In Control with no Control: Perceptions and Reality of Windows 10 Home Edition Update Features, Jason Morris, Ingolf Becker, Simon Parkin – University College London Workshop on Usable Security (USEC) 201924 February 2019, San Diego, CA, USAISBN 1-1891562-53-3 http://dx.doi.org/10.14722/usec.2019.23008 – www.ndss-symposium.org: “Home computer users are regularly advised to install software updates to stay secure. Windows 10 Home edition is unique as it automatically downloads and installs updates, and restarts the computer automatically if needed. The automatic restarts can be influenced through a number of features, such as‘active hours’ (the period during which a computer will never automatically restart to finish installing an update) or by explicitly setting a time when to restart the computer. This research investigates if the features Microsoft provides for managing updates on Windows 10 Home edition are appropriate for computer owners.We build a model of the update behaviour of Windows 10. The model identifies all interaction points between the update system and the users. We contrast the theory with reality in a survey study with 93 participants which establishes the experiences and perceptions of users of Windows 10 Home.Windows will not restart a computer outside active hours if the computer is in use. However, if any user of a machine sets an explicit restart time, the computer will restart at that time in order to install quality updates even if the computer is still inactive use (potentially by a different user to the one who set the restart time). While overall perceptions of updates were positive,the pattern of use of almost all users was incompatible with the default setting of the ‘active hours’ feature. Only 28% of users knew of its existence. Users are mostly unaware of quality (bug-fix) updates, perceiving that updates act mostly to add features.Half of our participants report unexpected restarts, while half also reported growing concern about the state of their device if an update took a long time. Participants who had previous negative experiences had weaker beliefs about their ability to control updates than those who had not.We recommend that operating systems obtain explicit permission for restarts consistently; there are opportunities for default features such as active hours and update progress displays to learn from usage activity.”