Keep Windows 11 and 10 Up to Date: The Five Layers the Green Tick Misses
—
Keeping a Windows 11 or 10 PC up to date is five separate jobs that most people think are one: Windows itself (Windows Update), the drivers and firmware (Windows Update, optional updates, and the maker's tools), Microsoft Store apps (the Store's own updater), Microsoft 365 and other desktop programs (their own updaters, or winget), and the security intelligence for Defender (several times a day, on its own). Windows handles the first and last automatically; the middle three are where PCs quietly fall behind. This guide shows how to check and control each one, what the settings on the Windows Update page actually do (pause, active hours, optional updates, "get the latest updates as soon as they're available"), which build you should be on in September 2026, and, for anyone looking after more than one machine, how Windows Update for Business, Intune update rings and WSUS turn "keep it updated" into a policy with a report.
"It says up to date" — and three things weren't
A customer brought Jake a laptop that "kept getting hacked". Windows Update said You're up to date. Jake believed it, because the page said so in green.
"Up to date about what?" Ethan asked. He opened a terminal and ran winget upgrade. Fourteen lines: a browser two versions behind, a PDF reader from 2023 with a known exploit, a video-call app from last year, and a Java runtime nobody remembered installing. Then the Microsoft Store: eleven apps waiting. Then the maker's support page: a BIOS from 2022 with a security advisory.
"Windows was up to date," Ethan said. "Windows was never the problem. The PDF reader was."
That laptop had done exactly what the green tick promised, and no more. This page is about the other four jobs, and about making all five automatic.
The five things "up to date" actually means
| Layer | Updated by | Automatic? | Where you check |
|---|---|---|---|
| Windows (cumulative updates, security fixes, feature updates) | Windows Update | Yes, on a schedule you can shape | Settings → Windows Update |
| Defender security intelligence | Windows Update / Defender itself | Yes, several times a day | Windows Security → Virus & threat protection → Protection updates |
| Drivers and firmware | Windows Update (some), optional updates (more), the maker's tool (BIOS, chipset) | Partly | Windows Update → Advanced options → Optional updates; the maker's app |
| Store apps (and Windows components delivered as Store apps: Photos, Terminal, Notepad, Paint) | Microsoft Store | Usually, when the Store is allowed to | Microsoft Store → Library |
| Desktop programs (browsers, Office, Zoom, PDF readers, Java, runtimes) | Each program's own updater, or winget | Sometimes; often silently broken | winget upgrade in a terminal |
The green tick on the Windows Update page covers the first two, and, since 2023, some drivers. It says nothing about the last two, which is where the exploited PDF readers live.
Job 1: Windows Update, and what each setting on the page does
Settings → Windows Update (Windows 11) or Settings → Update & Security → Windows Update (Windows 10). Check for updates asks now; Windows checks on its own daily. The settings people misunderstand:
- Pause updates (1 to 5 weeks): stops everything, including security fixes, until the date. Use it for a week around a known bad update, not as a permanent setting; when the pause ends, everything installs at once. Our stop automatic updates guide covers the honest options for people who need more control. - Active hours (Advanced options): the hours Windows won't restart. Set them to your real working day; Windows can also set them automatically from your usage. - Get the latest updates as soon as they're available (Advanced options): opts you into the optional non-security preview updates in the fourth week of the month, before the next Patch Tuesday. Off for anyone who values stability; on for people who want features first. - Receive updates for other Microsoft products (Advanced options): lets Windows Update also patch Office (perpetual versions), SQL Server, and so on. Turn it on. - Optional updates (Advanced options): driver updates and non-security previews that Windows offers but doesn't force. Worth a look monthly; see drivers. - Update history: what installed, what failed, and the Uninstall updates link. When an update breaks something, our uninstall a Windows update guide takes over.
Monthly rhythm. Security updates arrive on the second Tuesday of the month (Patch Tuesday); an optional preview lands in the fourth week; occasionally an out-of-band fix appears when a Patch Tuesday update breaks something (September 2026's KB5124008 needed one six days later). A PC that installs the Patch Tuesday update within a week is doing fine; one that shows Last checked: 3 months ago has a problem, and the Windows Update troubleshooting guide starts there.
