When creating a Windows 10 Gold Image VM, as one of the last steps, you need to run the Citrix App Layering Image Preparation Utility.  When you get to the "Automatic Updates" section of the wizard, you see a message stating, "Automatic Updates is currently turned on.  In order for the installation to continue, Automatic Updates must be turned off."


Even though you have disabled the Windows Updates service, you still see this message.

The purpose for this requirement is to make sure that Windows Updates do not creep into any of your app layers or published images.  Windows Updates need to happen only in the OS layer.  (Similarly, Office Updates need to happen only in the Office layer.)  When you wish to update Windows, you need to re-enable the setting, do the updates, and then disable them again.

The installer specifically is looking at HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU.  It requires that the value for "NoAutoUpdate" is set to a 1.  If you look in your registry and that value is not set, then you may think that you disabled windows updates, but you actually have not.  That setting is the only one that will absolutely prevent any OS updates from taking place in Windows 10.

(For Windows 7, simply set the Windows Updates pull-down to Never.)