I suspected Pro and corporate oriented versions would be suffering this... I'm assuming MS thinks users for the home versions are just too stupid to disable the service, so they doesn't pay too much attention to them. Pro/LTSB/Workstation/Whatever versions seem to be the target as they know people who uses this versions want control, and they are trying to take it away. Just my little theory, I can be wrong, still was weird using the 1709 version and finding it just stays with the stuff desabled, as it should... I really find funny how MS is fighting to brick PC's...
I am on LTSB 2016 and have not seen WU turn itself back on yet. One time I was doing my usual setup and tweaks and noticed it running while still in the Disabled state though, but just brushed it off as me disabling it and forgetting to actually kill the service at the same time. I have noticed if you set your firewall to block in and outbound on all but programs you have created allow rules for breaks Windows Updates from working though...so there's that? It's funny (not) that a firewall is intended to keep external baddies out of your computer, but I have to use it to keep my bad OS in!
Yes, that works too, but most people do not use a real firewall or do not know, that WF can block outbound, or that they can block WU, simply by blocking svchost. The catch is, that DNS Cache, svchost as well, is enabled by default and by blocking it, people would block DNS requests, unless DNS servers are setup separately.
Me too have two VM's running builds LTSB_1607.14393.1914 and LTSB 1607 14393.1884 and this switch remains disabled to date. Not sure if this is about an update app that no longer works or about a MS change that when you disable that service it comes back on? I have not seen that. Been running 1884 for a while and installed 1914 for interest. Will keep monitoring but so far no. To OP how often was this (to reproduce) and are you using some kind of third party software to try to flip the switch? Regards Edit: Should mention the firewall gets configured on first boot: WFC (Cody's post) up and running built for my needs not M$'s. It exports rules makes it easy for reinstall.
Go back, read from the beginning, follow through, read all, carefully, as I don't want to repeat myself All still fine ATM, but I am going to put that CU on now (the one that has been there for a week or so), so will report back if this changes.