This is the number one question we get from IT admins evaluating Deep Freeze. And honestly, it's the right question to ask.
"If Deep Freeze wipes all changes on reboot, how on earth do I keep Windows updated? How do I install new software? How do I apply security patches?"
Fair concern. If Deep Freeze truly wiped everything permanently, it would be a security nightmare: you'd be stuck running outdated, vulnerable systems forever. Obviously, that's not how it works.
The short answer: Deep Freeze has built-in maintenance windows that temporarily thaw your systems, apply updates, and refreeze automatically. You can schedule it, automate it, and largely forget about it.
But the short answer never tells the whole story. Let's walk through exactly how this works, what your options are, and the mistakes we've seen admins make over the years.
Why Updates Don't Stick by Default (And Why That's the Point)
First, let's understand what's actually happening under the bonnet.
When Deep Freeze is active - what we call the "Frozen" state - it redirects all write operations to a temporary allocation table instead of the actual hard drive. The original system data stays untouched. When you reboot, Deep Freeze discards that allocation table and the original baseline reappears.
This is exactly what makes Deep Freeze so effective. Malware can't persist. User mistakes get erased. Configuration drift is impossible. Every reboot returns to your known-good state.
But it also means that if you install Windows updates whilst frozen, those updates exist only in the temporary allocation table. Reboot, and they're gone - the system reverts to its previous (unpatched) state.
This isn't a bug. It's the core feature. The question is: how do you selectively allow certain changes (like updates) to become permanent whilst still protecting against everything else?
That's where maintenance mode comes in.
How Maintenance Mode Works: Thawing, Updating, Refreezing
The fundamental concept is straightforward: to make permanent changes to a frozen system, you temporarily "thaw" it. Whilst thawed, the system behaves like any normal Windows machine: changes write directly to the drive and persist across reboots. When you're done, you refreeze it, and that new state becomes the baseline.
You can do this manually: log in, enter your admin password, thaw the machine, run your updates, then refreeze. We've all done it in a pinch. But manual thawing doesn't scale. If you're managing 50, 200, or 2,000 machines, you need automation.
Deep Freeze provides several ways to automate this:
Scheduled Thaw Periods. You define a window - say, every Wednesday at 2 AM — when the machine automatically reboots into a thawed state. During this window, your updates run. When the window closes, the machine reboots and refreezes with the new baseline.
Windows Update Tasks. Deep Freeze Cloud and Enterprise have a dedicated Windows Update task type. It's smarter than a simple thaw window: it can download updates whilst still frozen (caching them locally), then thaw only long enough to install them. Once installation completes, it automatically refreezes. No fixed end time required.
Batch File Tasks. For third-party software updates or custom scripts, you can schedule batch files to run during thawed periods. Deep Freeze thaws the machine, executes your script, then refreezes when complete.
On-Demand Thaw. From the console or mobile app, you can manually trigger a thaw on specific machines or groups. Useful for emergency patches or one-off software installations.
The key insight is this: Deep Freeze doesn't fight against updates: it gives you precise control over when and how they happen.
Best Practices for Windows Updates with Deep Freeze
After years of supporting organisations running Deep Freeze at scale, we've learnt what works and what causes headaches. Here's our recommended approach:
Schedule maintenance during off-hours. This seems obvious, but it's worth stating: run your update windows when users aren't on the machines. For schools, that's evenings or weekends. For libraries, overnight. For 24/7 environments, find your lowest-usage window. The last thing you want is a machine rebooting mid-session.
Use "When Windows Update completes" rather than fixed end times. Early versions of Deep Freeze required you to set a fixed maintenance window - say, 2 AM to 4 AM. The problem? Sometimes updates finish in 20 minutes. Sometimes they take three hours. If the window closes before updates complete, you risk boot loops or incomplete installations. Modern versions let you select "When Windows Update completes"; the machine stays thawed until everything's properly installed, then automatically refreezes. Use this option.
Let Deep Freeze download updates whilst frozen. Deep Freeze can cache Windows updates even when the system is frozen. The actual installation requires a thaw, but downloading doesn't. This means your thaw window is spent installing, not waiting for multi-gigabyte downloads. It's significantly faster.
