WUMTWrapperScript.cmd v2.3.8

@echo off
mode con cols=85 lines=12
Title WUMT Wrapper Script 2.3.8
Color 1F & goto start
Original script by pf100 @ MDL with special thanks to rpo and abbodi1406 @ MDL for code improvements.
Project page and source code:
https://forums.mydigitallife.net/threads/72203-WUMT-Wrapper-script-controls-windows-update-service
******************************************************************
You may freely modify this script as you wish, I only request that you leave the credits and the
link to the original script.
******************************************************************
This script provides manual updating for Windows 10 including Home versions.
Update Windows 10 on your schedule, not Microsoft's.
I originally wrote this script for personal use because of the lack of update options with the
original RTM release of Windows 10 Pro. I wanted to update Windows 10 when I had the free time
to manually update, just like I did with previous versions of Windows that allowed me to
set updates to manual, not when Microsoft forced it on me while I was busy using my computer.
*******************************************************************
WUMT is available here: https://forums.mydigitallife.net/threads/64939-Windows-Update-MiniTool
Windows Update Blocker is available here: https://www.dropbox.com/s/a67qj0qzbmx59bm/wub.exe?dl=1
Only use Windows Update Blocker v1.0 with this script, not v1.1.
*******************************************************************
How it works: The script first checks if the OS is Windows 7 or older and if so
it bypasses the Windows 10 Update Hijacker disable portion of the script.
This script creates a smart Windows Defender Update task "WUD" that updates Windows
Defender if it's running and enabled, and doesn't update it if it's not running and disabled,
auto-elevates, uninstalls and removes the Windows 10 Update Assistant, renames the
%programfiles%\rempl* folder, resets and removes permissions from and disables these
Update Hijackers:
remsh.exe*
osrss.dll
UsoClient.exe
WaaSMedic.exe
WaasMedicSvc.dll
WaaSMedicPS.dll
WaaSAssessment.dll
MusNotificationUx.exe
SIHClient.exe
makes sure the task "wub_task" is installed that runs wub at boot (to stop updates from turning
updates back on), runs wub.exe and enables and starts the windows update service (wuauserv) if
disabled (*wub can be disabled using the included Configurator.cmd script, leaving Windows Updates
always running so you can use Store and Defender at any time), then runs the correct version of
the Windows Update MiniTool in "auto search for updates" mode for your OS version's architecture
(x86 or x64), then disables and stops wuauserv giving you full control. No more forced automatic
updates or surprise reboots. This was written for Windows 10 Pro and Home, but works with all
versions of Windows 10. Don't change any settings in lower left of WUMT while running the script.
*******************************************************************
I also included an uninstaller.cmd that deletes the WDU and wub_task tasks, deletes the WDU.cmd
file used by WDU task, restores the rempl folder, resets Update Hijacker permissions to how they
were originally, and turns off wub (if enabled) which turns the windows update service on automatic
again, undoing everything done by the script. If you uninstall after having used the installer the
script folder is removed also.
*******************************************************************
Configurator leaves the Update Hijackers disabled, but gives you the option of turning on the windows
update service temporarily to use Store, or leave it on permanently to use Store anytime.
*******************************************************************
*If you need to install .Net 3.5 or use the Windows 10 Store or something that needs wuauserv
running, run the script and after it enables wuauserv and starts WUMT, install what you need
after WUMT checks for updates, before closing WUMT. If you ran the Configurator to "leave
the Windows Update Service running at all times" you can ignore this note as the store will
work at any time.
*******************************************************************
:start
:::::::::::::::::::::::::::::::::::::::::
:: Automatically check & get admin rights
:::::::::::::::::::::::::::::::::::::::::
:: ECHO.
:: ECHO =============================
:: ECHO Running Admin shell
:: ECHO =============================
:: Check Privileges
:: Get Privileges
:: and
:: Invoke UAC for Privilege Escalation
:: Notify if error escalating
:: and prevent looping if escalation fails
::::::::::::::::::::::::::::
set "params=Problem_with_elevating_UAC_for_Administrator_Privileges"&if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
fsutil dirty query %systemdrive%  >nul 2>&1 && goto :GotPrivileges
::    The following test is to avoid infinite looping if elevating UAC for Administrator Privileges failed
If "%1"=="%params%" (echo Elevating UAC for Administrator Privileges failed&echo Right click on the script and select 'Run as administrator'&echo Press any key to exit...&pause>nul 2>&1&exit)
cmd /u /c echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "%~0", "%params%", "", "runas", 1 > "%temp%\getadmin.vbs"&cscript //nologo "%temp%\getadmin.vbs"&exit
:GotPrivileges
::::::::::::::::::::::::::::
::START
::Uninstall and remove Windows 10 Update assistant.
