[F.R.] Manage other UpdateOrchestrator tasks

[Fred-Vatin]

In Windows 1903 (18362.267), there are other tasks allowed to wake PC from sleep

TaskPath                                       TaskName                          State
--------                                       --------                          -----
\Microsoft\Windows\.NET Framework\             .NET Framework NGEN v4.0.30319... Disabled
\Microsoft\Windows\.NET Framework\             .NET Framework NGEN v4.0.30319... Disabled
\Microsoft\Windows\InstallService\             WakeUpAndContinueUpdates          Disabled
\Microsoft\Windows\InstallService\             WakeUpAndScanForUpdates           Disabled
\Microsoft\Windows\SharedPC\                   Account Cleanup                   Disabled
\Microsoft\Windows\UpdateOrchestrator\         Backup Scan                       Ready
\Microsoft\Windows\UpdateOrchestrator\         Reboot_AC                         Disabled
\Microsoft\Windows\UpdateOrchestrator\         Universal Orchestrator Start      Ready

All the ones in UpdateOrchestrator can’t be disabled or edited.

Could your script manage to handle those tasks too to prevent them from waking PC ?

[seagull]

Reboot_AC and Reboot_Battery are new tasks added as part of 1903, yes. The others are not a concern. It's been on my to-do list for a while to improve the script to add these. Sit tight.

[Fred-Vatin]

Actually, I found a way to programatically untick the wake up PC to run the task option for any tasks that fill these conditions:

• is enabled
• its path is \Microsoft\Windows\UpdateOrchestrator\

It doesn’t need any third party tool and doesn’t disable the tasks or mess around with system files authorization. The trick is pretty simple and use Windows built in feature. Just create a task that will run as system.

1. Create a powershell script named disable wake.ps1 and copy this script in %windir%.

#Requires -RunAsAdministrator
write-host ""
Write-Host "Disable wake PC for UpdateOrchestrator tasks"
Write-Host "--------------------------------------------"

$error.clear()
try
{
    Get-ScheduledTask -TaskPath "\Microsoft\Windows\UpdateOrchestrator\" |
    ?{ $_.Settings.WakeToRun -eq $true -and $_.State -ne 'Disabled' } |
    %{
        write-host $_
        $_.Settings.WakeToRun = $false;
        Set-ScheduledTask $_
    }
}
catch
{
  Write-Host "    ¦   FAIL"
  Write-Host "    ¦   $_.Exception.Message"
}
finally
{
    if (!$error){
        Write-Host ""        
        Write-Host "      + SUCCESS"    
    }
}

# Read-Host -Prompt "Press Enter to exit"

2. Create an xml task file named Disable wake UpdateOrchestrator.xml:

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2019-08-12T10:44:23.4773054</Date>
    <Author>@freMea</Author>
    <Description>Désactive l'option de sortie de veille pour les tâches UpdateOrchestrator qui sont normalement impossible à modifier. Lance en tant que système "disable wake.ps1" dans le PATH pour cela.</Description>
    <URI>\Disable wake UpdateOrchestrator</URI>
  </RegistrationInfo>
  <Triggers>
    <LogonTrigger>
      <Enabled>true</Enabled>
      <Delay>PT1M</Delay>
    </LogonTrigger>
    <SessionStateChangeTrigger>
      <Enabled>true</Enabled>
      <StateChange>SessionLock</StateChange>
    </SessionStateChangeTrigger>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="System"&gt;&lt;Select Path="System"&gt;*[System[Provider[@Name='Microsoft-Windows-WindowsUpdateClient'] and EventID=19]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <Delay>PT30S</Delay>
    </EventTrigger>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="System"&gt;&lt;Select Path="System"&gt;*[System[Provider[@Name='Microsoft-Windows-Kernel-Power'] and EventID=42]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>powershell</Command>
      <Arguments>-executionPolicy unrestricted -file "%windir%\disable wake.ps1"</Arguments>
    </Exec>
  </Actions>
</Task>

3. Import this task with a SCHTASKS command in an admin console or run this batch file as admin in the same path as the XML:

@echo off
cls
title %~n0
cd /d "%~dp0"

SETLOCAL ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION

SCHTASKS /Create /F /TN "\Disable wake UpdateOrchestrator" /XML "Disable wake UpdateOrchestrator.xml"

pause

exit

Voilà !

Since MS regularly re-enable the wake PC option for some UpdateOrchestrator tasks, the Disable wake UpdateOrchestrator task will trigger at :

• every logon
• every time MSU has successfully installed and update
• every session lock (should also happen when user put his PC in sleep)
• every time the go to sleep event is trigger

[pdqpat]

This may be a solution to stopping my laptop from waking to run UpdateOrchestrator. It is designed like malware but is from Microsoft - really awful system design. I found this from a link on another site. Can I use the scripts from freMea in a Win10 Home system? Do I need to be logged in to an Admin account. (I recently created a new Admin account and changed my original account to Standard... finding typing a password at least once an hour painful.)

[seagull]

@freMea I have used a small part of your code in a rewrite and let you a credit. Thank you. Apologies for the slow rewrite, but this new version has been thoroughly tested and does the same job in a much more streamlined manner.