Chapter 35 · Windows Update

Knowledge Check

8 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. Name three reasons Microsoft ships updates.
  2. What is the job of the Update Orchestrator (UsoSvc)?
  3. What do BITS and Delivery Optimization do?
  4. What does it mean that a cumulative update is cumulative?
  5. When is Patch Tuesday?
  6. What is a .msu file and what does it contain?
  7. Which service and worker process do the actual installing?
  8. Why does the component store (WinSxS) look bigger in Explorer than it really is?
  9. Which command shows the Actual Size of Component Store without changing anything?
  10. About how long can you use Go back after a feature update?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Reasons for updates

Security fixes, bug fixes, new features, drivers, and Defender definitions (any three).

2. Update Orchestrator

It is the scheduler: it decides when to scan, download and install and when to ask for a restart (on Windows 10/11).

3. BITS and Delivery Optimization

They download update files in the background. BITS uses spare bandwidth and resumes after interruptions. Delivery Optimization can also share pieces with other PCs, and can be turned off.

4. Cumulative

Each update contains all earlier fixes for that version, so you only need the latest one.

5. Patch Tuesday

The second Tuesday of each month.

6. .msu

A Microsoft Update Standalone Package. It is a wrapper holding one or more .cab (compressed cabinet) files plus metadata, installed with wusa.exe.

7. The installer

TrustedInstaller (Windows Modules Installer service) and its worker TiWorker.exe.

8. WinSxS size

Live files in System32 are hard links to files in WinSxS. Explorer counts the same data under both names.

9. Read-only report

DISM /Online /Cleanup-Image /AnalyzeComponentStore (in an administrator window).

10. Go back

About 10 days (it may differ on your version), before C:\Windows.old is removed.

UNDERSTANDING QUESTIONS

Q1. Why did Microsoft move to cumulative updates instead of many small separate patches?

Answer A PC that missed months of updates needs only the latest one, so fewer PCs are left half-updated. Testing is simpler because every PC with the same version ends up with the same files. The cost is that each update is larger, which delta and express downloads reduce.

Q2. Why does an update stage new files in the component store first and switch to them later?

Answer Files in use cannot be replaced while Windows runs. Staging does the slow, safe work early. The switch (re-pointing hard links, at reboot when needed) is short. The old versions stay in the store, which makes rollback possible.

Q3. Why must a servicing stack update sometimes come before the main update?

Answer The servicing stack is the installer itself. A new package may use features the old installer does not understand, or the old installer may have a bug. The updater cannot safely replace itself in the middle of installing something else, so it is updated first.

Q4. Why is it safe that Delivery Optimization takes update pieces from other people's PCs?

Answer Every piece is verified using hashes and digital signatures that Microsoft published. A modified piece would not match and is discarded and fetched again. Only the source of the bytes changes, not the trust.

Q5. Why is deleting files from WinSxS by hand dangerous?

Answer Live system files are hard links to the files in the store, and the servicing logs and database expect them to exist. Removing them can break running Windows, rollback, `sfc` and `DISM` repairs, and later updates. The supported cleanup is `DISM /StartComponentCleanup` or the built-in clean-up tasks.

SCENARIO QUESTIONS (Troubleshooting)

S1. The screen says "Working on updates 40% — Don't turn off your computer" and has been at 40% for 25 minutes on an older hard-disk PC. What do you do?

Answer Wait. The offline phase touches thousands of files and spinning disks are slow. Check if the disk light is active. Do not force power off unless it has been stuck for many hours with no disk activity. Even then, Windows has a rollback to recover on the next start.

S2. Update history shows a feature update failed with an error code, then "Undoing changes". What happened?

Answer The transaction could not finish, so CBS used its saved records to restore the previous state. The old version of Windows still works. Note the error code, free disk space, run the Windows Update troubleshooter, repair with `DISM /RestoreHealth` and `sfc /scannow` if needed, then try again.

S3. After last night's monthly update, a printer stopped working. What are your options?

Answer First check for a newer driver or update. If needed, uninstall the monthly update (Settings → Windows Update → Update history → Uninstall updates), then pause updates briefly. Remember the security fix is then missing, so install the fixed version when it appears.

S4. A user says the PC has 10 GB free but "WinSxS is 15 GB, so Windows wastes my disk". What do you tell them?

Answer Explorer over-counts because of hard links. Run `DISM /Online /Cleanup-Image /AnalyzeComponentStore` to see the real size. Do not delete files by hand. If disk space is really low, use Storage settings or Disk Cleanup (Windows Update Cleanup), which use the supported method.

S5. Two weeks after a feature update the user wants to return to the old version, but "Go back" is missing. Why, and what now?

Answer The time limit (about 10 days) passed, and Windows deleted the old copy. Options: restore from a backup or an image you made earlier, or do a clean reinstall of the older version and copy files back. This is why backups before feature updates matter.

INTERVIEW QUESTIONS

I1. Describe the stages of a Windows update from scan to commit.

Answer Scan (the device reports its state, the service returns applicable updates), download (BITS or Delivery Optimization), verify (signature and hash), stage (unpack into SoftwareDistribution and the component store), online install, offline install during the restart ("Working on updates"), then commit and cleanup.

I2. What is CBS and what are TrustedInstaller and TiWorker?

Answer CBS (Component-Based Servicing) is the servicing engine that understands components, manifests and packages and applies them as transactions. TrustedInstaller is the service that runs it with the rights needed to modify protected files. TiWorker.exe is the worker process that does the installing.

I3. Explain how hard links make rollback possible.

Answer Each component version lives in WinSxS. The live file in System32 is a hard link to one version. An update adds a new version and re-points the link. The old version remains, so undoing means pointing the link back. No large copying is needed.

I4. A system will not boot after an update. Walk through recovery.

Answer Let Windows automatically rollback or enter WinRE. In WinRE use Troubleshoot → Advanced options → Uninstall Updates (latest quality or feature update), or System Restore if a point exists, or Startup Repair. If it boots, run DISM and sfc to repair damage, and review the logs (CBS.log, WindowsUpdateClient events).

I5. How would an organisation avoid a bad update hitting every PC at once?

Answer Use WSUS (approve updates after testing) or Windows Update for Business policies/Intune (deferrals and rings), so a pilot group gets updates first and the rest follow after some days. Known issue rollback from Microsoft can also disable a faulty change remotely.

PRACTICAL TASK

Make a one-page "update report" for your PC. Using the lab, write: your Windows version and build; the status of the five update services; the newest installed KB number and date; whether Delivery Optimization sharing is on; the Explorer size and the Actual Size of the component store; and whether the store is healthy.

Why This Matters

When something goes wrong with updates, the first question is always "what state is this PC in?" A written snapshot taken while everything works is a baseline you can compare against later.

CHAPTER SUMMARY

  • Updates deliver security fixes, bug fixes, features, drivers and definitions.
  • A team of services does the work: UsoSvc schedules, wuauserv scans, BITS and Delivery Optimization download, TrustedInstaller installs.
  • Packages: cumulative updates (all fixes so far), feature updates, SSUs; formats .msu and .cab; delta downloads; KB numbers.
  • Process: scan, download, verify, stage, online install, offline install at reboot, commit.
  • CBS applies components in transactions; logs include CBS.log and Get-WindowsUpdateLog.
  • The component store (WinSxS) keeps many versions; System32 files are hard links; read the real size with AnalyzeComponentStore.
  • Undo layers: automatic rollback, uninstall updates, Go back (about 10 days), WinRE, System Restore, DISM and sfc.