Clarification: Never10 is an alternative to group policy (gpedit.msc) and both are just frontends for some registry changes. It uses the MS sactioned way of disabling Operating System-level updates and relies on MS to honor the changes made there (they do). The GPO is added via KB3050265.
Official Way: gpedit.msc->compy config->admin templates->win components->Win update->"Turn off the upgrade to the latest version..." Set it to "Enabled" and then run gpupdate or restart your computer. Never10 is an alternative to the above steps that does, more or less the same thing.
For OS updates on 7 Sp1 vanilla, do not use Windows Update. Windows Update needs to be update first (the updater software itself).
Microsoft published a non-offical SP2 for Windows 7 that has the updates all bundled together recently. They are calling it a "Convenience rollup update."
If you really want to use Windows Update to do the updates instead of downloading them all at once, then install this first: KB949104 Update for Windows Update Agent, restart and then run windows update again.
Also: Don't forget to install the .Net Framework and the Visual Studio C++ redistributable packages. Windows software tends to require one or the other half the time and sooner or later you will install some software that will need it, so might as well get the dependencies out of the way now. Do both x86 and x64 on x64 systems for the VS C++ updates.
I would also do the .Net Framework prior to Windows Update. And be sure to reboot afterwards, even though it doesn't say to. Not rebooting has trashed systems in my experience.
Because that is basicly one of the best ways to do it. Just scan for updates manualy, and only install the KB updates that can be trusted. which arent that manny nowdays. All those third party tools for blocking Windows10 to get nagged to your system, might protect you for now, but you never know what new KB update comes next to screw you over. Also those tools mainly only protect you from the Windows10 installation not happening. But they dont protect you from all the telemetry and keyloggers crap that is getting backported trough certain KB updates.
Also i´m pretty conviced that allot of that telemetry crap is added to that recently announced "unofficial servicepack". Because why else would Microsoft even bother bring a pack out like that?
Microsoft has a respectable track record to respecting group policy. Never10 and the Group Policy Object provided by the relevant KB/update rollup both should provide an equal level of confidence that MS will continue to respect GP and not override the settings specified. While MS does not care even a little bit for the interests of the typical end-user (incl end-user privacy), they have exactly the reverse policy for their business grade ones. GP is core part of that and overly betraying that would cost them millions in lost revenue.
MS releases them periodically for their convenience and that of their users. 2000 had 4 I think. XP had 3, Vista had 2, This makes 7's 2nd, in essence. 8.1 was the "let's pretend this is a different OS" service pack for 8 RTM. 10 had one a few months after RTM, unoffically of course.
Keep in mind that the "bad" updates can be uninstalled and telemetry disabled (again via GPO, incl in Win10 for Enterprise editions). For example, the CEIP, a core setting related to telemetry data, can be permanently opted out of and WU won't DL CEIP related KBs and Windows will not activate the software components relevant to it after that. Conveying the fact that such settings are possible and how to do it for the typical end-user is another matter entirely...
MS does so many anti-consumer things that there's really no need to blame them for the relatively few things they get right too. We have every reason to believe that the "third party tool" called Never10 that blocks Win10 will "protect you for now" and also for the foreseeable future.
Sure you can uninstall the bad updates afterwards. But why bother if you simply can scan manualy and pick the updates you can trust and install them manualy? The list of telemetry KB updates that are getting injected is pretty long. Unless MS simply stops with offering individual updates, and only going to bring out packaged updates from now on?
For the love of God, don't disable windows update. MS patches crap all the time that will get your box owned. Just last month they patched at least three remote code execution bugs.
That's more or less what I do, but that's not practical for every user or even a significant fraction of users.
If automatic updates are still workable by setting some gpo's, then just them, create an image of the updated vm box and deploy it. Then the clients can still get updated automatically without having to worry about telemetry or random OS-level updates. Automatic > manual.
Anyway, my core point was not to confuse end-user level mechanisms/garbage (which are just bad) with the business grade stuff like gpos/domains/wub. The MS supported mechanisms/software on the enterprise side is actually quite nice near universally. MS just treats the two worlds psychopatically differently.
I dual boot windows 8.1 and opensuse 42.1 leap, using windows for exclusive programs (games and applications) and linux for everything else, use linux as my main operating system. I don't store personal data on windows, it's pretty much a glorified steambox. That and I disabled updates on windows since....you don't really need them anyway, well, I don't need them.
Seriously, my buddy has a laptop from 2007 that came with Vista (the first time I had ever seen it in the wild ever) for free and I installed xubuntu on that shit.
