v2.5.0_WUMTWrapperScript.cmd

@echo off
mode con cols=85 lines=12
Title WUMT Wrapper Script 2.5.0
Color 1F & goto start
Original script by pf100 @ MDL with special thanks to rpo and abbodi1406 @ MDL for code improvements.
Project page and source code:
https://forums.mydigitallife.net/threads/72203-WUMT-Wrapper-script-controls-windows-update-service
******************************************************************
You may freely modify this script as you wish, I only request that you leave the credits and the
link to the original script.
******************************************************************
This script provides manual updating for Windows 10 including Home versions.
Update Windows 10 on your schedule, not Microsoft's.
I originally wrote this script for personal use because of the lack of update options with the
original RTM release of Windows 10 Pro. I wanted to update Windows 10 when I had the free time
to manually update, just like I did with previous versions of Windows that allowed me to
set updates to manual, not when Microsoft forced it on me while I was busy using my computer.
*******************************************************************
WUMT is available here: https://forums.mydigitallife.net/threads/64939-Windows-Update-MiniTool
Windows Update Blocker is available here: http://sordum.org/files/windows-update-blocker/old/Wub_v1.0.zip
Only use Windows Update Blocker v1.0 with this script, not v1.1.
*******************************************************************
How it works: The script first checks if the OS is Windows 8.1 or older and if so
it bypasses the Windows 10 Update Hijacker disable portion of the script.
This script creates a smart Windows Defender Update task "WDU" that updates Windows
Defender every 2 hours if it's running and enabled, and doesn't update it if it's not
running and disabled, saving resources; auto-elevates, uninstalls and removes the
Windows 10 Update Assistant, renames the %programfiles%\rempl* folder, resets and
removes permissions from and disables these Update Hijackers:
remsh.exe*
osrss.dll
UsoClient.exe
WaaSMedic.exe
WaasMedicSvc.dll
WaaSMedicPS.dll
WaaSAssessment.dll
MusNotification.exe
MusNotificationUx.exe
SIHClient.exe
makes sure the task "wub_task" is installed that runs wub at boot (to stop updates from turning
updates back on), runs wub.exe and enables and starts the windows update service (wuauserv) if
disabled (*wub can be disabled using the included Configurator.cmd script, leaving Windows Updates
always running so you can use Store and Defender at any time), then runs the correct version of
the Windows Update MiniTool in "auto search for updates" mode for your OS version's architecture
(x86 or x64), then disables and stops wuauserv giving you full control. No more forced automatic
updates or surprise reboots. This was written for Windows 10 Pro and Home, but works with all
versions of Windows 10. Don't change any settings in lower left of WUMT while running the script.
*******************************************************************
I also included an uninstaller.cmd that deletes the WDU and wub_task tasks, deletes the WDU.cmd
file used by WDU task, restores the rempl folder, resets Update Hijacker permissions to how they
were originally, and turns off wub (if enabled) which turns the windows update service on automatic
again, undoing everything done by the script. If you uninstall after having used the installer the
script folder is removed also.
*******************************************************************
Configurator leaves the Update Hijackers disabled, but gives you the option of turning on the windows
update service temporarily to use Store, or leave it on permanently to use Store anytime.
*******************************************************************
*If you need to install .Net 3.5 or use the Windows 10 Store or something that needs wuauserv
running, run the script and after it enables wuauserv and starts WUMT, install what you need
after WUMT checks for updates, before closing WUMT. If you ran the Configurator to "leave
the Windows Update Service running at all times" you can ignore this note as the store will
work at any time.
*******************************************************************
:start
:::::::::::::::::::::::::::::::::::::::::
:: Automatically check & get admin rights
:::::::::::::::::::::::::::::::::::::::::
:: ECHO.
:: ECHO =============================
:: ECHO Running Admin shell
:: ECHO =============================
:: Check Privileges
:: Get Privileges
:: and
:: Invoke UAC for Privilege Escalation
:: Notify if error escalating
:: and prevent looping if escalation fails
::::::::::::::::::::::::::::
set "params=Problem_with_elevating_UAC_for_Administrator_Privileges"&if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
fsutil dirty query %systemdrive%  >nul 2>&1 && goto :GotPrivileges
::    The following test is to avoid infinite looping if elevating UAC for Administrator Privileges failed
If "%1"=="%params%" (echo Elevating UAC for Administrator Privileges failed&echo Right click on the script and select 'Run as administrator'&echo Press any key to exit...&pause>nul 2>&1&exit)
cmd /u /c echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "%~0", "%params%", "", "runas", 1 > "%temp%\getadmin.vbs"&cscript //nologo "%temp%\getadmin.vbs"&exit
:GotPrivileges
::::::::::::::::::::::::::::
::START
::Uninstall and remove Windows 10 Update assistant.
::Disable Windows Update Service until script menu screen.
::Reset (in case of wrong Permissions), remove Permissions from and
::disable "Update Hijackers"
::Install wub_task (prevents Windows Update service from starting after installing updates and rebooting).
::If Windows 10 install WDU task to perform automatic windows defender updates.
::Enable and start the Windows Update Service (wuauserv).
