Microsoft introduces reboot-free patching to minimize downtime for enterprise users.
Published: May 08, 2025
Key Takeaways:
Microsoft has announced that the first hotpatch update for Windows 11 Enterprise version 24H2 will roll out to businesses in the second week of May 2025. To receive it, organizations must enroll their devices in hotpatching and ensure the April 2025 baseline update is installed.
Microsoft first announced hotpatching support for Windows 11 Enterprise version 24H2 in April 2025. This feature allows security updates to be applied without requiring a system reboot. It works by dynamically modifying the in-memory code of system processes, so the updates take effect immediately.
Hotpatching follows a quarterly update cycle. Every three months, devices receive a full cumulative update with security fixes, new features, and enhancements, and this update requires a system restart. In the intervening months, devices get hotpatch updates that include only security patches and do not require a reboot. This approach keeps systems secure while minimizing downtime and disruptions for both end users and IT administrators.
Microsoft says that the upcoming Patch Tuesday update for Windows 11 Enterprise version 24H2 will be delivered as a hotpatch. To qualify for this reboot update, the device must have already installed the April baseline cumulative update. This feature also requires Virtualization-based Security (VBS) enabled and a Microsoft subscription, including Windows 11 Enterprise E3/E5/F3, Windows 11 Education A3/A5, or a Windows 365 Enterprise subscription.
Additionally, IT administrators will be required to create a hotpatch-enabled quality update policy in Windows Autopatch. Log in to the Microsoft Intune admin center, navigate to Devices > Windows updates > Create Windows quality update policy, and select the “Allow” option.
Hotpatching is currently supported on 64-bit Windows 11 Enterprise 24H2 devices with AMD or Intel processors. For Arm-based devices, the feature is available only in preview. To test hotpatching in production environments on Arm64 devices, IT administrators must disable CHPE support by configuring the HotPatchRestrictions registry key.