If you manage Windows Server infrastructure, you already know the pain: Patch Tuesday arrives, a maintenance window is scheduled, services are drained, servers are rebooted — rinse and repeat every single month. For high-availability workloads, that reboot cadence is expensive, disruptive, and increasingly difficult to justify to the business.

Microsoft’s answer is Windows Server 2025 Hotpatch — a technology that patches the in-memory code of running processes so that critical security updates take effect immediately, without requiring a restart. What was previously exclusive to Azure-hosted VMs is now available across on-premises servers, VMware, AWS, Google Cloud, and any other environment — as long as the server is connected to Azure Arc.

In this guide, I’ll cover everything you need to know: how hotpatch works under the hood, the prerequisites, how to enable it on Azure VMs, and — critically for most enterprise environments — how to roll it out to your on-premises and multi-cloud servers via Azure Arc.

1. What Is Windows Server Hotpatch?

Hotpatch is Microsoft’s live-patching technology for Windows Server that applies OS security updates directly to the in-memory code of running processes — without requiring those processes to restart, and without requiring the server itself to reboot. The result: your workload stays live, your services remain running, and your users notice nothing while the patch is applied.

This is not a new concept in the Linux world — distributions like RHEL and Ubuntu have offered similar kernel live-patching for years. Microsoft has brought a first-class equivalent to Windows Server, and with the Windows Server 2025 release, it has extended it far beyond Azure-only infrastructure.

Brief History

Hotpatch was first made available for Windows Server 2022 Datacenter: Azure Edition VMs hosted on Azure — a closed preview that showed enormous promise. The Xbox team at Microsoft was an early adopter, reporting that update cycles that previously took weeks were reduced to just a couple of days. With Windows Server 2025, Microsoft opened hotpatch to Standard and Datacenter editions, and through Azure Arc, to any server — anywhere.

2. How Hotpatch Works: The Technical Mechanism

Understanding the mechanism behind hotpatch helps you make informed deployment decisions and troubleshoot more effectively when things go wrong.

Traditional Windows Updates work by replacing OS binaries on disk and scheduling a restart. During the restart, the new binaries are loaded into memory, replacing the old ones. This is reliable but requires downtime.

Hotpatch takes a different approach:

3. The Hotpatch Update Cycle: Baseline vs. Hotpatch Months

Hotpatch does not eliminate all reboots — but it dramatically reduces them. The service follows a structured three-month cycle:

Baseline Months (Jan, Apr, Jul, Oct)

During a baseline month, your server receives a standard cumulative security update — the same full update that any non-hotpatch server receives. This update includes all security fixes plus any bug fixes, performance improvements, and new features accumulated since the previous baseline. A reboot is required. This is the update that establishes the new “code baseline” from which subsequent hotpatches are built.

Hotpatch Months (the 2 months following each baseline)

In the months following a baseline, your server receives hotpatch updates — security-only delta patches applied in memory. No reboot required. These cover the same security vulnerabilities that Patch Tuesday would normally address, just delivered differently.

In Practice: 4 Reboots Per Year Instead of 12+

A server enrolled in hotpatch reboots approximately four times per year instead of every single month. For organisations with strict change management processes, SLA-heavy workloads, or 24/7 operations, this is a significant operational improvement. One logistics company’s IT infrastructure lead reported saving around 70% of maintenance windows after enabling hotpatch in preview.

4. Prerequisites and Requirements

Before you attempt to enable hotpatch on any server, verify every item in this checklist. Missing a single requirement will cause the enablement to fail.

5. Enabling Hotpatch on Azure Virtual Machines

If you’re running Windows Server 2025 Datacenter: Azure Edition on Azure IaaS, hotpatch is already enabled by default — no action required. For Windows Server 2025 Standard or regular Datacenter edition on Azure, you can enable it through the VM creation flow or after deployment.