::Disable Windows Update Service until script menu screen.
::Reset (in case of wrong Permissions), remove Permissions from and Disable UsoClient.exe,
::WaaSMedic.exe, WaasMedicSvc.dll, WaaSMedicPS.dll, WaaSAssessment.dll, MusNotificationUx.exe, and SIHClient.exe.
::Kill remsh.exe if it's running.
::Rename the folder %ProgramFiles%\rempl to %ProgramFiles%\rempl-backup if it exists.
::Install wub_task (prevents Windows Update service from starting after installing updates and rebooting).
::Enable and start the Windows Update Service (wuauserv).
::Run the correct version of WUMT for your architecture.
::Start WUMT in "auto-check for updates" mode.
::After updates are completed and WUMT is closed and/or the "reboot"
::button in WUMT is pressed, silently run wub.exe and disable and stop wuauserv
::::::::::::::::::::::::::::
@echo off
cls
echo.
echo Please wait...
rem Get Windows OS build number
for /f "tokens=2 delims==" %%a in ('wmic path Win32_OperatingSystem get BuildNumber /value') do (
  set /a WinBuild=%%a
)
rem Test for Windows versions below Windows 10 and if so just install wub_task and start wumt.
if %winbuild% LEQ 9600 (
rem Sanity check if script copied over different version of script:
rem If somehow both files "wub.exe" and "wub.exe-backup" exist, delete "wub.exe-backup"
rem If only wub.exe-backup exists, rename it to wub.exe
	(if exist "%~dp0wub.exe"  (del "%~dp0wub.exe-backup" /f /q) else (ren "%~dp0wub.exe-backup" wub.exe)) >nul 2>&1

	call :Install_wub_task
	goto :StartWUMT
)
if exist "%systemdrive%\Windows10Upgrade\Windows10UpgraderApp.exe" ( echo Windows 10 Update Assistant detected. Preparing to uninstall.
echo The "Windows 10 Update Assistant has stopped working" dialog box may pop up. If so, just close it.
echo Press a key to acknowledge this and please wait for the uninstall to finish.
echo Script will continue after uninstall and removal is completed...
pause > nul
echo Uninstalling Windows 10 Update Assistant...
%systemdrive%\Windows10Upgrade\Windows10UpgraderApp.exe /forceuninstall
timeout /t 10 /nobreak >nul 2>&1
del %systemroot%\UpdateAssistant\*.* /f /q >nul 2>&1
rmdir %systemroot%\UpdateAssistant /s /q >nul 2>&1
del %SystemDrive%\Windows10Upgrade\*.* /f /q >nul 2>&1
rmdir %SystemDrive%\Windows10Upgrade /s /q >nul 2>&1
cls
echo Windows 10 Update Assistant removed.
echo Press a key to continue...
pause > nul )
cls
::::::::::::::::::::::::::::
::Create automatic Windows Defender Update "WDU" task that updates Defender only if it's enabled and running.
::Create Windows Update Blocker "Wub_task" that sets your desired Windows Update service state at boot.
cls
echo.
echo Please wait...
call :Install_wub_task >nul 2>&1
cls
echo.
echo Please wait...
call :Install_wdu_task >nul 2>&1
::::::::::::::::::::::::::::
del %systemroot%\UpdateAssistantV2\*.* /f /q >nul 2>&1
rmdir %systemroot%\UpdateAssistantV2 /s /q >nul 2>&1
::::::::::::::::::::::::::::
::Check if update service is running or not and then delete correct file
sc query | find /i "wuauserv" > nul & if errorlevel 1 (if exist "%~dp0wub.exe" del "%~dp0wub.exe-backup" /f /q >nul 2>&1
) else (
if exist "%~dp0wub.exe-backup" del "%~dp0wub.exe" /f /q >nul 2>&1)
::::::::::::::::::::::::::::
::If somehow both files "wub.exe" and "wub.exe-backup" exist after the previous check, delete "wub.exe-backup"
if exist "%~dp0wub.exe" if exist "%~dp0wub.exe-backup" del "%~dp0wub.exe-backup" /f /q >nul 2>&1
::::::::::::::::::::::::::::
"%~dp0wub.exe" /d /p >nul 2>&1
::::::::::::::::::::::::::::
::Remove ability for the following files to be executed
takeown /f "%systemroot%\System32\osrss.dll" /a >nul 2>&1
icacls "%systemroot%\System32\osrss.dll" /reset >nul 2>&1
icacls "%systemroot%\System32\osrss.dll" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
takeown /f "%systemroot%\System32\UsoClient.exe" /a >nul 2>&1
