{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/operate-windows-server-2025-hotpatch-reboot-cadence/", "item": { "id": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/", "slug": "operate-windows-server-2025-hotpatch-reboot-cadence", "url": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence.md", "json": "https://update.dsesecurity.com/api/v1/posts/operate-windows-server-2025-hotpatch-reboot-cadence/" }, "title": "Operate Windows Server 2025 Hotpatch without pretending reboots disappeared", "summary": "Windows Server 2025 Hotpatch can remove restarts from many monthly Windows update cycles, but planned and unplanned baselines, .NET, drivers, firmware, and other updates still need maintenance. Build the service around the complete reboot calendar.", "format": { "slug": "playbook", "name": "Playbook" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-08-11T09:25:00+00:00", "modified_at": "2026-08-11T14:12:11+00:00", "reviewed_on": "2026-08-11", "reading_minutes": 3, "word_count": 642, "potentially_affected": "Windows Server 2025 Standard and Datacenter systems connected to Azure Arc; supported Windows Server Datacenter: Azure Edition virtual machines; Azure Update Manager; workloads with constrained maintenance windows.", "dse_recommendation": "Inventory eligible servers, verify the documented platform prerequisites, enroll a representative pilot, map baseline and non-Hotpatch restart needs, and approve each cycle only after workload-level validation and recorded recovery evidence.", "primary_source": { "name": "Microsoft Learn: Hotpatch for Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch", "published_on": "2025-07-14", "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts: Hotpatch changes the cadence, not the operating responsibility

\n

Microsoft describes Hotpatch for Windows Server as a way to apply eligible Windows operating-system updates by patching in-memory code without restarting the server or its processes. For Azure Arc-connected machines, Microsoft currently lists Windows Server 2025 Standard and Datacenter as eligible editions after Hotpatch is enabled. Supported Windows Server Datacenter: Azure Edition images in Azure and Azure Local follow their documented image and orchestration requirements. Custom images, containers, and unlisted offer-and-SKU combinations are not automatically covered by the Azure image support table.

\n

The servicing pattern is built around baselines. A planned baseline uses the current cumulative update and requires a restart. Microsoft describes a typical cycle as a baseline month followed by two Hotpatch months. An unplanned baseline can replace a Hotpatch release when an update cannot be delivered as a Hotpatch, and that baseline also requires a restart. Microsoft therefore presents Hotpatch as fewer restarts, not a restart-free server.

\n

The boundary matters. Microsoft says Hotpatch covers the Windows update content included in its program, while nonsecurity Windows updates, .NET updates, drivers, firmware, and non-Windows updates are outside that Hotpatch scope and can still require conventional installation and restart handling. The documentation also states that Hotpatch updates do not provide automatic rollback; recovery from a problematic Hotpatch can require uninstalling it, installing the last functional baseline, and restarting.

\n

As of this review, Microsoft states that Azure Arc-enabled Hotpatch for eligible Windows Server 2025 machines is available at no extra Hotpatch cost. Azure connectivity, Azure Arc requirements, supported build and edition, virtualization-based security prerequisites, management tooling, and any other Azure services used by the design still need to be confirmed for each environment.

\n\n

DSE recommendation: operate one calendar for every update class

\n

Do not divide the server program into “Hotpatch machines” and “machines that need maintenance.” Keep a single maintenance register that shows the next planned baseline, any announced unplanned baseline, .NET servicing, application updates, agents, drivers, firmware, and vendor maintenance for every workload. Hotpatch is a scheduling input within that register.

\n
    \n
  1. Prove eligibility. Record edition, build, installation type, physical or virtual platform, Azure Arc state, required agents, virtualization-based security state, update source, and orchestration owner. Treat portal enrollment as incomplete until the server reports the expected Hotpatch status.
    2. \n
  2. Use a representative pilot. Include each important application pattern, not merely an idle utility server. Exercise services, scheduled work, integrations, storage, printing, monitoring, backup agents, and any latency-sensitive role after the update.
    3. \n
  3. Publish a twelve-month restart forecast. Mark expected baseline months and the normal restart window. Reserve a path for unplanned baselines and out-of-band workload maintenance. A forecast is not a promise that a particular month will remain restart-free.
    4. \n
  4. Separate install success from service health. Capture update status and build, then test the business service through its normal client and dependency path. A successful Windows update record does not prove that the application completed its own recovery.
    5. \n
  5. Keep recovery executable. Confirm supported backup or recovery methods, application-specific shutdown requirements, the last functional baseline, console access, escalation contacts, and the authority to extend or reverse a change.
    6. \n
  6. Reconcile exceptions. Servers that miss a baseline, receive an out-of-band update, lose Arc connectivity, or drift from the approved build need an explicit disposition before the next Hotpatch cycle.
    7. \n
\n

Measure the program by avoided workload interruptions, completed baselines, update currency, application test success, exception age, and recovery performance. Do not count “no reboot requested” as the sole success condition. A server can remain online while a dependent service is degraded, and an update outside the Hotpatch scope can still be waiting for a restart.

\n

The durable benefit is predictable servicing: routine eligible months can have less disruption, while baseline and exceptional maintenance remain visible, rehearsed, and owned.

\n\n

Official references

\n", "content_text": "Source facts: Hotpatch changes the cadence, not the operating responsibility\nMicrosoft describes Hotpatch for Windows Server as a way to apply eligible Windows operating-system updates by patching in-memory code without restarting the server or its processes. For Azure Arc-connected machines, Microsoft currently lists Windows Server 2025 Standard and Datacenter as eligible editions after Hotpatch is enabled. Supported Windows Server Datacenter: Azure Edition images in Azure and Azure Local follow their documented image and orchestration requirements. Custom images, containers, and unlisted offer-and-SKU combinations are not automatically covered by the Azure image support table.\nThe servicing pattern is built around baselines. A planned baseline uses the current cumulative update and requires a restart. Microsoft describes a typical cycle as a baseline month followed by two Hotpatch months. An unplanned baseline can replace a Hotpatch release when an update cannot be delivered as a Hotpatch, and that baseline also requires a restart. Microsoft therefore presents Hotpatch as fewer restarts, not a restart-free server.\nThe boundary matters. Microsoft says Hotpatch covers the Windows update content included in its program, while nonsecurity Windows updates, .NET updates, drivers, firmware, and non-Windows updates are outside that Hotpatch scope and can still require conventional installation and restart handling. The documentation also states that Hotpatch updates do not provide automatic rollback; recovery from a problematic Hotpatch can require uninstalling it, installing the last functional baseline, and restarting.\nAs of this review, Microsoft states that Azure Arc-enabled Hotpatch for eligible Windows Server 2025 machines is available at no extra Hotpatch cost. Azure connectivity, Azure Arc requirements, supported build and edition, virtualization-based security prerequisites, management tooling, and any other Azure services used by the design still need to be confirmed for each environment.\n\nDSE recommendation: operate one calendar for every update class\nDo not divide the server program into “Hotpatch machines” and “machines that need maintenance.” Keep a single maintenance register that shows the next planned baseline, any announced unplanned baseline, .NET servicing, application updates, agents, drivers, firmware, and vendor maintenance for every workload. Hotpatch is a scheduling input within that register.\n\nProve eligibility. Record edition, build, installation type, physical or virtual platform, Azure Arc state, required agents, virtualization-based security state, update source, and orchestration owner. Treat portal enrollment as incomplete until the server reports the expected Hotpatch status.\nUse a representative pilot. Include each important application pattern, not merely an idle utility server. Exercise services, scheduled work, integrations, storage, printing, monitoring, backup agents, and any latency-sensitive role after the update.\nPublish a twelve-month restart forecast. Mark expected baseline months and the normal restart window. Reserve a path for unplanned baselines and out-of-band workload maintenance. A forecast is not a promise that a particular month will remain restart-free.\nSeparate install success from service health. Capture update status and build, then test the business service through its normal client and dependency path. A successful Windows update record does not prove that the application completed its own recovery.\nKeep recovery executable. Confirm supported backup or recovery methods, application-specific shutdown requirements, the last functional baseline, console access, escalation contacts, and the authority to extend or reverse a change.\nReconcile exceptions. Servers that miss a baseline, receive an out-of-band update, lose Arc connectivity, or drift from the approved build need an explicit disposition before the next Hotpatch cycle.\n\nMeasure the program by avoided workload interruptions, completed baselines, update currency, application test success, exception age, and recovery performance. Do not count “no reboot requested” as the sole success condition. A server can remain online while a dependent service is degraded, and an update outside the Hotpatch scope can still be waiting for a restart.\nThe durable benefit is predictable servicing: routine eligible months can have less disruption, while baseline and exceptional maintenance remain visible, rehearsed, and owned.\n\nOfficial references\n\nMicrosoft Learn, Hotpatch for Windows Server, July 14, 2025; documentation reviewed August 11, 2026.\nMicrosoft Learn, Windows Server release information, including the current Hotpatch calendar.", "content_markdown": "## Source facts: Hotpatch changes the cadence, not the operating responsibility\n\nMicrosoft describes [Hotpatch for Windows Server](https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch) as a way to apply eligible Windows operating-system updates by patching in-memory code without restarting the server or its processes. For Azure Arc-connected machines, Microsoft currently lists Windows Server 2025 Standard and Datacenter as eligible editions after Hotpatch is enabled. Supported Windows Server Datacenter: Azure Edition images in Azure and Azure Local follow their documented image and orchestration requirements. Custom images, containers, and unlisted offer-and-SKU combinations are not automatically covered by the Azure image support table.