Thursday, April 3rd 2025
Forget Reboots, Live Patches are Coming to Windows 11 Enterprise Clients
Microsoft is introducing live patch updates for Windows 11 Enterprise, version 24H2, that allow critical security fixes to be applied without interrupting users. These updates, known as hotpatches, are available for x64 devices running on AMD or Intel CPUs. Hotpatch updates are designed to install quickly and take effect immediately. Unlike standard monthly security updates that require a system restart, hotpatch updates provide instant protection against vulnerabilities while allowing users to continue working. This new process can reduce the number of restarts from twelve per year to just four. The update schedule follows a quarterly cycle. In January, April, July, and October, devices install a complete security update with new features and fixes that do require a restart. In the two months that follow each of these baseline updates, devices receive hotpatch updates that only include security fixes and do not need a reboot. This approach ensures that essential protections are applied quickly without impacting daily work.
To use hotpatch updates, organizations need a Microsoft subscription that includes Windows 11 Enterprise (or Windows 365 Enterprise) and devices running build 26100.2033 or later. These devices must also be managed using Microsoft Intune, where IT administrators can set up a hotpatch-enabled quality update policy. The Intune admin center automatically detects eligible devices and manages the update process. Hotpatch updates are currently available on Intel and AMD-powered devices. For Arm64 devices, hotpatch updates are still in public preview and require an extra configuration step: disabling CHPE support via a registry key or the upcoming DisableCHPE CSP. This update system represents a more efficient way to secure Windows client devices. By minimizing the need for restarts and delivering updates in a predictable, quarterly cycle, Microsoft aims to help organizations protect their systems with minimal disruption. We expect these live patches to trickle down to more Windows 11 versions, like Home and Pro editions.
Source:
Windows IT Pro Blog
To use hotpatch updates, organizations need a Microsoft subscription that includes Windows 11 Enterprise (or Windows 365 Enterprise) and devices running build 26100.2033 or later. These devices must also be managed using Microsoft Intune, where IT administrators can set up a hotpatch-enabled quality update policy. The Intune admin center automatically detects eligible devices and manages the update process. Hotpatch updates are currently available on Intel and AMD-powered devices. For Arm64 devices, hotpatch updates are still in public preview and require an extra configuration step: disabling CHPE support via a registry key or the upcoming DisableCHPE CSP. This update system represents a more efficient way to secure Windows client devices. By minimizing the need for restarts and delivering updates in a predictable, quarterly cycle, Microsoft aims to help organizations protect their systems with minimal disruption. We expect these live patches to trickle down to more Windows 11 versions, like Home and Pro editions.
28 Comments on Forget Reboots, Live Patches are Coming to Windows 11 Enterprise Clients
Please M$, don't take away my 12x mandatory reboots per year, I love them soooooooo much I can barely wait for the next one to come along.........
n.O.t......
/s
They system, and any running applications, would be using the "patched" binaries after a live patch, no differently than it would post restarting from a cold patch.
Not exactly the same thing (considering how differently they run), but you can check this: en.wikipedia.org/wiki/Kpatch#InternalsThis does imply that patches that require restart will be deferred up to 3 months, which goes against the whole "better security" thing.
Sure, they'd release critical patches immediately, but that still leave the less-than-critical ones. And if the latter were unimportant enough to wait months, why wouldn't they be unimportant enough to wait 24 hours (given how they force every computer to restart to finish updates these days)?
Yes. I'm just just trivialising this because it's Microsoft. Sue me. :cool:
Yesterday I initialised a refurbished notebook with a official microsoft refurbish windows 11 pro 24h2 license. Lot's of issues with 4.5 year old notebook.
Marketing news piece - vs real life scenario.
en.wikipedia.org/wiki/Delta_update
The article states that MS has used this since XP but considering every Win11 monthly roll-up is 700MB+ i doubt there are 700MB+ worth of changes every month.
This would save massive amount of resources if properly implemented in terms of bandwidth, disk space etc.
But since this is MS they'll problably just add more emoji's, becauyse who cares about how long it takes to do the updates.
Windows 11 is just shite though, basically a downgrade to 10 so far & not looking forward to their end of support.
Windows simply does not do "driver timeouts on background pics changes", it even sounds insane.
If you do a clean install without literally anything else but the latest official drivers and funky crap still happens then you either have a failing hardware or you have that one 0.01% specific combination of it which could not be tested (since no one tests for 0.01%).
Utterly significant is that Windows Update is a perennial source of problems and had become very slow on Windows Vista and 7 computers. I have dug rather deep into this (it was many years ago), yet I've never found a full, right down to the metal, public explanation for this. Apparently, Windows has used (and might still be using) a kind of component-based architecture, very advanced by itself. Components can depend on each other and can supersede each other. According to tales, in order to enable update supercession, the Update services had to check every update against every other update in the whole catalog (database). This made it end up at least with quadratic behaviour and is (again, according to some) the primary reason why my HDD-based Vista SP2 computer took in the realm of—possibly more—than three quarters of an hour of one (of two, relatively weak) cores working hard and 700–800MiB of RAM to arrive at the conclusion that no applicable updates had been published. The whole update architecture seems to have been intractable garbage for the common case, advanced as it may have been. Imagine the wasted computing power accross all machines. In fact, even Win11’s update check is kinda slow.
So, what Microsoft has done is they’ve decided, at some point in time, that they would henceforth only roll out cumulative monthly updates (if I recall correctly), that have all the previous updates since some point in time (I think they started out with, since the last major update, but might be even more since then?) This enabled them to simplify their algorithm, but it means there will be lots of redundant changes delivered to you. (By month four, you'll install updates 4, 3, 2, 1, month five, 5, 4, 3, 2, 1, month six, 6, 5, 4, 3, 2, 1, …)
Now a minor point again, no matter whether they actually only delta file-wise (and I, too, remember hearing about something like that), it’s the natural run of things that changes all over the place would start accumulating, thus more and more approaching a full update.Heh, funny thing about that, Windows is used on some 1.6bn devices (1.6KKK, not to be confused with the other triple-K) worldwide, so if 0.01% of setups were failing, that’d still be 100,000 or so of very angry people … (Might be just about in the right ballpark? What kind of time frame are we talking about, broken devices total at any given point in time? Might be at most an order of magnitude less, wordwide?)Standard advice is: Have you tried a clean clean install? Where you nuke your disk before installing? Very weird. Are these alll the same models of computers, or various? There’s a mechanism to install drivers from your UEFI, if that is the cause, that’d be rad. I don’t think it’s malware.There’s one simple trick Microsoft (or any OS could have implemented back in 2001 with XP, or even before: Instead of restarting and then idling ad infinitum, hand the user a restart-to-standby button. With the re-opening of programs Windows has received at some point in time (I’ve used Vista for years, but did that already have it? Win7, -8?) many users could have had painless restarts who previously might not have felt like it. Of course, there’s strings attached, not all programs seamlessly resume where you’ve left off, but for many, it could have been good enough.
It’s paramount for that that Windows would actually reliably force a power-down state. Either standby, and if that cannot be reached for whichever reason, force a shutdown. This would remove concerns about the computer running indefinitely.