Job 1b: Are you on a supported version at all?
Settings → System → About → Windows specifications → Version. As of September 2026:
| Version | Status | What to do |
|---|---|---|
| Windows 11 25H2 | Current | Nothing; keep the monthly updates flowing |
| Windows 11 24H2 | Supported (Home/Pro until late 2026; Enterprise/Education into 2027) | Fine; take 25H2 when offered, it's a small enablement update |
| Windows 11 23H2 and older | Home/Pro out of support | Windows Update should offer 24H2/25H2; if it doesn't, the PC requirements guide explains the block |
| Windows 10 22H2 | Out of support since Oct 14, 2025 unless enrolled in ESU | Enroll in consumer ESU (free with a Microsoft account backup, or paid) for security fixes until October 12, 2027; plan the replacement |
The version line is the one software requirements quote, and the one that decides whether security updates still arrive. Being "up to date" on an unsupported version means the last update it will ever get.
Job 2: Drivers and firmware (the ones Windows Update won't push)
- Windows Update → Advanced options → Optional updates → Driver updates. Windows lists drivers it has but won't force (graphics, audio, network, chipset). Install the ones for hardware you use; skip the ones for devices you don't recognize.
- Graphics drivers: NVIDIA, AMD and Intel ship far more often than Windows Update offers them. Their own apps (NVIDIA App, AMD Adrenalin, Intel Driver & Support Assistant) keep them current; a game or a display problem is usually a driver version away (display problems after an update).
- BIOS/UEFI and firmware: never via Windows Update on most consumer PCs. The maker's tool (Dell SupportAssist, Lenovo Vantage, HP Support Assistant, ASUS MyASUS) or the support page for your model (find the model and current BIOS version). Update firmware when the notes mention security, TPM, Secure Boot or a problem you have; not for sport.
- Device Manager → right-click → Update driver → Search automatically still exists and still mostly says "the best drivers are already installed", because it only asks Windows Update. It's not the tool it looks like.
Don't install "driver updater" programs from the internet; they are the category of software most often bundled with the adware that causes the Edge "managed by your organization" banner.
Job 3: Microsoft Store apps (including the Windows apps you didn't know were Store apps)
Microsoft Store → Library (bottom left) → Get updates. This covers Store apps you installed and the pieces of Windows now delivered through the Store: Photos, Notepad, Paint, Terminal, Snipping Tool, Calculator, the Xbox app, and Copilot. App updates under Store settings should be on; if the Store never updates, the Windows Store troubleshooting steps usually fix it, and wsreset.exe clears its cache.
Job 4: Every other program, with winget (the command that changes everything)
Windows 11 and updated Windows 10 include winget, Microsoft's package manager. In a terminal:
winget upgradelists every installed program it knows with an update available: browsers, Zoom, PDF readers, 7-Zip, VLC, Java, runtimes, Office (Click-to-Run), Teams, dozens more. Then:
winget upgrade --all --silent --accept-package-agreements --accept-source-agreementsupdates all of them in one go, mostly without prompts. Two honest caveats: some installers still pop a window or want a restart; and for a program installed outside winget's knowledge you'll see "unknown" as the version and it's skipped (--include-unknown forces it, at some risk of reinstalling). Run it weekly; put it in a Task Scheduler task at a quiet time if you'd rather never think about it.
Office: Microsoft 365 updates itself (File → Account → Update Options → Update Now checks immediately). Perpetual Office 2021/2024 updates through Windows Update if Receive updates for other Microsoft products is on.
Job 5: Security intelligence (already automatic; here's how to confirm)
Windows Security → Virus & threat protection → Virus & threat protection updates → Protection updates → Check for updates. The version and date should be from today; Defender fetches several times a day. If it's days old, Windows Update is stuck, and the update troubleshooting guide applies. If the notification says Defender is off while it's plainly running, that was a known false alert in August–September 2026, fixed in Defender platform 4.18.26080.4; our threat service post covers the real failure.
🙋♂️ Jake's Reality Check
"Can't I just turn on one thing that keeps everything updated?"
