I have updates to Win 10 Pro disabled. Over the last 2 days Host Processes
has uploaded almost 700 megabytes to my computer. Any way I can figure out
what Microsoft is up to and also make it leave me alone?
--
<Bill>

Brought to you from Anchorage, Alaska

On 4/16/2024 1:12 PM, Bill Bradshaw wrote:
> I have updates to Win 10 Pro disabled. Over the last 2 days Host Processes
> has uploaded almost 700 megabytes to my computer. Any way I can figure out
> what Microsoft is up to and also make it leave me alone?
>

MS are not in the habit of explaining themselves. They just came
out with a new update, with very little info aside from saying that
it will improve notifications to Microsoft accounts. That sounds
ominous to me. I've worked hard to kill all notifications, and I don't
have a Microsoft account.

I looked into that update out of curiosity and was unable to find
any actual facts, aside from a list of files that would be changed.

To stop updates, there's an easy program. There's also a Registry
tweak:

Here's the easy way:
https://www.majorgeeks.com/files/details/windows_update_blocker.html

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
"ProductVersion" "Windows 10"
"TargetReleaseVersion" 00000001
"TargetReleaseVersionInfo" "22H2"

The second value is a dword. This setting tells the updater not
to go beyond the specified version. In this case, Win10 22H2. You
can also diasable the services Windows Update, WU Medic service
and BITS.

But be aware that MS have become increasingly sleazy.
Even disabled, they might get activated again. It used to be that
if you disabled a service then nothing could turn it on. That's no
longer true. And WU isn't the only one. I recently jumped through
ridiculous hoops to shut off searchapp.exe, which I have no use for.

I'd suggest also checking out WinAero Tweaker and Win10 Privacy.
They have a lot of obscure settings made available in an easy GUI.

On 4/16/2024 1:12 PM, Bill Bradshaw wrote:
> I have updates to Win 10 Pro disabled. Over the last 2 days Host Processes
> has uploaded almost 700 megabytes to my computer. Any way I can figure out
> what Microsoft is up to and also make it leave me alone?
>

Computer has

BITS <=== original scheme, may be used as a fallback, or via Powershell command
DoSVC <=== current scheme

for data transfer. A transfer can be "queued up" and resolved
as link bandwidth or user bandwidth settings, permit. You can define
policies to control bandwidth (GPEDIT.msc on pro). The controls on
BITS generally sucked.

I'm not aware of a readout, which displays in plain english, what the
computer is doing. More than one transfer file can be open at a time.
At one time, WU could open sixteen connections at once, but I think
they may have moderated that somewhat. It was causing unfair network usage
in peoples homes (PC#1 updates, PC#2 "can't surf").

C:\Windows\System32 might get its updates via Windows Update. There
are a few services associated with that.

The Metro.App items may independently do updates.

The lock screen, and various advertising campaigns, they
may load async to Patch Tuesday as well.

AV definition updates, there are a couple per day. As well
as the AV program itself getting patched on Patch Tuesday.

We don't know when "MSEdgeUpdate" or whatever passes for that,
does its update. There should be a fair number of those.

There are *LOTS* of little things, but not an infinite number
of them. The link should occasionally be quiet.

On purpose, I run IPV4 only here. I find IPV6 too "chatty" and
I like my Link LED flashing to alert me when real transfers
are under way. I don't want IPV6 ARPing me for nothing.

Your web browser can be running keep-alive on the HTTP connections.
This results in some amount of traffic, even when you have
hands-off-keyboard.

Disconnecting the network cable, really cuts down on nuisance traffic <snicker>.
Microsoft knows that. I hope they are measuring how often I unplug.

The power consumption of a Windows computer is cut in half,
if you disconnect the network cable... and then boot.

Using TCPView or doing traces, the names of the nodes can
be obfuscated (like using Akamai perhaps). And this is why
a PiHole for blocking, may have limited success. It depends
on the person collecting node names, as to whether they
can stop all activity. But Microsoft are quite proud of some
of their activities, which is why "vortex" is still used
as a node name. That's where your browser URLs go.

Telemetry (uploads to Microsoft server) can't be stopped entirely.