\n\nThe servicing pattern is built around baselines. A planned baseline uses the current cumulative update and requires a restart. Microsoft describes a typical cycle as a baseline month followed by two Hotpatch months. An unplanned baseline can replace a Hotpatch release when an update cannot be delivered as a Hotpatch, and that baseline also requires a restart. Microsoft therefore presents Hotpatch as fewer restarts, not a restart-free server.\n\nThe boundary matters. Microsoft says Hotpatch covers the Windows update content included in its program, while nonsecurity Windows updates, .NET updates, drivers, firmware, and non-Windows updates are outside that Hotpatch scope and can still require conventional installation and restart handling. The documentation also states that Hotpatch updates do not provide automatic rollback; recovery from a problematic Hotpatch can require uninstalling it, installing the last functional baseline, and restarting.\n\nAs of this review, Microsoft states that Azure Arc-enabled Hotpatch for eligible Windows Server 2025 machines is available at no extra Hotpatch cost. Azure connectivity, Azure Arc requirements, supported build and edition, virtualization-based security prerequisites, management tooling, and any other Azure services used by the design still need to be confirmed for each environment.\n\n## DSE recommendation: operate one calendar for every update class\n\nDo not divide the server program into “Hotpatch machines” and “machines that need maintenance.” Keep a single maintenance register that shows the next planned baseline, any announced unplanned baseline, .NET servicing, application updates, agents, drivers, firmware, and vendor maintenance for every workload. Hotpatch is a scheduling input within that register.\n\n- Prove eligibility. Record edition, build, installation type, physical or virtual platform, Azure Arc state, required agents, virtualization-based security state, update source, and orchestration owner. Treat portal enrollment as incomplete until the server reports the expected Hotpatch status.\n\n- Use a representative pilot. Include each important application pattern, not merely an idle utility server. Exercise services, scheduled work, integrations, storage, printing, monitoring, backup agents, and any latency-sensitive role after the update.\n\n- Publish a twelve-month restart forecast. Mark expected baseline months and the normal restart window. Reserve a path for unplanned baselines and out-of-band workload maintenance. A forecast is not a promise that a particular month will remain restart-free.\n\n- Separate install success from service health. Capture update status and build, then test the business service through its normal client and dependency path. A successful Windows update record does not prove that the application completed its own recovery.\n\n- Keep recovery executable. Confirm supported backup or recovery methods, application-specific shutdown requirements, the last functional baseline, console access, escalation contacts, and the authority to extend or reverse a change.\n\n- Reconcile exceptions. Servers that miss a baseline, receive an out-of-band update, lose Arc connectivity, or drift from the approved build need an explicit disposition before the next Hotpatch cycle.\n\nMeasure the program by avoided workload interruptions, completed baselines, update currency, application test success, exception age, and recovery performance. Do not count “no reboot requested” as the sole success condition. A server can remain online while a dependent service is degraded, and an update outside the Hotpatch scope can still be waiting for a restart.\n\nThe durable benefit is predictable servicing: routine eligible months can have less disruption, while baseline and exceptional maintenance remain visible, rehearsed, and owned.\n\n## Official references\n\n- Microsoft Learn, [Hotpatch for Windows Server](https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch), July 14, 2025; documentation reviewed August 11, 2026.\n\n- Microsoft Learn, [Windows Server release information](https://learn.microsoft.com/en-us/windows/release-health/windows-server-release-info), including the current Hotpatch calendar." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/", "url": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-08-11" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Operate Windows Server 2025 Hotpatch without pretending reboots disappeared", "item": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/#article", "identifier": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/", "url": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/", "headline": "Operate Windows Server 2025 Hotpatch without pretending reboots disappeared", "description": "Windows Server 2025 Hotpatch can remove restarts from many monthly Windows update cycles, but planned and unplanned baselines, .NET, drivers, firmware…", "abstract": "Windows Server 2025 Hotpatch can remove restarts from many monthly Windows update cycles, but planned and unplanned baselines, .NET, drivers, firmware, and other updates still need maintenance. Build the service around the complete reboot calendar.", "articleBody": "Source facts: Hotpatch changes the cadence, not the operating responsibility\nMicrosoft describes Hotpatch for Windows Server as a way to apply eligible Windows operating-system updates by patching in-memory code without restarting the server or its processes. For Azure Arc-connected machines, Microsoft currently lists Windows Server 2025 Standard and Datacenter as eligible editions after Hotpatch is enabled. Supported Windows Server Datacenter: Azure Edition images in Azure and Azure Local follow their documented image and orchestration requirements. Custom images, containers, and unlisted offer-and-SKU combinations are not automatically covered by the Azure image support table.