The challenge here was Windows Update Service is need for DSC (what OCC is based on), so just turning off the service did not provide the needed to behavior. The following has been added to the MDT install: To disable driver updates: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v SearchOrderConfig /t REG_DWORD /d 0 /f To disable Windows updates: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f This will pause the search and download and install of updates for 35 days. In the OCC manifest: { "ComponentName": "disabeldriverupdate", "ComponentType": "RegistryKeySet", "Comment": "", "Key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DriverSearching", "ValueName": "SearchOrderConfig", "ValueType": "Dword", "ValueData": "0x00000000", "Hex": true }, { "ComponentName": "pauseupdate", "ComponentType": "RegistryKeySet", "Comment": "", "Key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows\\AU", "ValueName": "NoAutoUpdate", "ValueType": "Dword", "ValueData": "0x00000001", "Hex": true }, { "ComponentName": "Donnotupdate", "ComponentType": "RegistryKeySet", "Comment": "", "Key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows\\AU", "ValueName": "AUOptions", "ValueType": "Dword", "ValueData": "0x00000002", "Hex": true }, BY having "NoAutoUpdate" in the manifest as well ensures that the machine is permanently paused. Each time the registry updates it restarts the 35 day pause period. The "Donnotupdate" update is a final measure in place. If for any reason the machine is no longer pause it will not download and install without human interaction.