Merge pull request #9201 from MicrosoftDocs/main

Publish main to live 12/08/2023, 3:30 PM

windows/deployment/update/servicing-stack-updates.md

@@ -15,21 +15,22 @@ appliesto:
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server </a>
-ms.date: 12/31/2017
+ms.date: 12/08/2023
 ---
 
 # Servicing stack updates
 
 ## What is a servicing stack update?
-Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically doesn't have updates released every month.
+
+Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the component-based servicing stack (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. [CBS](https://techcommunity.microsoft.com/t5/ask-the-performance-team/understanding-component-based-servicing/ba-p/373012) is a small component that typically doesn't have updates released every month.
 
 ## Why should servicing stack updates be installed and kept up to date?
   
-Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
+Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't have the latest servicing stack update installed, there's a risk that your device can't be updated with the latest Microsoft security fixes.
 
 ## When are they released?
 
-Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical."
+Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions, a servicing stack update might need to be released out of band to address an issue impacting systems installing the monthly security update. New servicing stack updates are classified as `Security` with a severity rating of `Critical`.
 
 
 ## What's the difference between a servicing stack update and a cumulative update?
@@ -38,14 +39,14 @@ Both Windows client and Windows Server use the cumulative update mechanism, in w
 
 Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest monthly security update release and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
 
-Microsoft publishes all cumulative updates and SSUs for Windows 10, version 2004 and later together as one cumulative monthly update to the normal release category in WSUS.
+Microsoft publishes all cumulative updates and servicing stack updates for Windows 10, version 2004 and later together as one cumulative monthly update to the normal release category in Windows Server Update Services (WSUS).
 
 ## Is there any special guidance?
 
-Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update.
-
 Typically, the improvements are reliability and performance improvements that don't require any specific special guidance. If there's any significant impact, it will be present in the release notes.
 
+Most users don't need to install an isolated servicing stack update. In the rare case that you need to install an isolated servicing stack update, Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update.
+
 ## Installation notes
 
 * Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system.
@@ -56,6 +57,6 @@ Typically, the improvements are reliability and performance improvements that do
 
 ## Simplifying on-premises deployment of servicing stack updates
 
-With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update includes the latest servicing stack updates, to provide a single cumulative update payload to both Windows Server Update Services (WSUS) and Microsoft Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you'll only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update is available on Windows 10, version 2004 and later starting with the 2021 2C release, KB4601382.
+With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update includes the latest servicing stack updates, to provide a single cumulative update payload to both WSUS and the Microsoft Update Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you'll only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update is available on Windows 10, version 2004 and later starting with [KB4601382](https://support.microsoft.com/kb/4601382), released in February of 2021.
 
 

windows/deployment/update/windows-update-logs.md

@@ -13,7 +13,7 @@ ms.collection:
 appliesto: 
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
 - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>	
-ms.date: 12/31/2017
+ms.date: 12/08/2023
 ---
 
 # Windows Update log files
@@ -24,18 +24,20 @@ The following table describes the log files created by Windows Update.
 
 |Log file|Location|Description|When to use |
 |-|-|-|-|
-|windowsupdate.log|C:\Windows\Logs\WindowsUpdate|Starting in Windows 8.1 and continuing in Windows 10, Windows Update client uses Event Tracing for Windows (ETW) to generate diagnostic logs.|If you receive an error message when you run Windows Update, you can use the information that is included in the Windowsupdate.log log file to troubleshoot the issue.|
-|UpdateSessionOrchestration.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the Update Orchestrator is responsible for sequence of downloading and installing various update types from Windows Update. And the events are logged to these .etl files.|When you see that the updates are available but download is not getting triggered.  <br>When Updates are downloaded but installation is not triggered.<br>When Updates are installed but reboot is not triggered. |
+|windowsupdate.log|C:\Windows\Logs\WindowsUpdate|Starting in Windows 8.1 and continuing in Windows 10, Windows Update client uses Event Tracing for Windows (ETW) to generate diagnostic logs.|If you receive an error message when you run Windows Update, you can use the information included in the Windowsupdate.log log file to troubleshoot the issue.|
+|UpdateSessionOrchestration.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the Update Orchestrator Service is responsible for sequence of downloading and installing various update types from Windows Update. And the events are logged to these .etl files.|<ul> <li>When you see that the updates are available but download isn't getting triggered.  </li><li>When updates are downloaded but installation isn't triggered. </li> <li>When updates are installed but reboot isn't triggered. </li></ul> |
 |NotificationUxBroker.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the notification toast or the banner is triggered by NotificationUxBroker.exe. |When you want to check whether the notification was triggered or not. |
 |CBS.log|%systemroot%\Logs\CBS|This log provides insight on the update installation part in the servicing stack.|To troubleshoot the issues related to Windows Update installation.|
 
 ## Generating WindowsUpdate.log
+
 To merge and convert Windows Update trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](/powershell/module/windowsupdate/get-windowsupdatelog?preserve-view=tru&view=win10-ps). 
 
