Updates, Patches and Drivers

Why updates matter

Software ships with flaws, and some are security vulnerabilities: mistakes that let an attacker read data, run code or take over the machine. Vendors fix them in updates, and they fix ordinary bugs and add features too. Three reasons to update, in order of urgency:

• Security: most successful attacks use known vulnerabilities for which a fix already exists. When a vendor publishes a fix, attackers compare the old and new code to find the hole, and working attacks often appear within days. From that moment, every unpatched computer is an easy target.
• Stability: bug fixes for crashes, hangs, printing problems and compatibility with new hardware.
• Features: new functions and changes to existing ones, which also need training and testing.

The trade-off is risk the other way: an update can itself break something, such as a driver, a printer or a business application. Good update practice is not "never update" or "install everything immediately", but updating quickly and in a controlled way.

Terminology

A patch is a change to installed software that fixes a specific problem, such as a security vulnerability or a bug, without replacing the whole program. The other terms describe size and urgency:

• Hotfix: an urgent fix for one specific problem, released outside the normal schedule, sometimes only to the customers affected by it.
• Update: the general word for any delivered change that keeps you on the same product version: patches, collections of fixes, new drivers, new definitions for antivirus software.
• Upgrade: moving to a new version or edition, such as Windows 10 to Windows 11, or Windows 11 Home to Pro. An upgrade changes more, takes longer and needs more planning (see Installing and Upgrading an Operating System).

Feature updates and quality updates

Windows sorts its updates into two main kinds:

• A feature update is a new version of Windows, released once a year, usually in the second half of the year. Its name is the year and half in which it appeared, such as 24H2 or 25H2. Installing it is technically an in-place upgrade. Each feature update is supported for 24 months on Home and Pro, and 36 months on Enterprise and Education, so an organization must move to a newer one before that runs out.
• A quality update is the monthly package of security fixes and bug fixes for a feature update, without new major features. Quality updates are cumulative: each one contains all the fixes of the previous ones, so a computer that missed three months needs only the latest update, not four.

The installed version shows in Settings, System, About, or by running winver. The operating system (OS) build number tells you precisely: the part before the dot is the feature update (22631 is 23H2, 26100 is 24H2, 26200 is 25H2) and the part after the dot grows with every monthly quality update. 25H2 shares its code with 24H2, which is why a 24H2 computer could move to it with a small enablement package instead of a full in-place upgrade.

Patch Tuesday and out-of-band updates

Patch Tuesday is the second Tuesday of each month, when Microsoft releases its regular security updates for Windows and its other products. A fixed, predictable day lets IT departments plan testing and deployment instead of reacting to surprise releases; other vendors, such as Adobe, release on the same day. Later in the month, Microsoft usually offers an optional preview update with the non-security fixes that will be part of the next Patch Tuesday.

When a problem cannot wait, for example a vulnerability that is already being exploited, or a monthly update that broke something important, Microsoft releases an out-of-band (OOB) update outside the schedule. Treat out-of-band security updates as urgent: the vendor decided they could not wait.

Windows Update settings

On a home or small-business computer, Windows Update in Settings is where updates are installed and controlled. The settings a technician uses most:

• Check for updates: looks for and installs available updates right away.
• Pause updates: postpones updates for one to five weeks, for example during a busy period. After the pause ends, the device must install the latest updates before it can be paused again, so pausing delays but does not skip.
• Active hours (under Advanced options): the hours in which Windows will not restart automatically to finish an update. Windows can adjust them automatically based on when the computer is used.
• Optional updates (under Advanced options): driver updates and preview updates that are not installed automatically. Install an optional driver only when it fixes a problem you actually have.
• Update history: what was installed and when, failed updates with their error codes, and the link to Uninstall updates.

