[SOLVED] How to stop Microsoft Store Apps zombie auto updates?

[Cellie]

I'm on Windows 10 Pro. Is there a way to prevent Microsoft Store from auto-updating other Windows Apps when Store itself was already removed? (You read that right)

Logic says that once Microsoft Store package is removed it should no longer be doing stuff, but it's Microsoft we're talking about. Despite being where autoupdate settings are it doesn't seem it's MS Store that autoupdates anything — it's keeps whatever rogue process doing it in check instead.

To remove the MS Store I used Remove-AppXPackage. I've had it disabled for years without issues, but last year this MS Store's updating functionality quietly rose from the dead and won't leave Windows Photos alone, auto-updating the cursed thing despite of my best efforts to keep it in an earlier version. No, Store didn't reinstall itself or anything, it's still removed, but somehow apps get updated.

For good measure auto downloads are disabled through registry, (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore > AutoDownload set to "2", which is Never). Trying to fully remove any traces of the package using DISM /Online /Remove-ProvisionedAppxPackage /PackageName doesn't work. Windows Updates are set to notify only, so it's not the culprit. There's no setting in Photos controlling updates either.

So far the only way to keep Windows Apps from updating seems to keep Microsoft Store installed (I'm not even sure of it yet, apps auto-update in about 10min without it, don't with it, but who's to say it won't autoupdate in a week?). I'm not a fan of leaving garbage around if I can help it and the notion of having to have an app installed to keep it from running is absurd. There has to be some residue of it that's not flushed when removing the package, something that once also removed will stop updating things, I just don't know what or where.

Doing a Get-AppxPackage *store* -allusers shows a "Microsoft.Services.Store.Engagement" (which I can't seem to remove) for another user account, but I don't think it's it.

---

Edit: Quick guide to rolling back Windows Apps​

The issue was that without MS Store Windows Photos updated itself whenever it wanted. You'll need to block it in a firewall. Check the solution below and the rest of the thread to see how I solved it.

Since I couldn't find anything on the internet about that specific update issue and other people coming from the search might end up here in the future, here's a tangentially related quick guide on how to rollback Windows 10 Apps because you'll need to do this also.

You'll need Powershell with admin access.

1. Go to the Microsoft Store site and search for the app you want to rollback. Copy the app's page url.
2. Paste the URL in the search box of https://store.rg-adguard.net/. Change from "RP" to "Retail" and hit search. This site searches MS's server for previous builds. Look for an .AppxBundle with the approximate date of the version you need in the filename.
3. Open Powershell with Admin. You'll need to navigate to the directory where the appx was downloaded, remove the updated package and install the one you downloaded. I'll use Windows Photos as example, which I donwloaded to "A:\":

cd A:
Get-AppxPackage Microsoft.Windows.Photos* | Remove-AppXPackage
Add-AppXPackage Microsoft.Windows.Photos_2023.10030.27002.0_neutral_~_8wekyb3d8bbwe.AppxBundle

Afaik you call reinstall or rollback any MS app this way, even Windows Store itself.

 

[35below0]

There might be a way. It all hinges on which process is going to try to autoupdate the apps you want untouched.

Windows 10 Firewall Control allows you to block incoming and outgoing! traffic across the windows firewall.

Windows 10 Firewall Control: Sphinx Software

Windows 10 Firewall Control: simple and exhaustive solution for applications network activity controlling and monitoring. Prevents undesired programs and Windows updates, informational incoming and outgoing leakage of applications running locally or remotely. Provides detailed logging and...

www.sphinx-soft.com

Paid version can block OS/system processes, free version lacks that ability.

The way it works is simple. A process tries to use the internet connection, it trips a Firewall Control popup that asks you to allow, block, or set up some limited access (there are existing presets such as web, mail, MSonline, MSoffline).
I use it to stop unknown apps/processes. Obviously if i launch a new game or browser, and it triggers a Firewall Control popup, i know what it is and why it wants to connect outside or in. But sometimes a random process with an unrecognizable name will attempt to connect, and it will be outed by the Firewall Control popup.

For you, if the updater is not an OS/system process, you can block it using the free version. If it's part of the Windows system, you would need the paid version.

