Section 2: Update Packages

The Big Picture: Kinds of Parcels

Not every delivery is the same. A letter, a box and a moving truck are all "deliveries", but you handle them differently. Windows updates also come in different sizes and types. Knowing which is which explains why one update takes 2 minutes and another takes an hour.

2.1 Cumulative Updates

What it is: A cumulative update (often called the LCU, Latest Cumulative Update) contains all the fixes released so far for your version of Windows, plus the newest ones. It replaces the older ones.

Analogy: A newspaper "year so far" edition. You do not need to read January, February and March separately. The October edition already includes them.

Old way (separate patches)          Cumulative way

Fix A ──► install                   Month 1:  [A]
Fix B ──► install                   Month 2:  [A + B]
Fix C ──► install                   Month 3:  [A + B + C]   <-- install only this
(miss one, and you                  Skipped months? No problem: the
 may be exposed)                    latest one contains everything.

Why Microsoft chose this: a PC that was switched off for 6 months needs one update, not twenty. Testing is also simpler, because every PC with the same version ends up with the same set of files.

Patch Tuesday. Microsoft publishes the main security release on the second Tuesday of each month. People call this Patch Tuesday. Later in the month there is often an optional, non-security "preview" update. It lets people try the next month's fixes early. Windows does not force you to install the preview one. Details of timing and names can change, so check Microsoft's current documentation.

Knowledge Base numbers (KB). Every update gets a KB number, such as KB5000000 (a made-up example). It is the ID of a support article that describes the update. It is how you search, talk about, or uninstall one specific update. Windows lists them by KB in update history.

2.2 Feature Updates vs Quality Updates

What it is: Microsoft splits updates into two families.

What the names mean. 22H2 means "2022, second half". The pattern is year + half. Which version is newest, and when each was released, changes over time, so look at Microsoft's page rather than trusting a book. On your own PC, run winver to see your version.

Full upgrade vs enablement package. A feature update is sometimes a big package (a whole new set of system files). When two versions share the same code base, Microsoft can ship the new features already inside the monthly updates, switched off, and later send a tiny enablement package that just flips them on. That is why some "new versions" install in a few minutes with one restart.

Servicing a version. Each version of Windows is supported for a limited time (the "support lifecycle"). When it ends, no more security fixes arrive, so you must move to a newer version. Windows Update will eventually offer or push the newer one for you.

2.3 .msu / .cab Package Formats

What it is: The file types an update arrives in. You normally never see them, because Windows Update handles them. But you can download an update by hand from the Microsoft Update Catalog website, and then these files appear.

   KB5000000.msu   (the outer parcel)
   ├── metadata (what it is, what it needs)
   └── Windows...KB5000000.cab   (the inner box)
         ├── manifests   (lists: "this component, this version")
         ├── files       (the new/changed DLLs, EXEs...)
         └── update.mum  (the package description)

Figure 35.2 — Simplified layout of an update parcel. The names are examples, and the exact contents differ between Windows versions.

A .mum file ("Microsoft Update Manifest") and .manifest files are small text-like files (XML) that tell the installer what the package contains and in which order to apply it. Section 4 shows who reads them.

Express and delta updates. Instead of sending a whole new file, Microsoft can send only the bytes that changed (a delta). Your PC rebuilds the new file from the old one plus the delta. This makes downloads much smaller. Think of an editor sending you only the corrected sentences, not the whole book.

2.4 Drivers and Defender Definitions Are Separate

Drivers (Chapter 13). Hardware makers can publish drivers through Windows Update. They appear in Settings → Windows Update → Advanced options → Optional updates, or install automatically. A driver update is not part of the monthly cumulative update.

Defender definitions. Microsoft Defender needs a fresh list of known threats, sometimes several times a day. These tiny files do not need a restart and are delivered separately from the monthly update. That is why you may see "Security Intelligence Update for Microsoft Defender Antivirus" in the history list again and again.

2.5 Where to Read About Your Updates

You will use these in the lab. The sections ahead explain what happens after a package arrives: Chapter 21 — Windows System Files and Directories shows where its files end up.

Summary