In Control with no Control: Perceptions and Reality of Windows 10 Home Edition Update Features

Abstract

Home computer users are regularly advised to install software updates to stay secure. Windows 10 Home edition is unique as it automatically downloads and installs updates, and restarts the computer automatically if needed. The automatic restarts can be influenced through a number of features, such as 'active hours' (the period during which a computer will never automatically restart to finish installing an update) or by explicitly setting a time when to restart the computer. This research investigates if the features Microsoft provides for managing updates on Windows 10 Home edition are appropriate for computer owners. We build a model of the update behaviour of Windows 10. The model identifies all interaction points between the update system and the users. We contrast the theory with reality in a survey study with 93 participants which establishes the experiences and perceptions of users of Windows 10 Home. Windows will not restart a computer outside active hours if the computer is in use. However, if any user of a machine sets an explicit restart time, the computer will restart at that time in order to install quality updates even if the computer is still in active use (potentially by a different user to the one who set the restart time). While overall perceptions of updates were positive, the pattern of use of almost all users was incompatible with the default setting of the 'active hours' feature. Only 28% of users knew of its existence. Users are mostly unaware of quality (bugfix) updates, perceiving that updates act mostly to add features. Half of our participants report unexpected restarts, while half also reported growing concern about the state of their device if an update took a long time. Participants who had previous negative experiences had weaker beliefs about their ability to control updates than those who had not. We recommend that operating systems obtain explicit permission for restarts consistently; there are opportunities for default features such as active hours and update progress displays to learn from usage activity.

On the stress potential of an organisational climate of innovation: a survey study in Germany

“…For the directionality of this relationship, there is only sparse evidence in the context of research on digital stress, with Shu, Tu, and Wang (2011) highlighting that these two stressors often accompany each other when new systems are introduced but they do not discuss whether the perception of these stressors could influence each other. We find some evidence for a potential directionality in a recent survey by Morris, Becker, and Parkin (2019) though, who found that the process of changing a system causes uncertainty, particularly as users are expecting problems with their device if an update takes place.…”

The boundedly rational employee: Security economics for behaviour intervention support in organizations1

“…This moves in the direction of better matching updates to the work context, i.e., how operating system updates interact with corporate applications and systems, and how updates can fit into the work day of employees. This would be akin to knowing employees' 'Active Hours' (as is already seen within Windows 10 home installations [66]), and assessing whether these hours make it feasible to install the updates within the working day.…”

“…Rational advice to keep a system up-to-date does not consider that modern systems may already be doing (some or all of) this without user involvement, so advice may, for example, need to consider specific operating system software. Unless an operating system or application provides separate feature updates and security updates, the value of updates for security may not allow a decision-maker to consider clear choices [66]. A bounded security decision-making approach would acknowledge how updates work on the system the decision-maker is using.…”