Use Wake-on-LAN for powered-off machines. Deep Freeze's power management can wake machines for scheduled maintenance, even if they're switched off. Configure this so your overnight updates actually happen, rather than failing because someone turned off the PC.
Consider using WSUS for more control. If you're running a WSUS server, Deep Freeze integrates with it. The advantage? You control exactly which updates get pushed. Deep Freeze's native Windows Update task applies Critical and Security updates by default, but WSUS lets you approve specific patches, defer feature updates, or test before deploying broadly.
Stagger your maintenance windows. Don't schedule all 200 machines to update at exactly 2 AM. Stagger them: Group A at 2 AM, Group B at 2:30 AM, and so on. This reduces load on your network and update servers, and means if something goes wrong, you catch it before the entire estate is affected.
Schedule restarts even without updates. Even if there are no pending updates, periodic reboots restore your frozen baseline and clear any accumulated session data. Many organisations schedule daily or weekly restarts as standard practice.
Updating Third-Party Software Without Breaking Things
Windows Update handles the OS. But what about Chrome, Firefox, Adobe Reader, Java, Zoom, and the dozens of other applications on your machines?
Same principle applies: updates must happen whilst thawed. But third-party updates need a bit more thought because Deep Freeze doesn't manage them directly.
Option 1: Use your existing deployment tools. If you're already using SCCM, Intune, PDQ Deploy, or similar, keep using them. Schedule your deployments to coincide with Deep Freeze's thaw periods. Deploy software whilst thawed, then let Deep Freeze refreeze with the new applications in the baseline.
Option 2: Use Deep Freeze's Batch File tasks. You can schedule batch files or PowerShell scripts to run during thawed periods. Write a script that silently updates your key applications, schedule it as a Batch File task, and Deep Freeze handles the thaw-execute-refreeze cycle automatically.
Option 3: Use Deep Freeze Cloud's Software Updater. If you're on certain Deep Freeze Cloud bundles, the Software Updater feature can handle common third-party applications automatically. It checks for updates and applies them during maintenance windows.
Critical tip: disable auto-updates within applications. Many applications try to update themselves automatically. On a frozen machine, these updates download, partially install, then vanish on reboot, wasting bandwidth and potentially causing odd behaviour. Disable auto-update features within the applications themselves, and manage updates centrally during thaw periods instead.
Antivirus definitions are a special case. Your AV software likely updates definitions multiple times daily. Some AV products can store definitions on a Thawed partition (more on that below), allowing updates to persist without thawing the entire system. Alternatively, schedule definition updates during your thaw periods. Coordinate with your AV vendor's documentation for best results.
Common Mistakes That Cause Headaches
We've been supporting Deep Freeze deployments for nearly 30 years. These are the update-related mistakes we see most often:
Updating whilst frozen and wondering why it didn't work. This happens more than you'd think, especially with new admins. They install updates, reboot, and the updates are gone. Then they install again, reboot again, same result. Check your freeze state before running updates. The polar bear icon in the system tray tells you: animated means frozen, static means thawed.
Forgetting to refreeze after manual thawing. You thaw a machine to install something, get distracted, and leave it thawed for days. That machine is now unprotected: accumulating changes, potentially picking up malware, drifting from your baseline. Always refreeze immediately when you're done. If you're prone to forgetting, use scheduled thaw periods with automatic refreeze instead of manual thawing.
Setting fixed maintenance windows that are too short. A two-hour window might be fine for monthly patch Tuesday. But if a machine has been off for weeks and has dozens of pending updates, two hours won't cut it. Use the "When Windows Update completes" option to avoid this problem entirely.
Not testing updates before mass deployment. This isn't Deep Freeze-specific, but it matters here too. Test updates on a pilot group first. If something breaks, you want to know before it affects your entire estate.
Ignoring Windows feature updates. Starting with Windows 10, Microsoft releases major feature updates once or twice yearly. These are large, time-consuming, and sometimes change things significantly. Deep Freeze handles them, but you should plan for longer maintenance windows and consider deferring them until you've tested thoroughly.
