How to Completely Disable the ‘fwupd-refresh’ Service in Ubuntu Server

The fwupd (Firmware Update Daemon) is a service in Ubuntu Server designed to automatically query hardware vendors for firmware updates (like BIOS/UEFI updates or peripheral microcode) and apply them. The fwupd-refresh.service specifically runs on a timer to periodically fetch the latest metadata from the Linux Vendor Firmware Service (LVFS). While highly convenient on a desktop workstation, automatic firmware polling is generally discouraged in a strict enterprise server environment. Firmware updates carry a inherent risk of bricking hardware or causing unpredictable system instability, and should only ever be applied manually during a carefully planned, authorized maintenance window.

This guide explains how to completely disable the fwupd-refresh service in Ubuntu Server to prevent automatic background firmware metadata polling.

Stop and Disable the Firmware Refresh Timer

Because the refresh mechanism is triggered by a systemd timer rather than a continuously running daemon, we must disable both the timer and the underlying service to ensure the polling ceases entirely.

1. Log into your Ubuntu Server via SSH or local console using an account with sudo privileges.
2. First, stop the active timer that schedules the refresh jobs:

   sudo systemctl stop fwupd-refresh.timer

3. Next, disable the timer so it does not initialize during the next system boot:

   sudo systemctl disable fwupd-refresh.timer

4. To guarantee that no other automated process can accidentally trigger the refresh service itself, mask the underlying service unit entirely:

   sudo systemctl mask fwupd-refresh.service

Verify the Polling Lockdown

By disabling the timer and masking the service, you guarantee that your server will no longer silently reach out to the internet to check for hardware microcode updates.

To verify the lockdown is successful, run the following command to check the status of the timer:

systemctl status fwupd-refresh.timer

The output will clearly state that the timer is inactive (dead) and its loaded state is disabled. Furthermore, if you check the service itself using systemctl status fwupd-refresh.service, it will show as masked (symlinked to /dev/null). The background polling has been successfully eradicated, ensuring firmware management remains a strictly manual, controlled process.