How to get rid of "Updates are available" message in Windows 10?

Question

Today I got the following message:

Computer was frozen and the only button available was "Get Updates".

I don't need this feature, I need to work, not serve my machine the time she wants.

Currently I did cold reboot and had time to open task manager and process explorer on different screens before the message appears again. Due to the bug in the application, I was able to kill MusNotification.exe process.

Unfortunately, I am unable to restrict system access to musnotification.exe and musnotificationux.exe files, or add them to antivirus blacklist.

How to ban this feature?

Solution 1

Unfortunately, I am unable to restrict system access to musnotification.exe and musnotificationux.exe files

From my observations, "restrict system access to musnotification.exe and musnotificationux.exe files" is an effective method of blocking that message, if you have administrator privilege.

Paste these lines to elevated cmd to deny Everyone from executing the two files:

cd /d "%Windir%\System32"
takeown /F MusNotification.exe
icacls MusNotification.exe /deny Everyone:(X)
takeown /F MusNotificationUx.exe
icacls MusNotificationUx.exe /deny Everyone:(X)
rem

---

I have managed to create a Hyper-V virtual machine that can test this "feature".

1. Clean install Windows 10 Enterprise LTSB
2. In gpedit.msc change Windows Update to Notify download
3. Check for updates, but reboot when it begins to download.
4. Run usoclient StartScan and wait for the CPU usage to drop to normal. Save a virtual machine checkpoint.

Now, changing the system date to one month later (!) will 100% immediately trigger the "Updates are available" message.

However, if I restore the checkpoint and paste the commands above, changing the date will do nothing special.

---

Edit:

To undo the changes, run the following commands:

cd /d "%Windir%\System32"
icacls MusNotification.exe /remove:d Everyone
icacls MusNotification.exe /grant Everyone:F
icacls MusNotification.exe /setowner "NT SERVICE\TrustedInstaller"
icacls MusNotification.exe /remove:g Everyone
icacls MusNotificationUx.exe /remove:d Everyone
icacls MusNotificationUx.exe /grant Everyone:F
icacls MusNotificationUx.exe /setowner "NT SERVICE\TrustedInstaller"
icacls MusNotificationUx.exe /remove:g Everyone
rem

This removes the execution restriction first, and temporarily grants Everyone full access to the relevant two files, so that you are able to change the owner of the files back to Windows (TrustedInstaller). After the ownership change, the temporary full access is removed. This is tested on Windows Server 2016 TP4 and does bring back the awful dialog, if I change the system date to 1 month later.

Solution 2

The only way i found around this crap is to switch the MusNotificationUx.exe for something less annoying, lets say cmd.exe or somesuch. Sure, a window still opens, but it's not blocking the entire machine.

To do this make sure you change the owner of the file appropriately (away from TrustedInstaller) and set file access accordingly. Then replace the file.

This "feature" is a slap in the face for anyone using Windows 10.

Solution 3

When the window opens, clicking anything will open the update panel and it will set a restart time for the updates to apply. This is fully undesirable.

There is a simpler trick to close the window without touching it:

• Hit Ctrl+Shift+Esc, the task anager appears in the background
• Hit Ctrl+Tab to navigate to the Details tab
• Hit Tab to focus the processes list
• Hit M, U, S, N or the keyboard arrows to reach the MusNotificationUx.exe item
  • Killing MusNotification.exe does not do anything
• Hit Del to end the task
• Hit Enter to confirm. The window gets killed.

Comments

[Tetsujin]

see superuser.com/questions/946957/…

[Sami Kuhmonen]

Allowing it to download is not "serving your machine", but if it's for work, surely you have Pro and can just defer them?

[Dims]

I don't like disturbance while thinking. I agree to setup either automatic or manual download / install. I disagree to setup annoying messages. Imagine 100 programs asking for download each day -- when you would work?

[fixer1234]

Do you want to stop the updates or just stop the notifications?

[Dims]

@fixer1234 I agree with notifications, but they should not block my screen

[Dims]

Thnx. Can say additionally, that when I was experimenting with killing musnotificationux.exe program, I found, that notification is still appearing, but as normal tray notification: this is a way to notify myself (everybody) prefer.

[janot]

@Tetsujin Present answers to linked question can't help here. gpedit.msc way doesn't disable notifications, and "defer upgrades" doesn't affect security updates (which are likely causing this annoying notification).

[Linef4ult]

W10 is designed to function this way, you really should revert to 7 if its counterproductive for you.

[jingyu9575]

What's the problem with restrict system access to musnotification.exe and musnotificationux.exe files? I've been denying the execute permission of these 2 programs for Everyone. Since I did this, I have never seen this notification any more. But I cannot be sure as I have also messed up a lot with my task schuduler.

[Arturs Radionovs]

Agreed. This is a completely ridiculous behavior. I've been in a conference call sharing my screen for a demo and had this stupid full-screen nag screen pop up interrupting.

[jingyu9575]

When I am testing the undo commands, I notice that 2 new permissions have been set (possibly by Windows Update) on the mentioned files: Deny Everyone from changing permissions and Deny Everyone from taking ownership. They are not effective against Administrators, but I suspect Microsoft is aware of this workaround now, and this is a failed attempt to block it. @mpen see the edit.

[Dediqated]

in my case icacls MusNotification.exe /deny Everyone:(X) fails with the error Everyone: No mapping between account names and security IDs was done. Successfully processed 0 files; Failed processing 1 files. Seemed that I had to translate Everyone to Dutch: Iedereen.

[Jens]

@Dediqated Can confirm this. German version is: Jeder

[Alex S]

This is good. But, how do you bypass that Single button blue thing when it already comes up on some machine?

[jingyu9575]

@AlexS (If MS hasn't change it since I last saw this dialog) Click the only button will redirect you to the update settings page, where you can decide to update or just close the window.

[Alex S]

@jingyu9575 - I meant what to do where on a machine the above hack/ tweak of settings has not been done.

[Dediqated]

Oh how fun, after an update this behaviour is back again...

[Bassem Adas]

A big slap. MSFT, you almost redeemed yourself.

[Steve]

@AlexS You can mash on the escape button, it'll still popup the Update window but it won't actually get any updates

[Domino]

Hum, why the "rem" at the end? That's just a comment.

[jingyu9575]

@JacqueGoupil If you copy the code altogether and paste it on cmd, all lines except the last are immediately executed, but the last line is not executed without pressing "Enter", because there is no "Enter" after it. I put a rem comment to ensure that all commands above are executed upon paste.

[Domino]

Ah, clever trick. I didn't notice because my text editor is setup to add a newline at the end of files.

[ScottN]

Does anyone know what the exe is for Windows Server 2012 R2? The file MusNotification.exe isn't on Windows Server 2012.

[Kaustubh Sariputra]

This opens the update center here.

[chew socks]

If you use PowerShell to do this you need to put Everyone:(X) inside quotes.

[CrouZ]

@ScottN For 64-bit Windows, note that the commands must be executed from a 64-bit command prompt. The reason is that the content of "%Windir%\System32" is different for 32-bit and 64-bit processes.

[hlovdal]

This was the perfect solution for getting rid of the message on a remote machine, only difference I had to press Ctrl-Alt-End to get to Task manager since Ctrl-Shift-Esc was captured by the host machine.