Using third-party update tools without coordination. Deep Freeze suppresses the Windows Update service whilst frozen to prevent conflicts. If you're using a third-party patching tool that depends on Windows Update, it may not work correctly unless it runs during thaw periods. Coordinate your tools with your Deep Freeze maintenance schedule.
A Note on ThawSpaces and Thawed Partitions
You might be wondering: is there any way to keep certain data persistent without thawing the entire system?
Yes. Deep Freeze offers ThawSpaces and Thawed partitions for exactly this purpose.
ThawSpaces are virtual partitions that remain writable even when the system is frozen. Data saved to a ThawSpace persists across reboots. They're useful for things like user documents, AV definitions, or application data that needs to survive reboots.
Thawed Partitions are entire drives that Deep Freeze ignores. If your machine has a D: drive set as Thawed, anything saved there persists regardless of the freeze state.
However - and this is important - you can't use ThawSpaces or Thawed partitions to make Windows updates persistent. The Windows system files live on the frozen system partition. Updates need to modify those files, which requires thawing the system partition itself.
ThawSpaces are for user data and specific application data. System updates require proper thaw periods.
Frequently Asked Questions
Can Windows updates install completely automatically?
Yes. Configure a Windows Update task in Faronics Cloud Deep Freeze, set it to run during off-hours, and select "When Windows Update completes." Deep Freeze will download updates whilst frozen, thaw automatically at the scheduled time, install updates, handle any required reboots, and refreeze when finished. No manual intervention required.
How often should I schedule maintenance windows?
It depends on your environment. Most organisations schedule Windows Update tasks weekly, often timed to coincide with Patch Tuesday (second Tuesday of each month) plus one or two additional runs to catch anything that requires multiple reboots. For environments with heavy usage or security sensitivity, consider running maintenance twice weekly. For lower-risk environments, fortnightly may suffice.
Can users update software themselves?
By default, no, and that's intentional. Any software users install whilst frozen will disappear on reboot. If you want users to be able to install persistent software, you'd need to give them thaw access, which defeats the purpose of protection. Better practice: let users request software through your normal IT channels, and deploy it centrally during maintenance windows.
What if a machine misses its maintenance window?
If a machine is powered off during its scheduled maintenance, the updates won't run. Options: enable Wake-on-LAN so Deep Freeze can wake the machine, or schedule a "catch-up" window during daytime hours as a fallback. Faronics Cloud Deep Freeze shows maintenance task status in the console, so you can identify machines that missed their window.
How do I handle machines that need different update schedules?
Create multiple policies. Deep Freeze lets you define different configurations for different groups of machines. Your computer labs might update weekly on Wednesdays, whilst library public PCs update daily overnight. Set up groups in your console and assign appropriate policies to each.
What about WSUS? Does Deep Freeze work with it?
Yes. You can configure Deep Freeze to pull updates from your WSUS server rather than directly from Microsoft. The advantage is control: WSUS lets you approve specific updates, test before deploying, and manage which updates reach which machines. Deep Freeze will install all WSUS-approved updates during the maintenance window.
Can I update Deep Freeze itself whilst the system is frozen?
No. Deep Freeze updates require the system to be thawed. You can push Deep Freeze updates from the console during maintenance windows, or schedule them as part of your regular maintenance cycle.
The Bottom Line: Updates and Deep Freeze Work Together
The concern that Deep Freeze prevents updates is one of the most common objections we hear: and one of the most easily addressed.
Yes, Deep Freeze wipes changes by default. That's the whole point. But it also gives you controlled windows to make permanent changes when you need them. Updates download whilst frozen. Machines thaw automatically at scheduled times. Updates install. Machines refreeze with the updated baseline.
The result? You get the security and consistency benefits of reboot-to-restore, whilst still maintaining fully patched, up-to-date systems. You don't have to choose.
Set up your maintenance windows properly, use the automation features we've built in, and updates become a non-issue. We've got organisations running thousands of frozen machines with fully automated patching. It works.
If you're still unsure how this would work in your environment, grab a trial and test it. Configure a maintenance window, run some updates, see how the process works in practice. That's worth more than any documentation.
Ready to See It in Action?
Try Faronics Cloud Deep Freeze free for 30 days. Set up a maintenance window, run some updates, and see how seamless it is.
