With the spring feature update to Windows 10 (version 1803, build 17134, Redstone 4) now rolling out, here are the best ways to ensure you install it when you’re ready — even in the face of recent forced updates from Microsoft.

With Microsoft now rolling out the Windows 10 April 2018 Update, version 1803, I take it as an article of faith that you don’t want to install it right away. As we’ve seen, repeatedly, upgrading to a new version of Windows 10 as soon as it’s out leads to madness. For almost everyone, the new features in version 1803 — Timeline, a few moved settings, more telemetry options but not the one (“OFF”) that matters most, faster upgrades — just aren’t worth the bother of installing and setting up an entirely new copy of Windows. (Unless you really want Candy Crush Soda Saga installed for the umpteenth time.)

If you’re a Cortana or Edge fan, your opinion may vary, of course. And there are undeniable benefits under the covers. But for 90% of us, I would guess, 1803 isn’t high on the priority list. It certainly isn’t worth thrusting yourself into the unpaid beta tester pool at the earliest opportunity, while waiting for Microsoft to iron is problems out. Thus, for most Windows 10 users, it makes a whole lot of sense to wait and update to 1803 when you’re good and ready for it — not when MS decides to push it on you.

[ Further reading: The Best Windows 10 Features for Laptop and Tablet PC Users]

Turning the Automatic Update switch off should only take a few clicks. After all, that’s what we had with Windows 7 and 8.1. We’ve gone beyond that now. Windows 10 updates itself “as a service” — but your system needn’t be servile.

The textbook approach (for Windows 10 Pro, Enterprise and Education)

For those of you running Windows 10 Pro, Enterprise or Education, there’s always the Microsoft Party Line. Here’s the official way to turn off Windows 10 “feature updates” (that’s the official name for a version upgrade):

Step 1. Click Start > Settings > Update & Security.

You see the Advanced Options pane. If you’re running Win10 Fall Creators Update, version 1709, what you see is shown in the screenshot.

Step 2. Set the Branch Readiness to Semi-Annual Channel.

This setting should tell Microsoft to refrain from installing the next version of Windows (in this case, 1803) until there’s been an official announcement that the version is “ready for widespread deployment” or “full availability.” As you’ll see in the next section, that’s not what’s happened in the recent past. One hopes it’ll happen in the future.

In theory, new versions of Windows 10 will be deemed “ready for widespread deployment” four months after initial release — in the case of 1803, that would be in early August. In practice, the milestone (formerly called “Current Branch for Business”) has taken a little over three months.

There’s no warning about the shift to “Semi-Annual Channel.” Microsoft just declares a new version to be ready for full availability, for reasons as yet unknown, and that same day, the new version starts rolling out to those on the Semi-Annual Channel branch.

If you’re running Windows 10 Creators Update, version 1703, the pane’s a little bit different. You want to choose Current Branch for Business.

Step 3. Set the Feature Update deferral to 365 days.

In theory, this setting tells Microsoft that you want to wait for the next version of Windows, version 1803 in this case, to be declared “ready for widespread deployment” and after that you want to wait for an additional 365 days. In practice, we’ve never hit the 365 day mark, but this setting should perform at least as well as wearing a strand of garlic around your neck.

The setting’s the same for both Windows 10 1709 and 1703.

While you’re here, you should also tell Windows 10 to wait 30 days before installing cumulative updates (“quality updates”).

You can “X” out of the pane. There’s no Save button.

If you use Windows 10 Home

For those of you running Windows 10 Home, the situation isn’t nearly as straightforward. Many people recommend that you turn off the Windows Update service, wuauserv, but I’ve never been a fan of that approach — too many possible problems and undocumented side effects. (If you feel so inclined, though, just google “disable wuauserv.”)

My recommendation is to mark your internet connection as “metered” — telling Microsoft, in effect, that you’re paying for internet by the bit, and you don’t want to overload your connection. There’s no guarantee this approach (dare I call it a “trick”?) will always work, but, unlike the official settings mentioned in the preceding section, it doesn’t look like Microsoft has ignored them specifically to force upgrades on blocked machines.

Metered connections have some odd side effects, with selective downloading that’s occasionally hard to predict, but if you don’t have Pro, Enterprise or Education, it’s an easy way to dodge the forced upgrade bullet.

