WRT updates and restarting, we went through quite a bit of effort tracking down exactly the settings needed to disable update checking, because once it checks for updates it seems like there is basically no way you can prevent it from rebooting on it's own at some point in the future. And this is on Windows Server, where you'd think they'd be even more reluctant to just reboot.

We ended up with this, BTW:

    Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\' -Name NoAutoUpdate -Value 1