Section 6: Rollback and Recovery

The Big Picture: An Undo Button With Layers

Updates are very well tested, but PCs are all different: odd drivers, old software, unusual hardware. Sometimes an update goes wrong. Windows therefore has several layers of undo, from "automatic and invisible" to "boot into the recovery tools".

6.1 Automatic Rollback on Failed Update

What it is: If something fails during installation, Windows undoes its own changes. You may see:

We couldn't complete the updates
Undoing changes. Don't turn off your computer.

How it works. CBS applies changes as a transaction (Section 4.1). It records enough information to reverse each step: which files were switched, which links were changed. If the transaction cannot finish (a file will not replace, a check fails, power was cut), CBS replays the record backwards during the next start. Because old versions are still in the component store (Section 5), putting back the previous state is mostly re-pointing links.

  Start state: version 1  ────────────────┐
                                          │  (saved: how to get back)
  Step 1 ✓  Step 2 ✓  Step 3 ✓  Step 4 ✗  │
                                  │       │
                                  ▼       │
                       FAILURE: undo 3, 2, 1
                                  │       │
                                  ▼       │
  End state: version 1 again  ◄───────────┘

Figure 35.6 — A transaction either finishes completely, or is unwound back to the starting version.

What you see afterwards. Windows starts normally, the old version is still in place, and Update history shows a failed entry with an error code. Windows may try again later, sometimes with a different method.

Where this connects to booting. Both "Working on updates" and "Undoing changes" happen very early in startup, before the sign-in screen (Chapter 6 — Complete Boot Process).

Is it dangerous to turn the power off? It is risky, but the transaction design is made for this. If you had no choice, power on again and wait. Let Windows finish the rollback by itself.

6.2 Uninstalling a Problematic Update

What it is: Removing one installed update so that the older files return.

Quality updates (monthly updates). Use Settings:

Settings → Windows Update → Update history → Uninstall updates

This opens a list of installed updates with their KB numbers. Choose one and press Uninstall. A restart is usually needed. The command line has the same tool: wusa /uninstall /kb:NNNNNNN, where the number is the KB number without the letters "KB". (Some updates, notably some servicing stack updates, cannot be uninstalled.)

Whether the uninstall option exists depends on the update and on your version. Also, uninstalling a security update re-opens the hole it closed. Do it only as a temporary step while you wait for a fix, and pause updates for a short time.

Feature updates: "Go back". After a feature update, Windows keeps your previous version in the folder C:\Windows.old (plus other hidden folders). You can return to it using:

Settings → System → Recovery → Go back

This is available only for a limited time, about 10 days (this number may differ on your version). After that, Windows deletes the old copy to free space, and Go back disappears. Your files stay, but apps and settings added after the upgrade may be lost, so back up first.

Known issue rollback (hedged). For some problems, Microsoft can switch off just the faulty change on all PCs from its servers without you uninstalling anything. This is sometimes called known issue rollback. It is done quietly and may require a restart to take effect. You do not need to do anything.

6.3 When Windows Will Not Start

If an update breaks startup badly, use the Windows Recovery Environment (WinRE). It is a small separate Windows that lives on a hidden recovery partition (see Chapter 6 and Chapter 21). Windows normally opens it by itself after repeated failed starts. You can also start it by holding Shift while choosing Restart.

In WinRE, choose Troubleshoot → Advanced options. You will find:

System Restore points. A restore point is a snapshot of system files and registry settings. Windows may make one before certain installs, if System Restore protection is turned on for the drive. It does not touch your personal documents. It is off by default on some PCs, so check it before you need it.

6.4 Repairing Damage: SFC and DISM

Sometimes an update fails because a component is damaged (a bad shutdown, a failing disk). Two supported tools repair this. Both change the system, but only to restore Windows files, so they are the normal answer, not a risky one. They need an administrator window.

The usual order: DISM /Online /Cleanup-Image /RestoreHealth first (repair the warehouse), then sfc /scannow (restore the live files from the warehouse). This is because sfc takes its good copies from the component store. If the store is damaged, sfc has nothing good to copy. More about these in Chapter 21 — Windows System Files and Directories.

A sensible plan when updates go wrong:

1. Note the error code and KB number (Update history)
2. Free disk space; restart; try again
3. Run the Windows Update troubleshooter
4. DISM RestoreHealth, then sfc /scannow, then try again
5. Still failing? Uninstall the last update, and pause updates briefly
6. Cannot start? Use WinRE: Uninstall Updates / System Restore
7. Always keep backups of your own files

Summary