De: "But it's my understanding that there's no way to keep Microsoft's updates from running, short of keeping a Windows box offline."
I believe Evorem firewall can do this. Of course, I don't keep my computer on the internet all the time so there is no way for me to totally sure...yet.
What I've done is downloaded brave browser and enabled THAT, and not Edge, to access the internet. I block EVERYTHING at the beginning and only carefully allow processes on line which I absolutely need. So I enabled TurboTax to phone home to authenticate and then to update (it uses its own "browser") . Once it was actived and updated I cut it off again.
I don't think anything is getting past Evorim, but I don't know that for sure. I do know that Microsoft keeps waking up a dozen or so of weird processes regularly whining about how it needs the internet in order to make me more "secure".
Anyway, back up your system and then play with Evorem. If you other software you should be able to selectively allow. Again, I wouldn't give anything carte blanche. Rather, enable apps ONLY when you really want to use them - don't leave them free to "phone home" on their schedule.
In my opinion, this makes for a VASTLY better version of Windows 10. Castrated, with its tongue cut off, and its legs amputated makes Microsoft tolerable. But Linux is clearly better.
| 
