Sometimes its necessary to prevent Windows clients from taking any updates from online sources, this is not necessarily the best approach to managing Windows Updates, and should only really be configured if you have a solution such as WSUS or Config Manager in place to push updates to your workstations. Without this, you will not receive any security updates and this could be disastrous for your organisation.

You should also be aware that this solution means that Windows cannot install features from Online sources such as RSAT tools. There are offline deployments available in most scenarios however.

In order to achieve this, in Group Policy, setup the following two settings

Computer Configuration | Policies | Administrative Templates | System | Internet Communication Management | Internet Communication Settings

Now set “Turn off access to all Windows Update features” to Enabled

Computer Configuration | Policies | Administrative Templates | Windows Components | Windows Update

Now set “Configure Automatic Updates” to Disabled