http://www.wsusoffline.net/
and once the OS is updated, totally disable updates, all of its processes and services and tasks, and never update again ... that’s absolutely the only way to maintain a stable Windows system ..."
WSUS Offline can even be run from one Windows system to download all the updates for a different Windows version, even for installation on different hardware. I typically run WSUS Offline using Virtual WinXP running on VBox on Linux Mint, then move the updates to Win7 and Win10 PCs by thumb drive.
For the most trouble-free Windows experience you can have, download the latest image for your version (make sure you have access to the product key). Then customize it and convert it to ".wim" format with NTLite. Then install the .wim image using Bob.Omb's Modified Win10PEx64 run from a thumb drive.
There are no end of Windows "features" than can't be uninstalled but that can be removed before installation. Like Cortana, for instance. You can have a 'clean' install with Cortana, UAC, DRM, or Windows Update (and a ton of other crapware) either not installed or deactivated from birth. Plus all your favorite customization features (small desktop icons, XP Start Button, etc) and your pet registry hacks, done and dusted on the install.
Then do all the updating you think necessary using WSUS Offline.
“WSUS Offline can even be run from one Windows system to download all the updates for a different Windows version, even for installation on different hardware.’
indeed. i do this all the time ... totally bypasses the horrible, balky, problematic, usually broken, builtin windows download/update mess ...
and i forgot to note for those that don’t know about wsusoffline that it updates ONLY the security updates that run parallel to the “rollup” bundles and not the “rollups” themselves that have security plus whatever else garbage MS wants to destroy your PC with ...