Comment by aeternum

I would simply disable windows update. It always seemed insane to me that the solution to preventing RCE was to open an RCE channel to basically every provider that has installed a driver or an application on your machine.

Each auto-update is by definition remote code execution.