All,

I am in the process of migrating away from WSUS and over to using Desktop Central to manage all the patches in my (very) small network.

WSUS has been so-so - it worked - but required too much overhead than I have time for. Desktop Central on the other hand - requires very little setup and almost zero maintenance time.

This past weekend - I stood up a new Windows 2016 server which is running great along with Desktop Central

While I am very familiar with the usual WU GPO settings to get Windows 10 clients talking exclusively to WSUS - what I want to know now is are the ideal Windows Update settings to use with NO WSUS - to ensure these client machines do NOT automatically ever check Windows Update at all and more importantly - prevent my users from clicking Check for Updates.

I believe it may be a simple as setting Automatic Updates to Disable and there is another setting which greys out the Check For Updates button (the policy named "Remove access to Windows Update or something like that).

I am also aware of the setting that disables ALL windows update access - but I do not want to turn that on since we do have a few Windows Store apps that need the occasional update or two.

Right now - I still have all machines clients pointed at an old WSUS server (in place prior to last weekends rebuild) so they cannot get any updates right now - but I need to build a new local GPO (or a registry file for deployment via DS) that ensures no update checking occurs and all patches come from Desktop Central - when I tell it to apply them.

One final item - all my Windows 10 client machines are happily running v1709. Before I start removing the old WSUS settings - it is imperative that NONE of these machines automatically receive Win 10 v1803 as I am still testing that in a closed environment. Feature Updates (upgrades) only happen here via MDT so I can completely control the upgrade process.

When I tested a 1709 VM last week - with Automatic Updates set to Disabled - but the Check For Updates button still enabled - I clicked it and WU immediately started sending 1803 down the pipe. That cannot happen. 

Appreciate any tips that you can share for the above

B