Windows Update

Unified Update Platform (UUP)

The Unified Update Platform (UUP) is the update-technology that was introduced with Windows 10.

Update Session Orchestrator (USO)

Update Session Orchestrator (USO) is a Windows component that manages the sequence of downloading and installing different update types. (Store Apps are not updated by the USO).

The executable for the USO seems to be UsoClient.exe.

Update types

Windows differentiates between various update types:

OS Feature updates
OS Security updates
Device drivers
Defender definition updates

These update types are also reflected in the update history setting panel.

Apparently, a user can opt-in to also manage Office update with USO.

Note: Store apps are not updated by the Update Session Orchestrator.

Update steps

Windows is continuously updated by the following steps:

Scan
Download
Install
Commit

Updating Windows from PowerShell

First, the psWindowsUpdate module needs to be installed.

install-Module psWindowsUpdate -force

With this module, Windows can be updated like so:

get-windowsUpdate
install-windowsUpdate

Feature Update

When opening Windows Update Settings using start ms-settings:windowsupdate (2021-02-02), I found the following situation, which seems to indicate that feature updates are treated differently from ordinary(?) updates:

Performing a feature udpate, for example from 1909 to 2004, can be executed like so:

$destDir = "$env:temp\FeatureUpdate"
mkdir $destDir

$webClient =  new-object System.Net.WebClient
$exe       = "$destDir\Win10Upgrade.exe"

$webClient.DownloadFile('https://go.microsoft.com/fwlink/?LinkID=799445', $exe)

start-process -filePath $exe -argumentList '/quietinstall /skipeula /auto upgrade /copylogs $destDir' 

# check if still running:
while (get-process Windows10UpgraderApp) { start-sleep 1 }; 'done'

# Check if updated
get-itemPropertyValue 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'  ReleaseId

Quick Fix Engineering (QFE) update

A Quick Fix Engineering (QFE) update is a small system-wide update that is applied to the Windows Operating System and its components such as the Internet Explorer (IE), Windows Server Roles and features.

Any (so called) non-inbox software, such as Office, Exchange Server etc. are distributed differently.

Querying the update history

Quick Fix Engineering updates

Quick Fix Engineering updates can be reported with the PowerShell get-hotfix cmdLet:

PS C:\Windows\system32> get-hotfix

Source        Description      HotFixID      InstalledBy          InstalledOn
------        -----------      --------      -----------          -----------
DESKTOP-1S... Update           KB4534131     NT AUTHORITY\SYSTEM  2/22/2020 12:00:00 AM
DESKTOP-1S... Update           KB4465065     NT AUTHORITY\SYSTEM  7/27/2019 12:00:00 AM
DESKTOP-1S... Update           KB4470502                          1/8/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4470788                          1/8/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4480979                          1/8/2019 12:00:00 AM
DESKTOP-1S... Update           KB4486153     NT AUTHORITY\SYSTEM  2/1/2020 12:00:00 AM
DESKTOP-1S... Update           KB4486159     NT AUTHORITY\SYSTEM  2/3/2020 12:00:00 AM
DESKTOP-1S... Security Update  KB4504369     NT AUTHORITY\SYSTEM  7/27/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4509095     NT AUTHORITY\SYSTEM  7/27/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4512577     NT AUTHORITY\SYSTEM  9/27/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4516115     NT AUTHORITY\SYSTEM  9/27/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4521862     NT AUTHORITY\SYSTEM  10/21/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4523204     NT AUTHORITY\SYSTEM  11/13/2019 12:00:00 AM
DESKTOP-1S... Security Update  KB4537759     NT AUTHORITY\SYSTEM  2/22/2020 12:00:00 AM
DESKTOP-1S... Security Update  KB4532691     NT AUTHORITY\SYSTEM  2/22/2020 12:00:00 AM

More or less the same result can be obtained with wmic.exe:

C:\> wmic qfe list
…

Reporting all updates

The COM Object Microsoft.Update.Session allows to query the update history of applications (as opposed to QFE updates):

PS C:\> $wuSess   = new-object -comObject Microsoft.Update.Session
PS C:\> $wuSearch = $wuSess.createUpdateSearcher()
PS C:\> $wuSearch.search("isInstalled=1").updates | select-object lastDeploymentChangeTime, title

LastDeploymentChangeTime Title
------------------------ -----
5/16/2019 12:00:00 AM    2019-02 Update for Windows 10 Version 1809 for x64-based Systems (KB4465065)
8/13/2019 12:00:00 AM    Microsoft .NET Framework 4.8 Language Packs for Windows 10 Version 1809 for x64 (KB4087642)
2/11/2020 12:00:00 AM    Windows Malicious Software Removal Tool x64 - February 2020 (KB890830)
2/11/2020 12:00:00 AM    2020-02 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10 Version 1809 for x64 (KB4538122)
2/11/2020 12:00:00 AM    2020-02 Security Update for Adobe Flash Player for Windows 10 Version 1809 for x64-based Systems (KB4537759)
3/4/2020 12:00:00 AM     Update for Windows Defender Antivirus antimalware platform - KB4052623 (Version 4.18.2001.10)
2/11/2020 12:00:00 AM    2020-02 Cumulative Update for Windows 10 Version 1809 for x64-based Systems (KB4532691)
2/18/2020 12:00:00 AM    2019-12 Update for Windows 10 Version 1809 for x64-based Systems (KB4023057)

TODO: with PowerShell

Apparently, some update related log entries can be queried in PowerShell like so:

PS C:\> get-eventLog system -source Microsoft-Windows-WindowsUpdateClient | select-object timeGenerated, message
PS C:\> get-winEvent setup

Log Files

Directories

Log files are located under

They seem to have the suffix *.etl and *.etw (the latter being Event Tracing for Windows).

PowerShell commands

get-windowsUpdateLog merges *.etl files into a single log file, named WindowsUpdate.log.

Links

Microsoft Technet: How to List All of the Windows and Software Updates Applied to a Computer

uupdump.net: Download UUP files from Windows Update servers with ease.

uup.rg-adguard.net seems to be something similar.