icacls "%systemroot%\System32\UsoClient.exe" /reset >nul 2>&1
icacls "%systemroot%\System32\UsoClient.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
takeown /f "%systemroot%\System32\WaaSMedic.exe" /a >nul 2>&1
icacls "%systemroot%\System32\WaaSMedic.exe" /reset >nul 2>&1
icacls "%systemroot%\System32\WaaSMedic.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
takeown /f "%systemroot%\System32\WaasMedicSvc.dll" /a >nul 2>&1
icacls "%systemroot%\System32\WaasMedicSvc.dll" /reset >nul 2>&1
icacls "%systemroot%\System32\WaasMedicSvc.dll" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
takeown /f "%systemroot%\System32\WaaSMedicPS.dll" /a >nul 2>&1
icacls "%systemroot%\System32\WaaSMedicPS.dll" /reset >nul 2>&1
icacls "%systemroot%\System32\WaaSMedicPS.dll" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
takeown /f "%systemroot%\System32\WaaSAssessment.dll" /a >nul 2>&1
icacls "%systemroot%\System32\WaaSAssessment.dll" /reset >nul 2>&1
icacls "%systemroot%\System32\WaaSAssessment.dll" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
takeown /f "%systemroot%\System32\SIHClient.exe" /a >nul 2>&1
icacls "%systemroot%\System32\SIHClient.exe" /reset >nul 2>&1
icacls "%systemroot%\System32\SIHClient.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
takeown /f "%systemroot%\System32\MusNotificationUx.exe" /a >nul 2>&1
icacls "%systemroot%\System32\MusNotificationUx.exe" /reset >nul 2>&1
icacls "%systemroot%\System32\MusNotificationUx.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
::Disable remsh
taskkill /im remsh.exe /f >nul 2>&1
if exist "%ProgramFiles%\rempl" rmdir /s /q "%ProgramFiles%\rempl-backup" >nul 2>&1
ren "%ProgramFiles%\rempl" rempl-backup >nul 2>&1
::::::::::::::::::::::::::::
:refresh
cls
echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ WUMT Wrapper Script Windows Update Service Configurator & echo.
sc query | find /i "wuauserv" > nul & if errorlevel 1 (goto wudisabled) ELSE (goto wuenabled)
:wudisabled
echo ^ ^ ^ ^ ^ ^ ---^>^>^> Windows Update Service is DISABLED and stopped ^(default^) ^<^<^<---
echo. & echo [E]nable Update Service to allow Windows Store.
echo. & echo [C]ontinue script if above Update Service Status is okay...
echo. & echo E[x]it script if you're just verifying or changing the update service status... & echo.
CHOICE /C ECX /M "Your choice?:"
if %errorlevel%==3 (exit)
if %errorlevel%==2 (goto splash)
if %errorlevel%==1 (
start "" /w "%~dp0wub.exe" /e >nul 2>&1
ping 127.0.0.1 -n 1 -w 500> nul
ren "%~dp0wub.exe" wub.exe-backup >nul 2>&1
ping 127.0.0.1 -n 1 -w 500> nul
echo. & goto refresh
)
:wuenabled
echo ^ ^ ^ ^ ^ ^ ---^>^>^> Windows Update Service is ENABLED and running ^(for Store^) ^<^<^<---
echo. & echo [D]isable Update Service and only allow to run during updates with script (default).
echo. & echo [C]ontinue script if above Update Service Status is okay...
echo. & echo E[x]it script if you're just verifying or changing the update service status... & echo.
CHOICE /C DCX /M "Your choice?:"
if %errorlevel%==3 (exit)
if %errorlevel%==2 (goto splash)
if %errorlevel%==1 (
ren "%~dp0wub.exe-backup" wub.exe >nul 2>&1
ping 127.0.0.1 -n 1 -w 500> nul
start "" /w "%~dp0wub.exe" /d /p >nul 2>&1
ping 127.0.0.1 -n 1 -w 500> nul
echo. & goto refresh
)
::::::::::::::::::::::::::::
:splash
mode con cols=56 lines=33
cls
echo ***********************************************
echo Welcome to manual updates! & echo.
sc query | find /i "wuauserv" > nul & if errorlevel 1 (echo Windows Update Service is DISABLED and stopped ^(default^)
) else (echo Windows Update Service is ENABLED and set to ALWAYS run.)
echo.
echo Press any key to check for updates, or close this screen
echo ^ ^ ^ ^ ^ to cancel and leave updates turned off
echo ^ ^ ^ ^ ^ (unless overridden with configurator). & echo.