To set your internet connection to metered, click Start > Settings > Network & Internet. If you have a wired (Ethernet) connection, on the left, click Ethernet, click on the network icon, and slide “Set as metered connection” to On (see the screenshot below).

If you connect to the internet via Wi-Fi, the instructions are the same except, on the left, click Wi-Fi.

Windows 7 and 8.1

If you haven’t yet made the leap to Windows 10, there’s nothing to worry about. The days of pushed Win10 updates are long behind us, and it’s unlikely they’ll come again. In theory, Win7 and 8.1 users have to pay for the Win10 upgrade. I’ve seen no indication that Microsoft will ever bring back the “Get Windows 10” debacle.

Microsoft’s propensity to forget its own settings

On three separate occasions over the past five months — in November 2017, January 2018, and March 2018 — Microsoft forcibly upgraded Windows 10 Pro machines that have Advanced Options set to defer upgrades. Microsoft has, in effect, ignored its own settings. You can think of these incidents as accidents, or the result of overworked or overly zealous individuals. I, for one, am not so magnanimous.

These aren’t fly-by-night reports, or wails of pain from users who forgot to turn something on or off. All three have been documented by Microsoft as being Microsoft mistakes, in nooks and crannies of its various posts.

Oddly, it seems that the metered connection trick kept working in the face of all of those “oopsies.” You may well want to set your internet connection to metered, even if you use Windows 10 Pro, Enterprise or Education. Belt and suspenders and all that.

Microsoft’s official back door

The last, and most nefarious of the three “oops” events involves a, uh, feature called Update Assistant and its executioner program, updateassistant.exe. The poorly documented Update Assistant has been around for a long time, but its intrusive nature came to light when it started (erroneously, according to Microsoft) ignoring the Windows Update settings that were supposed to block installation of the next version of Windows 10.

Update Assistant has evolved. You may have seen KB 4023057, the “Update to Windows 10 Versions 1507, 1511, 1607, and 1703 for update reliability,” which has been released and re-re-re-released more than a dozen times. This “Remediation Shell” (formerly “WaaSMedic”) patch is intended to (in the words of abbodi86):

Fix and reset Windows Update-related parts to their “supported” configuration, i.e. restore registry settings, services status, schedule tasks, clear disk space, and launch UpdateAssistant.exe if installed. Mainly it’s meant to pave the way to receive the latest updates, whether quality updates, or feature update to latest Windows 10 version… it evolved from just fixing the Registry to restoring tasks and fixing the drivers DB, and compatibility for UAC management.. the main purpose or function did not change: re-allow blocked or disabled Windows Update.

Microsoft’s so gung-ho on blasting away your Windows Update blocks that it’s set up a regimen worthy of the finest malware. The most egregious example is KB 4023814 which has an odd web page that says:

Some versions of Windows 10 display a notification to install the latest version.

If you’re currently running Windows 10 Version 1507, Version 1511, Version 1607, or Version 1703, you can expect to receive a notification that states that your device has to have the latest security updates installed. Windows Update will then try to update your device.

The KB article somehow neglects to mention what KB 4023814 actually does. As MrBrian notes on AskWoody, when you run the patch, it installs (or updates) updateassistant.exe and Windows10Upgrade.exe, then sets up two scheduled tasks:

• UpdateAssistant runs every time you restart your machine or log on to Windows. The scheduled task looks to see if updateassistant.exe or Windows10Upgrade.exe is available and, if not, reconstructs it from the files in C:\Windows\UpdateAssistant or \UpdateAssistantV2. It then runs updateassistant.exe.
• UpdateAssistantCalendarRun runs every three days whether you reboot or not. Like UpdateAssistant, it reconstitutes the updateassistant.exe or Windows10Upgrade.exe file, then runs updateassistant.exe.

MrBrian has also found references to yet another task named UpdateAssistantWakeupRun. Abbodi86 says the latest KB 4023814 versions are just wrappers for Windows10Update.exe.

To put icing on the cake, you can’t uninstall KB 4023814. It doesn’t show up in your list of installed updates. It isn’t in the Microsoft Update Catalog either, for that matter.

Microsoft really doesn’t want you to mess with the Windows Update service. If you do, your efforts are likely to be blasted away. Microsoft has used this vector to force people from Windows 10 1703 to 1709, whether they wanted it or not. It remains to be seen how many “oops” moments we’ll see in the movement from 1709 to 1803.

