The Big Picture: The Builder and the Builder's Tools
An update is a set of building materials. Someone has to know how to build with them: which piece goes where, in what order, and how to undo it if the wall collapses. That someone is the servicing stack.
Here is the catch. The builder's tools can have bugs too. If the tools are old, they may not understand a new type of material. So Microsoft sometimes has to update the builder first. That is what this section is about.
4.1 Servicing Stack Updates (SSU) — Updates the Updater Itself
What it is: The servicing stack is the set of Windows code that installs, removes and repairs updates and optional features. Its main part is CBS (Component-Based Servicing).
A Servicing Stack Update (SSU) is an update for that installer code, not for Windows features. It fixes problems in the installing process itself.
| Part | What it is |
|---|---|
| CBS (Component-Based Servicing) | The engine that understands components and packages |
| TrustedInstaller.exe | The service ("Windows Modules Installer") that runs the engine with enough rights to change protected system files |
| TiWorker.exe | The worker process it starts to do the heavy lifting. You may see it using CPU in Task Manager during updates. That is normal |
| DISM | A command-line tool that talks to the same engine (see Section 5) |
Why does TrustedInstaller own the system files? Normal programs, and even an administrator, are blocked from changing core Windows files. Only this service may. This protects Windows from accidents and from malware (see Chapter 25 — Windows Permissions).
Components, manifests and packages. CBS thinks in these words:
| Word | Plain meaning | Analogy |
|---|---|---|
| Component | One piece of Windows: its files, registry entries and rules, at a specific version | One LEGO piece |
| Manifest | An XML description of a component: its name, version, files, how to install it | The label on the bag |
| Package | A group of components shipped together (an update is a package) | The whole box |
| Servicing stack | The code that reads manifests and builds with components | The builder |
PACKAGE (for example, a monthly update)
├── Component A (version 10.0.xxxx.100) + manifest
├── Component B (version 10.0.xxxx.200) + manifest
└── Component C (version 10.0.xxxx.300) + manifest
│
▼
CBS reads each manifest, decides what to install,
and records the result in its logs and database
Figure 35.4 — A package is made of components. CBS reads each component's manifest to know what to do with it.
Transactional installs. CBS applies changes as a transaction: a group of steps that must all succeed or none count. If step 40 of 50 fails, CBS undoes steps 1–39 using saved transaction data. That is what you see as "We couldn't complete the updates. Undoing changes." (Section 6.1). This is the same all-or-nothing idea as a journal in the file system (Chapter 19).
Logs. CBS writes detailed notes. They are for reading only. Never edit or delete them.
| Log | What it contains |
|---|---|
C:\Windows\Logs\CBS\CBS.log | The main servicing log: every package and component step. Very long and detailed |
C:\Windows\Logs\DISM\dism.log | Notes from DISM operations |
| Event Viewer → Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient → Operational | A readable list of download, install and failure events (path may differ slightly) |
Get-WindowsUpdateLog | A PowerShell command that converts the binary Windows Update logs into a readable text file (usually saved on your Desktop; may take a minute) |
Older Windows versions wrote C:\Windows\WindowsUpdate.log as plain text. On Windows 10 and 11 the data is stored in a binary format, so you must run Get-WindowsUpdateLog to get the text version. It writes a new file; it does not change Windows.
4.2 Why SSUs Must Install Before Feature Updates
What it is: A rule of order: update the installer first, then install the big package with the new installer.
Analogy: Before you assemble new furniture, you make sure you have the right screwdriver. If the screwdriver is old and does not fit the new screws, the job fails halfway.
Why it matters most for feature updates:
| Reason | Explanation |
|---|---|
| New package features | A big update may use new ways of packing files. An old installer would not understand them |
| Bug fixes in the installer | A flaw in the old installer could damage the very update that fixes it |
| Safety of rollback | The rollback logic is also in the servicing stack. A fixed one means safer undo |
| Chicken-and-egg | The updater cannot repair itself while it is running, so a separate, earlier step is needed |
WRONG ORDER RIGHT ORDER
Big update (needs new tools) 1. SSU installs (new tools)
│ 2. Big update installs
▼ using the new tools
Old installer fails ✗ ▼
Success ✓
In practice today. Microsoft has changed how SSUs are delivered over the years. In newer Windows versions the servicing stack update is often bundled with the monthly cumulative update, so you do not install it by hand. Older ones, or standalone updates downloaded from the Update Catalog, may need the SSU first. If you install updates by hand, read the KB article: it says whether an SSU is needed and in what order. The exact delivery method may differ on your version.
What you should remember. You do not manage the servicing stack yourself. Windows Update does it. But when you read "Servicing Stack Update" in your update history, you now know it is the installer updating itself.
Summary
| Term | Plain meaning |
|---|---|
| Servicing stack | The Windows code that installs and removes updates |
| CBS | Component-Based Servicing, the main engine |
| SSU | An update for the installer itself |
TrustedInstaller / TiWorker.exe | The service and worker that do the installing |
| Component | One versioned piece of Windows, described by a manifest |
| Package | A group of components (an update) |
| Transaction | All steps succeed together or are all undone |
CBS.log, dism.log | Detailed install notes, for reading only |
Get-WindowsUpdateLog | Makes a readable Windows Update log from binary data |