echo ***********************************************
echo Automatic updates are now turned off (unless overriden
echo with Configurator). This script automates the update
echo process. It automatically disables a range of "Update
echo Hijackers" such as: osrss, remsh, Uso, WaaS, SIH, and
echo Update Assistant. Enables and starts only the Windows
echo Update Service, runs the Windows Update MiniTool (WUMT).
echo After updates, stops and disables the Windows Update
echo service (unless overriden with Configurator). The
echo included uninstaller undoes script changes. Closing WUMT
echo at any time disables updates again (unless overriden
echo with Configurator); however, if WUMT is already offering
echo updates, you need to hide them and/or install them
echo one-by-one before closing WUMT or it may install them
echo without asking next time. Don't change WUMT settings
echo while running this script. If an update requires a
echo reboot, re-run the script after the reboot and just
echo close the first screen to make sure the "Update
echo Hijackers" stay off. Enable update service in
echo Configurator in script to use the Store at the risk of
echo possible unwanted updates if you leave it on. Better to
echo enable updates, use store, then disable updates. Use at
echo your discretion.
echo ***********************************************
echo Press any key to run Windows Update MiniTool...
pause > nul
:StartWUMT
"%~dp0wub.exe" /e
:: Check OS and run correct version of WUMT
for /f "tokens=2 delims==" %%a in ('wmic cpu get AddressWidth /value') do (set arch=%%a)
IF %arch% == 32 (set "wumt=%~dp0wumt_x86.exe") else (set "wumt=%~dp0wumt_x64.exe")
Start "" "%wumt%" -update "-onclose %~dp0wub.exe /d /p"
goto :EOF
::
::
:Install_Wub_task
set "Task_Name=wub_task"
::
::	Create wbu_task.xml
::
(
echo ^<?xml version="1.0" encoding="UTF-16"?^>
echo ^<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"^>
echo   ^<RegistrationInfo^>
echo     ^<Date^>2018-02-18T08:29:39^</Date^>
echo     ^<Author^>pf100\rpo^</Author^>
echo     ^<URI^>\wub_task^</URI^>
echo   ^</RegistrationInfo^>
echo   ^<Triggers^>
echo     ^<BootTrigger^>
echo       ^<StartBoundary^>2018-02-18T08:29:00^</StartBoundary^>
echo       ^<Enabled^>true^</Enabled^>
echo     ^</BootTrigger^>
echo   ^</Triggers^>
echo   ^<Principals^>
echo     ^<Principal id="Author"^>
echo       ^<UserId^>S-1-5-18^</UserId^>
echo       ^<RunLevel^>HighestAvailable^</RunLevel^>
echo     ^</Principal^>
echo   ^</Principals^>
echo   ^<Settings^>
echo     ^<MultipleInstancesPolicy^>IgnoreNew^</MultipleInstancesPolicy^>
echo     ^<DisallowStartIfOnBatteries^>false^</DisallowStartIfOnBatteries^>
echo     ^<StopIfGoingOnBatteries^>false^</StopIfGoingOnBatteries^>
echo     ^<AllowHardTerminate^>true^</AllowHardTerminate^>
echo     ^<StartWhenAvailable^>false^</StartWhenAvailable^>
echo     ^<RunOnlyIfNetworkAvailable^>false^</RunOnlyIfNetworkAvailable^>
echo     ^<IdleSettings^>
echo       ^<StopOnIdleEnd^>true^</StopOnIdleEnd^>
echo       ^<RestartOnIdle^>false^</RestartOnIdle^>
echo     ^</IdleSettings^>
echo     ^<AllowStartOnDemand^>true^</AllowStartOnDemand^>
echo     ^<Enabled^>true^</Enabled^>
echo     ^<Hidden^>false^</Hidden^>
echo     ^<RunOnlyIfIdle^>false^</RunOnlyIfIdle^>
echo     ^<WakeToRun^>false^</WakeToRun^>
echo     ^<ExecutionTimeLimit^>PT72H^</ExecutionTimeLimit^>
echo     ^<Priority^>7^</Priority^>
echo   ^</Settings^>
echo   ^<Actions Context="Author"^>
echo     ^<Exec^>
echo       ^<Command^>"%~dp0wub.exe"^</Command^>
echo       ^<Arguments^>/d /p^</Arguments^>
echo     ^</Exec^>
echo   ^</Actions^>
echo ^</Task^>
)>"%~dp0%Task_Name%.xml"
schtasks /delete /tn "%Task_Name%" /f 1>nul 2>nul
schtasks /query /fo list 2>nul | findstr /i "%Task_Name%" 1>nul || (
    echo.&echo Creating Windows Update Blocker Auto-Renewal task %Task_Name%.
