permissions - Can't Access Windows 10 Update Orchestrator Service

I'm on build 1803 of Windows 10 Home. I need to disable Update Orchestrator Service aka. UsoSvc because I am running several scientific analysis programs (Biochemistry) that are required for work but may be broken with future Windows updates. I need complete control over when and how I update in order to ensure each patch is compatible.

I find that even using an elevated administrator account (activated through the command line) and running command line through the "Run As: Admin" with sc config UsoSvc start= disabled. I am denied access to the service through system error 5. Accessing through the Services manager shows a grayed out box where start-up properties are. See this screenshot:

The computer is not on a domain, it's my home system. Is there any way to either a) access the UsoSvc and change access the start-up property to disabled and eliminate the scheduled tasks, or b) access my computer with the LocalSystem account? Upon boot there is no option to click "other users..." at the start up screen to type in the computer name\localsystem.

I am looking for a way that does not include permanent deletion of the service. I have already disabled start-up of wuauserv and the trustedinstaller. Can anyone help?

Answer

Disclaimer: The Update Orchestrator Service is tied to Windows Update. Changing the registry may cause problems with Windows Update and associated services. So if you don't know what the registry does I recommend not to mangle with registry and services.

All Windows services have some security to control their permissions and user interactions. Security is managed through HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SERVICE_NAME\Security and RequiredPrivileges registry. If there are some permissions denied in Service Manager (aka. services.msc) then Startup Type can be changed using the registry. Use the following command to change startup type of that ``UsoSvc` service.

set X=UsoSvc
reg add "HKLM\SYSTEM\CurrentControlSet\Services\%X%" /V "Start" /T REG_DWORD /D "4" /F

What does the command do? reg add command adds (or changes) the Start DWORD registry in HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc registry path. The 4 value means Disabled. Here are the list of those values:

0 = Boot
1 = System
2 = Automatic
3 = Manual
4 = Disabled
5 and more = Unknown

To revert the registry, change 4 value with 2 to make it automatic. Restart PC to effect the change. Read more about the registry at Microsoft Docs: Services Registry Tree