2

I am trying to get a handle on how Windows 10, once having downloaded them, makes the decision to actually install updates.

I am looking back through the event logs of a Windows 10 (1607) installation relating to the WindowsUpdateClient source. The computer gets turned on only occasionally (maybe for several hours every week or two, sometimes more often, sometimes less often).

I can see 4 different possible events.

  • Started Downloading
  • Started Installing
  • Installation Success
  • Installation Failed.

I can a lot of "Started Downloading" events on 4/April, 17/May, 27/June, 10/July but no attempt to begin installation until 10/July

Then on 10/July and 28 / August it starts to attempt a few installations - not all of what it previously downloaded (only 9 out of over 20 downloads) - some succeeded but two failed. The fails were:

  • HP - Printer - 20.79.1.6738 (failed twice!)
  • 2022 Security Update (KB5012170)

Then on 28/August, it attempted to redownload the 2 failed ones, the HP one 3 times(!) (all starting at 13:29:39 so I don't think it's 3 retries)

And there's been nothing in the Event log since for this source - but a user reported on 10/Sept that it was attempting and failing to install the HP Printer one again (in a loop), but though these attempts don't appear in the event log under WindowsUpdateClient

So what triggers Windows to start the actual installation of updates? And how does it choose which updates to install - i.e. why wasn't installation attempted of the other updates that appeared in the event log as downloading? (Maybe the download didn't complete - the event log only mentions the Start of download).

And are there any other events I should be looking out for in the event log? e.g. something else that indicates attempts to install the updates, or that indicates that the download o the update has completed? I feel like I might be missing some information, e.g. those HP Printer updates I mentioned.

Edit

I have read that it might decide to start installation during "idle time" - however, I am not sure how this is defined. And are there other conditions that would set off the installation?

komodosp
  • 353

1 Answers1

1

There are 2 main systems in Windows that work for the Windows Update system.

Windows Update Service

Windows Update uses a set of services to install the updates and maintain its health. The health mechanism will check if Windows Update is still setup the way it is supposed to be, and will attempt to fix it if this is not the case.

This is how the service can enable itself again if you stop or disable it.

The windows Update Service will perform all the actions for downloading, installing and rebooting the system, but it will not start this by itself. This is the executing component only.

Scheduling when the events happen

Windows Update uses Scheduled Tasks to plan when the next action is to take place.

The scheduled tasks are located at: Library\Microsoft\Windows Update.

There will be a task: scheduled start which will have multiple triggers. This task will be scheduled regularly and initiate the Windows Update service to do a series of checks.

This is a list of what the Windows Update checks are:

  • Check/refresh the Group Policy settings
  • Check if there are new updates
  • Download new updates if available
  • Install updates if set to do so automatically
  • Check if a restart is pending
  • If pending restart, check if allowed to do, or if the user needs to grand permission
  • If user rescheduled the restart, reschedule the scheduled task.
  • Check if a certain time has passed and user has ignored a restart, restart anyway.

The GPO check is actually performed using a second scheduled task.

LPChip
  • 66,193