If you ever wondered why 90% of all Windows 10 users got bumped to Windows 10 1709, now you know.

Of course, from Microsoft’s point of view they’re simply correcting any bugs that may have been introduced in the upgrade process. Defeating those who actively block the upgrade is just a bit of fortuitous collateral damage.

Wushowhide

When all else fails — or if you want to hold the Windows 10 1803 upgrade at bay while you install other updates — Microsoft’s wushowhide utility works great. You want to hide the “Feature update to Windows 10, version 1803.” The trick is that you can’t hide the “Feature update to Windows 10, version 1803” update until it actually appears on your machine — and it may not get pushed to you for days, weeks, or even months.

To prevent any nasty surprises, you should run wushowhide before you switch off any of the 1803-blocking techniques mentioned in this feature. If 1803 is being offered on your machine, wushowhide lets you “hide” the patch while you use Windows Update to get your other patches brought up to date.

Here’s how to run wushowhide:

Step 1. Go to KB 3073930 and download Microsoft’s Wushowhide tool. (Click the link marked “Download the ‘Show or hide updates’ troubleshooter package now.”) Drag the downloaded file, Wushowhide.diagcab, to any convenient location.

Step 2. Double-click on Wushowhide.diagcab to run it.

Step 3. This part’s important. Click the link marked Advanced. Uncheck the box marked “Apply repairs automatically.” Click Next.

Step 4. Wushowhide will run for a long, long time. When it comes back up for air, click the link to Hide Updates. If you see a checkbox marked “Feature update to Windows 10, version 1803,” as in the screenshot, check the box next to the item and click Next. (If you don’t see “Feature update to Windows 10, version 1709,” the upgrade isn’t being sent to your box yet. “X” out of wushowhide and check again tomorrow.

Wushowhide is an odd bird. If it successfully hid the upgrade/update/patch, you’ll see a “Troubleshooting has completed” dialog with your 1803 patch marked as a “Problems found.” You did everything right.

Step 5. Click Close. You’re done.

If you don’t trust Microsoft’s wushowhide tool, you can verify for yourself that it hid the version 1803 upgrade. Go back to Windows Update (Start > Settings > Update & security, then Check for Updates) your machine should show “Your device is up to date.” The 1803 upgrade didn’t get installed.

When you’re ready to install version 1803 — you probably will, at some point — the reverse procedure’s just as easy. Here’s how to unhide the update:

Step 1. Double-click on Wushowhide.diagcab to run it. This part’s important. Click the link marked Advanced. Uncheck the box marked “Apply repairs automatically.” Click Next.

Step 2. Wushowhide will run for a long time. When it comes back up, click the link to Show hidden updates.

Step 3. Check the box next to “Feature update to Windows 10, version 1803,” click Next, and click Next again.

Wushowhide will dutifully tell you it is “Resolving problems.” When it’s done, you see a “Troubleshooting has completed” dialog.

Step 4. Click Close.

Version 1803 will then get queued up again, and the next time Windows Update runs (you can check for updates manually, or let it run by itself, likely overnight), your machine will reboot into Windows 10 Redstone 4, version 1803, build 17133.

Your options

Nobody knows what kinds of dirty tricks (er, remediation techniques) Microsoft will employ to push Windows 10 users onto 1803 — whether we’ll have even more “oops” experiences. So it’s impossible to say definitively how you can block the upgrade to 1803, both now and in the future.

At this point, if you’re serious about staying on your current version of Windows 10, here’s what I would recommend:

• If you’re running Windows 10 Pro, Enterprise or Education, follow the official instructions and set Windows Update’s advanced options to Semi-Annual Channel and 365-day deferral of “feature updates,” as shown in the screenshot.
• No matter which edition of Windows 10 you’re using, set your internet connection to “metered.”
• If you’re feeling particularly paranoid (and technically capable), delete the UpdateAssistant scheduled tasks and delete everything in c:\Windows\UpdateAssistant and \UpdateAssistantV2. Carefully watch what’s being applied to your machine to make sure no more UpdateAssistant-related patches leak through including, notably, KB 4023814 and KB 4023057.

Work is under way to figure out how best to keep updateassistant.exe and Windows10Upgrade.exe at bay. We’ll be following closely on AskWoody.com.

Thx to MrBrian, abbodi86, and the other intrepid interlocutors on AskWoody.

Follow the update struggle on the AskWoody Lounge