I've been getting the "Update to Windows 10" messages for months and I'm tired of seeing them. I have several legacy software packages that I still use quite often on Windows 7 and I'm not certain they will work with Windows 10. I also have older GPS devices that may or may not have Windows 10 drivers. Finally, I've been reading about corporate spyware in Windows 10 that tells Microsoft what I'm up to. None of those things makes me particularly excited about upgrading.

About a month ago, I thought I had configured my PC to not upgrade to Windows 10 but apparently I didn't go through all the steps to properly eradicate it. If you don't get rid of all traces, they can reappear. So, I'm going through this process again and getting rid of the traces. I'm going to document the steps I use for others, giving credit where credit is due.

This guide is for someone running the "non-consumer" versions of Windows 7: Pro, Enterprise, and Ultimate. You must have "Local Administrator" privilege and your computer should not be on a domain, managed as part of a Group Policy program (i.e. a company laptop).

One final note before we start... These instructions aren't for casual users--they are for people who are familiar with Windows administrative tools. If these instructions seem unintelligible, you should not undertake the process. Let someone who knows how these things work do it. And before you ask, No, I wont do this for you. :-)

Getting Started

Before you can go through these steps, you'll need a script for taking ownership of system files. Microsoft installs some files and gives them elevated access controls so a standard user can't remove them. The script you need is called "Take Ownership" and it adds a registry entry so that you can take ownership of files from the Windows Explorer. Casual users should not install registry tweaks unless there's a need, but this one is needed for this use case and there's an uninstall script you can use after you're done.

The script is located here or you can download it from the original source. Unzip the archive and double click on Take Ownership - Install.reg. You will be given a chance to change your mind with a dialog box asking if you're sure you want to install the registry tweak.

The next thing you will need to do is log out of your user account and log into the computer administrator account. I could not make this process work as my regular user. If you are an administrator with your regular account (bad idea, BTW), you may still need to enable the system administrator account to gain elevated administrator privileges.

If your computer doesn't seem to have an Administrator account, you may need to activate it. There's a good article on this site but the short answer is you'll need to start the Local Users control panel (C:\Windows\System32\lusrmgr.msc) and enable Administrator. Also, don't forget to give Administrator a strong password.

Windows Update

We need to uninstall Windows Update number 3035583. This is the thing that sticks the reminder on your toolbar as well as a couple of other artifacts. Uninstalling this update is only the first step because the uninstall doesn't remove the artifacts. I'm going to link to a good article on the site HowToGeek on uninstalling this update. They have better directions than I could provide. But, for posterity's sake, in case that article goes away

  1. Launch Windows Update
  2. Locate Installed Updates
  3. Scroll through the list and find number 3035583. Don't use the search box as that doesn't seem to work. This item is located in "Updates for Microsoft Windows" which is after the numerous security updates and updates for Microsoft Office and the security updates for Microsoft Office...
  4. Choose to uninstall the update.
  5. DO NOT RESTART WINDOWS
  6. Launch Task Manager (right click on taskbar) and make sure that the program named "GWX.exe" is not running. If it is running, right click on it and choose "End Process".

Removing Artifacts of Update 3035583

Now you can remove the residual files left by the Windows Update. If you restart your computer with these files in place, Windows will just reinstall them or sometime the next day...

Launch Windows Explorer and navigate to your Windows directory. In this directory is 'SysWOW64'. Go into this folder and find a directory named GWX. Right click on this folder and choose the "Take Ownership" option that is installed by the registry tweak. A Command prompt window will appear for a few seconds and then disappear. If no problems occurred, you should be able to delete the GWX folder. Empty the trash can when it finishes.

Now, navigate to Windows\System32\Tasks\Microsoft\Windows\Setup. In this folder you should see a directory for tasks to update GWX. This is what causes that popup to reappear over and over. Using the "Take Ownership" item again, take ownership of the GWX directory and then delete the contents. Empty the trash can when it finishes.

Prevent GWX from Returning

I don't want to keep having to go through this process, but I may find that the GWX virus keeps showing up. We will need to remain vigilant about this. It seems that Microsoft doesn't really hide or ignore this particular update and it comes across as an important update every time. If you have automatic updates, you will need to disable them and manually choose which ones to install.

The HowToGeek article mentions adding a registry entry to disable updates of GWX. I've added this entry and it doesn't seem to work. But, if you'd like to do this, here is a Registry Tweak for a shortcut.

Confirmation

Now you can reboot your PC. After rebooting, log back in as the administrator account. Let all the services start up (i.e. you stop hearing the hard drive grinding).

  • Confirm that the "Get Windows 10" popup doesn't show in the notification panel.
  • Start Task Manager and ensure that GWX.exe isn't running.
  • From the Start Menu search for "Task Scheduler" and confirm that there are no GWX items in Microsoft->Windows->Setup

Now, launch Windows Update. Let Windows figure out which updates are available. In the list, you will see that 3035583 is there and it's checked by default. Uncheck the update. Then, right click on the update and select "Hide Update" or "Ignore Update". Install any other updates.

Reboot your PC one more time. Again, login and let all the system services load. Wait a few minutes and then open Windows Update again. Hopefully, the update for 3035583 is hidden and you won't be constantly reminded to update.

Wrap up

To do this exercise, you lowered your security. You need to undo these changes so your PC isn't vulnerable.

  1. Remove the "Take Ownership" registry tweak by clicking the uninstall script that came in the ZIP file
  2. Make sure your local administrator account is either disabled or has a strong password
  3. Make sure your regular user account is not a local administrator
Good luck. Let me know if this works for you by tweeting to @ericc.

Credits

Thanks to these sites for their help and insight in getting this done.