Windows patch management comes up in almost every enterprise project I work on. Users want their machines secure, but they don't want to be forced into a restart every few weeks. As of April 2025, the Windows 11 hotpatch feature is generally available for Enterprise 24H2 (x64, AMD/Intel), and that changes how updates get deployed. The benefits show up in practice: less forced downtime, fewer user complaints, and compliance stays where it should be.

Windows 11 hotpatch installs security fixes without a reboot

Anyone who has managed Windows Server on Azure or worked with Autopatch will recognise the idea. Critical security fixes are applied without a reboot. On Windows 11 Enterprise 24H2 (x64), two of the three months in each quarter can be covered by hotpatch, with no restart at all. The baseline month is the exception. It always bundles deeper fixes and cumulative updates, so a restart is still required. The cycle is predictable, and for end users it is mostly invisible.

Pro tip: Baseline months are always marked as "Cumulative Update" in Microsoft documentation and in device reporting via Intune or Windows Update Reports. You won't get a hotpatch shortcut that month, so plan the restarts in advance.

Hotpatch needs a few prerequisites and one Intune setting

The requirements are simple. You need Windows 11 Enterprise E3 or E5 (or an equivalent Microsoft 365 licence), version 24H2 installed, and Virtualization Based Security (VBS) turned on. Management runs entirely through Intune via the Quality Update Policy. In the Intune admin center, go to Devices → Windows updates → Quality updates and you'll find the option "When available, apply without restarting the device (hotpatch)". After you enable it, supported devices pick up hotpatches automatically. Arm64 support is still in preview, so for production use hotpatch is limited to x64 (AMD/Intel).

If you already use Windows Autopatch for automated deployments, the settings will look familiar (see Windows Autopatch: Deployment rings, groups and real-world tips). Hotpatch works on Enterprise 24H2 devices managed by Autopatch as well as on those managed through classic Intune.

Hotpatch months and baseline months follow a fixed quarterly cycle

The diagram below shows how hotpatch and baseline months alternate over the year:

graph TD
    Start["Month 1: Hotpatch"] --> Month2["Month 2: Hotpatch"]
    Month2 --> Baseline["Month 3: Baseline (Restart)"]
    Baseline --> Start

Figure: The cycle repeats with two hotpatch months (no restart) followed by one baseline month (restart required).

In practice, most security updates now install quietly in the background. Admins only have to schedule reboots once every three months.

Users barely notice hotpatches while admins track them in reports

For users, Windows 11 hotpatch is close to invisible. In most months the update installs silently and no reboot prompt appears. Users can see the update status, but nobody gets interrupted in a meeting or halfway through a task. The usual restart notifications only show up in a baseline month. Admins, on the other hand, need good reporting. Intune's Reports → Windows Update Reports section and the dedicated quality update reports (Windows update reports) show which devices are hotpatching. Windows Autopatch also displays the hotpatch update status in its device views.

If you want to see exactly which updates (hotpatch or baseline) landed on a specific device, run this in PowerShell as a local admin on Windows 11 24H2:

Get-WindowsUpdateLog

The log lists hotpatch and baseline entries separately, which makes it easy to confirm which device received which fixes.

Your existing update processes deserve a second look

In many environments, hotpatch is a good reason to rethink how updates are handled. Tenants running a mix of Windows versions, or with gaps in licensing, will have to keep the classic update flow for older or Pro devices. Hotpatch only applies to Enterprise 24H2 with VBS enabled, and everything else stays on the cycle that requires reboots. If you're planning a 24H2 rollout or migration, have a look at Windows 11 24H2: Controlled rollout with Intune and Autopatch. And if VBS isn't widely deployed in your estate yet, I'd tackle that now, because without VBS there is no hotpatch.

For Autopatch customers, moving to hotpatching should be painless as long as the prerequisites are met. With classic Intune update rings it works too, provided you're targeting Enterprise 24H2.

Hotpatch means less disruption and more trust in Windows security

I've run hotpatch pilots on real customer tenants, and the benefits were clear. Support load went down, there were fewer complaints about surprise restarts, and users were noticeably more accepting of Windows updates. You still have to plan for the baseline (restart) months, but patching as a whole is far less disruptive. Early adopters are already seeing results, particularly those pairing Autopatch with modern Intune policies. If you want strong security and a quiet update cycle at the same time, Windows 11 hotpatch is a real step forward.