard drive. This demonstrates a fundamental breach of trust by Microsoft whereby they are now prepared to use their Windows Update system to push pretty much anything they want onto your PC.
Not all of its updates should therefore now be trusted, so automatic updates should NEVER be enabled.
Since writing this, I've discovered a really nice tool that is regularly updated and which deals with pretty much everything in this article in terms of preventing Windows 10 nagware and installation (except, at the time of writing, blocking the nasty updates). It's called "GWX Control Panel":
Its homepage in the form of a blog post is here: http://blog.ultimateoutsider.com/2015/08/using-gwx-stopper-to-permanently-remove.html
Download it from here: http://ultimateoutsider.com/downloads/
It should be installed fully, and Monitor Mode should be enabled. Regularly check for updates and make sure any hint of Windows 10 nastiness is dealt with immediately.
You should still follow the sections below regarding disabling the nasty Windows Updates and opting out of CEIP! However, GWX Control Panel, set to monitor (icon in system tray), properly installed and maintained, should deal with the rest of the business of stopping Windows 10.
As soon Windows 7 is installed on a PC (preferably before it's connected to the internet), automatic updates should be disabled. As soon as possible, configure Windows Updates like so:
This will obviously prevent any updates from being automatically installed. You will still want to install the good updates. Basically you have to go through the updates and make sure they're not in the "list of Windows 10 nagware/malware updates" below. Most of the ones in the list are marked as "Recommended", but are still down as "Optional" rather than "Important" (automatic updates will still auto-install "Recommended" updates). However, one or two are still marked as "Important" updates, so make sure you trawl through both "Optional" and "Important" updates, only installing good ones.
Note that whilst you're trawling through, selecting which updates to install, you can "hide" the bad updates like so:
However, I don't trust this "hide" mechanism long-term. Hidden updates have been known to come back and get installed anyway, so only ever use "hide" as a temporary mechanism to help you screen out the bad updates in this session. ALWAYS check to make sure you're not installing malicious/nagware updates each time you periodically do manual checks for new updates (which you will have to do, as automatic updates are now disabled).
Once updates have been installed, you'll want to immediately go into PowerShell and check that you didn't accidentally install any of the bad updates, uninstalling them immediately if you did:
get-hotfix -id KB3035583,KB2952664,KB2976978,KB3021917,KB3044374,KB2990214,KB3083711,KB3083710,KB3068708,KB3022345,KB3075249,KB3080149,KB3112343,KB3123862
Microsoft enrols everyone who installs Windows 7 into their "Windows Customer Experience Improvement Program" which sends telemetry data back to Microsoft. Do you want to be enrolled in that? No, didn't think so. This should also be disabled ASAP on any Windows 7 install (or any Windows install, for that matter!) In the start menu, search for "experience" and you should see an entry come up titled "Change Customer Experience Improvement Program settings". Run this, select "No, I don't want to participate in the program", and save changes.
Obviously, you should first disable automatic updates and setup the Windows Update system to operate as described above if you haven't done so already.
With that said, the first thing to mention is what NOT to do. Don't bother using a registry hack to hide the icon. Although one exists (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Gwx\"DisableGwx"), it still leaves the frankly malicious Microsoft nagware software on your hard drive which might end up downloading GIGABYTES of Windows 10 installation files "just in case" you decide you want to switch to Windows 10. You'll be wanting to get these updates off your system, and keep them out. They're basically malware; you don't hide it, you remove it.
So you'll want to remove the updates (make sure you disable automatic updates FIRST so they don't come back automatically!) The following, at the time of writing, are the offending updates that may result in nagware being installed and/or GIGABYTES of Windows 10 installation files being downloaded to your hard drive (thanks to this ghacks article for this info).
List of Windows 10 nagware/malware updates:
Microsoft notes that users should not remove or block the updates 3044374 and 2990214 as they are used for Windows Update functionality and not only to upgrade to Windows 10. But screw that. You should block them.
They may already have been installed. Firstly, to tell which ones are already installed, open a command prompt and type powershell. Once you're in PowerShell, type:
get-hotfix -id KB3035583,KB2952664,KB2976978,KB3021917,KB3044374,KB2990214,KB3083711,KB3083710,KB3068708,KB3022345,KB3075249,KB3080149,KB3112343,KB3123862
This will give a list of which of the offending updates have already been installed or (if you're lucky and none of them have been installed) will give you an error message in red about how the command "cannot find hot-fix on the machine..." If you get the error in red, you're OK and none of them have been installed. Otherwise, you'll need to uninstall each one listed one-by-one. Do this by (still in PowerShell) using the following command for each hotfix:
wusa /uninstall /kb:2952664
... where 2952664 is the ID of the hotfix in question to uninstall. Note that this is a very unideal way to do things (much better not to install them in the first place) and I have personally found that sometimes the uninstall won't work completely and although the uninstaller will claim to have uninstalled the hotfix, it sticks around. For instance I can't get rid of "KB2952664". Just won't go away. So yeah, avoid installing these things in the first place.
One further thing to check (and try to keep your blood pressure down here), is whether one of these "updates" from Microsoft may STILL have silently downloaded gigabytes of Windows 10 "upgrade" data which will be wasting space on your hard drive. Have a look on your hard drives for the (hidden) folder called "$Windows.~BT". It may be there, wasting gigabytes of space. It can be safely deleted as long as you don't want to "upgrade" to Windows 10, but it aint easy to get rid of.
First, make sure you have the handy "unixutils" bin directory in your path; you'll be needing its "rm" command. Then, write a killMS.bat file with the following contents, and run it inside a command window opened as Administrator. Once it's completed and hopefully deleted the waste-of-space directory, it can itself be deleted.
@ECHO OFF CLS ECHO Project "terminate $Windows.~BT folder" - Jeremy Morton ECHO ======================================================= ECHO Assuming the $Windows.~BT folder is on drive C: - if not, please Ctrl-C now and ECHO modify this batch file to the appropriate drive letter. PAUSE C: cd "\$Windows.~BT" ECHO. ECHO Taking ownership of all the directory's files (YOU SHOULD GET A BUNCH OF ECHO SUCCESS MESSAGES; THESE ARE OK, AND THE OPERATION HAS NOT FAILED). PAUSE takeown /F *.* /R /D Y PAUSE ECHO. ECHO Granting full rights to everyone for all the directory's files. PAUSE icacls *.* /grant Everyone:(OI)(CI)F /T PAUSE ECHO. ECHO Terminating the $Windows.~BT directory. PAUSE cd \ rm -rf "$Windows.~BT" ECHO. ECHO Finished. Press a key to exit. PAUSE