A pending restart is the most common reason an update "did not install": the files are staged but only applied during the next restart. In PowerShell, Get-HotFix lists the updates Windows reports as installed, each with its Knowledge Base (KB) number, which is how Microsoft identifies an update in its documentation:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 3

Source        Description      HotFixID      InstalledBy          InstalledOn
------        -----------      --------      -----------          -----------
PC-FIN-01     Security Update  KB5070001     NT AUTHORITY\SYSTEM  9/9/2026 12:00:00 AM
PC-FIN-01     Update           KB5070002     NT AUTHORITY\SYSTEM  9/9/2026 12:00:00 AM
PC-FIN-01     Security Update  KB5068002     NT AUTHORITY\SYSTEM  8/12/2026 12:00:00 AM

macOS and Linux

On macOS, updates are in System Settings, General, Software Update, where you can also choose automatic installation of macOS updates, App Store app updates and security responses. The same can be done in the Terminal, which is handy over a remote session:

softwareupdate --list
sudo softwareupdate --install --all --restart

--list shows what is available; the second line installs everything and restarts the Mac if an update requires it, so warn the user first.

On Linux, the package manager updates the operating system and all applications from the repositories in one go (see Linux at a Glance):

sudo apt update && sudo apt upgrade    # Debian, Ubuntu
sudo dnf upgrade                          # Fedora, Red Hat Enterprise Linux

Ubuntu installs security updates automatically by default (through the unattended-upgrades package). A new kernel only takes effect after a restart; on Ubuntu the file /run/reboot-required exists when one is due.

Patch management in organizations

In an organization with hundreds or thousands of computers, updates cannot be left to each machine and each user. Patch management is the process of finding, testing, deploying and verifying updates across all systems, in a controlled and documented way. It runs as a cycle, every month:

1. Inventory: know which devices, operating systems and applications exist, and which versions they run. You cannot patch what you do not know about.
2. Assess and prioritize: read the release notes; vulnerabilities that are critical or already exploited go first, and internet-facing systems before internal ones.
3. Test: install the updates on test machines and check the important business applications.
4. Pilot: deploy to a small group of real users, often IT staff and volunteers from each department, and wait a few days for problems.
5. Deploy: roll out to everyone, in waves (rings), so a problem that slipped through stops early.
6. Verify and report: check which devices actually installed the updates, chase the ones that did not, and report compliance. Exceptions (a machine that cannot be patched) are documented and protected in other ways.

Tools

• Windows Server Update Services (WSUS): an on-premises server that downloads Microsoft updates once and lets administrators approve them for groups of computers. Microsoft has deprecated it: it still works, but gets no new features.
• Microsoft Intune: cloud-based management that configures update rings and deadlines for Windows directly from Microsoft's update service, also for devices outside the office.
• Microsoft Configuration Manager (formerly System Center Configuration Manager, SCCM): on-premises management for large organizations, which also deploys third-party applications.

Applications need patching too: browsers, PDF readers and collaboration tools are frequent targets. Management tools and package managers such as winget on Windows handle those alongside the operating system.

Checking compliance is a comparison against a baseline: for each supported feature update (the build number), the minimum revision that this month's update brings. One baseline for all builds does not work: compared with 10.0.26100.6584, a 25H2 computer (10.0.26200) would always count as up to date, however many monthly updates it missed. This program checks an inventory. The build numbers are illustrative.

BASELINE = {26100: 6584, 26200: 6584}  # minimum revision per build

inventory = [
    ("PC-FIN-01", "10.0.26100.6584"),
    ("PC-FIN-02", "10.0.26100.4946"),
    ("PC-HR-01", "10.0.26200.6584"),
    ("PC-HR-02", "10.0.22631.5909"),
    ("PC-HR-03", "10.0.26200.5074"),
    ("LAPTOP-07", "10.0.26100.6899"),
]


def build_and_revision(version):
    parts = version.split(".")
    return int(parts[2]), int(parts[3])


not_compliant = []
for name, version in inventory:
    build, revision = build_and_revision(version)
    if build not in BASELINE:
        status = "NEEDS FEATURE UPDATE"
    elif revision < BASELINE[build]:
        status = "BEHIND"
    else:
        status = "ok"
    if status != "ok":
        not_compliant.append(name)
    print(f"{name:<10} {version:<16} {status}")

print(f"{len(not_compliant)} of {len(inventory)} not compliant: {', '.join(not_compliant)}")

# Why convert to numbers? As text, a five-digit revision sorts before a four-digit one:
print("10000" < "6584", 10000 < 6584)

