gpedit is essentially a front end to the registry - you can do the same thing by modifying, adding, or removing keys. gpedit just does it for you in a graphical sort of way. - at least for single user machines. Group policies under a domain controlled machine have other uses. My solution doesn't just prevent updates, it disables the machine's ability to do updates at all because the service that provides them isn't running. It's what I do on Win7 machines (and did on XP machines when those were going out of service) - I don't trust microsoft not to slip in something funny, and there's always that chance you get a bad update that does what OP described.