Event details
Are you ready to experience seamless security updates with minimal disruption? Let’s dive into hotpatching for Windows 11, version 24H2 and Windows Server 2025 machines connected to Azure Arc! Hotpatch updates are delivered eight times a year, ensuring your systems remain fully secure without the need for restarts. Find out how you can experience the public preview of hotpatch security for updates Windows 11, version 24H2 and Windows Server 2025 and start visualizing the benefits you’ll receive from faster, more efficient security updates.
Speaker: David Callaghan
This session is part of Microsoft Technical Takeoff: Windows and Intune.
49 Comments
- Jay MichaudIron Contributor
How can I determine if any apps rely on CHPE?
- David_CallaghanFormer Employee
Great question. If you want to determine whether or not an app relies on CHPE you need to figure out if it is a 32-bit x86 app vs. other non CHPE related x64 or Arm. Perhaps the easiest option to consider is try to obtain the latest x64 or Arm64 version if available.
If you are unsure about an existing app, you can check to see if it is x86 (32-bit) by using Task Manager. Launch Task Manager and select the Details tab view and observe the Architecture column with values like Arm64 (ARM), x64 (64-bit) or x86 (32-bit). If the application, you are investigating is x86, its 32-bit and could be using CHPE. Another way to look at it, if its Arm64 or x64 its not using CHPE. You must still disable CHPE to receive hotpatch updates, however you should not expect to see any major performance or compatibility issues related to disabling CHPE for the x64 and Arm native (e.g. non x86 32-bit) applications being examined.
If you're wondering what is CHPE? Windows OS CHPE (Compiled Hybrid Portable Executable) is a technology introduced to improve compatibility and performance for 32-bit applications on 64-bit Arm CPU based Windows systems. (If your PC uses an AMD or Intel CPU then the CHPE doesn't apply you.) Enabling or disabling CHPE flag discussed in the video doesn't determine that your application(s) will or won't work. As mentioned, CHPE is designed to improve compatibility and performance. We recommend that you test the application with the CHPE disabled before widely deploying hotpatch on Arm64 PCs to ensure that there are no unexpected compatibility issues with any of the x86 app(s) you or your users rely on.
- SGInsideCopper Contributor
Why is this license restricted and not on the business premium license? Surely small business' should have access to such security measures, it's disappointing that Microsoft restricts security behind licenses.
- Jay MichaudIron Contributor
Is there a way for a user to request the full cumulative update from the Settings app when this a hotpatch policy is applied?
- Joe_Lurie
Microsoft
Hi Jay Michaud. Yes, you can request the full LCU by clearing the CHPE disable flag (HotPatchRestrictions=0) and then restart the device. Keep in mind, though, that the device will stay off of Hotpatch until the next baseline. So if you clear the flag in May (for example) it will have to wait till July to be "re-enrolled" into Hotpatch.
Here's a link for reference: Hotpatch updates | Microsoft Learn
- Jay MichaudIron Contributor
Is this supported on Windows Education Edition?
- SakshiMonga
Microsoft
No, hotpatching for Windows 11 24H2 is only available for Windows Enterprise E3 or E5 (e.g. Microsoft 365 A3/A5 or Microsoft 365 F3); or a Windows 365 Enterprise subscription.
Hotpatch for client comes to Windows 11 - Windows IT Pro Blog
- ucbryanweaverCopper Contributor
How do you enroll in the hotpatch updates?
- Joe_Lurie
Microsoft
Here you go: Hotpatch updates | Microsoft Learn
Specifically, step 7:
Under the Settings section, set "When available, apply without restarting the device ("Hotpatch") to Allow. Then, select Next.
- jtopper1979Copper Contributor
Is there Hot Patching for Microsoft Edge too? There were so many vulnerability notifications recently and users had to restart Edge for them to take effect.
- Nevine_Geissa
Microsoft
Hotpatching is currently designed for Windows Updates and applies to the Windows OS, Microsoft Edge is not included in this mechanism.
For Edge, security updates are applied via its own update channel, and some critical fixes may require to restart Edge to fully take effect.
- Nishant2603Copper Contributor
What if Patch break the PC??
- David_CallaghanFormer Employee
I agree with my other colleagues' responses below. I'd like to add a few additional comments.
If we determine there is an issue in a hotpatch update that impacts our users we could potentially deploy another hotpatch update that fixes the issue and potentially will not require a restart. This also points out we could deploy more than one hotpatch update per month if necessary.
- Joe_Lurie
Microsoft
Here you go, Nishant. Hotpatch updates | Microsoft Learn.
Specifically: Automatic rollback of a Hotpatch update isn’t supported but you can uninstall them. If you experience an unexpected issue with hotpatch updates, you can investigate by uninstalling the hotpatch update and installing the latest standard cumulative update (LCU) and restart. Uninstalling a hotpatch update is quick, however, it does require a device restart.
- Nevine_Geissa
Microsoft
We understand that reliability is a top concern when applying updates. Hotpatching is designed to minimize disruptions by applying security updates without requiring a reboot. However, if an issue arises, there are multiple safeguards in place:
- Rollback via Uninstall – Hotpatches can be uninstalled individually if needed. After rollback, users can install the standard cumulative update and reboot the device to ensure they remain secure.
- Safe Deployment Practices – Microsoft thoroughly tests hotpatches before release, and customers can validate them in a test environment before broad deployment.
- If you encounter an issue, Microsoft Support is available to assist.
- Heather_Poulsen
Community Manager
Welcome to “The hottest way to update Windows 11 and Windows Server 2025” at Microsoft Technical Takeoff! Q&A is open now and throughout the week. Please post any questions or feedback here in the Comments.
- ucbryanweaverCopper Contributor
One thing I would change on your setup for these sessions, have the comments to the side not below. Currently I am using 2 windows, one for the video and one for the comments.
- Pearl-Angeles
Community Manager
Thanks for your feedback! We've shared this with the Technical Takeoff team.
- Vijay_kumar89Copper Contributor
Hello,
We have enabled Hotpatch in the February cycle. We have noticed that the build version is different on the device where Hotpatch was installed win 11 build 3107 and for normal Windows 11 24H2(OS Build 26100 3194). Why is this the case? Additionally, we have enabled optional updates from Intune, and we have observed that devices where the Hotpatch setting was deployed are not receiving optional updates? Is this by design?
Thanks.- VishalBajaj
Microsoft
Hello Vijay_kumar89 ,
Great observation, the minor version of hotpatch will be lower that the regular minor version of a cumulative update for the same month. This allows for installation of a cumulative update on top a hotpatch update if you so choose. Despite ethe version difference, both updates present the same security coverage.
Installing the cumulative update during a hotpatch month will take the device off the hotpatch train. The device will then receive a hotpatch post a planned baseline month.
Regarding the non-security update, these are not offered if the machine is opted into hotpatch and is on the hotpatch train.