Windows Update

What it does

Runs Windows Update the way clicking Settings → Windows Update → Check for updates does — installing OS, quality and security updates plus the driver updates Microsoft publishes. It works on any machine, including VMs and OEMs with no vendor tool.

Because a single setup pass can't survive a reboot, this step installs a background task that scans, installs, reboots when required, and re-checks on the next boot — looping until a scan comes back empty, then removing itself. It waits while OOBE is still running so it never reboots mid-setup. Provisioning does not wait for it to finish; it keeps updating in the background after the device is handed over.

Options

Option	What it controls
OS / quality / security updates	Standard Windows updates. Enabled by default.
Driver updates (Microsoft-published)	Drivers delivered through Windows Update. Enabled by default.
Include Microsoft Update	Broadens coverage to Office and a wider driver catalogue. Enabled by default.
Reboot automatically and keep updating	Let it reboot and continue until finished. Enabled by default.

What's in scope — and what isn't

This step installs what Windows Update itself offers: OS quality/security updates and Microsoft-published drivers. It does not install:

• Feature / version upgrades (e.g. moving between Windows 11 versions),
• Optional driver updates (Windows hides these by design), or
• OEM firmware / BIOS and vendor-signed driver packs — that's the Hardware update step's job.

So a few items may still appear in Settings afterwards; that's expected, not a failure. For firmware and OEM drivers, pair this step with Hardware update.

Good to know

• A progress log is written on the device at C:\ProgramData\DeviceProvisioning\WindowsUpdate\windows-update.log.
• Because it runs in the background, the step completing means "the update loop is scheduled and running", not "every update is already installed". It's non-blocking (warn) by default.

Part of the step catalogue.