PC-FIN-01  10.0.26100.6584  ok
PC-FIN-02  10.0.26100.4946  BEHIND
PC-HR-01   10.0.26200.6584  ok
PC-HR-02   10.0.22631.5909  NEEDS FEATURE UPDATE
PC-HR-03   10.0.26200.5074  BEHIND
LAPTOP-07  10.0.26100.6899  ok
3 of 6 not compliant: PC-FIN-02, PC-HR-02, PC-HR-03
True False

PC-FIN-02 and PC-HR-03 missed some monthly updates. PC-HR-02 is on build 22631, an older feature update (23H2) that is not in the baseline: a quality update alone cannot bring it up to date, it needs a feature update. 23H2 Home and Pro reached the end of servicing on November 11, 2025. The last line shows why revisions are compared as numbers: as text, "10000" would count as lower than "6584".

Driver updates and rollback

A device driver is the software that lets the operating system control a piece of hardware. Drivers run with high privileges, so a faulty driver can cause crashes and blue screens, and a vulnerable one is a security risk. There are two main sources:

• Windows Update: manufacturers publish tested drivers through Microsoft. They are installed automatically or offered as optional updates. This is the safest default.
• The vendor: the computer manufacturer's update tool or support site, or the chip maker for graphics drivers. Vendor drivers are often newer and sometimes add features, but are less widely tested in combination with your hardware.

The rule for drivers is: if it works, only update it for a reason (a fix you need, a security advisory, support for new hardware). When a new driver causes problems, use driver rollback: in Device Manager, open the device's Properties, go to the Driver tab and choose Roll Back Driver. Windows reinstalls the previous driver it kept. The button is unavailable when there is no previous driver, for example after a clean install; then uninstall the device (with the option to remove its driver) and install a known good version from the vendor.

A driver that Windows Update keeps reinstalling can be blocked by an administrator, but that is a temporary measure: the underlying problem should be reported to the vendor.

Firmware and BIOS/UEFI updates

Firmware, the software stored on the hardware itself, also receives updates: the motherboard's Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI), solid-state drive (SSD) firmware, docking stations. They fix security flaws in the processor and platform, stability problems and compatibility issues. Many manufacturers now deliver UEFI updates through Windows Update or, on Linux, through fwupd. A firmware update must not be interrupted: keep a laptop on its charger and never turn the computer off while it runs. How firmware updates work, and what to do when one fails, is covered in BIOS, UEFI and the Boot Process.

Rolling back updates

When a problem starts right after an update, undoing it is often the fastest fix. Pick the smallest tool that does the job:

Rolling back is a workaround, not a fix. A security update that was removed leaves the vulnerability open, and Windows will try to install it again. Pause updates on that machine if needed, find out what conflicts (usually a driver or an application), and plan to reinstall the update once that is solved.

End of life and end of support

Every operating system version has an end date. After its end of support (often called end of life, EOL), the vendor publishes no more security updates, so every new vulnerability stays open forever. The computer keeps working, which is exactly why the risk is easy to underestimate.

• Windows 10 reached end of support on October 14, 2025 (Home, Pro, Enterprise and Education; Long-Term Servicing Channel (LTSC) editions later). Extended Security Updates (ESU) buy time: for consumers until October 13, 2026, and for organizations, paid per device, for up to three years. ESU provides security fixes only.
• Windows 11 feature updates each have their own end date (24 or 36 months, see above), so a Windows 11 computer that never takes a feature update also falls out of support.
• macOS: Apple usually provides security updates for the current version and the two before it, but only the current version is guaranteed to receive all security fixes; older versions get only some of them.
• Linux: each distribution release has a published end date; an Ubuntu LTS release gets five years of standard security updates.

Plan replacement or upgrade well before the date, and isolate any system that must stay on an unsupported version (a machine that controls lab equipment, for example) from the internet and the rest of the network.

Zero-day vulnerabilities

A zero-day is a vulnerability that attackers exploit before the vendor has released a fix: defenders have had zero days to patch. Nothing can be installed yet, so the defense is layered: the vendor's temporary workaround (disable a feature, block a port), security software that detects the attack, and installing the out-of-band update the moment it appears. Zero-days are rare compared to attacks on known, already patched vulnerabilities, which is why fast routine patching prevents far more incidents. Vulnerabilities and attacks are covered in depth in the Security topic.