DoSvc can serve Windows Update received files, to other
computers in the house. You need to check the settings
for that, if it concerns you. If you clean out the DoSvc cache,
then it cannot serve those files.

BITS does not do caching like that. BITS is your friend.

It's DoSvc which is a full service "bar and grille". If you do Windows Update
on Computer #1 for Win10 Pro, if you later boot Computer #2 Win10 Pro,
you may see a couple files shoot from #1 to #2, saving on
downloading the same files from Microsoft a second time.
They will be hash-checked for authenticity.

While DoSvc can serve that file to a random Internet user,
I have not observed such a thing happening, and there is
a setting to stop that and it is not likely to be
the default either. As a lot of home users have "poor upload".

My 15/1 service, serving Windows Update files in the "1" direction
would be silly (too slow). Even if the protocol uses byte-ranges,
the idea would still be silly. If you were on 1000/1000 fiber,
you would make an excellent donor (symmetric). So in some ways,
your candidacy would be similar to original Skype, where "well-connected"
machines were valued as "SuperNodes". As if your machine was a
Skype company resource. The Microsoft version of Skype, is centralized
and does not do that. The original Skype was "distributed", reducing
Skype hardware costs. The original Skype was one clever design.
A marvel of crypto.

[Picture] A sampling of what a DoSvc control might look like...

https://i.postimg.cc/ncVrDP7k/W11-Do-Svc-panel.gif

Paul

Bill Bradshaw <bradshaw@gci.net> wrote:

> I have updates to Win 10 Pro disabled. Over the last 2 days Host
> Processes has uploaded almost 700 megabytes to my computer. Any way
> I can figure out what Microsoft is up to and also make it leave me
> alone?

Use something that shows to where a process connects, like SysInternals
TCPview. Check were remote address is not * (orphaned connection), not
localhost, and not your hostname as those are your host, not elsewhere.

On 4/16/24 10:12 AM, Bill Bradshaw wrote:
> I have updates to Win 10 Pro disabled. Over the last 2 days Host Processes
> has uploaded almost 700 megabytes to my computer. Any way I can figure out
> what Microsoft is up to and also make it leave me alone?

You could start by looking in:
Windows Update
- look for updates that have not been installed or available to download
Windows Update/Update History
- look for the recent installed updates(they are all dated)
Ensure you look in all subcategories
Windows Updates, Driver Updates, Definition Updates, and Other Updates

If Windows 10 has been disabled for some time
Other updates have been included in Monthly cumulative updates
Security, Servicing Stack(the engine for Windows Update), Windows
Recovery partition(aka WinRE), and a possible Feature Update(if Win10 is
not at 22H2 level, 21H2 reached end-of-service in June 2023). Also June
2023 also was the initial phase for deploying WinRE updates - there have
been 3 WinRE updates since then - Aug, Oct, Dec 2023.

Other updates not deployed via Windows Update
e.g. Apps, Edge, Office 2016 or later including M365.

Tell us what you see, then a better educated guess might be possible.

--
....w¡ñ§±¤ñ

Bill Bradshaw <bradshaw@gci.net> wrote:
> I have updates to Win 10 Pro disabled. Over the last 2 days Host Processes
> has uploaded almost 700 megabytes to my computer. Any way I can figure out
> what Microsoft is up to and also make it leave me alone?

I have Windows 11 Home. I checked my Host Processes For Windows
Services usage over the last month and then zoomed in on the peak and
indeed saw 864MB downloaded on April 10, which is the day after 'patch
Tuesday' (because I'm in the Dutch timezone).

So it seems while your system is not updating, it still is downloading
updates.

As Paul hinted at, Windows Update has settings to limit data usage.

When I'm on costly mobile data, I just 'Pause updates' for up to 5
weeks and then Windows Updates uses no/little data.