 >[!NOTE]
 >When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpdate.log unless you run **Get-WindowsUpdateLog** again. 
  
-### Windows Update log components 
+## Windows Update log components
+
 The Windows Update engine has different component names. The following are some of the most common components that appear in the WindowsUpdate.log file: 
 
 - AGENT- Windows Update agent 
@@ -54,7 +56,7 @@ The Windows Update engine has different component names. The following are some
 - PT- Synchronizes updates information to the local datastore 
 - REPORT- Collects reporting information 
 - SERVICE- Startup/shutdown of the Automatic Updates service 
-- SETUP- Installs new versions of the Windows Update client when it is available 
+- SETUP- Installs new versions of the Windows Update client when it's available 
 - SHUTDWN- Install at shutdown feature 
 - WUREDIR- The Windows Update redirector files 
 - WUWEB- The Windows Update ActiveX control 
@@ -68,7 +70,7 @@ The Windows Update engine has different component names. The following are some
 >[!NOTE]
 >Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what's important. 
  
-### Windows Update log structure 
+## Windows Update log structure 
 The Windows update log structure is separated into four main identities: 
 
 - Time Stamps 
@@ -82,7 +84,7 @@ The Windows update log structure is separated into four main identities:
 
 The WindowsUpdate.log structure is discussed in the following sections. 
 
-#### Time stamps  
+### Time stamps  
 The time stamp indicates the time at which the logging occurs. 
 - Messages are usually in chronological order, but there may be exceptions. 
 - A pause during a sync can indicate a network problem, even if the scan succeeds. 
@@ -90,15 +92,15 @@ The time stamp indicates the time at which the logging occurs.
    ![Windows Update time stamps.](images/update-time-log.png)
 
 
-#### Process ID and thread ID  
+### Process ID and thread ID  
 The Process IDs and Thread IDs are random, and they can vary from log to log and even from service session to service session within the same log. 
-- The first four hex digits are the process ID. 
-- The next four hex digits are the thread ID. 
+- The first four digits, in hex, are the process ID. 
+- The next four digits, in hex, are the thread ID. 
 - Each component, such as the USO, Windows Update engine, COM API callers, and Windows Update installer handlers, has its own process ID.   
    ![Windows Update process and thread IDs.](images/update-process-id.png)
 
 
-#### Component name  
+### Component name  
 Search for and identify the components that are associated with the IDs. Different parts of the Windows Update engine have different component names. Some of them are as follows: 
 
 - ProtocolTalker - Client-server sync 
@@ -111,31 +113,36 @@ Search for and identify the components that are associated with the IDs. Differe
 ![Windows Update component name.](images/update-component-name.png)
 
 
-#### Update identifiers  
+### Update identifiers  
+
+The following items are update identifiers:
+
+#### Update ID and revision number 
 
-##### Update ID and revision number 
 There are different identifiers for the same update in different contexts. It's important to know the identifier schemes. 
-- Update ID: A GUID (indicated in the previous screenshot) that's assigned to a given update at publication time 
+- Update ID: A GUID (indicated in the previous screenshot) assigned to a given update at publication time 
 - Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service 
 - Revision numbers are reused from one update to another (not a unique identifier). 
 - The update ID and revision number are often shown together as "{GUID}.revision." 
    ![Windows Update update identifiers.](images/update-update-id.png)
 
 
-##### Revision ID 
-- A Revision ID (don't confuse this value with "revision number") is a serial number that's issued when an update is initially published or revised on a given service. 
-- An existing update that's revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a new revision ID that is not related to the previous ID. 
+#### Revision ID
+
+- A Revision ID (don't confuse this value with "revision number") is a serial number issued when an update is initially published or revised on a given service. 
+- An existing update that is revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a new revision ID that isn't related to the previous ID. 
 - Revision IDs are unique on a given update source, but not across multiple sources. 
 - The same update revision might have different revision IDs on Windows Update and WSUS. 
 - The same revision ID might represent different updates on Windows Update and WSUS. 
 
-##### Local ID 
-- Local ID is a serial number issued when an update is received from a service by a given Windows Update client 
+#### Local ID
+
+- Local ID is a serial number issued by a given Windows Update client when an update is received from a service. 
 - Typically seen in debug logs, especially involving the local cache for update info (Datastore) 
-- Different client PCs will assign different Local IDs to the same update 
+- Different client PCs assign different Local IDs to the same update 
 - You can find the local IDs that a client is using by getting the client's %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file 
 
-##### Inconsistent terminology 
+#### Inconsistent terminology 
 - Sometimes the logs use terms inconsistently. For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs. 
 - Recognize IDs by form and context: