Refactor update management

BlockWindows.bat

@@ -1,134 +1,78 @@
-@echo off
-openfiles.exe 1>nul 2>&1
-if not %errorlevel% equ 0 (
-    Echo You are not administrator! Right Click file select run as admin
-    pause
-    EXIT 1
-) else (   
-
-SETLOCAL
-
-REM --- uninstall updates
-echo uninstalling updates, be patient...
-echo Delete KB971033 (license validation)
-start "title" /b /wait wusa.exe /kb:971033 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2902907 (Microsoft Security Essentials)
-start "title" /b /wait wusa.exe /kb:2902907 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2952664 (Get Windows 10 assistant)
-start "title" /b /wait wusa.exe /kb:2952664 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2976978 (update for windows 8.1 and windows 8)
-start "title" /b /wait wusa.exe /kb:2976978 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2977759 (update for windows 7 rtm)
-start "title" /b /wait wusa.exe /kb:2977759 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2990214 (Get Windows 10 for Win7)
-start "title" /b /wait wusa.exe /kb:2990214 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3012973 (Upgrade to Windows 10 Pro)
-start "title" /b /wait wusa.exe /kb:3012973 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3014460 (Upgrade for windows insider preview / upgrade to windows 10)
-start "title" /b /wait wusa.exe /kb:3014460 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3015249 (Upgrade that adds telemetry points to consent.exe in Windows 8.1 and Windows 7)
-start "title" /b /wait wusa.exe /kb:3015249 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3021917 (update to Windows 7 SP1 for performance improvements)
-start "title" /b /wait wusa.exe /kb:3021917 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3022345 (telemetry)
-start "title" /b /wait wusa.exe /kb:3022345 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3035583 (GWX Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1)
-start "title" /b /wait wusa.exe /kb:3035583 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3044374 (Get Windows 10 for Win8.1)
-start "title" /b /wait wusa.exe /kb:3044374 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3050265 (update for Windows Update on Win7)
-start "title" /b /wait wusa.exe /kb:3050265 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3050267 (update for windows update client for windows 8.1 june 2015)
-start "title" /b /wait wusa.exe /kb:3050267 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3065987 (update for Windows Update on Win7/Server 2008R2)
-start "title" /b /wait wusa.exe /kb:3065987 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3068708 (telemetry)
-start "title" /b /wait wusa.exe /kb:3068708 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3075249 (telemetry for Win7/8.1)
-start "title" /b /wait wusa.exe /kb:3075249 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3075851 (update for Windows Update on Win7/Server 2008R2)
-start "title" /b /wait wusa.exe /kb:3075851 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3075853 (update for Windows Update on Win8.1/Server 2012R2)
-start "title" /b /wait wusa.exe /kb:3075853 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3080149 (Telemetry)
-start "title" /b /wait wusa.exe /kb:3080149 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3112336 (monitor quality of upgrade experience)
-start "title" /b /wait wusa.exe /kb:3112336 /uninstall /quiet /norestart
-echo  - done.
-timeout 5
-
-REM --- Hide updates
-echo Hiding updates, may take a while be patient...
-
-start "title" /b /wait cscript.exe "%~dp0HideWindowsUpdates.vbs" 971033 2902907 2952664 2976978 2977759 2990214 3012973 3014460 3015249 3021917 3022345 3035583 3044374 3050265 3050267 3065987 3068708 3075249 3075851 3075853 3080149 3112336 
-echo  - done.
-
-REM --- Disable tasks
-echo Disabling tasks. Depending on Windows version this may have errors, this is normal...
-timeout 3
-
-schtasks /Change /TN "\Microsoft\Windows\Application Experience\AitAgent" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Autochk\Proxy" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Maintenance\WinSAT" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\ActivateWindowsSearch" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\ConfigureInternetTimeService" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\DispatchRecoveryTasks" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\ehDRMInit" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\InstallPlayReady" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\mcupdate" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\MediaCenterRecoveryTask" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\OCURActivate" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\OCURDiscovery" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\PBDADiscovery" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\PBDADiscoveryW1" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\PBDADiscoveryW2" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\PvrRecoveryTask" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\PvrScheduleTask" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\RegisterSearch" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\ReindexSearchRoot" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\SqlLiteRecoveryTask" /DISABLE
-schtasks /Change /TN "\Microsoft\Windows\Media Center\UpdateRecordPath" /DISABLE
-echo - done
-
-REM --- Kill services
-echo Killing Diagtrack-service (if it still exists)...
-sc stop Diagtrack
-sc delete Diagtrack
-echo - done
-
-echo Stop remoteregistry-service (if it still exists)...
-sc config remoteregistry start= disabled
-sc stop remoteregistry
-
-echo Done. Manually Reboot for changes to take effect
-REM shutdown -r
-pause
-)
+@echo off
+openfiles.exe 1>nul 2>&1
+if errorlevel 1 (
+    echo You are not administrator! Right Click file select run as admin!
+    pause 1>nul 2>&1
+    EXIT 1
+)
+
+SETLOCAL ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION
+
+REM --- uninstall updates
+echo Uninstalling updates, be patient...
+for %%f in ( %~dp0*.list ) do (
+    for /F "tokens=1,2,*" %%k in (%%~f) do (
+        if "%%~l" gtr "%~1" (
+            set _LIST=!_LIST! %%~k
+            < nul: set /P _=Removing KB%%~k "%%~m"
+            start "%%~k" /WAIT wusa.exe /kb:%%~k /uninstall /quiet /norestart
+            if errorlevel 1 (
+                echo  - not found.
+            ) ELSE (
+                echo  - done.
+            )
+        )
+    )
+)
+echo.
+
+REM --- Hide updates
+echo Hiding updates, may take a while be patient...
+
+cscript.exe /NoLogo "%~dp0HideWindowsUpdates.vbs" %_LIST%
+echo  - done.
+echo.
+
+REM --- Disable tasks
+echo Disabling tasks. Depending on Windows version this may give errors, this is normal...
+
+schtasks /Change /TN "\Microsoft\Windows\Application Experience\AitAgent" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Autochk\Proxy" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Maintenance\WinSAT" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\ActivateWindowsSearch" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\ConfigureInternetTimeService" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\DispatchRecoveryTasks" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\ehDRMInit" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\InstallPlayReady" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\mcupdate" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\MediaCenterRecoveryTask" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\OCURActivate" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\OCURDiscovery" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\PBDADiscovery" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\PBDADiscoveryW1" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\PBDADiscoveryW2" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\PvrRecoveryTask" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\PvrScheduleTask" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\RegisterSearch" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\ReindexSearchRoot" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\SqlLiteRecoveryTask" /DISABLE
+schtasks /Change /TN "\Microsoft\Windows\Media Center\UpdateRecordPath" /DISABLE
+echo - done.
+echo.
+
+REM --- Kill services
+< NUL: SET /P =Killing Diagtrack-service (if it still exists)...
+sc stop Diagtrack > NUL:
+sc delete Diagtrack > NUL:
+echo  - done.
+
+echo.
+echo Done. Manually Reboot for changes to take effect.
+REM shutdown -r

HideWindowsUpdates.vbs

@@ -1,9 +1,9 @@
 '// Inspired by Opmet and Colin Bowern: http://serverfault.com/a/341318
 If Wscript.Arguments.Count < 1 Then
-    WScript.Echo "Syntax: HideWindowsUpdates.vbs [Hotfix Article ID]" & vbCRLF & _
-        " - Examples: HideWindowsUpdates.vbs 2990214" & vbCRLF & _
-        " - Examples: HideWindowsUpdates.vbs 3022345 3035583"
-    WScript.Quit 1
+    WScript.Stdout.WriteLine "Syntax: HideWindowsUpdates.vbs [Hotfix Article ID] ..." & vbCRLF _
+        & "Example:" & vbCRLF _
+        & "  HideWindowsUpdates.vbs 3022345 3035583"
+    WScript.Quit
 End If
 
 Dim objArgs
@@ -12,28 +12,26 @@ Dim updateSession, updateSearcher
 Set updateSession = CreateObject("Microsoft.Update.Session")
 Set updateSearcher = updateSession.CreateUpdateSearcher()
 
-Wscript.Stdout.Write "Searching for pending updates..." 
+Wscript.Stdout.Write "Searching for pending updates..."
 Dim searchResult
-Set searchResult = updateSearcher.Search("IsInstalled=0")
-
-Dim update, kbArticleId, index, index2
-WScript.Echo CStr(searchResult.Updates.Count) & " found."
-For index = 0 To searchResult.Updates.Count - 1
-    Set update = searchResult.Updates.Item(index)
-    For index2 = 0 To update.KBArticleIDs.Count - 1
-        kbArticleId = update.KBArticleIDs(index2)
+Set searchResult = updateSearcher.Search("IsInstalled=0 and IsHidden=0")
 
+WScript.Stdout.WriteLine " " & CStr(searchResult.Updates.Count) & " found."
+Dim update, kbArticleId, hotfixId
+For Each update in searchResult.Updates
+    For Each kbArticleId in update.KBArticleIDs
         For Each hotfixId in objArgs
             If kbArticleId = hotfixId Then
-                If update.IsHidden = False Then
-                    WScript.Echo "Hiding update: " & update.Title
-                    update.IsHidden = True
-                Else
-                    WScript.Echo "Already hidden: " & update.Title
-                End If          
+                WScript.Echo "Hiding update: " & update.Title
+                update.IsHidden = True
+                ' We're done, no need to loop further.
+                Exit For
             End If
         Next
-
+        If update.IsHidden Then
+            ' We're done, no need to loop further.
+            Exit For
+        End If
     Next
 Next
 '// EOF