\nThe servicing pattern is built around baselines. A planned baseline uses the current cumulative update and requires a restart. Microsoft describes a typical cycle as a baseline month followed by two Hotpatch months. An unplanned baseline can replace a Hotpatch release when an update cannot be delivered as a Hotpatch, and that baseline also requires a restart. Microsoft therefore presents Hotpatch as fewer restarts, not a restart-free server.\nThe boundary matters. Microsoft says Hotpatch covers the Windows update content included in its program, while nonsecurity Windows updates, .NET updates, drivers, firmware, and non-Windows updates are outside that Hotpatch scope and can still require conventional installation and restart handling. The documentation also states that Hotpatch updates do not provide automatic rollback; recovery from a problematic Hotpatch can require uninstalling it, installing the last functional baseline, and restarting.\nAs of this review, Microsoft states that Azure Arc-enabled Hotpatch for eligible Windows Server 2025 machines is available at no extra Hotpatch cost. Azure connectivity, Azure Arc requirements, supported build and edition, virtualization-based security prerequisites, management tooling, and any other Azure services used by the design still need to be confirmed for each environment.\n\nDSE recommendation: operate one calendar for every update class\nDo not divide the server program into “Hotpatch machines” and “machines that need maintenance.” Keep a single maintenance register that shows the next planned baseline, any announced unplanned baseline, .NET servicing, application updates, agents, drivers, firmware, and vendor maintenance for every workload. Hotpatch is a scheduling input within that register.\n\nProve eligibility. Record edition, build, installation type, physical or virtual platform, Azure Arc state, required agents, virtualization-based security state, update source, and orchestration owner. Treat portal enrollment as incomplete until the server reports the expected Hotpatch status.\nUse a representative pilot. Include each important application pattern, not merely an idle utility server. Exercise services, scheduled work, integrations, storage, printing, monitoring, backup agents, and any latency-sensitive role after the update.\nPublish a twelve-month restart forecast. Mark expected baseline months and the normal restart window. Reserve a path for unplanned baselines and out-of-band workload maintenance. A forecast is not a promise that a particular month will remain restart-free.\nSeparate install success from service health. Capture update status and build, then test the business service through its normal client and dependency path. A successful Windows update record does not prove that the application completed its own recovery.\nKeep recovery executable. Confirm supported backup or recovery methods, application-specific shutdown requirements, the last functional baseline, console access, escalation contacts, and the authority to extend or reverse a change.\nReconcile exceptions. Servers that miss a baseline, receive an out-of-band update, lose Arc connectivity, or drift from the approved build need an explicit disposition before the next Hotpatch cycle.\n\nMeasure the program by avoided workload interruptions, completed baselines, update currency, application test success, exception age, and recovery performance. Do not count “no reboot requested” as the sole success condition. A server can remain online while a dependent service is degraded, and an update outside the Hotpatch scope can still be waiting for a restart.\nThe durable benefit is predictable servicing: routine eligible months can have less disruption, while baseline and exceptional maintenance remain visible, rehearsed, and owned.\n\nOfficial references\n\nMicrosoft Learn, Hotpatch for Windows Server, July 14, 2025; documentation reviewed August 11, 2026.\nMicrosoft Learn, Windows Server release information, including the current Hotpatch calendar.", "datePublished": "2026-08-11T09:25:00+00:00", "dateModified": "2026-08-11T14:12:11+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/operate-windows-server-2025-hotpatch-reboot-cadence/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Operate Windows Server 2025 Hotpatch without pretending reboots disappeared" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Playbook", "Advisory priority" ], "genre": "Playbook", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 642, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Microsoft Learn: Hotpatch for Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch", "datePublished": "2025-07-14" } } ] } }