Saturday, March 12, 2016

How to prevent gwx.exe from running

This affects Windows 7, Windows 8.x, and this post is only about the "Get Windows 10" nag message seen in the taskbar notification area.
04.04.2016 Update: Before even of this post, there have been more sophisticated efforts to keep Windows 10 from automatically installing itself on computers with Windows 7 and 8.x. Never10 is the latest effort. Computerworld article here.
  • This post assumes, that the user already knows how to change file permissions and attributes.
  • I wrote it from memory, because I used the below method on someone else's computer that had Windows 7 in it.
I won't vouch, that following the below steps will prevent drive-by installs of Windows 10, but in a computer I worked on, the nagging stopped.

There are also several updates that should be hidden, and which one would be smart not to install. Or, if they're there, to uninstall. Upon returning the computer, I instructed the user only to install critical updates from Windows Update, but not recommended updates.

* As Administrator or a user with admin rights, go to the location where gwx.exe is at;
* Go to its file properties and take ownership of the file. The default owner is TRUSTEDINSTALLER
* After that, change file permissions for all users so, that only you or the administrator can only read it.
* Repeat that with other executables in the same folder.

Writing to the file(s) should thus be forbidden, and also deleting it (them).

You or a designated administrator account should be the only ones who can change the file's attributes. I don't know, if prohibiting file attribute changes also affects changing whether rights to the file can be modified in the future.

In total, this should mean, that the file can't be executed and its attributes can't be changed by other users.

I also remember doing some changes at Windows Scheduler as to whether gwx.exe should run, and I remember disabling some of these items, too.

And then restart the computer. After that, the "Get Windows 10" notification did not appear anymore. #worksforme

No comments: