Step reference
Windows Update
Run Windows Update like "Check for updates", installing OS, quality/security and Microsoft-published driver updates, rebooting and re-checking across restarts until none remain.
What it does
Runs Windows Update the way clicking Settings → Windows Update → Check for updates does, installing OS, quality and security updates plus the driver updates Microsoft publishes. It works on any machine, including VMs and OEMs with no vendor tool.
Because a single setup pass can't survive a reboot, this step installs a background task that keeps going across as many restarts as it takes.
Scan
Ask Windows Update what's available, waiting while OOBE is still running.
Install
Apply what came back, then reboot if Windows asks for one.
Re-check
On the next boot the task runs again and scans once more.
Unregister
Once a scan comes back empty, the task removes itself.
It never reboots mid-setup. Provisioning does not wait for it to finish; it keeps updating in the background after the device is handed over.
Why installing Windows doesn't already cover this
Installing Windows 11 downloads the image directly from Microsoft and applies driver and firmware packages from the Microsoft Update Catalogue. What it never does is run Windows Update.
So a freshly installed machine is only as patched as the month its image was published. Every cumulative update, security fix and Defender definition released since then is missing — which on a several-month-old image can be a lot, and is exactly what a user discovers on their first Tuesday afternoon.
This step is what actually brings the OS current, and it keeps going across as many reboots as that takes rather than giving up after one pass.
Two different jobs, and you want both
This step covers the operating system. Hardware update covers OEM firmware and BIOS, which Microsoft largely doesn't publish. Neither one covers the other, and installing Windows covers neither.
Options
| Option | What it controls |
|---|---|
| OS / quality / security updates | Standard Windows updates. Enabled by default. |
| Driver updates (Microsoft-published) | Drivers delivered through Windows Update. Enabled by default. |
| Include Microsoft Update | Broadens coverage to Office and a wider driver catalogue. Enabled by default. |
| Reboot automatically and keep updating | Let it reboot and continue until finished. Enabled by default. |
What's in scope, and what isn't
This step installs what Windows Update itself offers: OS quality/security updates and Microsoft-published drivers. It does not install:
- Feature / version upgrades (e.g. moving between Windows 11 versions),
- Optional driver updates (Windows hides these by design), or
- OEM firmware / BIOS and vendor-signed driver packs, which are the Hardware update step's job.
Leftover items in Settings are expected
A few updates may still show as available afterwards. That's the scope above doing its job, not a failure. For firmware and OEM drivers, pair this step with Hardware update.
Good to know
- A progress log is written on the device at
C:\ProgramData\DeviceProvisioning\WindowsUpdate\windows-update.log. - Because it runs in the background, the step completing means "the update loop is scheduled and running", not "every update is already installed". It's non-blocking (warn) by default.
Part of the step catalogue.
Related
Install Windows 11
True bare-metal Windows 11 install with the right OEM driver pack injected automatically. Wipes the target disk; runs only on the USB entry point.
OOBE configuration
Auto-answer the out-of-box screens (region, keyboard, device name, EULA, optional Wi-Fi) and optionally skip the account screen so the device lands ready, with no duplicate admin.
Language & region
Set the display language, keyboard layout, regional format, home location and timezone for the installed Windows and every new user. Autopilot-compatible.