8 steps to install Windows 10 patches like a pro

Tired of the bugs in Microsoft's pushed patches? Here's how to take control in Windows 10.

, Columnist, Computerworld |

Microsoft Windows 10 logo bandage data map

Thinkstock

You don't have to take patches the way they're dealt

If you're ready to take command of your own Win10 destiny, at least a little bit,  sidestepping Microsoft's Automatic Update and patching like a pro shouldn't give you any heartburn.

Most Windows 10 users get their patches applied automatically: Once or twice — or three or four times — a month, Microsoft rolls new patches out the Automatic Update chute. They get installed, your machine reboots and (fingers crossed) you suddenly have a new build.

There's just one problem. Frequently, the patches do more harm than good.  Hiccups can range from minor to devastating, depending on what hardware and software you're using. Microsoft's own hardware and software aren't immune, as any Surface Pro or Dynamics CRM user can attest. Sometimes the patches change settings or completely wipe out some features.

As detailed in The case against Windows Automatic Update, if you're moderately conversant with Windows, and you're willing to stay diligent, delaying automatic updates can save you all sorts of headaches. Let the other tens of millions of guinea pigs test things first.

The converse is also true. If you aren't particularly good at Windows and/or you don't want to take the time to keep your machine fed, use Automatic Update. That part's easy: You don't have to do anything. Windows 10, all by itself, will feed you patches as Microsoft releases them.

If you want to look at a third-party solution, AskWoody MVP ch100 recommends the Windows Update Mini Tool, a free utility that stands between your computer and the Windows Update server. WUMT has a long history of performing well. My only reservation is its provenance: I don't know, and can't confirm, who created it and who maintains it. If you're still comfortable using it, go ahead — WUMT automates and simplifies much of this manual procedure.

If you want to do it yourself, here's how you can take control of your own Windows 10 updating. It's specifically for those running Windows 10 1703, the Creators Update, with notes about differences in earlier versions.

winver

IDG/Woody Leonhard

Step 1: Wait

This is an odd way to start a checklist, but it's true.

If you've already taken these steps once, your system's already set to block automatic updating. If this is your first time through, follow these steps and by the end you'll be blocked for next month.

In general, the best approach is to wait until the early beta testers have had a chance to bring out all the bugs. In practice, that isn't always the case: We sometimes find bugs weeks or even months after a bad patch gets pushed out the Windows Update chute. It's an imperfect world.

While you're waiting, you can watch your favorite websites and keep your ear to the ground. Look for problems that may affect you and your setup.

You have to install security patches sooner or later, but waiting a couple of weeks can keep you from stepping in the deepest offal.

Keep in mind that you may be installing not only the latest Windows 10 cumulative update (listed here), but also .NET patches, new drivers, Silverlight, Flash patches, fixes for the Windows Update servicing stack (the software that installs the updates), odd one-off bug fixes with little documentation, the latest Malicious Software Removal Tool, Windows Defender antivirus updates, Surface device firmware updates (yes, those are pushed out by Windows Update), and even Office patches, for those who have Office installed.

While you're waiting it wouldn't hurt to check your version and build number. In the Cortana box to the right of the Start icon, type

winver

...and push Enter. You can see how you compare to the latest versions and builds on the Windows 10 release information site.

easeus

IDG/Woody Leonhard

Step 2: Back up

Of course, you're supposed to back up regularly. Of course, you don't — but you should. While you're here, waiting to install an update, now's a very good time to crank up the backup routine.

Microsoft doesn't support its Windows 7-era backup routine very well (type backup in the Cortana search box then, on the right, click the link to Go to Backup and Restore (Windows 7)). They'd rather forget about it and get you to use their Reset and Restore options (Start > Settings > Update & security > Recovery), which pull new copies of Windows down from the Microsoft servers.

You can certainly follow the Microsoft way if you wish, but heaven help you if something goes really wrong with an update.

There are many free and cheap backup programs. I recommend EaseUS Todo Backup, detailed in Top 30 free apps for Windows 10. It isn't perfect, and that installer hook that tries to get you to pay is bothersome, but it does the job — and it's free.

While you're thinking about backing up, make sure you have Windows set to create Restore Points. See Trick 9 in my 10 tricks to get (and keep) Windows 10 Creators Update running smoothly.

wushowhide

IDG/Woody Leonhard

Step 3: Make sure the updates you don't want are hidden – and vice-versa

This takes two runs of Microsoft's 1990s-style wushowhide tool to get the hidden and unhidden patches sorted out. It's clunky, but it works.

