Patch Tuesday goes wrong more often than Microsoft‘s release notes admit, and when it does, the failure mode is usually the same: the machine restarts, the spinning dots appear, and then nothing. No login screen. No error code worth typing into a search box. Just a boot loop or a black frame staring back at you.
I have kept a running log of these incidents on my own hardware and on machines friends dragged over to my desk. Six of them stand out, and each one taught a slightly different recovery lesson. Here they are, roughly in the order I hit them, with the fix that actually worked.
1. A monthly rollup that left the system on “Getting Windows ready”
This one is the most common shape of the problem. A cumulative update installs, the machine reboots, and then hangs on the “Getting Windows ready” screen indefinitely. The update essentially failed to finish committing, and the boot process is stuck waiting for it.
The fix that reliably works is a hard power-off, then booting into the recovery environment (hold Shift while clicking Restart, or interrupt the boot three times on a machine that will not cooperate). From there, Troubleshoot > Advanced options > Uninstall Updates lets you remove the most recent quality update. The system reboots cleanly after that. You can then reinstall the update later if you want, though I usually wait a cycle to see whether the next cumulative build covers it.
Keep a note of the KB number before you uninstall. Microsoft’s own guidance points to the Update history page under Settings > Windows Update, and having the number makes it far easier to check whether the issue is a known one or something local to your machine.
2. Broken Always On VPN after a security update
Microsoft has confirmed that Always On VPN connections may break after installing the September 2026 security patches for Windows 11. This is the sneaky class of breakage: the machine boots fine, the desktop loads, but remote workers discover the VPN tunnel will not come up, and from their perspective the laptop is “broken.”
Recovery here is not about booting, it is about isolating the update. If you can boot into Safe Mode with Networking, test the VPN there. If it works, the update is the culprit. The practical fix is to uninstall the offending security update, block it temporarily, and pin the machine to a working state until Microsoft ships a repair. That is annoying in a security context, but a laptop that cannot reach the corporate network is worse than one missing a single month’s patches. Note which update you removed so you can reinstall it once a fix cycle lands.
3. A driver update bundled into Windows Update that killed display output
Not every bad boot comes from a security patch. Windows Update occasionally pushes GPU drivers through the optional updates channel, and on older cards this has produced a boot that gets as far as the login screen and then flickers to black. The machine is alive, you just cannot see it.
Boot into Safe Mode (which loads the basic display driver) and open Device Manager. Expand Display adapters, right-click the GPU, and choose Roll Back Driver. If the button is greyed out, uninstall the device and let Windows re-detect it on the next boot. This is also the moment to visit the vendor’s own site and grab the correct driver package rather than trusting the one Windows chose. A clean install from the manufacturer usually sticks. I have seen this fix hold for months on an old ThinkPad.
4. A failed feature update that corrupted the boot configuration
Feature updates (the big version bumps) can fail midway and leave the boot configuration data damaged. The symptom is a “Boot device not found” or a recovery screen listing error codes you have never seen. The Windows partition is intact, the bootloader just cannot find its way to it.
From the recovery environment, open a command prompt and run bootrec /fixmbr, then bootrec /fixboot, then bootrec /rebuildbcd. In most cases the rebuild step finds the Windows installation and restores the entry. If it does not, you may need to run bcdboot against the system partition manually. This is the point where having a USB recovery drive you made in advance saves you a very long evening. Make one. It takes ten minutes and it is the single best insurance policy against this class of failure.
5. Antivirus and update interacting to produce a boot-time hang
Third-party security software sometimes intercepts file operations during the update’s commit phase and the two deadlock. The result is a machine that hangs at the vendor splash screen with no progress. The tell is that the update installed but the machine never reaches the desktop.
Boot into Safe Mode, uninstall the third-party antivirus, and let the machine start normally with Windows Security in place. Once it boots, reinstall a fresh copy of the antivirus from the vendor’s site. Clean reinstall beats repair here every time. Going forward, I pause Windows Update long enough to disable real-time protection before a major feature update, then re-enable it after. It is a small manual step that has saved me two support calls.
6. Storage full during the update’s staging phase
The most avoidable of the six. Updates need free disk space to stage files before the reboot. If the drive is nearly full, the update can fail partway and leave the machine unable to finish the commit, producing a boot loop.
Boot to recovery, open a command prompt, and delete temp files with cleanmgr or by clearing the %temp% and SoftwareDistribution folders. Then reboot. Windows will usually complete the pending update once there is room. The lesson is to keep at least 20 GB free on the system drive at all times. Storage Sense (under Settings > System > Storage) can handle the routine cleanup automatically, and it is worth turning on.
The habits that actually prevent these
Three things have consistently saved me from disaster. First, a bootable recovery USB made from the same Windows build, kept current. Second, a folder of notes with the KB number, the date, and what you changed, because without that you are guessing. Third, a pause before installing updates on any machine you depend on for work. Delaying by a week or so lets other people find these bugs first, and Microsoft’s release notes rarely tell you everything that broke.
None of this is glamorous. But if you keep a working recovery drive, know where the Uninstall Updates menu lives, and remember that bootrec exists, you can turn a dead laptop into a twenty-minute fix. That beats waiting on hold to confirm the machine is plugged in.