Windows Update’s default configuration — automatic download and installation — is correct for security. The vast majority of updates contain security patches for actively-exploited vulnerabilities, and delaying them creates real exposure. The problem isn’t automatic updates; it’s that the timing, the restart behaviour, and the occasional problematic update that breaks something aren’t well-managed by default. You’ll find the complete rundown in our Complete Guide to Windows 11.
This guide covers: checking for and installing updates, configuring update timing so restarts don’t interrupt work, understanding which updates can be paused and which can’t, handling the occasional bad update, and recovering when an update goes wrong.
Checking for and installing updates manually
Most of the time Windows handles this on its own, but it helps to know how to trigger it yourself — especially right after a major security release. Open Settings (Windows + I), select Windows Update, and click Check for updates. Anything pending downloads automatically; if Windows waits for you, click Download & install, then Restart now when prompted, since most updates only finish applying after a reboot. When you return, the page should read “You’re up to date.”
To confirm which build you actually ended up on — handy when you want to be sure a specific patch landed — press Windows + R, type winver, and press Enter. The box shows your Windows 11 version (such as 24H2) and the exact OS build number, which you can match against the latest released build for your version on Microsoft’s release-health dashboard.
Active hours — the most important update setting
Settings → Windows Update → Advanced options → Active hours. This tells Windows not to restart for update installation during your working hours. Set this to cover your typical work period. Windows can automatically detect active hours based on usage patterns, or you can set them manually (maximum 18-hour range).
With active hours set correctly: Windows downloads updates in the background, but the restart to install them happens outside your active period. You return to your computer after it has already restarted and installed updates overnight or during lunch. This is the primary friction point for most users, and active hours solve it completely for machines that are left on or in sleep mode during non-active periods.
Pausing updates
Settings → Windows Update → “Pause updates” → pause for 1-5 weeks. Use this when a specific update has known problems (check Windows Health Dashboard at aka.ms/WindowsReleaseHealth before pausing), when a critical work period requires stability, or when you want to wait for early adopters to surface any issues with a major Windows release.
What can be paused: Feature updates (major Windows versions), Quality updates (monthly security patches, bug fixes). What cannot be paused indefinitely: Microsoft Defender definition updates continue regardless of pause settings — this is intentional and correct, since pausing antivirus updates would create security exposure.
After the pause period expires: Windows prompts to install all paused updates before pausing again. You can immediately re-pause if needed, but there’s no indefinite pause — eventually, updates install.
Optional updates and driver updates
Windows Update delivers two types of updates most users don’t see in the main view:
Optional quality updates: Settings → Windows Update → Advanced options → Optional updates → these are non-security improvements and bug fixes. They’re available to install but not automatic. Check here monthly for updates that fix specific issues you’re experiencing.
Driver updates: Settings → Windows Update → Advanced options → Optional updates → Driver updates. Windows Update provides generally-compatible drivers, but manufacturer websites (NVIDIA, AMD, Intel, Realtek) typically have newer and more optimised versions. For GPU drivers especially: the manufacturer’s version is usually preferable. GPU drivers from Windows Update can be several versions behind the manufacturer’s current release.
Update history and identifying which update caused a problem
Settings → Windows Update → Update history shows every installed update with dates. When something breaks after an update: the history tells you which update coincided with the problem. The KB (Knowledge Base) number for each update can be searched at support.microsoft.com for details about what was changed and known issues.
Known issues for each update are documented in the Windows Release Health dashboard (aka.ms/WindowsReleaseHealth). Before assuming an update caused a problem: check here to see if the issue is already known and whether a fix is expected. This is particularly useful when many users report the same problem — Microsoft usually acknowledges widespread issues quickly and provides workarounds or expedited fixes.
Uninstalling a problematic update
Settings → Windows Update → Update history → “Uninstall updates” at the top → shows updates that can be removed. Click “Uninstall” next to the problematic update → restart. This rolls back that specific update while keeping all others.
Not all updates can be uninstalled through this interface — some are cumulative and can’t be individually removed. For those: System Restore (if a restore point exists from before the update) or the “Go back” option in Recovery settings (available within 10 days of a feature update) are the alternatives.
