Windows Update Overview
Windows Update delivers security patches, feature updates, driver updates, and cumulative updates to Windows systems. Access via Settings → Update & Security → Windows Update. Update types: Security updates (patch vulnerabilities — Critical, Important, Moderate, Low severity ratings). Quality updates / cumulative updates (bug fixes, reliability improvements; bundled monthly as 'Patch Tuesday' releases — second Tuesday of each month). Feature updates (Windows 10/11: semi-annual major version upgrades, e.g., 22H2 → 23H2). Driver updates (hardware driver updates via Windows Update — can also be managed via Device Manager). Microsoft Store app updates (separate from Windows Update, managed via Store). Optional updates: hardware, driver, and other updates not automatically installed.
Windows Update Settings
Settings → Update & Security → Windows Update options: Check for updates (manual check). Pause updates (Windows 10/11: pause for up to 5 weeks on Pro/Enterprise). Schedule restart (choose when to install and restart after download). View update history (list of installed updates with KB numbers and status). Advanced options: Receive updates for other Microsoft products (Office, etc.), Download over metered connections (off by default), Notify me to restart (vs auto-restart). Active hours: Windows won't automatically restart during specified active hours (default 8 AM – 5 PM, adjustable up to 18 hours). Delivery Optimization: allows downloading updates from other PCs on the local network or the internet (P2P update distribution) — reduces bandwidth from Microsoft servers. Can be configured to limit upload/download bandwidth.
WSUS (Windows Server Update Services)
WSUS is a Microsoft server role that centralizes update management for enterprise environments. Key capabilities: IT administrators approve which updates deploy to which computers. Updates download once to WSUS server, then distributed internally (saves internet bandwidth). Create computer groups (e.g., Test, Pilot, Production) for staged rollout. Schedule update deployment windows. Generate compliance reports. Client computers configured via Group Policy to point to WSUS server: Computer Configuration → Administrative Templates → Windows Components → Windows Update → Configure Automatic Updates. WSUS vs Windows Update for Business: WSUS requires on-premise server infrastructure. Windows Update for Business uses Microsoft cloud infrastructure (suitable for smaller organizations or cloud-first environments) — configured via Group Policy or MDM.
Update Troubleshooting
Common update problems: Updates fail to install, updates download but don't apply, Windows Update stuck on percentage. Windows Update Troubleshooter: Settings → Update & Security → Troubleshoot → Windows Update. Manual fix steps: Stop Windows Update service: `net stop wuauserv`, stop BITS: `net stop bits`. Delete contents of C:\Windows\SoftwareDistribution\Download (cached update files — safe to delete; Windows re-downloads). Restart services: `net start wuauserv`, `net start bits`. sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth can fix underlying corruption that blocks updates. DISM /Online /Cleanup-Image /StartComponentCleanup reduces WinSxS folder size. Check disk space: Windows needs free space to download and install updates (at least 10-20 GB recommended). Reset Windows Update components: Microsoft provides a Reset Windows Update Agent script for stubborn issues.
Managing Updates in Enterprise
Windows 10/11 update channels / servicing channels: General Availability Channel (standard, broad deployment — gets updates when Microsoft deems them ready for most users). Long-Term Servicing Channel (LTSC): only security and quality updates, no feature updates — used for critical systems (ATMs, medical devices, industrial control). Windows Update for Business (WUfB): configure deferral periods (security updates: up to 30 days; feature updates: up to 365 days) via Group Policy or Intune. Group Policy update settings: Computer Configuration → Administrative Templates → Windows Components → Windows Update. Key policies: Configure Automatic Updates (1=notify download, 2=auto download notify install, 3=auto download auto install, 4=auto download schedule install), Specify intranet WSUS location, Set auto-update schedule.