Method A: Enable During VM Creation (Recommended)

📸 The Hotpatch toggle in the Azure VM creation wizard (Management tab → Guest OS Updates)

Method B: Enable Hotpatch on an Existing Azure VM

Enable via PowerShell (Azure VM)

# Set variables
$resourceGroup = "rg-production"
$vmName        = "WS2025-App01"
$location      = "southeastasia"

# Get the VM object
$vm = Get-AzVM -ResourceGroupName $resourceGroup -Name $vmName

# Enable AutomaticByPlatform patching and turn on Hotpatch
$vm.OSProfile.WindowsConfiguration.PatchSettings.PatchMode           = "AutomaticByPlatform"
$vm.OSProfile.WindowsConfiguration.PatchSettings.EnableHotpatching   = $true

# Apply the changes
Update-AzVM -ResourceGroupName $resourceGroup -VM $vm

Write-Host "Hotpatch enabled on $vmName" -ForegroundColor Green

6. Enabling Hotpatch on On-Premises Servers via Azure Arc

This is where the game changes for enterprise IT. Whether your server is sitting in your own data centre, a colo facility, or a branch office, you can bring it under hotpatch management via Azure Arc. Here is the complete end-to-end process.

Step 1: Connect the Server to Azure Arc

# Run as Administrator on the target Windows Server 2025 machine
# This is the general structure of the generated Arc onboarding script

$env:SUBSCRIPTION_ID  = "<your-subscription-id>"
$env:RESOURCE_GROUP   = "rg-arc-servers"
$env:TENANT_ID        = "<your-tenant-id>"
$env:LOCATION         = "southeastasia"
$env:AUTH_TYPE        = "token"
$env:CORRELATION_ID   = "<guid-from-portal>"

# Download and install the Connected Machine agent
Invoke-WebRequest -Uri "https://aka.ms/azcmagent-windows" `
    -TimeoutSec 30 -OutFile "$env:TEMP\install_windows_azcmagent.ps1"

& "$env:TEMP\install_windows_azcmagent.ps1"

# Connect to Azure Arc (opens browser for device code auth)
azcmagent connect `
    --resource-group $env:RESOURCE_GROUP `
    --tenant-id     $env:TENANT_ID `
    --location      $env:LOCATION `
    --subscription-id $env:SUBSCRIPTION_ID `
    --correlation-id  $env:CORRELATION_ID

# Verify connection status
azcmagent show

📸 The Azure Connected Machine agent (azcmagent) running on a Windows Server — this is the bridge between your on-prem server and Azure Arc

Step 2: Verify VBS is Running

Before enabling hotpatch, confirm VBS is active. See Section 8 for full VBS verification and enablement steps.

Step 3: Enable Hotpatch from the Azure Arc Portal

📸 Windows Server 2025 machine in Azure Arc with Hotpatch enabled — note the VBS status check that runs automatically

At-Scale Onboarding with Group Policy or Service Principal

For environments with dozens or hundreds of servers, you do not want to onboard manually. Azure Arc supports at-scale deployment via:

• Group Policy — Deploy the Connected Machine agent to domain-joined machines silently using a GPO startup script.
• Service Principal — Create an Azure AD service principal with the Azure Connected Machine Onboarding role, embed the credentials in your deployment script, and run it via SCCM, Ansible, or any orchestration tool.
• Terraform — Use the azurerm_arc_machine resource for infrastructure-as-code deployments.

7. Enabling Hotpatch on AWS / GCP Servers via Azure Arc

The process for multi-cloud servers (running on AWS EC2 or Google Cloud Compute Engine) is identical to on-premises — because Azure Arc abstracts the underlying platform. As long as the machine runs Windows Server 2025 and has outbound internet access to Azure Arc endpoints, it can be Arc-enabled and hotpatched.

Key Considerations for AWS EC2 (Windows Server 2025)

• Ensure the EC2 instance uses a UEFI boot mode. Most modern instance types (e.g., M6i, C6i, R6i and later) support this. Check your AMI and instance type compatibility.
• Verify that the EC2 Security Group allows outbound HTTPS (port 443) to Azure Arc service URLs.
• AWS Systems Manager (SSM) and Azure Arc can coexist — there is no conflict between the two agents.
• You can use AWS Systems Manager Run Command to push the Arc onboarding script across a fleet of EC2 instances at scale.