For a feature update (major Windows version) that broke things: Settings → System → Recovery → “Go back” → available if it’s within 10 days of the feature update. After 10 days: the previous Windows version files are deleted and this option disappears. This is why it’s worth knowing this option exists immediately after a feature update, before the 10-day window closes.
Our guide on Windows 11 troubleshooters covers the Windows Update-specific troubleshooter that fixes common update failures, and our Windows 11 setup guide covers the initial update pass that’s important to complete after a fresh installation. For Windows release notes and known issues per update, Microsoft’s Windows Release Health dashboard is the authoritative source for what’s in each update and which issues are known.
Windows Update for Business — update rings
On Windows 11 Pro, Education, and Enterprise: “Windows Update for Business” settings allow configuring deferral periods. Settings → Windows Update → Advanced options:
- Receive quality updates: defer by 0-30 days. Quality updates are monthly security patches. Deferring by 7-14 days lets early adopters surface any critical issues before your machine installs the update.
- Receive feature updates: defer by 0-365 days. Feature updates are major Windows releases (23H2, 24H2, etc.). Most home users and businesses benefit from deferring these by at least 30-90 days — major releases occasionally have compatibility issues that are fixed in subsequent patches.
Home edition doesn’t have these deferral options beyond the 5-week pause. For Home users who want more control: the pause feature combined with monitoring the Windows Release Health page provides a manual version of the deferral strategy.
Metered connections and Windows Update
Settings → Network & internet → Wi-Fi or Ethernet → Properties → “Metered connection” → toggle On. On a metered connection, Windows Update doesn’t automatically download updates in the background — it waits for a non-metered connection. This prevents Windows Update from consuming mobile data or a data-capped broadband connection.
Manually trigger updates on a metered connection: Settings → Windows Update → “Check for updates” → Windows downloads available updates on demand rather than waiting. Useful when connected to a limited data connection and you want to control exactly when update data is used.
What Windows Update doesn’t cover
Windows Update handles: Windows itself, Microsoft Defender, some Microsoft applications (Office with the right settings enabled), and driver updates from Microsoft’s catalogue. It doesn’t automatically update: third-party applications (Chrome, Firefox, VLC, 7-Zip, etc.), manufacturer-specific drivers not in Microsoft’s catalogue, BIOS/UEFI firmware (most manufacturers have their own tools), or applications from the Microsoft Store (those update through the Store separately).
For third-party application updates: Winget (the Windows Package Manager, built into Windows 11) can update many installed applications from the command line: winget upgrade --all checks for and installs updates for all Winget-managed applications. This fills the gap that Windows Update leaves — a single command that updates all applications rather than opening each one individually to check for updates.
| Update control goal | Where to find it |
| Stop restarts during work hours | Windows Update → Advanced options → Active hours |
| Pause updates temporarily | Windows Update → Pause updates (1-5 weeks) |
| Install optional updates | Windows Update → Advanced options → Optional updates |
| Remove a specific update | Windows Update → Update history → Uninstall updates |
| Delay major feature updates | Windows Update → Advanced options (Pro only) |
| Save data on metered connections | Network settings → Metered connection → On |
| Check update status and known issues | aka.ms/WindowsReleaseHealth |
The key insight about Windows Update management: automatic updates are the right approach for security, but controlling when they install (active hours), how long they can be deferred (pause), and having a recovery path when they break something (update history, uninstall, System Restore) gives you the security benefit without the productivity disruption. Getting all three configured takes 10 minutes and produces a machine that updates safely, restarts at appropriate times, and has a recovery path if something goes wrong.
Windows Update and system restore points
Windows automatically creates a System Restore point before installing updates — or at least it’s supposed to. On machines with limited disk space or where System Protection has been disabled: restore points may not be created. Verify System Protection is active: Win+S → “Create a restore point” → System Protection tab → ensure it shows “On” for the C: drive. Turning it on sets a disk space allocation for restore points and ensures they’re created before updates.
