How to make a complete blocking of windows update on 10-ke?

Question

Windows

How can I completely disable windows 10 updates?

What has been done before and did not help:
1 - All updates were disabled using O&O ShutUp10++.
2 - In the file "C:\Windows\System32\drivers\etc\hosts" was added a list of DNS servers that are being updated.

127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 download.windowsupdate.com
127.0.0.1 wustat.windows.com
127.0.0.1 ntservicepack.microsoft.com
127.0.0.1 go.microsoft.com
127.0.0.1 dl.delivery.mp.microsoft.com
127.0.0.1 corporate.windowsupdate.microsoft.com
127.0.0.1 v3.windowsupdate.microsoft.com
127.0.0.1 v4.windowsupdate.microsoft.com
127.0.0.1 v4-ori.windowsupdate.microsoft.com
127.0.0.1 v5.windowsupdate.microsoft.com
127.0.0.1 stats.update.microsoft.com
127.0.0.1 preview.update.microsoft.com
127.0.0.1 fe1.update.microsoft.com
127.0.0.1 cy2.pending.sls.update.microsoft.com
127.0.0.1 test.catalog.update.microsoft.com
127.0.0.1 bn2.pending.sls.update.microsoft.com
127.0.0.1 slscr.update.microsoft.com
127.0.0.1 co4.pending.sls.update.microsoft.com
127.0.0.1 test.stats.update.microsoft.com
127.0.0.1 db5.pending.sls.update.microsoft.com
127.0.0.1 v9.update.microsoft.com
127.0.0.1 statsfe2.update.microsoft.com
127.0.0.1 pending.sls.update.microsoft.com
127.0.0.1 pending.sls-dev.update.microsoft.com
127.0.0.1 statsfe2-dev.update.microsoft.com
127.0.0.1 www.catalog.update.microsoft.com
127.0.0.1 redir.update.microsoft.com
127.0.0.1 pending.sls-int.update.microsoft.com
127.0.0.1 fe2cr.update.microsoft.com
127.0.0.1 hk2.pending.sls.update.microsoft.com
127.0.0.1 pending.sls-tip.update.microsoft.com
127.0.0.1 fe2.update.microsoft.com
127.0.0.1 sls.update.microsoft.com
127.0.0.1 www.update.microsoft.com
127.0.0.1 catalog.update.microsoft.com
127.0.0.1 officecdn-microsoft-com.akamaized.net
127.0.0.1 cdn.x.cp.wd.microsoft.com
127.0.0.1 www.windowsupdate.com
127.0.0.1 msedges.s.download.windowsupdate.com
127.0.0.1 aupl.v4.b1.download.windowsupdate.com
127.0.0.1 wp.download.windowsupdate.com
127.0.0.1 ds.download.windowsupdate.com
127.0.0.1 1a.au.download.windowsupdate.com
127.0.0.1 9.au.download.windowsupdate.com
127.0.0.1 au.b1.download.windowsupdate.com
127.0.0.1 3.download.windowsupdate.com
127.0.0.1 2.au.download.windowsupdate.com
127.0.0.1 11.au.download.windowsupdate.com
127.0.0.1 v4.download.windowsupdate.com
127.0.0.1 ctldl.windowsupdate.com
127.0.0.1 wsus.ds.www.download.windowsupdate.com
127.0.0.1 fg.ds.b1.download.windowsupdate.com
127.0.0.1 fg.ds.download.windowsupdate.com
127.0.0.1 b1.download.windowsupdate.com
127.0.0.1 az.or.windowsupdate.com
127.0.0.1 www.download.windowsupdate.com
127.0.0.1 windowsupdate.com
127.0.0.1 download.microsoft.com
127.0.0.1 update.microsoft.com

Now I'm testing the next option. In the firewall, I created an outbound rule that prevents the file "C:\Windows\System32\svchost.exe" from accessing ports 80 and 443 via TCP.
But I'm not completely sure about this method.

Answer 1

I have StopUpdates10
I have enough
And what does not help then? updates arrive?

Answer 2

if wine pro, you can edit the group policy computer policy -> administrative templates -> components -> windows updater or something like that.
you can install a third-party firewall and block the specified addresses through it.

Answer 3

What suddenly such struggle with updates?
When I needed something like this, I simply forbade the start of the update service. And that's all.
No firewalls, files or group policies rules.
If updates are suddenly needed again, turn on the service.
You can automate the process.
The last time I did this was on Win7. But I think this approach will work with Win10 as well.