The Update BureauPlain-English Reference & Admin Cheat Sheets
Guides & Recurring KBs
Practical walkthroughs to fix or delay a problematic update, understand Microsoft's monthly release cycle and lifecycles, check your OS or server build, and recognize KBs that install repeatedly.
Quick version-check cheat sheet — One-line commands to check your OS or server build Show commands Hide commands
> Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object DisplayVersion, CurrentBuild, UBR, EditionID
> Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' | Format-List Version, Release
> SELECT @@VERSION;
> Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo }
> (Get-SPFarm).BuildVersion
Secure Boot certificates in 2026: what changes and what to do
The Secure Boot certificates from 2011 began expiring in June 2026. Windows Update installs the new 2023 certificates on most PCs by itself; here is how to check yours and what happens if it misses them.
Fix & manage Windows updates
Pause, uninstall, block a bad update, stop unwanted restarts, repair errors & manual install-
How to pause Windows updates
Delay updates for a few weeks, for example while a known issue is being fixed.
-
How to uninstall a Windows update
Remove a recent update that causes problems, and what to do next.
-
How to fix a Windows update that fails or gets stuck
Step-by-step fixes for an update that will not install or stops halfway, from the built-in troubleshooter to repairing the component store, plus what the common error codes mean.
-
How to block or hide a single Windows update
Stop one problematic update, driver or feature upgrade from installing again while keeping the rest of Windows Update working.
-
How to stop Windows from restarting by itself after an update
Keep Windows from rebooting while you have work open, using Active Hours, restart notifications, Group Policy or a registry switch.
-
How to install an update from the Microsoft Update Catalog
Download a KB update as an .msu or .cab file and install it by hand, when Windows Update does not offer it, the PC is offline or Windows Update itself fails.
-
Known Issue Rollback (KIR), explained
How Windows switches off one faulty change from a non-security update without uninstalling the whole update, and how IT admins apply a KIR with Group Policy or Intune.
Release cycle, package types & storage
Patch Tuesday, optional previews, LCU/SSU/eKB, Out-of-band, gradual rollout & WinSxS cleanup-
What is Patch Tuesday?
Why Windows security updates arrive on the second Tuesday of the month, and what happens outside that day.
-
Optional preview updates, explained
What the optional "preview" update each month is, and whether you should install it.
-
Cumulative updates, servicing stack updates and enablement packages
What the three kinds of Windows update packages do, why one monthly update replaces all the earlier ones, and why a new Windows version can arrive with a single restart.
-
Out-of-band and zero-day updates, explained
What an out-of-band update is, how it differs from an update that fixes an exploited vulnerability, and when you should not wait for the next Patch Tuesday.
-
Why new Windows features roll out gradually
Why a feature from the release notes may be missing after you install the update, what "gradual rollout" and "normal rollout" mean, and which switch and policies control it.
-
How to reclaim disk space after Windows updates
Safely clean up old update files in the WinSxS folder and remove Windows.old after a version upgrade, without breaking Windows.
Lifecycles, editions, Insider & Hotpatch
Secure Boot 2026, Windows 10 ESU, LTSC vs IoT Enterprise, Insider channels & Hotpatch-
Secure Boot certificates in 2026: what changes and what to do
The Secure Boot certificates from 2011 began expiring in June 2026. Windows Update installs the new 2023 certificates on most PCs by itself; here is how to check yours and what happens if it misses them.
-
Windows 10 Extended Security Updates (ESU), explained
How Windows 10 22H2 keeps receiving security updates after free support ended on October 14, 2025, who can enroll, what each ESU program covers and how to check the licence.
-
Windows LTSC and IoT Enterprise LTSC, explained
How Windows Enterprise LTSC, LTSB and IoT Enterprise LTSC receive updates, which monthly KB articles apply to them, and how the 5-year and 10-year lifecycles differ.
-
Windows Insider channels, explained
What the Experimental, Beta and Release Preview channels are, how their build numbers relate to Windows 11 versions, and how to stop receiving preview builds without reinstalling.
-
Windows hotpatch updates, explained
How hotpatch installs Windows security updates without a restart, the 4-baseline and 8-hotpatch yearly cycle, what Windows 11 Enterprise and Windows Server 2025 need, and why hotpatch KB numbers differ.
Check your version, build & updates
Find your build and manage updates on Windows, PowerShell, .NET Framework, SQL, Exchange & SharePoint-
How to check your Windows version and build
Find out in a few seconds which Windows version and build you have, to know which updates apply to you.
-
How to check, install and hide Windows updates from PowerShell
List missing updates, install a specific KB or hide an unwanted update from the terminal with PSWindowsUpdate or Windows Update's built-in COM API.
-
How to check your .NET Framework version
Find out which .NET Framework versions your PC has, to know which monthly .NET Framework update applies to you.
-
How to check your SQL Server version
Find out which SQL Server version, build and servicing branch you run, to know which update applies to your server.
-
How to check your Exchange Server version
Find out which Exchange Server version, cumulative update and security update you run, to know which update applies to your servers.
-
How to check your SharePoint Server version
Find out which SharePoint Server or Office Online Server version and build you run, to know which update applies to your farm.
Recurring updates (same KB number every time)
Permanent KB numbers for Microsoft Defender, Malicious Software Removal Tool & Windows Update components-
KB890830: Windows Malicious Software Removal Tool
A monthly one-time Microsoft scanner that Windows Update runs in the background on Patch Tuesday to detect and remove specific widespread malware families.
Safe · One-time scan Read KB details → -
KB2267602: Microsoft Defender security intelligence update
Daily virus and threat definitions (plus monthly scanning engine updates) for Microsoft Defender Antivirus, always delivered under KB2267602.
Automatic · No restart Read KB details → -
KB4052623: Microsoft Defender antimalware platform update
The monthly update to the Microsoft Defender Antivirus program and services themselves, always released in phases under KB4052623.
Automatic · Core platform Read KB details → -
KB5007651: Windows Security app update
Updates the Windows Security app (Microsoft.SecHealthUI) and Windows Security platform service on Windows 11 under a permanent KB number.
Automatic · Windows 11 only Read KB details → -
KB4023057: Microsoft Update Health Tools
A recurring reliability update for Windows Update service components that repairs common update blockers and enables expedited updates in Microsoft Intune.
Automatic · Intune Expedite Read KB details → -
KB5001716: Update for Windows Update service components
A recurring servicing update that Microsoft re-releases to notify PCs approaching end of support and keep Windows Update transitions working.
Automatic · Lifecycle UI Read KB details →