Windows 11 Hotpatch Updates: Enable, Verify & Fix

Last Updated: August 2026

Windows 11 hotpatch updates let eligible Windows 11 Enterprise/Education devices (version 24H2+) install monthly security fixes without a restart, using Windows Autopatch and Intune. In our testing, the two hard requirements people miss are Virtualization-Based Security (VBS) being turned on, and the device being enrolled in a Windows Autopatch quality update policy with hotpatch allowed. This guide covers every step: enabling hotpatch, turning on VBS at scale, building a compliance policy to track readiness, and verifying that a hotpatch actually installed — with every available method and our recommendation for each.

What Is Windows 11 Hotpatch and How Does It Work?

Windows 11 hotpatch is a delivery mechanism for monthly security-only updates that apply to a running system without requiring a restart. It’s an extension of Windows Update that depends on Windows Autopatch to create and deploy the update to enrolled devices. Instead of writing new files to disk and swapping them in at the next boot, hotpatch modifies in-memory code for a small, targeted set of components covered by that month’s fix.

In our lab testing on a 24H2 device enrolled in a pilot Autopatch group, the update installed silently in the background and a green confirmation banner appeared under Windows Update within a few minutes — no user interruption, no forced restart prompt. This matters most for shared kiosks, meeting-room PCs, and any fleet where scheduling reboot windows is operationally painful.

Hotpatch does not replace reboots entirely. Feature updates, driver updates, and quarterly baseline cumulative updates still require a restart. Hotpatch only removes the restart requirement for the in-between monthly security-only releases.

Requirements and Prerequisites

A device must clear every row below. If even one item is missing, Windows Autopatch silently falls back to a standard cumulative update (LCU) with a restart — there’s no error, so this is worth auditing proactively rather than waiting for a support ticket.

The Hotpatch Release Cycle

Hotpatch follows a fixed quarterly rhythm: one baseline month (restart required) followed by two hotpatch months (no restart). This pattern repeats identically every quarter across all hotpatch-eligible operating systems, cutting the number of forced restarts from twelve a year down to four.

An emergency out-of-cycle baseline can occasionally be issued for a specific security issue. When this happens, the regular quarterly cadence isn’t shifted — the extra baseline is simply layered in.

Step-by-Step: Enable Hotpatch via Intune

This creates the Windows Quality Update policy that actually turns hotpatch on for a target group of devices.

1. Sign in to the Intune admin center.
2. Go to Devices > Windows updates > Quality updates tab.
3. Select Create > Windows quality update policy.
4. On the Basics page, name the policy (e.g., “Win11-Hotpatch-Pilot”) and select Next.
5. On the Settings page, set “When available, apply without restarting the device (Hotpatch)” to Allow. Select Next.
6. Choose relevant Scope tags or leave as Default. Select Next.
7. Assign the policy to a small pilot device group first — never the full fleet on day one.
8. Review and select Create.

In our testing, policy application isn’t instant after an Intune sync — the device’s background Windows Update client components (Usoclient and MoUSOCoreWorker) fetch and apply the policy on their own schedule, so allow up to 24 hours before checking for the “Enable hotpatching when available” confirmation under Windows Update > Advanced options > Configured update policies.

Step-by-Step: Enable VBS at Scale (All Options)

VBS is the single most commonly missed hotpatch prerequisite. There are three practical ways to turn it on across a fleet. We cover all three, then give our recommendation.

Option A — Intune Settings Catalog (CSP-based, cloud-managed)

1. Intune admin center > Devices > Windows > Configuration profiles > Create > New policy.
2. Platform: Windows 10 and later. Profile type: Settings catalog.
3. Name it (e.g., “VBS-Hotpatch-Readiness”).
4. Select + Add settings and search for “Virtualization Based Security”.
5. Configure: Enable Virtualization Based Security = Enabled; Platform Security Level = Secure Boot (add DMA protection if hardware supports it); Virtualization Based Protection of Code Integrity = Enabled without UEFI lock (recommended for remote manageability — see note below).
6. Assign to a pilot group first.
7. Save and monitor under the profile’s Device status tab.

Option B — Group Policy (on-prem / hybrid-joined devices)

1. Open Group Policy Management Console on a domain controller or RSAT workstation.
2. Create or edit a GPO scoped to a pilot OU — never apply directly to the root domain.
3. Navigate to Computer Configuration > Administrative Templates > System > Device Guard.
4. Enable “Turn On Virtualization Based Security”.
5. Set Select Platform Security Level to Secure Boot (or Secure Boot and DMA Protection).
6. Set Virtualization Based Protection of Code Integrity to Enabled without lock.
7. Link the GPO to the pilot OU and run gpupdate /force on a test device, then restart to confirm VBS activates.

Option C — Registry / provisioning package (manual or imaging-time)

1. Set the DWORD HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity = 1.
2. Set RequirePlatformSecurityFeatures = 1 (Secure Boot) or 3 (Secure Boot + DMA).
3. Set HypervisorEnforcedCodeIntegrity = 1 under the same key.
4. Restart the device to activate.
5. This can be embedded in a Windows provisioning package (.ppkg) at imaging time for new-device rollouts.

Step-by-Step: Build a VBS Compliance Policy

Native Intune compliance policies don’t include a built-in VBS check, unlike Secure Boot or BitLocker. A custom compliance policy closes that gap and gives you a clean compliant/non-compliant list.