    schtasks /create /tn "%Task_Name%" /ru "SYSTEM" /xml "%~dp0%Task_Name%.xml" >nul 2>&1 || (
		echo.&Creating Windows Update Blocker Auto-Renewal %Task_Name% task errored.& echo Press any key to exit... & pause > nul &exit)
rem	echo Windows Update Blocker Auto-Renewal %Task_Name% created.
	del /f /q "%~dp0%Task_Name%.xml" >nul 2>&1)
exit /b
::
::
:Install_wdu_task
set "Task_Name=WDU"
::
::	Create WDU.cmd
::
(
echo rem Don't run this file. It's for use by wrapper script.
echo cd /d "%%~dp0"
echo query ^| find /i "windefend" ^> nul ^& if errorlevel 1 ^(exit^)
echo if not exist wub.exe-backup ^(wub.exe /e^)
echo "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate
echo if not exist wub.exe-backup ^(wub.exe /d /p^)
echo exit
)> "%~dp0%Task_Name%.cmd"
::
::	Create WDU.xml
::
(
echo ^<?xml version="1.0" encoding="UTF-16"?^>
echo ^<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"^>
echo   ^<RegistrationInfo^>
echo     ^<Date^>2018-02-18T08:29:39^</Date^>
echo     ^<Author^>pf100\rpo^</Author^>
echo     ^<URI^>WindowsDefenderUpdate^</URI^>
echo   ^</RegistrationInfo^>
echo   ^<Triggers^>
echo     ^<CalendarTrigger^>
echo       ^<StartBoundary^>2018-05-12T10:35:00.0^</StartBoundary^>
echo       ^<Enabled^>true^</Enabled^>
echo       ^<ScheduleByDay^>
echo         ^<DaysInterval^>1^</DaysInterval^>
echo       ^</ScheduleByDay^>
echo     ^</CalendarTrigger^>
echo   ^</Triggers^>
echo   ^<Principals^>
echo     ^<Principal id="Author"^>
echo       ^<UserId^>S-1-5-18^</UserId^>
echo       ^<RunLevel^>HighestAvailable^</RunLevel^>
echo     ^</Principal^>
echo   ^</Principals^>
echo   ^<Settings^>
echo     ^<MultipleInstancesPolicy^>IgnoreNew^</MultipleInstancesPolicy^>
echo     ^<DisallowStartIfOnBatteries^>false^</DisallowStartIfOnBatteries^>
echo     ^<StopIfGoingOnBatteries^>false^</StopIfGoingOnBatteries^>
echo     ^<AllowHardTerminate^>true^</AllowHardTerminate^>
echo     ^<StartWhenAvailable^>true^</StartWhenAvailable^>
echo     ^<RunOnlyIfNetworkAvailable^>true^</RunOnlyIfNetworkAvailable^>
echo     ^<IdleSettings^>
echo       ^<StopOnIdleEnd^>true^</StopOnIdleEnd^>
echo       ^<RestartOnIdle^>false^</RestartOnIdle^>
echo     ^</IdleSettings^>
echo     ^<AllowStartOnDemand^>true^</AllowStartOnDemand^>
echo     ^<Enabled^>true^</Enabled^>
echo     ^<Hidden^>false^</Hidden^>
echo     ^<RunOnlyIfIdle^>false^</RunOnlyIfIdle^>
echo     ^<WakeToRun^>false^</WakeToRun^>
echo     ^<ExecutionTimeLimit^>PT72H^</ExecutionTimeLimit^>
echo     ^<Priority^>7^</Priority^>
echo   ^</Settings^>
echo   ^<Actions Context="Author"^>
echo     ^<Exec^>
echo       ^<Command^>"%~dp0WDU.cmd"^</Command^>
echo     ^</Exec^>
echo   ^</Actions^>
echo ^</Task^>
) >"%~dp0%Task_Name%.xml"
rem
rem	Creating Windows Defender Update auto renewal task
rem
schtasks /delete /tn "%Task_Name%" /f 1>nul 2>nul
schtasks /query /fo list 2>nul | findstr /i "%Task_Name%" 1>nul || (
    echo.&echo Creating Windows Defender Update task %Task_Name%.
    schtasks /create /tn "%Task_Name%" /ru "SYSTEM" /xml "%~dp0%Task_Name%.xml" >nul 2>&1 || (
		echo.&echo Creating Windows Defender Update %Task_Name% task errored.& echo Press any key to exit... & pause > nul &exit)
rem	echo Windows Defender Update task %Task_Name% created.
	del /f /q "%~dp0%Task_Name%.xml" >nul 2>&1)
exit /b