Updates, patches and feature upgrades, which are three different things

Why this matters

Updates generate a disproportionate share of support tickets, and most of them come from three confusions: not knowing which kind of update is being installed, not knowing that some updates arrive by a completely different road, and not knowing what the deferral controls actually do.

There is also a security argument that belongs here rather than in the security domain, because this is where the decision gets made. Patching prevents more real compromises than any product a technician can install, and a machine that has been "kept stable" by deferring updates for a year is not stable. It is exposed, and somebody chose that.

The lesson

Quality updates against feature updates, and the cadence of each

Windows has two kinds of update and they behave completely differently.

Quality updates are the monthly ones. They are cumulative — each contains every fix since the last feature release — they install in minutes, they require one restart, and they are the security-relevant ones. The cumulative property matters: a machine three months behind needs one update, not three, and there is no partial state to reason about.

Feature updates move the machine to a new version of Windows. They are an in-place upgrade wearing an update's clothes: they take much longer, they can change behaviour, they can remove features, and they create a rollback window of about ten days.

The cadence, approximately: quality updates monthly, on a predictable day; feature updates annually. Out-of-band updates appear between the monthly ones when a vulnerability is serious enough, and those are worth installing promptly rather than waiting.

Why the distinction matters in practice:

• A user complaining that "an update changed everything" has had a feature update, and the rollback window may still be open.
• An organisation that defers updates is usually right to defer feature updates for a few months and wrong to defer quality ones at all.
• A feature update needs free disk space — commonly 20 GB or more — and the most common feature update failure is not having it.

Driver and firmware updates, which arrive by a different road entirely

Two categories of update do not come from Windows Update in the way people assume, and both cause specific faults.

Drivers. Windows Update supplies generic and vendor-submitted drivers, which is fine for most hardware and not sufficient for some. Graphics drivers in particular are usually better taken from the vendor. The practical rule: let Windows Update handle drivers by default; go to the vendor when the hardware has a specific problem, or when the vendor's control software is needed.

The failure mode worth knowing: Windows Update reinstalling a driver you deliberately rolled back. A driver rolled back to fix a fault will return on the next scan unless it is blocked, and there is a Microsoft tool for exactly that purpose. A fault that "comes back after a few days" is often this.

Firmware. Firmware updates for the machine itself — the BIOS/UEFI — come from the manufacturer, sometimes through Windows Update on managed hardware and often through the vendor's own utility. They are different in kind from every other update:

• They cannot always be rolled back.
• An interrupted firmware update can leave a machine that will not start at all.
• They should be done on mains power, with the battery present on a laptop, and with nothing else running.

So the rule for firmware is the opposite of the rule for patches: install one when it fixes a problem you have or addresses a security issue, not because it exists.

Deferring, pausing and scheduling, and the machine that never restarts

The deferral controls are misunderstood in both directions, and the exam asks about them.

• Pause stops updates for a limited period — typically up to 35 days. When it expires, the machine must install everything before it can be paused again. It is a genuine pause, not an indefinite one.
• Active hours tell Windows when not to restart automatically. It does not stop updates downloading or installing; it stops the restart landing in the middle of a presentation.
• Deferral policies, available on Pro and above through policy, hold quality updates for a number of days and feature updates for longer. This is the mechanism an organisation actually uses.
• Metered connection on a network suppresses most automatic downloading, which is occasionally the accidental cause of a machine that never updates.

Then there is the machine that never restarts. A laptop that is only ever closed and opened sleeps rather than shutting down, so pending updates queue up indefinitely. The symptoms are a machine that is slow for no visible reason, a Windows Update pane showing a restart required for weeks, and eventually a forced restart at an inconvenient time.

The fix is a genuine restart — and it is worth knowing that on a machine with fast startup enabled, "shut down" does not fully restart the kernel and "restart" does. For applying updates, clearing a fault, or getting a clean state, restart is the correct instruction and shut down is not. That single fact resolves a surprising number of "I already turned it off and on again" conversations.

A failed update: reading the error, rolling back, and clearing the cache

Update failures have a small number of causes and a reliable order of attack.

Read the error first. Windows Update shows a code. It is worth searching, because the common ones map to specific causes: not enough disk space, a corrupted download, a component store problem, or a driver that blocks the upgrade.

The order that resolves most of them:

1. Check free space. A feature update needs tens of gigabytes. This is the most common cause and the easiest to miss.
2. Run the built-in troubleshooter. It resets the obvious things and sometimes simply works.
3. Clear the download cache. Stop the Windows Update and background transfer services, rename C:\Windows\SoftwareDistribution, start them again. The folder is rebuilt and a corrupted download is discarded. This is safe and it is the classic fix.
4. Repair the component store. DISM /Online /Cleanup-Image /RestoreHealth then sfc /scannow, in that order.
5. For a feature update that keeps failing, run setup from installation media with the keep-files option. It reports blocking issues far more clearly than Windows Update does.

Rolling back is the other half. A quality update can be uninstalled from installed updates. A feature update can be rolled back from recovery for about ten days, after which the previous installation is deleted and the option disappears. If a machine is going to be rolled back, it needs to happen inside that window, which is a reason to check on a user after a feature update rather than waiting for them to complain.

Why an unpatched machine is a security topic and not a convenience one

This is the sentence that belongs at the end of the objective: patching is a security control, and deferring it is a security decision.

The reasoning is not abstract. The overwhelming majority of successful attacks on ordinary machines use vulnerabilities that were patched before the attack happened — often months before. The patch existed; the machine did not have it. That is not a sophisticated attack, and it is not bad luck.

What follows for a technician:

• "If it isn't broken, don't update it" is wrong for security patches and right for firmware. Knowing which is which is the skill.
• An organisation deferring quality updates for stability is trading a small, measurable, reversible risk of an update causing a problem against an unbounded one. Naming that trade-off out loud is part of the job.
• A machine running a version that no longer receives updates is not "old"; it is permanently vulnerable, and no amount of endpoint protection compensates. That is the real argument for the upgrade in the next lesson.
• Third-party software matters as much as the operating system. Browsers, document readers, runtimes and plug-ins are attacked heavily, and many update themselves only when run.

The professional habit: when you touch a machine for any reason, look at whether it is patched, and say so in the ticket. It takes ten seconds and it is the single highest-value observation available.