Patch the Kernel, Skip the Reboot: The Case for Arc-Enabled Hotpatching on Windows Server 2025

For decades, applying a security fix to core OS components meant swapping files on disk and restarting so the loader could map the new image into memory. Rebooting to patch is a workaround for a limitation we no longer must accept. Windows Server 2025 removes that constraint with Arc-enabled hotpatching: in-memory patching of running code, delivered at no additional charge through Azure Arc.

Let me say this again: Hotpaching for Arc-enabled Windows Server 2025 AT NO COST.

This post is for the engineers who run the fleet. Let's get into how it works, what it requires, and why you should Arc-enable a server this week.

The Real Cost of an Unpatched Window

The interval between a CVE's public disclosure and active exploitation in the wild is now frequently measured in hours. Automated scanners fingerprint exposed services and match them against known vulnerabilities faster than most change-management processes can approve a maintenance window. Every reboot you defer widens the exposure window on a known, documented, fixable attack path.

Traditional patching forces a trade-off:

• Patch aggressively and absorb frequent reboots, service interruptions, failover events, and the operational risk of something not coming back cleanly.
• Patch conservatively and accept a standing backlog of unremediated vulnerabilities on production systems.

Hotpatching removes that trade-off. You patch aggressively and keep the process running.

How Hotpatching Actually Works

Hotpatching operates on the in-memory image of running code rather than requiring the OS to reload a new binary from disk on restart. At a high level:

• The hotpatch engine applies fixes by patching the loaded code of target processes and kernel components in place, so a fix takes effect immediately on the running system—no reboot, no process restart.
• Updates are organized around a baseline plus hotpatch model:
• A baseline is a standard cumulative update (new on-disk binaries) applied on a scheduled cadence—typically once per quarter—which does require a reboot.
• Between baselines, hotpatches deliver the intervening security fixes with no reboot required.
• The practical outcome on Windows Server 2025: reboots drop from a roughly monthly rhythm to about four planned reboots per year (the quarterly baselines), while security content lands continuously in between.

Because the hotpatch payload targets the same code paths the corresponding cumulative update would have, you get equivalent security coverage without the restart. When a fix genuinely can't be hotpatched, it's rolled into the next baseline—so nothing is silently skipped.

What It Requires

Arc-enabled hotpatching for Windows Server 2025 hinges on three things:

1. Windows Server 2025 (Standard or Datacenter).
2. Azure Arc connectivity: the machine is projected into Azure via the Azure Connected Machine agent (`azcmagent`), giving it a resource identity in an Azure subscription and resource group.
3. The Hotpatch capability enabled managed through Azure Update Manager, which orchestrates baseline/hotpatch scheduling and reports per-machine hotpatch compliance.

Notably, for Windows Server 2025 connected through Arc, the hotpatching capability itself carries no additional charge. There's no separate SKU to buy and no premium tier to unlock—just the Arc onboarding step.

Arc Is the Control Plane, Not Just a Prerequisite

Connecting a server with the Connected Machine agent does more than switch on hotpatching—it registers that machine as a first-class Azure resource. Everything Azure's governance and security stack does for native VMs now extends to your on-prem, edge, and multi-cloud servers:

Microsoft Defender for Cloud

Onboard Arc machines to Defender for Servers to get agent-based EDR (via the Defender for Endpoint sensor), vulnerability assessment, file integrity monitoring, and continuous Secure Score-based posture management. Findings surface in the same portal and APIs as the rest of your Azure estate, so on-prem is no longer a monitoring blind spot.

Azure Monitor

Deploy the Azure Monitor Agent (AMA) via Arc to stream performance counters, event logs, and custom logs into a Log Analytics workspace. From there you get KQL queries, VM Insights, workbooks, and metric/alert rules. Hotpatch and update status can be correlated with performance and security signals in one query surface.

Azure Policy

Use Azure Policy and Machine Configuration (guest configuration) to audit and enforce in-guest state—required agents installed, hotpatch enabled, baseline hardening applied—at fleet scale. Assign a policy initiative once and let Azure continuously evaluate drift and, where configured, remediate it automatically.

And the rest of the toolchain

• Azure Update Manager — centralized patch orchestration, scheduling, and compliance reporting across the whole fleet (and the control point for hotpatch).
• Change Tracking & Inventory — track software, files, registry, and service changes over time.
• Extended Security Updates via Arc — for the down-level Windows Server versions still in your environment.

The Layered Result

Put together, this is defense in depth expressed as an integrated platform rather than a pile of point tools:

Each layer reinforces the others, and all four are driven from the same Azure control plane against the same resource inventory.

Arc-Enable One Server. Try It.

At this point you may still be skeptical. You may be thinking, “Windows Server 2025 hotpatching for free? No downtime? No cost? There must be a catch.”

Here’s what I tell everyone when I have this conversation, “Don’t believe a word I just said. Just try it. Setup one server, Arc-enable the server and enable Windows Server 2025 hotpatching through Azure Update Manager.” You don't need a project plan, a steering committee, or a budget line to evaluate this. Pick one non-critical Windows Server 2025 box and Arc-enable it:

1. In the Azure portal, go to Azure Arc → Servers → Add, and generate an onboarding script (or grab a service-principal script for at-scale later).
2. Run the script on the server to install and configure the Connected Machine agent (`azcmagent connect`).
3. In Azure Update Manager, enable Hotpatch for the machine.
4. Watch the next hotpatch land—and enjoy the lack of reboot and peace of mind.

That's it. Arc-enabling a server cost nothing, and hotpatching on Windows Server 2025 through Arc costs nothing. You risk one afternoon on one server and get back reboot-free security patching, plus a live demo of Defender, Azure Monitor, and Azure Policy reaching a machine that used to be invisible to Azure.

Free tooling, free hotpatching, less downtime, and a stronger security posture. Who doesn't want free hotpatching? Arc-enable one server. Try it. Then decide how fast you want to roll it out to the rest.

Cheers,

-Jeff Woolsey