UpdateFilter.bat

@@ -0,0 +1,24 @@
+@ECHO OFF
+openfiles.exe 1>nul 2>&1
+IF ERRORLEVEL 1 (
+    ECHO You are not administrator! Right Click file select run as admin!
+    PAUSE 1>nul 2>&1
+    EXIT 1
+)
+
+SETLOCAL ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION
+
+FOR %%f IN ( %~dp0*.list ) DO (
+    FOR /F "tokens=1,2,*" %%k IN (%%~f) DO (
+        IF "%%~l" GTR "%~1" (
+            SET _LIST=!_LIST! %%~k
+        )
+    )
+)
+
+REM --- Hide updates
+ECHO Hiding updates, may take a while be patient...
+
+cscript.exe /NoLogo "%~dp0HideWindowsUpdates.vbs" %_LIST%
+ECHO  - done.
+ECHO.

Updates.list

@@ -0,0 +1,41 @@
+ 971033 9 Update for Windows Activation Technologies
+2882822 9 Update adds ITraceRelogger interface support
+2891638 9 Work folders update
+2902907 9 Microsoft Security Essentials
+2952664 9 "Compatibility" update for upgrading Windows 7
+2966583 9 "Improvements" for the "System Update Readiness Tool" in Windows 7 and Windows Server 2008 R2
+2976978 9 "Compatibility" update for Windows 8.1 and Windows 8 (see the previous one)
+2977759 9 "Compatibility" update for Windows 7 RTM (same)
+2990214 9 "Update" that enables you to "upgrade" from Windows 7 to a later version of Windows
+3012973 9 Upgrade to Windows 10 Pro
+3014460 9 Upgrade for windows insider preview / upgrade to windows 10
+3015249 9 Upgrade that adds telemetry points to consent.exe in Windows 8.1 and Windows 7
+3021917 9 Update to Windows 7 SP1 "for performance improvements" ("shall I pester you to upgrade?")
+3022345 9 Update for "customer experience" and "diagnostic telemetry"
+3035583 9 "Get Windows 10" nag
+3044374 9 Update that enables you to upgrade from Windows 8.1 to Windows 10
+3050265 5 Windows Update Client for Windows 7: June 2015
+3050267 5 Windows Update Client for Windows 8.1: June 2015
+3065987 5 Windows Update Client for Windows 7 and Windows Server 2008 R2: July 2015
+3068708 9 Update for "customer experience" and "diagnostic telemetry".
+3075249 9 Adds "telemetry" to UAC
+3075851 5 Windows Update Client for Windows 7 and Windows Server 2008 R2: August 2015
+3075853 5 Windows Update Client for Windows 8.1 and Windows Server 2012 R2: August 2015
+3080149 9 Update for "customer experience" and "diagnostic telemetry".
+3081954 9 Adds "telemetry data points" to Work Folders (Win10 upgrade compat)
+3083324 5 Windows Update Client for Windows 7 and Windows Server 2008 R2: September 2015
+3083710 5 Windows Update Client for Windows 7 and Windows Server 2008 R2: October 2015
+3112336 5 Windows Update Client for Windows 8.1 and Windows Server 2012 R2: December 2015
+3112343 5 Windows Update Client for Windows 7 and Windows Server 2008 R2: December 2015
+3123862 9 Updated capabilities to upgrade Windows 8.1 and Windows 7
+3135445 5 Windows Update Client for Windows 7 and Windows Server 2008 R2: February 2016
+3138612 5 Windows Update Client for Windows 7 and Windows Server 2008 R2: March 2016
+3138615 5 Windows Update Client for Windows 8.1 and Windows Server 2012 R2: March 2016
+3139923 9 DiagTrack installation
+3150513 9 May 2016 Spying Compatibility Update for Windows
+3161608 9 June 2016 update rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1
+3170735 9 July 2016 Windows Journal development notifications - superceded by KB3161102
+3173040 9 "End of upgrade" nag.
+3184143 9 Upgrade nag removal.
+4493132 9 "End of upgrade" nag.
+4524752 9 "End of upgrade" nag.

Updates.list.md

@@ -0,0 +1,22 @@
+# Updates.list format explained
+
+The format itself is rather simple.
+```
+KBID Severity KB article description.
+```
+
+F.e.:
+```
+2952664 9 "Compatibility" update for upgrading Windows 7
+2966583 9 "Improvements" for the "System Update Readiness Tool" in Windows 7 and Windows Server 2008 R2
+```
+
+Severity is then used by the [BlockWindows.bat](BlockWindows.bat) to decide, which updates are to be treated, and which are free to pass.
+
+The maximum safe severity is passed as the first argument. The default severity value is zero (technically, it is an empty string, but…), thus, if no arguments given, anything with severity 1 and up will be considered unwanted.
+
+## Suggested severity values
+
+* 9 - An unwanted piece.
+* 5 - Windows Update Client updates.
+* Anything lower - use in your additional lists at your own discretion.