Windows Update

As the service has evolved over the years, so has its client software. For a decade, the primary client component of the service was the Windows Update web app that could only be run on Internet Explorer. Starting with Windows Vista, the primary client component became Windows Update Agent, an integral component of the operating system.

The service provides several kinds of updates. Security updates or critical updates mitigate vulnerabilities and security exploits in Microsoft Windows. Cumulative updates are updates that bundle multiple updates, both new and previously released updates. Cumulative updates were introduced with Windows 10 and only some have been backported to Windows 7 and Windows 8.1. Windows 11 24H2 also introduced checkpoint cumulative updates and updates with Hotpatch capability in the name, where some of the updates no longer require a reboot.

Microsoft routinely releases updates on the second Tuesday of each month (known as the Patch Tuesday B updates) but can provide them whenever a new update is urgently required to prevent a newly discovered or prevalent exploit, so-called out-of-band updates. System administrators can configure Windows Update to install critical updates for Microsoft Windows automatically, so long as the computer has an Internet connection.

In Windows 10 and Windows 11, the use of Windows Update is mandatory; however, the software agreement states that users may stop receiving updates on their device by disconnecting their device from the Internet.

There also exist optional non-security preview releases (formerly known as "C" or "D" releases), that users can choose to install in the Windows Update UI.

Clients

Windows Update web app

Windows Update was introduced as a web app with the launch of Windows 98 and offered additional desktop themes, games, device driver updates, and optional components such as NetMeeting. Windows 95 and Windows NT 4.0 were retroactively given the ability to access the Windows Update website and download updates designed for those operating systems, starting with the release of Internet Explorer 4. The initial focus of Windows Update was free add-ons and new technologies for Windows. Security fixes for Outlook Express, Internet Explorer and other programs appeared later, as did access to beta versions of upcoming Microsoft software, e.g. Internet Explorer 5. Fixes to Windows 98 to resolve the Year 2000 problem were distributed using Windows Update in December 1998. Microsoft attributed the sales success of Windows 98 in part to Windows Update.

The Windows Update web app requires either Internet Explorer or a third-party web browser that supports the ActiveX technology. The earliest version of the web app, version 3, does not send any personally identifiable information to Microsoft. Instead, the app downloads a full list of every available update and chooses which one to download and install. But the list grew so large that the performance impact of processing became a concern. Arie Slob, writing for the Windows-help.net newsletter in March 2003, noted that the size of the update list had exceeded 400 KB, which caused delays of more than a minute for dial-up users. Windows Update v4, released in 2001 in conjunction with Windows XP, changed this. This version of the app makes an inventory of the system's hardware and Microsoft software and sends them to the service, thus offloading the processing burden to Microsoft servers.

Critical Update Notification Utility

Critical Update Notification Utility is a background process that checks the Windows Update website on a regular schedule for new updates that have been marked as "Critical." It was released shortly after Windows 98.

By default, this check occurs every five minutes, plus when Internet Explorer starts; however, the user could configure the next check to occur only at certain times of the day or on certain days of the week. The tool queries the Microsoft server for a file called "cucif.cab", which contained a list of all the critical updates released for the operating system. The tool then compares this list with the list of installed updates on its machine and displays an update availability notification. Once the check is executed, any custom schedule defined by the user is reverted to the default. Microsoft stated that this ensures that users receive notification of critical updates in a timely manner.

An analysis done by security researcher H. D. Moore in early 1999 was critical of this approach, describing it as "horribly inefficient" and susceptible to attacks. In a posting to BugTraq, he explained that, "every single Windows 98 computer that wishes to get an update has to rely on a single host for the security. If that one server got compromised one day, or an attacker cracked the [Microsoft] DNS server again, there could be millions of users installing trojans every hour. The scope of this attack is big enough to attract crackers who actually know what they are doing..."

Microsoft continued to promote the tool through 1999 and the first half of 2000. Initial releases of Windows 2000 shipped with the tool. The tool did not support Windows 95 and Windows NT 4.0.

Automatic Updates

Automatic Updates is the successor of the Critical Update Notification Utility. It was released in 2000, along with Windows Me. It supports Windows 2000 SP3 as well.

Unlike its predecessor, Automatic Updates can download and install updates. Instead of the five-minute schedule used by its predecessor, Automatic Updates checks the Windows Update servers once a day. After Windows Me is installed, a notification balloon prompts the user to configure the Automatic Updates client. The user can choose from three notification schemes: being notified before downloading the update, being notified before installing the update, or both. If new updates are ready to be installed, the user may install them before turning off the computer. A shield icon will be displayed on the Shutdown button during this time.

Windows XP and Windows 2000 SP3 include Background Intelligent Transfer Service, a Windows service for transferring files in the background without user interaction. As a system component, it is capable of monitoring the user's Internet usage and throttling its own bandwidth usage in order to prioritize user-initiated activities. The Automatic Updates client for these operating systems was updated to use this system service.

Automatic Updates in Windows XP gained notoriety for repeatedly interrupting the user while working on their computer. Every time an update requiring a reboot was installed, Automatic Updates would prompt the user with a dialog box that allowed the user to restart immediately or dismiss the dialog box, which would reappear in ten minutes; a behavior that Jeff Atwood described as "perhaps the naggiest dialog box ever."

