Practical Lab: Windows Update Exploration

Objective

Find out how updates work on your own PC: which update services exist, which updates are installed, what the logs say, and how big the component store really is. You only look. This lab does not install, uninstall or clean up anything.

Time: 25–30 minutes
You need: A Windows 10 or 11 PC. For Part 5 you need an administrator PowerShell window (the commands there are still read-only).

Safety rules for this lab: Do not click "Uninstall" or "Download and install". Do not delete anything in WinSxS or SoftwareDistribution. Do not run /StartComponentCleanup, /ResetBase or /RestoreHealth. If a screen asks you to confirm a change, close it.

What to Open

Part 1: Which Windows Version Am I On?

Press Win + R, type winver, press Enter. Write down:

1. Windows edition and version (for example "Version 23H2"): ________________
2. OS build (the numbers in brackets or after the dot): ________________

In PowerShell:

systeminfo | Select-String "OS Name","OS Version"

3. Does OS Version match the build from winver? ________________

Get-ComputerInfo can also show Windows version fields, but it is slow and the field names can differ between versions. If you try it, use: Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Part 2: The Update Team (Services)

In PowerShell:

Get-Service wuauserv,UsoSvc,BITS,TrustedInstaller,DoSvc

Fill in the table for Status (Running or Stopped):

4. Are any of them Stopped? Is that a problem? ________________

A stopped update service is normal. They start when needed (Chapter 12). If a name is not found, your Windows version names it differently. That is fine.

Part 3: Settings Tour

Open Settings → Windows Update. Look but do not press "Check for updates" if you want to avoid downloads. (Checking is only a scan, but it can start a download.)

5. What is the status line at the top (for example "You're up to date")? ________________
6. Click Update history. How many Quality Updates are listed? ________________
7. Which one is the most recent? Write its KB number: ________________
8. Open the Definition Updates group. How recent is the last one? ________________
9. Is there a Failed entry? If yes, note its error code: ________________
10. Go back, then open Advanced options and look at Active hours. What are yours? ________________
11. Open Advanced options → Delivery Optimization. Is "Allow downloads from other PCs" on or off? ________________

(Do not change anything. Only read.)

Part 4: Installed Updates in PowerShell

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

12. How many KB numbers appear, and what is the newest date? ________________
13. Does the newest KB match the one in Update history (question 7)? ________________

Get-HotFix does not list every update type (for example, some updates or definition packages may be missing). A mismatch is not an error.

Also look at your systeminfo hotfix list:

systeminfo | Select-String "KB"

Part 5: The Component Store (admin PowerShell, read-only)

5A. The Explorer view. In File Explorer open C:\Windows, right-click WinSxS → Properties. Wait until it finishes counting.

14. Size reported by Explorer: ________________ GB

5B. The real view. In the administrator PowerShell:

DISM /Online /Cleanup-Image /AnalyzeComponentStore

(It may take a minute. It only reads.)

15. Windows Explorer Reported Size of Component Store: ________________
16. Actual Size of Component Store: ________________
17. Shared with Windows: ________________
18. Date of Last Cleanup: ________________
19. Component Store Cleanup Recommended: Yes / No

Now a quick health check:

DISM /Online /Cleanup-Image /CheckHealth

20. What did it report? (For example "No component store corruption detected.") ________________

Do not run any cleanup that the output mentions. Reading is enough.

Part 6: Read the Update Log (Event Viewer)

1. Open Event Viewer.

2. Go to Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient → Operational. (The path can differ a little between versions.)

3. Click an event and read the text in the lower pane.

4. Find an event that says an update was downloaded or installed. Which update? ________________

5. What time did it happen? ________________

Optional: make a readable log. In normal PowerShell:

Get-WindowsUpdateLog

This can take a minute. It converts the binary logs into a text file (normally WindowsUpdate.log on your Desktop). Open it in Notepad and read only. Look for words like "Search", "Download" and "Install". Then delete the file from your Desktop if you wish (it is your copy, not a system file).

Part 7: Troubleshooter and wuauclt (Concepts Only)

Open Settings → System → Troubleshoot → Other troubleshooters and look for Windows Update. Read its description, but do not run it in this lab (it can reset update components).

You may see old guides that tell you to type wuauclt /detectnow. That command was used on older Windows versions. On Windows 10 and 11 the Update Orchestrator took over scanning, so it may do nothing. If you need to scan, use Settings → Windows Update → Check for updates.

23. In your own words, why is the troubleshooter not a read-only tool? ________________

What Should Happen

• Part 1 shows your Windows version and build.
• Part 2 shows the services. Many will be Stopped.
• Parts 3 and 4 show the same updates in two ways. Small differences are normal.
• Part 5 shows the Actual Size is smaller than Explorer's number.
• Part 6 shows your install history as events.

Interpretation Guide

Follow-Up Questions

1. Why can Get-HotFix and Update history show slightly different lists?
2. Why is Explorer's size for WinSxS bigger than the Actual Size?
3. Which service would you expect to be busiest during the "Working on updates" screen?
4. You see error code and KB number for a failed update. Where will you search, and what will you do before trying again?
5. Why does this lab avoid StartComponentCleanup?