Blog Post

Windows IT Pro Blog
3 MIN READ

Hotpatch for client comes to Windows 11 Enterprise

David_Callaghan's avatar
David_Callaghan
Icon for Microsoft rankMicrosoft
Nov 19, 2024

Today we announce the public preview of hotpatch updates for Windows 11 Enterprise, version 24H2. With hotpatch updates, you can quickly take measures to help protect your organization from the evolving landscape of cyberattacks, while minimizing user disruptions. Hotpatching represents a significant advancement in our journey to help make you and everyone who uses Windows more secure and productive.

Benefits of hotpatch updates

Hotpatch updates are scoped and provide a complete set of OS security patches. No additional features are included. They are unique in that they take effect immediately upon installation without requiring you to restart your device, helping to ensure focused, rapid protection.

Hotpatch technology already has a proven, two-year record for Windows Server. Expanding hotpatching to Windows 11 Enterprise, version 24H2 client devices offers numerous benefits:

  • Devices receive the same level of security patching as the standard monthly security updates released on Patch Tuesday.
  • Hotpatch updates take effect immediately and don’t require user attention.
  • Users maintain productivity and security without the need for a device restart.

How does it work? A year in hotpatching

The first month of each quarter of the calendar year (i.e. January, April, July, and October), devices install the standard monthly security update and restart. This cumulative update contains the latest security fixes, new features, and enhancements. The following two months, devices are offered hotpatch updates, which include only security updates and install without the need to restart. At the start of the next quarter, the cycle repeats.

That’s it. Devices stay secure and productive, and you reduce the number of required restarts for Windows updates from twelve to just four thanks to eight planned hotpatch updates each year!

Get started with hotpatching

To take advantage of the public preview, your organization will need the following to be eligible for hotpatching:

  • A Microsoft subscription that includes Windows Enterprise E3 or E5 (e.g. Microsoft 365 A3/A5 or Microsoft 365 F3); or a Windows 365 Enterprise subscription
  • Targeted devices running Windows 11 Enterprise, version 24H2 (Build 26100.2033 or later)
  • Microsoft Intune

You can enable hotpatch updates for eligible devices using a new Windows quality update policy in Intune and Windows Autopatch. Using those policies, you can opt devices in (or out) for automated hotpatch update deployment. And, good news, the quality update policy can auto-detect if your targeted devices are eligible for hotpatching. All other Windows 10 and Windows 11 devices will continue to receive the standard monthly security updates, ensuring that your ecosystem stays protected and productive.

To learn more about managing Windows updates with Windows Autopatch, see Windows quality updates.

We look forward to your feedback!

Hotpatching joins our catalog of innovations to help unlock a new level of security and productivity in your organization. Since hotpatching requires that devices be running Windows 11 Enterprise, version 24H2, now is a great time to plan for and upgrade to Windows 11.

As you try the public preview for hotpatch updates on your eligible devices, we look forward to hearing about your experience. Your feedback directly informs service improvements before it reaches general availability. Drop us a comment below and share your thoughts, then stay tuned for more information on hotpatch updates for Windows as we roll out the public preview!

Hear more about what's new with Windows and Windows 365

Bookmark our guide to Windows at Microsoft Ignite 2024, then dive into the Microsoft Ignite announcements that reinforce our commitment to getting you and your organization future-ready:

 

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Updated Nov 19, 2024
Version 3.0
servicing and updates
windows 11
  • grantmm's avatar
    grantmm
    Brass Contributor
    Nov 20, 2024

    Thanks for the article, you mention Windows 11 Enterprise, version 24H2. Is Windows 11 Education 24H2 also compatible? or is it strictly only the Enterprise version.

  • Karlt's avatar
    Karlt
    Copper Contributor
    Nov 22, 2024

    Please can we have this via ConfigMgr please?