Consider also that every damn application and proccess that ever runs and tries to use the internet will trip up Firewall control at least once. Once you set a rule (allow, block, etc) it will remain in force until you edit or delete the rule.


Last but not least, the sound played when the popup pops up is incredibly annoying. So be ready to replace it with a nicer sound or a blank .wav file.

 

[Cellie]

It's a bit early to say it solved the issue, but yours was a very good idea. I went with an open-source alternative though, simplewall.

I was dreading to look at traffic and discover it was some windows system process I can't block without consequences, but once I looked guess who was trying to phone home?

Windows Photos.

Looks like even the earlier builds have something that keeps trying to check with the mothership unless it MS Store is there to say "no". Blocked it and it has been well behaved so far. I'll give it, dunno, a week and come back edit it here to highlight your post is the answer because it seems I forgot to change the thread from "discussion" to "question" and now I won't be able to mark your post as an answer.

 

[gardenman]

Good idea on the app block.

I forgot to change the thread from "discussion" to "question"

Fixed.

After you choose the best answer, if the red "Question" doesn't change to green "Answered", a mod will eventually change it.

 

[35below0]

I went with an open-source alternative though, simplewall.

Ok, thanks for the tip. I didn't know about simplewall. I found the other one ages ago and lazily stuck with it.

guess who was trying to phone home?

Windows Photos.

Makes it simple to lock it down. Maybe. We'll see.
I thought it might be Photos, because i've noticed a lot of updaters on my firewall list. Instead of one from MS that handles everything. Some applications will even use two or three just to monitor and update different parts of the application.


One other word of warning. I don't know about simplewall obviously but Firewall Control will sometimes cause a problem with installers or updaters that run from a random location each time.

The installer unpacks and executes, trips over FC and is blocked. It then gives up and closes before it can be allowed. Allowing the process doesn't work because next time the same installer is run, it will unpack to a different temp location or have a different ID or whatever, so it will look like a unique process to Firewall Control, and as a result it will be blocked again. And again.

Most installers/updaters allow the user some time to check their internet connection if they cannot find it. But some just give up right away, and those have caused me problems from time to time.

So if you find yourself in a similar situation, you might need to disable simplewall temporarily.

 

[Cellie]

Good idea on the app block.


Fixed.

After you choose the best answer, if the red "Question" doesn't change to green "Answered", a mod will eventually change it.

Thanks for fixing it!

Ok, thanks for the tip. I didn't know about simplewall. I found the other one ages ago and lazily stuck with it.


Makes it simple to lock it down. Maybe. We'll see.
I thought it might be Photos, because i've noticed a lot of updaters on my firewall list. Instead of one from MS that handles everything. Some applications will even use two or three just to monitor and update different parts of the application.


One other word of warning. I don't know about simplewall obviously but Firewall Control will sometimes cause a problem with installers or updaters that run from a random location each time.

The installer unpacks and executes, trips over FC and is blocked. It then gives up and closes before it can be allowed. Allowing the process doesn't work because next time the same installer is run, it will unpack to a different temp location or have a different ID or whatever, so it will look like a unique process to Firewall Control, and as a result it will be blocked again. And again.

Most installers/updaters allow the user some time to check their internet connection if they cannot find it. But some just give up right away, and those have caused me problems from time to time.

So if you find yourself in a similar situation, you might need to disable simplewall temporarily.

Good to know, you potentially saved me from some head scratching. I don't think I'll have this issue with simplewall, but it's good to know.

I hadn't heard about simplewall until yesterday either, but I'm a fan of open source projects and every time I need something new I check if there isn't an open alternative just in case.

24 hours so far, and once everything was set up got no more updates.

It's easy to block windows apps and also filter everything to see who is calling who straight out of the box. It'll ask before blocking something new, so after first using it to see who autodowloaded the package I still had to rollback Windows Photos once as it only needs to phone home once to download the update, and it'll try to keep an open connection as well, all while bidding its time to update itself when you're not looking at it.

Once connections were severed and it was blocked updates stopped. I'm still keeping an eye on it and it's very satisfying to see it butting its head against the firewall in the logs.