Windows Update service set to Disabled keeps changing to Manual by itself (offline Windows 11 PC)

The supported approach is to control automatic updating through Windows Update policy rather than keeping wuauserv Disabled, and to use Process Monitor separately to determine whether a process writes the service’s Start value directly.

Identify what changes the startup type

Event 7040 records the change but does not identify the originating executable. Process Monitor captures real-time registry and process activity, including image path, command line, user, process tree, and thread stacks, and it supports boot-time logging if the change happens during startup.^1^

1. Download Process Monitor on another PC and transfer it using approved removable media.
2. Run Procmon64.exe as administrator.
3. Press Ctrl+L and add these filters:
   • Path → is →
     HKLM\System\CurrentControlSet\Services\wuauserv\Start → Include
   • Operation → is → RegSetValue → Include
   If no events appear, use Path begins with
   HKLM\System\CurrentControlSet\Services\wuauserv.
4. Select Filter → Drop Filtered Events to limit trace growth.
5. Start capture with Ctrl+E, set wuauserv to Disabled, and wait for Event 7040.
6. Stop capture immediately, then inspect the matching RegSetValue event:
   • Process Name
   • PID
   • User
   • Detail, including the written value
   • Event Properties → Process for the image path and command line
   • Event Properties → Stack
   • Tools → Process Tree

Save the result as a native PML file so its process and stack data are preserved.

Important limitation: if the change was requested through the Service Control Manager API, Process Monitor may show services.exe as the registry writer. That identifies the intermediary, not necessarily the process that called ChangeServiceConfig. Its stack or process tree can provide leads, but they are not guaranteed to reveal the RPC client.

If the result is only services.exe, a service-control API/ETW trace capable of correlating the caller is required. The available public documentation here does not provide a complete, supported WPR/WPA profile for that specific attribution. Preserve the PML, the 7040 event, and the exact timestamp for Microsoft Support rather than inferring that the nearby Store events caused the change.

Supplementary registry auditing

Registry auditing can confirm the account and registry modification, although an SCM-mediated change can again be attributed only to services.exe.

1. Open secpol.msc.
2. Go to Advanced Audit Policy Configuration → System Audit Policies → Object Access → Audit Registry.
3. Enable Success auditing.
4. In Registry Editor, open: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
5. Select Permissions → Advanced → Auditing → Add.
6. Audit successful Set Value access for the relevant principals.
7. After the change, inspect Event Viewer → Windows Logs → Security for Event 4657, “A registry value was modified.”

Registry audit events are generated only when Audit Registry is enabled and the registry object has a matching system access control list (SACL).^2^ Microsoft documents Event 4657 as the registry-value-modification event.^3^

Disable this targeted auditing afterward if it generates unnecessary events.

Supported update suppression

Do not rely on the wuauserv startup type as the update-control mechanism. Microsoft’s Windows IoT Enterprise guidance explicitly says stopping and disabling the service is no longer the supported method there; it prescribes Windows Update policies instead.^4^

On an edition containing Local Group Policy Editor:

1. Run gpedit.msc.
2. Open:
   Computer Configuration → Administrative Templates → Windows Components → Windows Update → Manage end user experience → Configure Automatic Updates
3. Set it to Disabled.
4. Optionally enable:
   Remove access to use all Windows Update features
5. Run gpupdate /force or restart.

Configure Automatic Updates = Disabled prevents automatic updating; it does not promise that the wuauserv startup type will remain Disabled. The user-interface policy alone also does not stop background activity.^4^

For Windows 11 Enterprise, Microsoft also documents policies for preventing connections to Windows Update Internet locations and directing the client to an intentionally blank intranet update location.^5^ That article is scoped to Enterprise and should not be applied as proof of support on Windows Home.

If this is Windows 11 Home, the cited documentation does not establish a supported policy that permanently pins wuauserv to Disabled. Since the PC is physically offline, leaving the service at its Windows-managed start type does not itself provide internet connectivity. Maintain an offline servicing plan for security and Defender updates rather than changing service ACLs or repeatedly forcing its registry Start value.

References

1. Process Monitor v4.12
2. Policy CSP - Audit
3. Advanced Audit Policy Configuration
4. OS Updates
5. Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services