  • En111_'s avatar
    En111_
    Brass Contributor
    Dec 05, 2024

    Maybe the opt-in button should reside next to the other opt-in buttons at

    Tenant admin | Autopatch groups -> Update Settings

    Turning it on was not a "one click" as described for autopatch devices where one more or less has decoupled oneself from editing policies oneself

  • sundi2019's avatar
    sundi2019
    Copper Contributor
    Nov 19, 2024

    Ok Microsoft, make sure everyone is on the same page before you release an article and get everyone existed. Autopatch and A3/A5 should not be listed in the same article unless there's an announcement at Ignite scheduled this week that Autopatch will FINALLY be supported for education.

    • rogergh's avatar
      rogergh
      Copper Contributor
      Nov 20, 2024

      Yeah, they really need to fix that. They say it is supported, but none of our A3\A5 users and computers could enroll into the program when we tried it out. Only the E3\E5 users worked properly... We rolled back to normal policies just to not have to manage two different methods to publish updates at the same time, because of the administrative headache that often comes with that.

      And based on their documentation, A3\A5 users don't share feature parity with E3\E5 in Autopatch either, so I don't know if we would have used it either way, as we would have to micromanage all the non-supported features separately, but ONLY for A3\A5-users... I don't know why Microsoft feels the need to limit the features for Autopatch on A3\A5-licenses, as Enterprise and Education-versions of Windows have always shared 99.9% feature parity. 

      And A3\A5 is where this feature would have shined in my opinion, as educators really don't want any downtime in their classrooms, believe me...

  • Tomasz Woźniak's avatar
    Tomasz Woźniak
    Copper Contributor
    Nov 19, 2024

    What about workstations that must not be exposed to Internet ? What options does Intune offer ?

  • ajp999's avatar
    ajp999
    Brass Contributor
    Nov 20, 2024

    Why does Autopatch need to be enabled to use hotpatching?

    • David_Callaghan's avatar
      David_Callaghan
      Icon for Microsoft rankMicrosoft
      Nov 20, 2024

      The Autopatch update policy provides a simple one click option to enable/disable offering hotpatch updates and handles the baseline orchestration to only offer to eligible devices. Device eligibility in this context requires precise OS version targeting because the hotpatch updates patch live code in memory for a specific OS version. Autopatch ensures customers get a simple friction free management of updates and baselines. The hotpatch updates will not install on an incorrect baseline but Autopatch means customers can avoid any frustration or extra burden trying to manually keep track of these important details.

      One tip to get started: Create a new update policy to see the hotpatch enable/disable option. You can have both Windows 10 and Windows 11 devices in the same policy and Autopatch handles the orchestration to only offer this month's hotpatch to eligible Windows 11, v24H2 devices on (Build 26100.2033). If you have a test device on Windows 24H2 build greater than 26100.2033 you can uninstall the KB update to get back to Build 26100.2033 after which the device is eligible for hotpatch update announced at Ignite as well as next month's hotpatch update planned for December. Alternatively, if you have devices not on Build 26100.2033 in a hotpatch enabled policy and just wait, the next quarterly baseline is January with hotpatch updates planned for February and March.

    • En111_'s avatar
      En111_
      Brass Contributor
      Dec 05, 2024

      I want to note that the thought that us as IT admins in 2024 have to manage patches for Windows might be an outdated one. iOS has patched phones for a billion devices without having to think much about them, and desktop OS' are becoming the same. With Windows Update for business, managing patches became something one did for minutes each month, and now with Autopatch something one may not have to think about at all, because it's all "handled for you".

       

      I understand that we as sysadmins might feel that this is something that should be in our area of responsibility, but we must also embrace change and realize that responsibility are also subject for change - and in this case a welcome one.

  • nkasco7's avatar
    nkasco7
    Copper Contributor
    Nov 20, 2024

    This is fantastic! Please extend this functionality to drivers as well.

  • wroot's avatar
    wroot
    Silver Contributor
    Nov 20, 2024

    As orchestrating of such updates is complex and requires Intune and Autopatch, i guess there is no chance for 3d party RMMs to support them. Although, i am not sure it is good idea to go without quality fixes for 3 months.