The straight answer: two things, not one, and neither is a paid program. Windows Update with Receive updates for other Microsoft products on handles Windows, Defender, Office and some drivers. A weekly winget upgrade --all handles the rest of your programs. The Store updates itself if you let it. That's the whole system; "update everything" utilities from the internet exist to sell you the thing Windows already does, and several of them are the malware they claim to prevent.
For IT admins: policy, rings and reports instead of green ticks
Windows Update for Business (WUfB). The set of policies that shapes Windows Update on Pro, Enterprise and Education without a server. Group Policy: Computer Configuration → Administrative Templates → Windows Components → Windows Update → Manage updates offered from Windows Update: Select when Quality Updates are received (defer 0–30 days), Select when Preview Builds and Feature Updates are received (defer up to 365 days), Select the target Feature Update version (pin to 24H2 or 25H2 so a feature update never surprises a fleet), plus Manage end user experience: active hours, deadlines (auto-restart after N days), and notifications.
Intune update rings. Devices → Update rings for Windows 10 and later: the same deferrals and deadlines as a profile assigned to a group. The usual pattern is three rings: Pilot (0-day deferral, IT's own machines), Broad (7-day quality deferral), Critical (14-day). Feature updates for Windows 10 and later pins the version; Expedite policies push an out-of-band fix immediately when one lands; and Driver updates policies (2023 onward) let you approve or auto-approve driver updates per group, which is the answer to "how do we control drivers" that WSUS never had.
WSUS / Configuration Manager. The on-premises route: approve or decline each update per group, with full reporting. Still supported, still the right tool for air-gapped or heavily regulated networks; Microsoft's direction is WUfB and Intune for everything else.
Reporting. Intune → Reports → Windows Update reports (compliance per ring and per device, and the Windows feature/quality update failures report) shows which devices are behind and why. Without Intune, Windows Update for Business reports in Azure Monitor does the same. The report replaces the green tick: it tells you the forty machines' state, not one.
Apps at scale. winget works in scripts and in Intune (as a Win32 app or a remediation), and Intune's Enterprise App Management catalog (licensed add-on) does the same with a catalog and reporting. The Store's updates are controlled with Turn off automatic download and install of updates (leave it Not Configured unless you have a reason). For Microsoft 365 Apps, the Office cloud update service or the Servicing Profile in the Microsoft 365 Apps admin center sets the channel and the deadline.
Windows 10 ESU for a fleet: the commercial ESU is per device per year (three years), activated with a MAK key or through Intune; the deadline logic and reports are the same as above.
✅ The admin's version in one line
Three update rings with deferrals and deadlines, a pinned feature-update version, driver updates approved by policy, winget for the rest of the apps, and a compliance report you look at monthly. "Up to date" is then a column in a report, not a green tick on one screen.
"Up to date" problems: the fix table
| What you see | What it means | What to do |
|---|---|---|
| "You're up to date" but programs are old | Windows Update doesn't cover desktop programs | winget upgrade --all; check the Store Library |
| Last checked weeks ago | Windows Update service or connectivity problem | Windows Update troubleshooting; net start wuauserv |
| Feature update to 25H2 not offered | Safeguard hold, or a policy pinning the version | Wait, or check gpresult /r for Select the target Feature Update version |
| Optional updates page empty | Nothing offered, or a policy hides drivers | Normal on well-supported hardware; check the maker's tool for BIOS |
| Store won't update apps | Store cache or service | wsreset.exe; sign out and in to the Store |
winget not recognized | App Installer missing or old | Install App Installer from the Store, or update it there |
| An update keeps failing | Component store or a specific KB problem | 0x80073712, 0x800f0922, 0x80070005 each have their own page |
| "Some settings are managed by your organization" on the Update page | A policy (or a leftover one) | The managed-by-administrator guide |
| Windows 10 says no more updates | Out of support, no ESU | Enroll in ESU or move to Windows 11; the requirements guide |
| Update installed and broke something | A bad monthly update | Uninstall it and pause for a week |
Keeping Windows up to date: the questions people search
How do I keep my computer up to date in Windows 11?
Settings → Windows Update → Check for updates, with Receive updates for other Microsoft products turned on under Advanced options; Microsoft Store → Library → Get updates for Store apps; and winget upgrade --all in a terminal for other programs. Drivers and BIOS come from Optional updates and the PC maker's tool.
