From 907dbf92b4bf13b84920838c3f0cb1bafd87dc20 Mon Sep 17 00:00:00 2001
From: Guofang <uglycat@foxmail.com>
Date: Fri, 16 Oct 2026 10:00:23 +0800
Subject: [PATCH] Add -DisableAutoUpdate switch to the Windows 11 configure
 script

Disables automatic Windows Update via policy, pins the current feature
release, and is enabled in Autounattend.xml.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 seediso/windows11/Autounattend.xml      |  2 +-
 seediso/windows11/Configure-Windows.ps1 | 36 +++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/seediso/windows11/Autounattend.xml b/seediso/windows11/Autounattend.xml
index 6a42b19..2ff5f46 100644
--- a/seediso/windows11/Autounattend.xml
+++ b/seediso/windows11/Autounattend.xml
@@ -162,7 +162,7 @@
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
           <Description>Configure Windows from the answer-media script</Description>
-          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = Get-ChildItem -Path (Get-PSDrive -PSProvider FileSystem).Root -Filter 'Configure-Windows.ps1' -File -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $script) { throw 'Configure-Windows.ps1 was not found on the attached media.' }; &amp; $script.FullName -InstallVirtIO -EnableAutomaticLogon -NoPause"</CommandLine>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = Get-ChildItem -Path (Get-PSDrive -PSProvider FileSystem).Root -Filter 'Configure-Windows.ps1' -File -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $script) { throw 'Configure-Windows.ps1 was not found on the attached media.' }; &amp; $script.FullName -InstallVirtIO -EnableAutomaticLogon -DisableAutoUpdate -NoPause"</CommandLine>
           <RequiresUserInput>false</RequiresUserInput>
         </SynchronousCommand>
       </FirstLogonCommands>
diff --git a/seediso/windows11/Configure-Windows.ps1 b/seediso/windows11/Configure-Windows.ps1
index 4c1fc79..b4c02f7 100644
--- a/seediso/windows11/Configure-Windows.ps1
+++ b/seediso/windows11/Configure-Windows.ps1
@@ -1,6 +1,7 @@
 param(
     [switch]$InstallVirtIO,
     [switch]$EnableAutomaticLogon,
+    [switch]$DisableAutoUpdate,
     [switch]$NoPause
 )
 
@@ -122,6 +123,38 @@ function Enable-AutomaticLogon {
     Remove-ItemProperty -Path $winlogonPath -Name 'AutoLogonCount' -ErrorAction SilentlyContinue
 }
 
+function Disable-AutomaticUpdate {
+    $windowsUpdatePath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
+    $autoUpdatePath = Join-Path $windowsUpdatePath 'AU'
+    $storePath = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore'
+    $currentVersion = Get-ItemProperty `
+        -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
+    $releaseVersion = $currentVersion.DisplayVersion
+
+    New-Item -Path $autoUpdatePath -Force | Out-Null
+    New-Item -Path $storePath -Force | Out-Null
+
+    # Never check automatically; manual checks and installs keep working.
+    Set-ItemProperty -Path $autoUpdatePath -Name 'NoAutoUpdate' -Value 1 -Type DWord
+    Set-ItemProperty -Path $autoUpdatePath -Name 'NoAutoRebootWithLoggedOnUsers' -Value 1 -Type DWord
+    Set-ItemProperty -Path $windowsUpdatePath -Name 'ExcludeWUDriversInQualityUpdate' -Value 1 -Type DWord
+
+    # Stay on the installed feature release instead of upgrading automatically.
+    if ($releaseVersion) {
+        Set-ItemProperty -Path $windowsUpdatePath -Name 'TargetReleaseVersion' -Value 1 -Type DWord
+        Set-ItemProperty -Path $windowsUpdatePath -Name 'TargetReleaseVersionInfo' -Value $releaseVersion -Type String
+    }
+
+    # 2 = never download Microsoft Store app updates automatically.
+    Set-ItemProperty -Path $storePath -Name 'AutoDownload' -Value 2 -Type DWord
+
+    # Windows may re-enable this task, so the policies above are the real switch.
+    Disable-ScheduledTask `
+        -TaskPath '\Microsoft\Windows\UpdateOrchestrator\' `
+        -TaskName 'Schedule Scan' `
+        -ErrorAction SilentlyContinue | Out-Null
+}
+
 $exitCode = 0
 try {
     if ($InstallVirtIO) {
@@ -132,6 +165,9 @@ try {
     if ($EnableAutomaticLogon) {
         Enable-AutomaticLogon
     }
+    if ($DisableAutoUpdate) {
+        Disable-AutomaticUpdate
+    }
     Write-Host 'Done.' -ForegroundColor Green
 }
 catch {