Enable and Verify Hotpatching on Windows Server 2025

Hotpatch can apply eligible Windows Server 2025 security updates without a restart between periodic baseline updates. For Windows Server 2025 Standard and Datacenter outside Azure Edition, this guide uses an Azure Arc-connected pilot server. Datacenter: Azure Edition has a different enablement path. Hotpatch does not remove every reboot: baselines, certain out-of-band updates, and other maintenance can still require one.

Keep the existing patching plan

Choose one noncritical pilot server and record its current update tool, maintenance window, reboot policy, and application health checks. Do not assume Arc enablement means all future updates are restart-free. Follow the published update classification and the server’s actual pending-restart state.

01

Confirm the OS Edition and Build

Eligibility

Run the inventory locally. Azure Arc hotpatch eligibility is for Windows Server 2025 Standard or Datacenter on a supported build; Microsoft’s current prerequisite is build 26100.1742 or later. Preview and Insider builds are not supported. Record whether the installation is Server Core or Desktop Experience and confirm the machine is properly licensed.

Get-CimInstance Win32_OperatingSystem |
  Select-Object Caption, Version, BuildNumber, OSArchitecture
Get-ComputerInfo |
  Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

❯ What to Verify

The pilot is a supported Windows Server 2025 edition and build.
Its edition and update baseline are recorded before enrollment.

02

Check Firmware and Virtual Security Prerequisites

Platform

Confirm UEFI, Secure Boot, and the virtualization-based security requirements in Microsoft’s hotpatch documentation. A Hyper-V pilot VM needs a Generation 2 configuration. Check Virtual Secure Mode status locally. Enabling VBS features can require a reboot and compatibility review, so schedule any prerequisite change separately rather than making it during the hotpatch enrollment check.

Confirm-SecureBootUEFI
Get-CimInstance -Namespace 'root/Microsoft/Windows/DeviceGuard' `
  -ClassName Win32_DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus,
                SecurityServicesConfigured, SecurityServicesRunning

❯ What to Verify

Secure Boot and VBS status meet the current hotpatch prerequisites,
or the server is held for a separate platform change.

Do not turn on security features blindly

If VBS is not running, review firmware, hypervisor, driver, and workload compatibility with the server owner. The Azure portal can reject hotpatch enablement when VSM is absent. Record and test the prerequisite change before retrying enrollment.

03

Verify Azure Arc Connectivity

Arc

Confirm the server is connected to the intended Azure subscription and resource group through the Azure Connected Machine agent. If it is not enrolled, follow the organization’s Azure Arc onboarding procedure with its approved identity and network path. Avoid copying an onboarding script from another tenant. In the Azure portal, check that the Arc machine status is Connected before enabling hotpatch.

# Run where the Azure Connected Machine agent is installed.
& "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" show

❯ What to Verify

The Arc machine reports Connected and points to the approved tenant,
subscription, and resource group.

04

Enable Hotpatch for the Pilot Machine

Enrollment

In the Azure portal, open Azure Arc > Machines, select the pilot machine, then select Hotpatch > Confirm. Wait for the status to settle and investigate a Pending or failed state through Arc agent health and Microsoft’s current troubleshooting notes. Record the time and status. Enabling the feature does not install an update immediately; an applicable hotpatch must be released and offered.

Azure portal > Azure Arc > Machines > pilot server > Hotpatch > Confirm
Verify: Hotpatch status shows Enabled for the pilot machine

❯ What to Verify

The selected Arc machine shows hotpatch enabled. Other servers remain
outside the pilot assignment.

05

Identify the Current Baseline and Update Type

Patch Planning

Compare the server’s installed updates with the current Windows Server hotpatch release notes and the update offered by the existing patch tool. A planned baseline is a cumulative update and requires a restart; later hotpatch releases in the cycle normally do not. An unplanned baseline can also require a restart. Keep the normal maintenance window for the first baseline and for any update that reports a reboot requirement.

Get-HotFix | Sort-Object InstalledOn -Descending |
  Select-Object -First 10 HotFixID, Description, InstalledOn
Get-CimInstance Win32_OperatingSystem |
  Select-Object Caption, Version, BuildNumber, LastBootUpTime

❯ What to Verify

The deployed baseline and offered update are identified by KB/build.
The maintenance plan reflects the update's actual reboot requirement.

Do not label every monthly patch a hotpatch

Only eligible hotpatch packages on an eligible, correctly based server avoid a restart. If a baseline is missing or an update is delivered as a regular cumulative update, plan for a reboot. An unrelated driver or application update may also require one.

06

Deploy One Update and Verify Service Health

Validation

Use the organization’s approved Windows Update or Azure Update Manager workflow for the pilot server. Review the update title, KB, deployment result, and reboot status. Compare build and boot time before and after, then run the application’s health checks. A successful installation with unchanged boot time supports a no-restart outcome for that update; it does not guarantee the next update will be the same.

Get-HotFix | Sort-Object InstalledOn -Descending |
  Select-Object -First 10 HotFixID, InstalledOn
Get-CimInstance Win32_OperatingSystem |
  Select-Object BuildNumber, LastBootUpTime

❯ What to Verify

Deployment history shows the specific update and status. Application
health, installed build, and any restart are documented for the pilot.

07

Review Exceptions Before Wider Enrollment

Closeout

If hotpatch status fails or the server receives a normal cumulative update, check Arc connection, VBS status, edition/build, and baseline level. Consult the current known-issues section rather than applying an old registry workaround to a new build. Expand to another server group only after a baseline cycle and a hotpatch cycle have both been observed with the application owner.

Pilot record: server | edition/build | Arc status | VBS status |
              baseline KB | hotpatch KB | reboot result | app checks

❯ What to Verify

The pilot has a documented result, known exceptions, and a maintenance
plan that still allows required baseline and emergency reboots.

Primary references

See Microsoft’s Azure Arc hotpatch enablement guide, Windows Server hotpatch architecture, and Azure Update Manager hotpatch guidance.