Our application needs to run in a locked-down operating system. Due to quality and regulatory concerns, all updates shall be prevented or blocked.

For example, we go through a checklist of Windows OS settings and verify they are set to prevent any updates. This doesn't actually test an update will be blocked.

Other than waiting for the next OS update from the developer, how can it be verified in Windows and other operating systems that all automatic updates will be prevented?