Add -DisableAutoUpdate switch to the Windows 11 configure script

Disables automatic Windows Update via policy, pins the current feature
release, and is enabled in Autounattend.xml.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

seediso/windows11/Autounattend.xml

@@ -162,7 +162,7 @@
         <SynchronousCommand wcm:action="add">
           <Order>1</Order>
           <Description>Configure Windows from the answer-media script</Description>
-          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = Get-ChildItem -Path (Get-PSDrive -PSProvider FileSystem).Root -Filter 'Configure-Windows.ps1' -File -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $script) { throw 'Configure-Windows.ps1 was not found on the attached media.' }; &amp; $script.FullName -InstallVirtIO -EnableAutomaticLogon -NoPause"</CommandLine>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = Get-ChildItem -Path (Get-PSDrive -PSProvider FileSystem).Root -Filter 'Configure-Windows.ps1' -File -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $script) { throw 'Configure-Windows.ps1 was not found on the attached media.' }; &amp; $script.FullName -InstallVirtIO -EnableAutomaticLogon -DisableAutoUpdate -NoPause"</CommandLine>
           <RequiresUserInput>false</RequiresUserInput>
         </SynchronousCommand>
       </FirstLogonCommands>

seediso/windows11/Configure-Windows.ps1

@@ -1,6 +1,7 @@
 param(
     [switch]$InstallVirtIO,
     [switch]$EnableAutomaticLogon,
+    [switch]$DisableAutoUpdate,
     [switch]$NoPause
 )
 
@@ -122,6 +123,38 @@ function Enable-AutomaticLogon {
     Remove-ItemProperty -Path $winlogonPath -Name 'AutoLogonCount' -ErrorAction SilentlyContinue
 }
 
+function Disable-AutomaticUpdate {
+    $windowsUpdatePath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
+    $autoUpdatePath = Join-Path $windowsUpdatePath 'AU'
+    $storePath = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore'
+    $currentVersion = Get-ItemProperty `
+        -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
+    $releaseVersion = $currentVersion.DisplayVersion
+
+    New-Item -Path $autoUpdatePath -Force | Out-Null
+    New-Item -Path $storePath -Force | Out-Null
+
+    # Never check automatically; manual checks and installs keep working.
+    Set-ItemProperty -Path $autoUpdatePath -Name 'NoAutoUpdate' -Value 1 -Type DWord
+    Set-ItemProperty -Path $autoUpdatePath -Name 'NoAutoRebootWithLoggedOnUsers' -Value 1 -Type DWord
+    Set-ItemProperty -Path $windowsUpdatePath -Name 'ExcludeWUDriversInQualityUpdate' -Value 1 -Type DWord
+
+    # Stay on the installed feature release instead of upgrading automatically.
+    if ($releaseVersion) {
+        Set-ItemProperty -Path $windowsUpdatePath -Name 'TargetReleaseVersion' -Value 1 -Type DWord
+        Set-ItemProperty -Path $windowsUpdatePath -Name 'TargetReleaseVersionInfo' -Value $releaseVersion -Type String
+    }
+
+    # 2 = never download Microsoft Store app updates automatically.
+    Set-ItemProperty -Path $storePath -Name 'AutoDownload' -Value 2 -Type DWord
+
+    # Windows may re-enable this task, so the policies above are the real switch.
+    Disable-ScheduledTask `
+        -TaskPath '\Microsoft\Windows\UpdateOrchestrator\' `
+        -TaskName 'Schedule Scan' `
+        -ErrorAction SilentlyContinue | Out-Null
+}
+
 $exitCode = 0
 try {
     if ($InstallVirtIO) {
@@ -132,6 +165,9 @@ try {
     if ($EnableAutomaticLogon) {
         Enable-AutomaticLogon
     }
+    if ($DisableAutoUpdate) {
+        Disable-AutomaticUpdate
+    }
     Write-Host 'Done.' -ForegroundColor Green
 }
 catch {