In 2013, it was observed that shortly after the startup process, Automatic Updates (wuauclt.exe) and Service Host (svchost.exe) in Windows XP would claim 100% of a computer's CPU capacity for extended periods of time (between ten minutes to two hours), making affected computers unusable. According to Woody Leonhart of InfoWorld, early reports of this issue could be seen in Microsoft TechNet forums in late May 2013, although Microsoft first received a large number of complaints about this issue in September 2013. The cause was an exponential algorithm in the evaluation of superseded updates, which had grown large over the decade following the release of Windows XP. Microsoft's attempts to fix the issue in October, November and December proved futile, causing the issue to be escalated to the top priority.

Windows Update Agent

Starting with Windows Vista and Windows Server 2008, Windows Update Agent replaces both the Windows Update web app and the Automatic Updates client. It is in charge of downloading and installing software update from Windows Update, as well as the on-premises servers of Windows Server Updates Services or System Center Configuration Manager.

Windows Update Agent can be managed through a Control Panel applet, as well as Group Policy, Microsoft Intune and Windows PowerShell. It can also be set to automatically download and install both important and recommended updates. In prior versions of Windows, such updates were only available through the Windows Update website. Additionally, Windows Update in Windows Vista supports downloading Windows Ultimate Extras, optional software for Windows Vista Ultimate Edition.

Unlike Automatic Updates in Windows XP, Windows Update Agent in Windows Vista and Windows 7 allows the user to postpone the mandatory restart (required for the update process to complete) for up to four hours. The revised dialog box that prompts for the restart appears under other windows, instead of on top of them. However, standard user accounts only have 15 minutes to respond to this dialog box. This was changed with Windows 8: Users have 3 days (72 hours) before the computer reboots automatically after installing automatic updates that require a reboot. Windows 8 also consolidates the restart requests for non-critical updates into just one per month. Additionally, the login screen notifies them of the restart requirements.

Windows Update Agent makes use of the Transactional NTFS feature introduced with Windows Vista to apply updates to Windows system files. This feature helps Windows recover cleanly in the event of an unexpected failure, as file changes are committed atomically.

Since Windows Vista, the Windows Update invokes the Windows Modules Installer to update WinSxS system files. If the download of the update package completed, Windows Update first verifies downloaded packages, then decompress it into WinSxS cache or DriverStore cache, then update the true system files.

Since Windows 8, the Windows Update is able to offers device firmware updates, for example UEFI.

Windows 10 contains major changes to Windows Update Agent operations; it no longer allows the manual, selective installation of updates. All updates, regardless of type (this includes hardware drivers), are downloaded and installed automatically, and users are only given the option to choose whether their system would reboot automatically to install updates when the system is inactive or be notified to schedule a reboot. Microsoft offers a diagnostic tool that can be used to hide troublesome device drivers and prevent them from being reinstalled, but only after they had already been installed and then uninstalled without rebooting the system.

Windows Update Agent on Windows 10 supports peer-to-peer distribution of updates; by default, systems' bandwidth is used to distribute previously downloaded updates to other users, in combination with Microsoft servers. Users may optionally change Windows Update to only perform peer-to-peer updates within their local area network.

Windows 10 also introduced cumulative updates. For example, if Microsoft released updates KB00001 in July, KB00002 in August, and KB00003 in September, Microsoft would release cumulative update KB00004, which packs KB00001, KB00002, and KB00003 together. Installing KB00004 will also install KB00001, KB00002 and KB00003, mitigating the need for multiple restarts and reducing the number of downloads needed. KB00004 may also include other fixes with their own KB number that were not separately released. A disadvantage of cumulative updates is that downloading and installing updates that fix individual problems is no longer possible. KB stands for knowledge base, as in Microsoft Knowledge Base.

Windows Update for Business

Windows Update for Business is a term for a set of features in the Pro, Enterprise and Education editions of Windows 10, intended to ease the administration of Windows across organizations. It enables IT pros to:

• Switch between the standard and the deferred release branches of Windows 10. This feature has since been removed as Microsoft retired the deferred branch.
• Defer automatic installation of ordinary updates for 30 days. Starting with Windows 10 version 20H1, this feature is more difficult to access.
  • Defer automatic installation of Windows upgrades (a.k.a. "feature updates", "cumulative updates") for 1 year. Starting with Windows 10 version 20H1, these updates are no longer automatically offered. You had to click on "Check for updates" to get the feature update or cumulative update.

These features were added in Windows 10 version 1511 (November 2015 Update). They are intended for large organizations with many computers, so they can logically group their computers for gradual deployment. Microsoft recommends a small set of pilot computers to receive the updates almost immediately, while the set of most critical computers receives them after every other group has done so, and has experienced their effects.

Other Microsoft update management solutions, such as Windows Server Update Services or System Center Configuration Manager, do not override Windows Update for Business. Rather, they force Windows 10 into the "dual scan mode". This can cause confusion for administrators who do not comprehend the full ramifications of the dual scan mode.