1. Detection script

Save as VBSComplianceCheck.ps1:

try {
    $deviceGuard = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction Stop
    $vbsRunning = $deviceGuard.VirtualizationBasedSecurityStatus -eq 2
    $hash = @{ VBSRunning = $vbsRunning }
}
catch {
    $hash = @{ VBSRunning = $false }
}
return $hash | ConvertTo-Json -Compress

2. Rules file

Save as VBSComplianceRules.json:

{
  "Rules": [
    {
      "SettingName": "VBSRunning",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://blog.core365.cloud/windows-11-hotpatch-updates-guide/",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Virtualization Based Security (VBS) is not running",
          "Description": "This device does not meet the VBS requirement for hotpatch updates. Confirm the VBS configuration profile applied and that the device has restarted."
        }
      ]
    }
  ]
}

3. Upload and create the policy

1. Intune admin center > Devices > Compliance > Scripts tab > Custom compliance settings > Add. Upload the JSON rules file. Platform: Windows 10 and later.
2. Go to Devices > Compliance > Policies > Create policy.
3. Platform: Windows 10 and later. Profile type: Custom compliance.
4. Toggle Use custom compliance settings to Yes.
5. Upload the discovery script (VBSComplianceCheck.ps1) and select the JSON rules file from step 1.
6. Configure Actions for noncompliance (email notification, mark noncompliant, or trigger Conditional Access enforcement).
7. Assign to your pilot group, review, and Create.

A common gotcha we ran into: custom compliance scripts run under the Intune Management Extension (IME). If IME isn’t already functioning on a device — for example, because it’s never received a Win32 app or script push before — the policy shows “Not evaluated” instead of a real pass/fail result. Confirm IME is active before troubleshooting a false negative.

How to Verify a Hotpatch Actually Installed (All Methods)

Because there’s no reboot, there’s no obvious visual signal after the first six installs. Here are every practical method, in order of reliability.

Troubleshooting Table

Windows 11 vs. Windows Server 2025 Hotpatch

The underlying mechanism is shared, but the management plane differs by platform.

If you’re running a mixed fleet, see our companion guide, Windows Server 2025 Hotpatch: The Complete Guide, for the Azure VM and Arc-managed on-prem setup.

For devices already troubleshooting join issues before you even get to hotpatch, our Microsoft Entra Hybrid Join Troubleshooting guide covers the Entra/Intune enrollment prerequisites in depth. And if you’re evaluating third-party patch tooling alongside native hotpatch, compare it against our ManageEngine Endpoint Central Patch Management guide.

Frequently Asked Questions

What is Windows 11 hotpatch and how does it work?

Hotpatch is a monthly security-only update delivered through Windows Autopatch that applies to a running system without a restart, by patching in-memory code for a small set of components.

Which Windows 11 editions support hotpatch?

Windows 11 SE, Enterprise, Education, Enterprise Multi-Session, Home and Pro, and IoT Enterprise, all on version 24H2 or later, with an eligible license.

Do I need Windows Autopilot to use hotpatch?

No. Autopilot only controls device provisioning. Any Intune-managed, Entra-joined or hybrid-joined device is eligible for hotpatch regardless of how it was originally enrolled.

Is VBS required for hotpatch updates?

Yes. Virtualization-Based Security must be turned on and actively running for a device to be offered hotpatch updates instead of standard cumulative updates.

Can I enable VBS through Intune without touching each laptop?

Yes, using a Settings Catalog configuration profile with the VirtualizationBasedTechnology CSP. Devices apply it automatically and need one restart to activate it.

What happens to devices that don’t meet hotpatch prerequisites?

They automatically receive the standard Latest Cumulative Update instead, with no error shown — the device is simply patched with a restart requirement that month.

How often are baseline updates released?

Quarterly — January, April, July, and October — with two rebootless hotpatch months following each baseline.

Does hotpatch eliminate reboots completely?

No. It removes restarts only for the monthly security-only hotpatch releases. Quarterly baseline updates and feature updates still require a restart.

How can I check if VBS is running on a device?

Run System Information (msinfo32) and check “Virtualization-based security” for a Running status, or query Win32_DeviceGuard via PowerShell.

Can I build a compliance policy just for VBS status?

Yes, using a custom compliance policy with a PowerShell discovery script and a matching JSON rules file uploaded to Intune.

How do I confirm a hotpatch update actually installed?

Check Windows Update history for the specific KB, cross-reference Event Viewer logs, or use the Autopatch Hotpatch quality update report for fleet-wide confirmation.

Can build number alone confirm a hotpatch installed?

Not reliably. Some hotpatch KBs don’t change the visible build number, so always verify against the specific KB ID rather than the build alone.

Does hotpatch work with Arm64 devices?

Yes, but Arm64 devices must disable Compiled Hybrid PE (CHPE) via the DisableCHPE policy CSP, which can affect legacy 32-bit x86 application performance.

Antonio Rennvick

Antonio Rennvick is an IT Infrastructure Manager with 15+ years running enterprise Active Directory, Microsoft 365, and Azure environments. He’s Microsoft certified (AZ-104, MS-102) and writes Core365 Cloud to share what actually works in production—PowerShell automation, AD deep dives, and security hardening drawn from real-world work, not test labs.