Step 3a. If you don't already have wushowhide, go to KB 3073930 and download Microsoft's Wushowhide tool. (Click the link marked "Download the 'Show or hide updates' troubleshooter package now.") Drag the downloaded file, Wushowhide.diagcab, to any convenient location.

Step 3b. Double-click on Wushowhide.diagcab to run it.

Step 3c. This step's important, and not at all obvious. Click the link marked Advanced. Then uncheck the box marked "Apply repairs automatically." Click Next. Wushowhide will run for a long, long time. When it comes back up for air, click the link to Show Hidden Updates. You see a list like the one in the screenshot.

Step 3d. This first run of wushowhide lets you unhide any patches that you may have hidden in the past. Check the box next to any patches you want to install. In this case, I want to install the AMD High Definition Audio Device, so I check the box.

Step 3e. Click Next. You see a list marked Select the repairs you want to apply. Click Next again. Wushowhide tells you that it's "Resolving problems." Wait a while for it to finish and click Close.

Step 3f. Next, run wushowhide again, but turn the tables. Double-click on wushowhide, click the link marked Advanced. Then uncheck the box marked "Apply repairs automatically." Click Next. Wushowhide will run for a long, long time. Click the link to Hide Updates. Check the boxes next to any updates that you don't want to install. Click Next.

Step 3g. You may see a list of "repairs you want to apply" – which means "hide these updates." If you see it, click Next. Wushowhide is an odd bird, with an interface reminiscent of troubleshooters in Windows XP. If wushowhide successfully hid the upgrade/update/patch, you don't get a confirmation screen. You only see a "Troubleshooting has completed" dialog.

clear advanced options

IDG/Woody Leonhard

Step 4: Clear out your Advanced Options

When you're ready to take control of your updating, and you've run wushowhide to prevent Windows Update from installing anything you don't want (and allowing Windows Update to install anything you do want), it's time to release the brakes.

To do so in Windows 10 Creators Update (version 1703) Pro or Enterprise, click Start > Settings (the gear icon) > Update & security and then on the right click Advanced Options. As you can see in the screenshot, the "cleared for landing" settings are Current Branch, 0 deferral on feature updates (what humans would call a version change) and 0 deferral for quality updates (normally called cumulative updates). You should also make sure that Pause Updates is turned off.

In Windows 10 version 1703 Home, you don't need to do anything.

In Windows 10 Anniversary Update (version 1607) and earlier, taking off the brakes is a bit more complex. If you're running an older version of Windows 10, see my Win10 Tip called Block forced Windows updates and the comprehensive list in AskWoody Knowledge Base article AKB1000005.

turn off metered connection

IDG/Woody Leonhard

Step 5: Open up your internet connection

Make sure that you're giving Windows Update full permission to pull down everything that it needs to get your machine patched. To do that, click Start > Settings > Network & Internet. Make sure your internet connection is showing on the right, then click Change connection properties. You should see something like the screenshot.

Make sure the Set as metered connection slider is set to Off, then "X" out of the Settings app.

Earlier versions of Windows had similar settings, but only for Wi-Fi connections. Some users may have rigged earlier versions of Windows 10 Home to make Windows think an Ethernet connection was "metered." If you used that hack, reverse it. See, for example, this Microsoft Answers forum post from Win10Nuc2.

check for updates

IDG/Woody Leonhard

Step 6: Run Windows Update

This is the point of no return. Once you tell Windows to check for updates, it's all over — whatever updates you've allowed through the wushowhide filter will be  installed. So make very sure that you want whatever Microsoft's offering, then run a manual update.

Save everything. Click Start > Settings > Update & security. On the left, you see Windows Update. On the right, click the box marked Check for updates.

Note: Once you click Check for updates, you don't have to do anything more to install the update. "Check" in this case means "Install."

Windows may take a long time to find the update, then take seeimngly forever to install it. You'll likely need to reboot, although you can theoretically delay the reboot using the Change active hours and/or the Restart options links on the right side of this panel. After the reboot, it may take a long while to start again, waiting for updates to install.