Does Windows Update update all my programs?
No. It updates Windows, Defender, some drivers and (if enabled) other Microsoft products such as Office. Browsers, Zoom, PDF readers, Java and most desktop programs update themselves or through winget.
What is winget and is it safe?
Microsoft's package manager, built into Windows 11 and updated Windows 10 through the App Installer. winget upgrade lists updates and winget upgrade --all installs them from the publishers' own installers. It's a Microsoft tool and the safest way to update many programs at once.
How often should I check for updates?
Windows checks daily by itself; the security update lands on the second Tuesday of each month. Run winget upgrade --all and the Store's Get updates weekly. Check for BIOS and graphics driver updates monthly or when something misbehaves.
Should I turn on "Get the latest updates as soon as they're available"?
Only if you want the optional preview updates a few weeks early. For stability leave it off; you still get every security update on Patch Tuesday.
What version of Windows 11 should I be on in 2026?
25H2 is current; 24H2 is still supported. Older versions are out of support for Home and Pro and should be updated through Windows Update.
Is Windows 10 still getting updates?
Only with Extended Security Updates. Windows 10 22H2 support ended October 14, 2025; consumer ESU provides security updates until October 12, 2027. Without ESU, it receives nothing new.
How do I update drivers in Windows 11?
Settings → Windows Update → Advanced options → Optional updates → Driver updates for what Windows offers; the graphics maker's app for GPU drivers; the PC maker's support tool for BIOS, chipset and firmware. Avoid third-party "driver updater" programs.
How do I update Microsoft Store apps?
Microsoft Store → Library → Get updates. Turn on App updates in the Store's settings so it happens automatically.
Can I pause Windows updates permanently?
The Settings page allows up to five weeks. Windows Update for Business policies allow longer deferrals and version pinning on Pro and above. Disabling updates entirely is possible but leaves the PC without security fixes; the stop-automatic-updates guide covers the trade-offs.
How do IT admins keep all computers up to date?
Windows Update for Business policies (Group Policy or Intune update rings) with deferrals, deadlines and a pinned feature-update version; driver update policies; WSUS or Configuration Manager where on-premises control is required; winget or Enterprise App Management for other software; and the Intune Windows Update reports for compliance.
What is Windows Update for Business?
The set of policies that lets organizations control Windows Update on Pro, Enterprise and Education editions without a server: when quality and feature updates are offered, deadlines, active hours, and which feature version a device targets.
How do I know if my BIOS needs updating?
Compare your version (msinfo32 → BIOS Version/Date) with the maker's support page for your model. Update when the release notes mention security, stability, TPM or Secure Boot fixes, or a problem you're seeing.
Why does my PC say it's up to date but still has problems?
Because Windows is up to date and something else isn't: an old driver, an old program, or an out-of-support Windows version. Check the other four layers.
Does winget upgrade --all need administrator rights?
For programs installed for all users, yes; run the terminal as administrator. Per-user apps update without it.
Does Windows 10 have winget and the same Windows Update settings?
Windows 10 22H2 has winget through App Installer and most of the same Windows Update settings under Update & Security; but without ESU it no longer receives Windows updates at all.
If you've been trusting the green tick, you weren't wrong to; it just answers a smaller question than it looks like. Turn on the "other Microsoft products" option, run one winget command a week, glance at the Store, and you've covered the part of "up to date" that the tick never did. If a screen here has moved by the time you read it, tell me through the contact page; Windows changes the update page every version, and this page stays accurate because readers write in.
📌 If you keep one line from this page
"Up to date" is five layers: Windows, Defender, drivers/firmware, Store apps, desktop programs. The green tick covers two.
Windows Update with "other Microsoft products" on, plus a weekly winget upgrade --all, plus the Store's Get updates: that's the whole routine.
Revision note. Originally published December 2016 for Windows 10; rewritten September 26, 2026, for Windows 11 25H2 and Windows 10 on ESU, adding the five-layer model, winget, driver and firmware guidance, the version table, and the Windows Update for Business, Intune and WSUS section. Version support dates are current as of that date. Next check: when 26H1 or the next Windows 10 ESU milestone lands. Windows updates itself; the other four layers are yours.