Section 3: Update Process

The Big Picture: From "Is There Anything New?" to "Restart Now"

Installing an update is like renovating a kitchen while still cooking in it. Windows has to bring in the materials, check them, do as much work as possible while you keep using the PC, and then do the last hard part when nothing else is running. That last part is why Windows asks you to restart.

 Microsoft servers
        │
        ▼
  1. SCAN      "Which updates apply to me?"
        ▼
  2. DOWNLOAD  BITS / Delivery Optimization
        ▼
  3. VERIFY    check signatures and hashes
        ▼
  4. STAGE     unpack into the waiting room and the component store
        ▼
  5. INSTALL (online)    while Windows is running
        ▼
  6. REBOOT    install (offline) phase: "Working on updates"
        ▼
  7. COMMIT    finalize, clean up, record in history

Figure 35.3 — The update pipeline from Microsoft's servers to a finished install. Each step is explained below.

Step One: Scan

What it is: The scan is your PC asking the service, "Given what I have, what applies to me?" The PC reports its version, installed updates and hardware. The service compares this with the metadata of every published update (Section 1.2) and replies with a short list.

Scans happen on a schedule decided by the Update Orchestrator (UsoSvc), or when you click Check for updates. No big files move at this point, only small questions and answers.

3.1 Download Phase

What it is: Fetching the actual update files, in the background, with BITS and Delivery Optimization (Section 1.3).

Files land in a folder that acts as a waiting room:

These folders belong to Windows. Do not delete files inside them by hand. Windows cleans them itself, and the "fix" of wiping them is a known last resort for stuck updates that should be done only by following Microsoft's steps.

Things that slow or pause a download:

3.2 Verification (Signature Check)

What it is: Before anything is installed, Windows checks that the files are genuine and unchanged. This is the same trust idea as digital signatures for drivers and programs (see Chapter 26 — Windows Security Architecture).

Two checks matter:

This is why Delivery Optimization is safe: even if the pieces came from a stranger's PC, they are checked against Microsoft's fingerprints. A tampered piece is thrown away and fetched again.

3.3 Installation Staging

What it is: Staging means preparing the update: unpacking its contents and placing them where the installer can reach them, without changing the running system yet.

Update package (.cab / .msu)
        │  unpack
        ▼
 C:\Windows\SoftwareDistribution\Download     (the waiting room)
        │  extract component files + manifests
        ▼
 C:\Windows\WinSxS                            (the component store)
        │
        │   new versions of files now sit NEXT TO the old ones.
        │   The live files in System32 still point to the old ones.
        ▼
  "Ready to be switched" (the installer builds a list of changes)

Why stage first? It keeps the risky "switch" as short as possible. If power fails during staging, nothing important changed yet.

Online install. Some work can be done while Windows runs: adding new files to the component store, registering things, preparing a transaction (a list of changes that will be applied all together or not at all). Files that are in use cannot be replaced while running (Windows locks them), so those changes are saved for the next step.

Pending operations. The list of changes waiting for the restart is saved on disk. You may see a file called pending.xml in C:\Windows\WinSxS. It is only a to-do list that the installer reads at startup. Leave it alone: damaging it can leave Windows unable to finish or undo an update.

3.4 Reboot to Finalize

What it is: The second half of the install. During a restart, Windows runs the offline phase: no apps are running, so all files can be swapped.

This is the screen you know:

Working on updates 30%
Don't turn off your computer

It happens early in the startup (see Chapter 6 — Complete Boot Process for where this fits). Windows reads the pending list, swaps the files, and may restart once or twice during the process.

Why does this take long? It touches thousands of files, and a full feature update replaces most of the system. A spinning hard disk (Chapter 18) is much slower than an SSD at this.

Never power off during "Working on updates". If the power fails, Windows tries to roll back on the next start (Section 6.1). That usually works, but it is a risk worth avoiding. On a laptop, plug in the charger first.

3.5 Active Hours, Restarts and Pauses

Reboot required. Some updates need a restart. Windows may show "Restart required" or a coloured dot on the power button. You can usually pick a time. Postponing for weeks leaves your PC without those fixes.

3.6 If an Update Seems Stuck: Safe Checks

Before you panic, check these. None of them change anything.

1. Wait. Big updates can sit at one percentage for 20–30 minutes, especially on slow disks.
2. Look at disk and network activity in Task Manager (Chapter 11). If the disk light or numbers move, it is working.
3. Check free disk space in File Explorer.
4. Open Update history and read the error code next to any failure. Search that code and the KB number.
5. Read the WindowsUpdateClient log in Event Viewer (see the lab).
6. If a failure repeats, the supported repair tools are the Windows Update troubleshooter (Settings → System → Troubleshoot) and, for corrupted files, sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth (Chapter 21).

Summary