diff --git a/scripts/block-updates.cmd b/optional/block-updates.cmd
similarity index 86%
rename from scripts/block-updates.cmd
rename to optional/block-updates.cmd
index b8a30df..c2486b4 100644
--- a/scripts/block-updates.cmd
+++ b/optional/block-updates.cmd
@@ -1,4 +1,6 @@
 @echo off
+call check-for-admin
+if %ERRORLEVEL% neq 0 exit /b
 
 echo ####### %0 #######
 
@@ -14,4 +16,5 @@ echo showing HIDDEN windows updates ...
 powershell -command "Get-WindowsUpdate -IsHidden"
 
 echo ####### %0 #######
+pause
 
diff --git a/scripts/autoconfig-all.cmd b/scripts/autoconfig-all.cmd
index 4fdc8e6..3490989 100644
--- a/scripts/autoconfig-all.cmd
+++ b/scripts/autoconfig-all.cmd
@@ -73,28 +73,28 @@ rem 7-zip is essential for other scripts ...
 call unpack-7zip.cmd
 echo.
 
-rem windows update blocker is in the zipfiles ...
-call unpack-zipfiles.cmd
-echo.
-
-rem unpack powershell packages and register them ...
-call unpack-pspackages.cmd
-echo.
-
 rem put vnc in place ...
 call unpack-vnc.cmd
 echo.
 
+rem unpack all the other zipfiles ...
+call unpack-zipfiles.cmd
+echo.
+
 rem copy some other stuff ...
 call copy-executables.cmd
 echo.
 
+rem unpack powershell packages and register them ...
+call unpack-pspackages.cmd
+echo.
+
 echo #######################
 echo ### MODIFICATIONS   ###
 echo #######################
 echo.
 
-rem this must be done EARLY!
+rem block updates - this must be done EARLY!
 if %windows_updates% == 0 (
   call disable-updates.cmd 
   echo.
@@ -205,20 +205,6 @@ echo.
 powershell -command .\disable-soundscheme.ps1
 echo.
 
-echo #####################
-echo ### UPDATES tasks ###
-echo #####################
-echo.
-
-rem enable updates again ...
-if %windows_updates% == 1 (
-  call enable-updates.cmd 
-  echo.
-)
-
-call block-updates.cmd
-echo.
-
 echo #####################
 echo ### CLEANUP tasks ###
 echo #####################
@@ -252,6 +238,12 @@ echo removing read-only flag on tools folder ...
 attrib /S /D -R %TOOLS%\*
 echo.
 
+rem enable updates again (doing it as late as possible) ...
+if %windows_updates% == 1 (
+  call enable-updates.cmd 
+  echo.
+)
+
 date /t
 time /t
 echo ####### %0 #######
diff --git a/scripts/startmenu/Windows Update Manager.lnk b/scripts/startmenu/Windows Update Manager.lnk
new file mode 100644
index 0000000..580f6b3
Binary files /dev/null and b/scripts/startmenu/Windows Update Manager.lnk differ