If the wheels fall off — and they will at some point — see the last slide in this article entitled, duh, If the wheels fall off.

advanced options to block

IDG/Woody Leonhard

Step 7: Lock down your Advanced Options

Once you're happy with the updates (or the wheels have fallen off and you've either put them back on or given up in disgust), you should turn off Automatic Updates. In Windows 10 version 1703 Pro and Enterprise, that's easy. In Windows 10 Home you don't have the same capabilities — skip to the next slide.

To block Automatic Updates (you can say "defer" if you prefer), click Start > Settings > Update & security. Click the link marked "Advanced Options." You can see the "Choose when updates are installed" pane in the screenshot.

Microsoft has changed the terminology several times in the past couple of months, but choosing "Current Branch for Business" in the first drop-down box should assure that you won't be upgraded to the next version of Windows (presumably, version 1709) until Microsoft says it's ready for widespread adoption. By choosing CBB, you're avoiding the four-month-long unpaid beta-testing phase, where those who leave Automatic Update enabled get to install and test the new version of Win10 as soon as it's rolled onto their machines.

Watch Computerworld for warnings and advice about Microsoft releasing the next version of Windows to those who chose "Current Branch for Business."

The Feature Updates box is supposed to delay the installation of new versions (read: version 1709) by the specified number of days. Remember Feature Update = Version change. At this point, we have no idea how that number will interact with the CBB choice in the first box — or even if it interacts at all. The rules seem to change every week.

The Quality Updates box, though, controls how long Windows Update waits to install the latest cumulative update. Remember Quality Update = Cumulative Update. I suggest you wind that up to 30 days, the maximum, but put a reminder in your calendar to check in a few weeks to see if the next cumulative update is behaving itself.

I don't recommend that you Pause Updates using this setting. It isn't clear what updates are being paused. You still want antivirus updates, for example, and even if Microsoft allows those through now, experience has taught that the rules change all the time.

Windows 10 versions 1507, 1511 and 1607 Pro and Enterprise had similar options, but you have to dig through Group Policy settings to get to them. See Step 3 of my Block forced Windows updates tip.

turn on metered connection

IDG/Woody Leonhard

Step 8: Set your internet connection to metered

If you have Windows 10 Home, the easiest way to block unintended updates is by turning your internet connection into a "metered" connection. In theory a metered connection is one that costs a bundle for every bit you use. In practice…well, Windows has no way of knowing how much you're paying for your internet bits.

In earlier versions of Windows 10, you only had a "metered" option for Wi-Fi internet connections. With version 1703, you can also now designate an Ethernet (wired) connection as metered. To do so, click Start > Settings > Network & Internet. You should see something like the screenshot. Make sure your internet connection is showing on the right, then click Change connection properties. You should see something like the screenshot back in Step 5.

Make sure the Set as metered connection slider is set to On, then "X" out of the Settings app.

For dealing with wired connections on earlier versions of Windows 10, see Step 4 of Block forced Windows updates.

working on updates

IDG/Woody Leonhard

Step 9: If something goes wrong

Into each life some rain must fall. Some days must be dark and dreary. When you're dealing with Windows 10 updates, those days seem to jump up and bite you more often than you'd like.

There are two broad categories of problems with Windows Update: Either it doesn't work and you get some sort of message (or possibly a frozen system and no message at all); or it does work, but you end up with a pulsing heap of electronic protoplasm that isn't working correctly.

If you can't get the update to install, start with the steps in Windows 10 install issues -- and what to do about them. Most people find that running the update troubleshooter suffices, but yours may be a particularly tough nut to crack. If the nostrums in that post don't cure your ills, take a look at Microsoft's You can't install updates on a Windows-based computer, which casts a wider and more complex net.

If you can get your machine working but the update set it into a malevolent parallel dimension, start by rolling back the update. Click Start > Settings > Update & security. On the left choose Recovery. On the right, under Go back to an earlier build, choose Get started. Follow the instructions and pray.

If none of those work, go to AskWoody.com and post your problem (yes, you can post anonymously), or try poking Microsoft hard on Reddit. There's a new thread posted on the Windows 10 reddit for every new update. Microsoft employees really do watch those comments.

Or you can just use the backup you created in Step 2 and start all over again. The price of freedom is eternal vigilance.

Big thanks to abbodi86, MrBrian, Noel Carboni, ch100, PKCano, NetDef, PhotM, and hundreds of lost souls on the AskWoody Lounge .

Copyright © 2017 IDG Communications, Inc.