[wordup] Defang Windows 2000 Service Pack 3

[Adam Shand]

So it's probably worth doing if you value your privacy and use Windows.

Link: http://www.theregister.co.uk/content/4/26750.html
More: http://www.theregister.co.uk/content/4/26698.html

How to defang Win2k SP3's auto updating
By John Lettice
Posted: 20/08/2002 at 11:43 GMT

Last week we told you how to install Windows 2000 Service Pack 3 without
having to agree to Microsoft's all-new 'we can steal your stuff but
we're not going to, honest' supplementary licence. We accepted at the
time, of course, that the exercise was essentially frivolous, in that
you'd probably be in breach of your licence agreement anyway if you
circumvented the new Ts & Cs, and because just circumventing it wouldn't
do anything to block the activities you objected to.

But hey, you could feel good about yourself, even if nobody else knew
and you had no proof that you'd actually stood up and been counted (by
yourself) for not checking that 'agree.' Naturally, we've had some
queries from the more rational section of the readership who don't
particularly care what they agree to, but do care about being snooped on
and/or having some maniac updating their machine without so much as a by
your leave. So, for the benefit of these holdouts, here's how you stop
the features added by SP3 doing their business.

Go to Start, then run services.msc. You can also do this via Control
Panel, Administrative Tools, Services. Find Automatic Updates, and
change startup type to disabled.

Then run gpedit.msc, the group policy editor. Go to User Configuration,
Administrative Templates, Windows Components, Windows Update. On a fresh
installation with SP3 applied this will show up as not configured, and
somewhat counter-intuitively, in order to remove access to Windows
Update, you enable it. Notice in passing that it's tagged Remove access
to use all Windows Update "featues," which we presume is one they can
fix in SP4.

The explanation is as follows:

"If you enable this setting, all Windows Update features will be
removed. This includes blocking access to the Windows Update Web site at
http://windowsupdate.microsoft.com and from the Windows Update hyperlink
on the Start menu and also on the Tools menu in Internet Explorer.
Windows automatic updating is also disabled; you will neither be
notified about nor will you receive critical updates from Windows
Update. This policy also prevents Device Manager from automatically
installing driver updates from the Windows Update Web site."

In English, this means you'll have to seek out patches and security
fixes yourself, and install them by hand. But you don't mind that, do
you? Back in Services, you may also want to switch Background
Intelligent Transfer Service to disabled. Its default seems to be
manual, but if it did get started you might not necessarily like it, as
the explanation indicates:

"Transfers files in the background using idle network bandwidth. If the
service is stopped, features such as Windows Update, and MSN Explorer
will be unable to automatically download programs and other information.
If this service is disabled, any services that explicitly depend on it
may fail to transfer files if they do not have a fail safe mechanism to
transfer files directly through IE in case BITS has been disabled."

By browsing through Services and Group Policy you'll find several other
things to get paranoid about (e.g. remote registry manipulation). Fiddle
with these if you like, we didn't tell you to, so don't blame us if you
break something.

Lastly, go to the Start menu, right click on Windows Update, and delete
it. Yes, you're sure. OK, as far as we can figure out you're now all
set.

Incidentally, business users will frequently find they don't have to
agree the new licence terms anyway. If SP3 is applied as part of a
slipstreamed install, which is a pretty common procedure in business,
then the new licence isn't installed either. We think this is a clerical
error rather than Redmond leniency. ®