Introduction
Keeping software up to date is the single most important thing you can do to reduce cybersecurity risk. New security holes are discovered every day, and updates are how they get fixed, so updates need to be installed as soon as they are available.
For Everyone
When your computer asks you to restart for an update, do it as soon as you reasonably can. Save your work first. Restarting usually takes only a few minutes.
To check for updates yourself on Windows 11:
- Click the Start menu and open Settings.
- Click Windows Update in the left sidebar.
- Click Check for updates, then install anything it finds.
- If it says Restart now, save your work and click it.
The rest of this page is for the sysadmin.
Windows
Windows updates can be disruptive and often require a restart, so users given the choice will put them off as long as possible. This is not acceptable.
The best solution is to enforce updates through policy. The office does not use Active Directory, but the same result can be achieved with HotCakeX’s Harden System Security app, which includes update enforcement even at its lowest (1-star) configuration. The policy tells each machine to download and install updates automatically, and requires the user to restart within a set period.
The fallback is to sign in to each machine and install updates manually. This is not recommended, as it is time-consuming and easy to forget.
For applications other than Windows itself, have users install software with winget rather than downloading .exe installers, and install Winget-AutoUpdate (Romanitho.Winget-AutoUpdate), which checks for and installs updates automatically.
tetrataenite
Updates are downloaded automatically in the background and applied on the next boot. No action is needed beyond restarting the machine regularly.