Key Considerations for GCP Compute Engine

• GCP Compute Engine supports UEFI boot for Windows instances — ensure your image uses UEFI-compatible boot disk.
• Use GCP OS Config or Startup Scripts to deploy the Connected Machine agent across GCP instances at scale.
• GCP’s default Windows Server images support VBS; verify through the OS after provisioning.

8. Enabling Virtualization-Based Security (VBS)

VBS is the most common blocker when enabling hotpatch. Here is how to check its status and enable it if needed.

Check VBS Status — PowerShell

# Check VirtualizationBasedSecurityStatus
# Output: 0 = Not enabled, 1 = Enabled but not running, 2 = Running (required for hotpatch)

Get-CimInstance -Namespace 'root/Microsoft/Windows/DeviceGuard' `
    -ClassName 'win32_deviceGuard' | `
    Select-Object -ExpandProperty 'VirtualizationBasedSecurityStatus'

# Also check via msinfo32 — look for "Virtualization-based Security" field
Start-Process "msinfo32.exe"

If the output is 2, VBS is running — you’re good to proceed. If it returns 0 or 1, you need to enable it.

Enable VBS — PowerShell (Registry Method)

# Enable Virtualization-Based Security via Registry
# Run as Administrator — requires a reboot to take effect

New-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\DeviceGuard' `
    -Name 'EnableVirtualizationBasedSecurity' `
    -PropertyType 'Dword' `
    -Value 1 `
    -Force

# Alternative: Command Prompt / CMD
# reg add "HKLM\System\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f

# Schedule a reboot (uncomment to execute)
# Restart-Computer -Force

Write-Host "VBS registry key set. A reboot is required." -ForegroundColor Yellow

Enable VBS via Group Policy (At Scale)

For domain-joined environments, deploy VBS centrally via Group Policy:

1. Open Group Policy Management Console (GPMC)
2. Create or edit a GPO linked to the target OU
3. Navigate to: Computer Configuration → Administrative Templates → System → Device Guard
4. Open “Turn On Virtualization Based Security” and set it to Enabled
5. Under Select Platform Security Level, choose Secure Boot and DMA Protection
6. Apply the GPO and schedule a coordinated reboot across the target servers

9. Managing Hotpatch at Scale with Azure Update Manager

Azure Update Manager (AUM) is Microsoft’s unified patch management service that works across Azure VMs, Arc-enabled servers, and Azure Local — all from a single pane of glass. For environments with multiple hotpatch-enrolled servers, AUM is the right tool for orchestrating rollouts, monitoring compliance, and scheduling maintenance windows.

📸 Azure Update Manager provides a unified view of hotpatch status, compliance, and update history across your entire hybrid server fleet

Key AUM Capabilities for Hotpatch

• Compliance Dashboard — See at a glance which servers are hotpatch-enrolled, which have pending hotpatches, and which are non-compliant.
• Schedule Updates — Create maintenance schedules that align with your change management calendar. AUM will apply hotpatches automatically during the defined window.
• Patch Groups — Group servers by environment (Dev, Staging, Production) and apply updates in waves with configurable delays between groups.
• On-Demand Assessment — Trigger an immediate compliance assessment on any server to see its current patch state without waiting for the scheduled check.
• Unified History — View the complete update history for any server, including whether each update was applied as a hotpatch (no-reboot) or a baseline (reboot).

Enable Hotpatch via Azure Update Manager

10. PowerShell & Azure CLI Reference

For automation-driven environments, here is a full reference of the key commands for hotpatch management.

Enable Hotpatch on Arc Machine via PowerShell

# Connect to Azure first
Connect-AzAccount

# Set the patch settings for an Arc-enabled machine
$resourceGroup  = "rg-arc-servers"
$machineName    = "SRV-PROD-01"
$subscriptionId = "<your-subscription-id>"

# REST API call via Invoke-AzRestMethod
$apiVersion = "2022-12-27"
$uri = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroup/providers/Microsoft.HybridCompute/machines/$machineName/patchSettings?api-version=$apiVersion"

$body = @{
    properties = @{
        windowsParameters = @{
            enableHotpatching = $true
        }
    }
} | ConvertTo-Json -Depth 5