Frank Slootweg wrote:
> Bill Bradshaw <bradshaw@gci.net> wrote:
>> I have updates to Win 10 Pro disabled. Over the last 2 days Host
>> Processes has uploaded almost 700 megabytes to my computer. Any way
>> I can figure out what Microsoft is up to and also make it leave me
>> alone?
>
> I have Windows 11 Home. I checked my Host Processes For Windows
> Services usage over the last month and then zoomed in on the peak and
> indeed saw 864MB downloaded on April 10, which is the day after 'patch
> Tuesday' (because I'm in the Dutch timezone).
>
> So it seems while your system is not updating, it still is
> downloading updates.
>
> As Paul hinted at, Windows Update has settings to limit data usage.
>
> When I'm on costly mobile data, I just 'Pause updates' for up to 5
> weeks and then Windows Updates uses no/little data.

A little more info. I use cumulative update and then run win 10 update.

Activity Monitor since 4/1/2024:

From Microsoft: 6.4 MB
From Microsoft Cache Server: 904.7 MB

Update History records no update since 4/11/2024.

Where you checking your Host Processes For Windows Services? I did not see
it in the Task Manager. So far usage today per NetWorx for this is 13.7 MB.

<Bill>

Bill Bradshaw <bradshaw@gci.net> wrote:
[...]
> A little more info. I use cumulative update and then run win 10 update.
>
> Activity Monitor since 4/1/2024:
>
> From Microsoft: 6.4 MB
> From Microsoft Cache Server: 904.7 MB
>
> Update History records no update since 4/11/2024.
>
> Where you checking your Host Processes For Windows Services? I did not see
> it in the Task Manager. So far usage today per NetWorx for this is 13.7 MB.

Great minds think alike! :-) I also use NetWorx, an old (5.5.5 of
2016) free version, which still works fine on Windows 11. There are
probably other (free?) tools, but as long as NetWorx keeps working, I'll
stick to it.

Frank Slootweg wrote:
> Bill Bradshaw <bradshaw@gci.net> wrote:
> [...]
>> A little more info. I use cumulative update and then run win 10
>> update.
>>
>> Activity Monitor since 4/1/2024:
>>
>> From Microsoft: 6.4 MB
>> From Microsoft Cache Server: 904.7 MB
>>
>> Update History records no update since 4/11/2024.
>>
>> Where you checking your Host Processes For Windows Services? I did
>> not see it in the Task Manager. So far usage today per NetWorx for
>> this is 13.7 MB.
>
> Great minds think alike! :-) I also use NetWorx, an old (5.5.5 of
> 2016) free version, which still works fine on Windows 11. There are
> probably other (free?) tools, but as long as NetWorx keeps working,
> I'll stick to it.

Same version here.

Bill Bradshaw wrote:
> I have updates to Win 10 Pro disabled. Over the last 2 days Host
> Processes has uploaded almost 700 megabytes to my computer. Any way
> I can figure out what Microsoft is up to and also make it leave me
> alone?

So I came across some info regarding using windows media player and
Microsoft taking info. Quit using media player and this problem seems to
have gone away. Now I need to figure out a program that will play music cds
copied to my hard drive.

<Bill>

On 4/24/2024 2:50 PM, Bill Bradshaw wrote:
> Bill Bradshaw wrote:
>> I have updates to Win 10 Pro disabled. Over the last 2 days Host
>> Processes has uploaded almost 700 megabytes to my computer. Any way
>> I can figure out what Microsoft is up to and also make it leave me
>> alone?
>
> So I came across some info regarding using windows media player and
> Microsoft taking info. Quit using media player and this problem seems to
> have gone away. Now I need to figure out a program that will play music cds
> copied to my hard drive.
>
> <Bill>

If you're referring to Windows Media Player contacting GraceNote
to get titles for ripped tracks, during the configuration stage
of WMP, you are asked whether you want to allow that or not.

Windows does more random telemetry than we will ever be able
to keep track of, and whatever a "legacy" thing like WMP is doing,
the regular telemetry could just as easily be keeping notes. While
Microsoft made a "Telemetry Viewer" thing, it was never intended to
help people in any way. You still don't know what it is doing.

I would rate the OS as "generally untrustworthy" versus "specifically untrustworthy".
It's designed for the notion of "scraping" and it likely places more
value on your address book collection, than your collection of ripped CDs.
That's why you can't run one of their email programs, without filling it
with accounts and passwords and so on.

Paul