Heya folks, Ned Pyle & Nick Washburn here with a big announcement: Hotpatching is now generally available as part of Azure Automanage for Windows Server. This capability allows you to patch and install updates to their Windows Server 2022 Datacenter: Azure Edition (Core) virtual machines on Azure without requiring a reboot! Together with Azure Automanage and included Azure-orchestrated patching, keeping your VMs up to date is easier and faster than ever.
Hotpatching is a new way to install updates on a Windows Server 2022 Datacenter: Azure Edition (Core) VM that doesn’t require a reboot after installation, by patching the in-memory code of running processes without the need to restart the process. In the future, we wish to add Hotpatch support to Full Desktop machines and even more broadly outside the server ecosystem; Server Core is our starting point because of the large logistical and dev effort that hotpatching brings - it has the smallest patching footprint, which means it came to market first.
Some of the benefits of running a Windows Server Azure Edition VM with hotpatching include:
Hotpatching covers Windows security updates and maintains parity with the content of security updates issued in the regular (non-Hotpatch) Windows Update channel. Hotpatching works by first establishing a baseline with a Windows Update Latest Cumulative Update.
We periodically release hotpatches (i.e., on the second Tuesday of the month) that build on that baseline, with updates that do not require a reboot. Periodically (starting at every three months), the baseline is refreshed with a new Latest Cumulative Update (LCU).
There are two types of baselines: Planned baselines and unplanned baselines.
There are some important considerations to running an Azure Edition VM with hotpatching. Reboots are still required to install updates that are not included in the Hotpatch program, and reboots are required periodically after a new baseline has been installed to keep the VM in sync with patches included in the LCU.
Should you need to install an update outside the Hotpatch program, you can disable and unenroll hotpatching on a VM and revert the VM to typical update behavior for Windows Server. You can reenroll VM hotpatching at a later time.
Let's do a quick walkthrough:
TIP: If you create your VM starting from this link, you can preview Azure Automanage machine best practices together with Hotpatch on your Azure Edition VM. Just enable Azure Automanage from the Management tab during VM creation to automate common VM operations and onboard select best practices Azure services. Learn more about Azure Automanage best practices here.
After your VM has been created, you can view the status of Hotpatching on the Guest + host updates blade in the Azure Portal.
3. Click on the Go to Hotpatch (Preview) button.
This screen shows the Hotpatch status of your VM.
Azure-orchestrated patching is enabled by default, so the status of hotpatching and any detected errors will be displayed automatically. As an example, a indicates that the hotpatching feature has been turned ‘On’ for your VM but a latest patch assessment has not been conducted for the VM.
All new VMs created with the Windows Server 2022 Datacenter: Azure Edition (Core) image will have hotpatching turned on and Azure-orchestrated patching enabled.
For any Windows VM that has Azure orchestrated patching enabled:
You will be able to configure Hotpatch updates to install immediately, or as part of a schedule. We recommend using Azure Update Management to configure a separate, faster cadence schedule for the installation of Hotpatch updates, alongside other types of updates.
Because Hotpatch patches the in-memory code of running processes without the need to restart the process, your applications will be unaffected by the patching process. Please note this is separate from any potential performance and functionality implications of the patch itself.
To wrap up, we are excited to bring Hotpatch and a way to install updates without rebooting your VM to the Azure public cloud:
Until next time,
- Ned & Nick
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.