::Run the correct version of WUMT for your architecture.
::Start WUMT in "auto-check for updates" mode.
::After updates are completed and WUMT is closed and/or the "reboot"
::button in WUMT is pressed, silently run wub.exe and disable and stop wuauserv
::::::::::::::::::::::::::::
@echo off
cls
rem Get Windows OS build number
for /f "tokens=2 delims==" %%a in ('wmic path Win32_OperatingSystem get BuildNumber /value') do (
  set /a WinBuild=%%a
)
rem Test for Windows versions below Windows 10 and if so just install wub_task and start wumt.
if %winbuild% LEQ 9600 (
rem Sanity check if script copied over different version of script:
rem If somehow both files "wub.exe" and "wub.exe-backup" exist, delete "wub.exe-backup"
rem If only wub.exe-backup exists, rename it to wub.exe
rem	(if exist "%~dp0wub.exe"  (del "%~dp0wub.exe-backup" /f /q) else (ren "%~dp0wub.exe-backup" wub.exe))
rem
rem	call :Install_wub_task
	goto :StartWUMT
)
::Remove Update Assistant
if exist "%systemdrive%\Windows10Upgrade\Windows10UpgraderApp.exe" ( echo Windows 10 Update Assistant detected. Preparing to uninstall.
echo The "Windows 10 Update Assistant has stopped working" dialog box may pop up. If so, just close it.
echo Press a key to acknowledge this and please wait for the uninstall to finish.
echo Script will continue after uninstall and removal is completed...
pause > nul
echo Uninstalling Windows 10 Update Assistant...
%systemdrive%\Windows10Upgrade\Windows10UpgraderApp.exe /forceuninstall
timeout /t 10 /nobreak
del %systemroot%\UpdateAssistant\*.* /f /q
rmdir %systemroot%\UpdateAssistant /s /q
del %SystemDrive%\Windows10Upgrade\*.* /f /q
rmdir %SystemDrive%\Windows10Upgrade /s /q
cls
echo Windows 10 Update Assistant removed.
echo Press a key to continue...
pause > nul )
del %systemroot%\UpdateAssistantV2\*.* /f /q
rmdir %systemroot%\UpdateAssistantV2 /s /q
::::::::::::::::::::::::::::
:: Delete an old temp file from the previous version of the script. This command will be removed in later versions.
del %systemroot%\System32\$null /q >nul 2>&1
cls
::::::::::::::::::::::::::::
echo. & echo. & echo. & echo.
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Initializing script...
::Create automatic Windows Defender Update "WDU" task that updates Defender only if it's enabled and running.
::Create Windows Update Blocker "Wub_task" that sets your desired Windows Update service state at boot.
pushd %~dp0
cscript //nologo module.vbs >nul 2>&1
cls
timeout /t 1 /nobreak >nul 2>&1
popd
::::::::::::::::::::::::::::
::In case new script is copied over old script while wub.exe-backup exists, then wub.exe would exist too,
::so check if windows update service is disabled or not and then correctly delete either wub.exe or wub.exe-backup.
Reg query "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v "Start" | find "4" >nul 2>&1
IF %ERRORLEVEL% == 0 (if exist "%~dp0wub.exe" del "%~dp0wub.exe-backup" /f /q >nul 2>&1) else (if exist "%~dp0wub.exe-backup" del "%~dp0wub.exe" /f /q >nul 2>&1)
echo. & echo. & echo. & echo.
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Initializing script...
::::::::::::::::::::::::::::
:: Disable and lock all Windows Update tasks and prevent them from being enabled.
takeown /f "%systemroot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\*" /a >nul 2>&1
icacls "%systemroot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\*" /q /c /t /reset >nul 2>&1
for %%? in ("%systemroot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\*") do schtasks /change /tn "Microsoft\Windows\WindowsUpdate\%%~nx?" /disable >nul 2>&1
icacls "%systemroot%\System32\Tasks\Microsoft\Windows\WindowsUpdate\*" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
::::::::::::::::::::::::::::
::Set list (s32list) of update hijacker files to be disabled, then disable everything in the list.
set s32list=EOSNotify.exe WaaSMedic.exe WaasMedicSvc.dll WaaSMedicPS.dll WaaSAssessment.dll UsoClient.exe
set s32list=%s32list% SIHClient.exe MusNotificationUx.exe MusNotification.exe osrss.dll
set s32=%systemroot%\System32
for %%# in (%s32list%) do (
takeown /f "%s32%\%%#" /a >nul 2>&1
icacls "%s32%\%%#" /reset >nul 2>&1
icacls "%s32%\%%#" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
)
::::::::::::::::::::::::::::
::Disable update service unless overriden with Configurator which renames wub.exe to wub.exe-backup
::in which case this command does nothing by design.
"%~dp0wub.exe" /d /p >nul 2>&1
::::::::::::::::::::::::::::
::Disable rempl
for %%? in ("%ProgramFiles%\rempl\*") do (
takeown /f "%%?" /a >nul 2>&1
icacls "%%?" /reset >nul 2>&1
icacls "%%?" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18 >nul 2>&1
)
::::::::::::::::::::::::::::
::Windows Update Service Configurator
cls
echo. & echo. & echo. & echo.