Invoke-AzRestMethod -Method PATCH -Path $uri -Payload $body

Write-Host "Hotpatch enablement request sent for $machineName"

Enable via Azure CLI

# Login to Azure
az login

# Enable hotpatch on an Arc-enabled server using REST
az rest --method PATCH \
  --url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/rg-arc-servers/providers/Microsoft.HybridCompute/machines/SRV-PROD-01/patchSettings?api-version=2022-12-27" \
  --body '{"properties":{"windowsParameters":{"enableHotpatching":true}}}'

# Check Arc machine connectivity status
az connectedmachine show \
  --resource-group rg-arc-servers \
  --name SRV-PROD-01 \
  --query "{name:name,status:status,agentVersion:agentVersion}" \
  --output table

Verify Hotpatch Status on the Server Locally

# Check Arc agent (Connected Machine) service status
Get-Service -Name 'himds' | Select-Object Name, Status, StartType

# Verify VBS is running (should return 2)
Get-CimInstance -Namespace 'root/Microsoft/Windows/DeviceGuard' `
    -ClassName 'win32_deviceGuard' | `
    Select-Object VirtualizationBasedSecurityStatus

# Check Windows Update logs for hotpatch entries
Get-WindowsUpdateLog

# List installed updates — hotpatches will show as smaller packages
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Alternatively, check via WMI
Get-CimInstance -ClassName 'Win32_QuickFixEngineering' | `
    Sort-Object InstalledOn -Descending | Select-Object -First 10

11. Limitations and What Hotpatch Does NOT Cover

Hotpatch is powerful, but it is not a universal patch solution. Understanding its limitations prevents surprises.

Additionally, you still need a quarterly reboot for baseline updates. If a critical zero-day cannot be delivered as an in-memory patch (e.g., it modifies kernel drivers), Microsoft will issue an unplanned baseline update that requires a reboot. Always maintain your change management process to accommodate emergency patching scenarios.

12. Troubleshooting Common Issues

Issue: Hotpatch Status Stuck on “Pending”

After enabling hotpatch in the portal, the status remains Pending for more than 15 minutes.

Resolution:

• Verify the Connected Machine agent (himds service) is running: Get-Service himds
• Check outbound connectivity to *.arc.azure.com and management.azure.com on port 443
• Restart the agent: Restart-Service -Name himds
• Check Arc agent logs: C:\ProgramData\AzureConnectedMachineAgent\Log\

Issue: VBS Enablement Fails

The server does not reach VBS status = 2 even after rebooting.

Resolution:

• Verify UEFI + Secure Boot are enabled in the firmware/BIOS settings
• For Hyper-V VMs: confirm it is a Generation 2 VM with Secure Boot enabled in VM settings
• For VMware: ensure VBS is enabled at the VMware VM configuration level (requires VM power-off)
• Check that the hardware/hypervisor meets VBS hardware requirements

Issue: Server Not Appearing in Azure Arc

After running the onboarding script, the machine does not appear in Azure Arc → Machines.

Resolution:

• Confirm the azcmagent connect command completed without errors
• Check firewall rules — the Arc agent requires outbound access to a range of Azure service endpoints (documented at aka.ms/AzureArcNetworkRequirements)
• Verify the user or service principal used has the Azure Connected Machine Onboarding role on the target subscription/resource group
• Run azcmagent show on the server to check connection status

Issue: “Edition Not Supported” Error

The portal shows an error indicating the edition is not supported for hotpatch.

Resolution:

• Confirm you are running Windows Server 2025 (not 2022) Standard or Datacenter
• Run (Get-ComputerInfo).WindowsProductName to verify the exact edition and build
• Ensure the server is on build 26100.1742 or later

# Check Arc agent service
Get-Service -Name 'himds'

# View Arc agent connection status
azcmagent show

# Collect Arc diagnostic bundle (saves to desktop)
azcmagent logs

# Check Windows Server edition and build
(Get-ComputerInfo).WindowsProductName
(Get-ComputerInfo).OsBuildNumber

# Check if himds process is communicating with Azure
Test-NetConnection -ComputerName "management.azure.com" -Port 443
Test-NetConnection -ComputerName "eastus.arc.azure.com" -Port 443