diff --git a/optional/block-updates.cmd b/optional/block-updates.cmd
new file mode 100644
index 0000000..55ee6b8
--- /dev/null
+++ b/optional/block-updates.cmd
@@ -0,0 +1,15 @@
+@echo off
+call check-for-admin
+if %ERRORLEVEL% neq 0 exit /b
+
+echo ####### %0 #######
+
+echo blocking UPDATE KB5005463 aka. PC-Health ...
+powershell -command "Hide-WindowsUpdate -KBArticleID KB5005463 -AcceptAll"
+
+echo showing WINDOWS updates ...
+powershell -command "Get-WindowsUpdate"
+
+echo ####### %0 #######
+pause
+
diff --git a/optional/install-psupdate.cmd b/optional/install-psupdate.cmd
new file mode 100644
index 0000000..9833e91
--- /dev/null
+++ b/optional/install-psupdate.cmd
@@ -0,0 +1,18 @@
+@echo off
+call check-for-admin
+if %ERRORLEVEL% neq 0 exit /b
+
+echo ####### %0 #######
+
+echo Installing package provider "NuGet" ...
+powershell -command "Install-PackageProvider NuGet -Force"
+
+echo Setting policy for "PSGallery" to "trusted" ...
+powershell -command "Set-PSRepository PSGallery -InstallationPolicy Trusted"
+
+echo Installing powershell package "PSWindowsUpdate" ...
+powershell -command "Install-Module PSWindowsUpdate"
+echo.
+
+echo ####### %0 #######
+pause
diff --git a/scripts/autoconfig-all.cmd b/scripts/autoconfig-all.cmd
index 456b2b3..c81c97a 100644
--- a/scripts/autoconfig-all.cmd
+++ b/scripts/autoconfig-all.cmd
@@ -178,14 +178,6 @@ rem should be done as late as possible ...
 call install-logonscript.cmd
 echo.
 
-echo add full access rights to all users on public icons ...
-icacls %PUBLIC%\Desktop\*.lnk /grant Users:F
-echo.
-
-echo removing read-only flag on tools folder ...
-attrib /S /D -R %TOOLS%\*
-echo.
-
 echo #####################
 echo ### DISABLE tasks ###
 echo #####################
@@ -234,6 +226,14 @@ rem ... remove stupid public folders
 call cleanup-publicdir.cmd
 echo.
 
+echo add read access rights to all users on public icons ...
+icacls %PUBLIC%\Desktop\*.lnk /grant Users:R
+echo.
+
+echo removing read-only flag on tools folder ...
+attrib /S /D -R %TOOLS%\*
+echo.
+
 date /t
 time /t
 echo ####### %0 #######