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Initializing Configurator...
Reg query "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v "Start" | find "4" >nul 2>&1
if %errorlevel% == 1 goto wuenable
::disable windows update service except when wumt is run.
:wudisable
ren "%~dp0wub.exe-backup" wub.exe >nul 2>&1
timeout /t 2 /nobreak >nul 2>&1
"%~dp0wub.exe" /d /p >nul 2>&1
timeout /t 2 /nobreak >nul 2>&1
cls
echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ WUMT Wrapper Script Windows Update Service Configurator & echo.
echo ^ ^ ^ ^ ^ ^ ---^>^>^> Windows Update Service is DISABLED and stopped ^(default^) ^<^<^<---
echo. & echo [E]nable Update Service to allow Windows Store.
echo. & echo [C]ontinue script if above Update Service Status is okay...
echo. & echo E[x]it script if you're just verifying or changing the update service status...
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Please select [E], [C], or [X]
CHOICE /C ECX /M "Your choice?:" >nul 2>&1
if %errorlevel%==3 (exit)
if %errorlevel%==2 (goto splash)
cls
echo. & echo. & echo.
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Please wait while Windows Update Service is enabled.
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ This will take a few seconds...
timeout /t 2 /nobreak >nul 2>&1
::enable windows update service
:wuenable
ren "%~dp0wub.exe-backup" wub.exe >nul 2>&1
timeout /t 2 /nobreak >nul 2>&1
"%~dp0wub.exe" /e >nul 2>&1
timeout /t 2 /nobreak >nul 2>&1
"%~dp0wub.exe" /e >nul 2>&1
timeout /t 2 /nobreak >nul 2>&1
ren "%~dp0wub.exe" wub.exe-backup >nul 2>&1
timeout /t 2 /nobreak >nul 2>&1
cls
echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ WUMT Wrapper Script Windows Update Service Configurator & echo.
echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ---^>^>^> Windows Update Service is ENABLED ^(for Store^) ^<^<^<---
echo. & echo [D]isable Update Service and only allow to run during updates with script (default).
echo. & echo [C]ontinue script if above Update Service Status is okay...
echo. & echo E[x]it script if you're just verifying or changing the update service status...
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Please select [D], [C], or [X]
CHOICE /C DCX /M "Your choice?:" >nul 2>&1
if %errorlevel%==3 (exit)
if %errorlevel%==2 (goto splash)
if %errorlevel%==1 (
cls
echo. & echo. & echo.
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Please wait while Windows Update Service is disabled.
echo. & echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ This will take a few seconds...
timeout /t 2 /nobreak >nul 2>&1
goto wudisable
)
::::::::::::::::::::::::::::
:splash
mode con cols=56 lines=36
cls
echo ********************************************************
echo ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Welcome to manual updates!
echo. & echo ^ ^ ^ Run script again after you install updates at
echo ^ ^ least until Configurator appears to kill any newly
echo ^ ^ ^ ^ ^ ^ ^ ^ ^ installed update hijackers!
echo. & echo Press any key to check for updates, or close this screen
echo ^ ^ ^ ^ ^ ^ ^ to cancel and leave updates turned off
echo ^ ^ ^ ^ ^ ^ ^ (unless overridden with configurator). & echo.
echo ********************************************************
echo Automatic updates are now turned off (unless overriden
echo with Configurator). This script automates the update
echo process. It automatically disables a range of "Update
echo Hijackers" such as: osrss, rempl, Uso, WaaS, SIH, and
echo Update Assistant. Enables and starts only the Windows
echo Update Service, runs the Windows Update MiniTool (WUMT).
echo After updates, stops and disables the Windows Update
echo service (unless overriden with Configurator). The
echo included uninstaller undoes script changes. Closing WUMT
echo at any time disables updates again (unless overriden
echo with Configurator); however, if WUMT is already offering
echo updates, you need to hide them and/or install them
echo one-by-one before closing WUMT or it may install them
echo without asking next time. Don't change WUMT settings
echo while running this script. If an update requires a
echo reboot, re-run the script after the reboot and just
echo close the first screen to make sure the "Update
echo Hijackers" stay off. Enable update service in
echo Configurator in script to use the Store at the risk of
echo possible unwanted updates if you leave it on. Better to
echo enable updates, use store, then disable updates. Use at
echo your discretion.
echo ********************************************************
echo ^ ^ ^ ^ Press any key to run Windows Update MiniTool...
pause > nul
:StartWUMT
"%~dp0wub.exe" /e >nul 2>&1
PowerShell.exe (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow() >nul 2>&1
cls
:: Check OS and run correct version of WUMT
for /f "tokens=2 delims==" %%a in ('wmic cpu get AddressWidth /value') do (set arch=%%a)
IF %arch% == 32 (set "wumt=%~dp0wumt_x86.exe") else (set "wumt=%~dp0wumt_x64.exe")
"%~dp0wub.exe" /e >nul 2>&1
Start "" "%wumt%" -update "-onclose %~dp0wub.exe /d /p"
:EOF