We have 5000+ servers and need to hide the 2008R2 SP1 so that our users don't accidentally install the service pack. I can use PSEXEC, powershell, ect. Is there a way to do this from command line so that we don't have to use the gui on each of the 5000+ machines?

  • Why are your users running Windows Server 2008R2?
    – joeqwerty
    Feb 24, 2011 at 16:26
  • They are not, we have app teams that use those servers. They just use the apps, but sometimes they get click happy and update.
    – shaiss
    Feb 24, 2011 at 16:36

2 Answers 2


Microsoft released a tool for that purpose: Windows Service Pack Blocker Tool Kit.

Microsoft text: "A blocking tool is available for organizations that would like to temporarily prevent installation of Service Pack updates through Windows Update.

This tool can be used with: Windows 7 Service Pack 1 (valid through 2/22/2012) Windows Server 2008 R2 Service Pack 1 (valid through 2/22/2012)

This toolkit contains three components. All of them function primarily to set or clear a specific registry key that is used to detect and block download of Service Packs from Windows Update. You only need to use the component which best serves your organization’s computer management infrastructure. 1. A Microsoft-signed executable 2. A script 3. An ADM template "

Hope this helps, Cheers


You could use Group Policy to disable the Windows Update/Automatic Updates service or use Group Policy to prevent users from accessing Windows Update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.