Don't forget, Windows 10 abuses TCP link sharing by opening over 100 simultaneous TCP connections to download updates, bringing your entire home network to a grinding halt until it's finished.

Side note to those with a Mikrotik router, you can protect your network from the malware that is Windows Update with the following firewall rules:

    /ip firewall filter add action=drop chain=forward connection-limit=9,12 \
      in-interface=ether1-gateway protocol=tcp src-port=80 tcp-flags=syn,ack
    /ipv6 firewall filter add action=drop chain=forward connection-limit=9,32 \
      in-interface=ether1-gateway protocol=tcp src-port=80 tcp-flags=syn,ack

placed before the rule to accept established connections. These rules are maybe a little overzealous, but they were the only way I've found to make my network usable when Windows Update launches a DoS attack.