Creating a manual restore point before installing a major Windows Update: System Properties → System Protection → “Create” → gives it a name → creates immediately. This provides a named restore point at a specific known-good state, separate from the automatic pre-update points that Windows creates. If something goes wrong: System Restore → select the named point → restore to exactly the state before the update.
Update troubleshooting — when updates fail
Update errors typically show as percentage stalls (stuck at 99%, keeps restarting at the same point), error codes (0x800…, 0x80070…), or the update downloading repeatedly without installing. The progression for fixing these:
- Run the Windows Update troubleshooter first: Settings → Troubleshoot → Other troubleshooters → Windows Update → Run
- If the troubleshooter finds and fixes something: restart → try updating again
- If the troubleshooter finds nothing: Admin Command Prompt → stop Windows Update services, clear the cache, restart services:
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:WindowsSoftwareDistribution SoftwareDistribution.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserverThis clears the update download cache (SoftwareDistribution folder) and allows Windows Update to start fresh. Windows re-downloads the updates on the next check. Most stubborn update failures resolve after this sequence.
Forced updates and Windows 11 upgrade pressure
Microsoft periodically makes feature updates (major Windows 11 versions) automatic when a version reaches end of support. Windows 11 22H2, for example, reached end of support and Microsoft began automatically upgrading qualifying machines to 23H2. Users on supported hardware cannot indefinitely defer these forced upgrades — eventually the update installs regardless of pause settings.
The practical response to unwanted feature updates: the 5-week pause buys time; multiple back-to-back pauses extend this further. On Pro editions: the deferral period of up to 365 days for feature updates provides a year to validate the new version before it installs. After the deferral expires or the previous version reaches end-of-support: the upgrade proceeds.
For machines that genuinely need to stay on a specific Windows version for compatibility reasons (industrial software, legacy applications, specific hardware): Windows LTSC (Long Term Servicing Channel) editions provide multiple years of support without feature updates. These require volume licensing and are intended for enterprise and specific-use scenarios rather than general home or business use.
Managing Windows Update is fundamentally about balancing security (updates should install promptly) with stability (not during critical work, not without a recovery path). The tools are all there: active hours to control timing, pause to delay problematic updates, update history to identify what changed, uninstall to roll back specific updates, and System Restore for broader recovery. Using them together provides the security of automatic updates with the control that professional work requires.
Windows Update notification management
Windows Update generates notifications for: update availability, restart required, and update completion. Settings → System → Notifications → Windows Update → toggle specific notification types. The “Restart required” notification is worth keeping — it reminds you that a restart is pending and helps you choose a convenient time rather than being surprised by an unscheduled restart.
The “Remind me” option in the restart notification (when active hours are set but a manual restart is possible): snooze the restart reminder for a defined period. This prevents the notification from being continuously dismissed until the machine restarts on its own at an inconvenient moment — the reminder keeps the pending restart visible without forcing it.
Checking update status with PowerShell
For users comfortable with command line: PowerShell can query Windows Update status more precisely than the Settings UI. Admin PowerShell:
Get-WindowsUpdateLogGenerates a detailed Windows Update log file on the Desktop. This log contains every update-related event — what was checked, downloaded, installed, and failed — with precise timestamps. Useful for diagnosing intermittent update failures that don’t produce obvious error codes in the Settings UI.
PowerShell’s Windows Update module (requires installing PSWindowsUpdate from the PowerShell Gallery) provides cmdlets like Get-WindowsUpdate (lists available updates), Install-WindowsUpdate (installs them without the GUI), and Get-WUHistory (update history). This is particularly useful on multiple machines or for scripting update management beyond what the Settings UI exposes.
Windows Update, managed correctly, should be nearly invisible in day-to-day use: updates install overnight, the machine is ready when you sit down, security patches are current, and the occasional problematic update has a clear recovery path. The difference between this smooth experience and the friction most users tolerate is primarily the active hours setting and knowing how to use the update history for recovery. Getting those two right is the foundation that makes everything else about Windows Update management practical. Our guide on Update Chrome covers an adjacent issue.
