Forget Reboots, Live Patches are Coming to Windows 11 Enterprise Clients

[AleksandarK]

Microsoft is introducing live patch updates for Windows 11 Enterprise, version 24H2, that allow critical security fixes to be applied without interrupting users. These updates, known as hotpatches, are available for x64 devices running on AMD or Intel CPUs. Hotpatch updates are designed to install quickly and take effect immediately. Unlike standard monthly security updates that require a system restart, hotpatch updates provide instant protection against vulnerabilities while allowing users to continue working. This new process can reduce the number of restarts from twelve per year to just four. The update schedule follows a quarterly cycle. In January, April, July, and October, devices install a complete security update with new features and fixes that do require a restart. In the two months that follow each of these baseline updates, devices receive hotpatch updates that only include security fixes and do not need a reboot. This approach ensures that essential protections are applied quickly without impacting daily work.

To use hotpatch updates, organizations need a Microsoft subscription that includes Windows 11 Enterprise (or Windows 365 Enterprise) and devices running build 26100.2033 or later. These devices must also be managed using Microsoft Intune, where IT administrators can set up a hotpatch-enabled quality update policy. The Intune admin center automatically detects eligible devices and manages the update process. Hotpatch updates are currently available on Intel and AMD-powered devices. For Arm64 devices, hotpatch updates are still in public preview and require an extra configuration step: disabling CHPE support via a registry key or the upcoming DisableCHPE CSP. This update system represents a more efficient way to secure Windows client devices. By minimizing the need for restarts and delivering updates in a predictable, quarterly cycle, Microsoft aims to help organizations protect their systems with minimal disruption. We expect these live patches to trickle down to more Windows 11 versions, like Home and Pro editions.



View at TechPowerUp Main Site | Source

 

[Assimilator]

Holy s**t I thought this day would never come.

 

[ZoneDymo]

useful for the users at my workplace, but personally Id give me...idk comfort? to have a big update and then reboot the pc, like its fully setup in the new way, a fresh start, instead of going on with half still depending on the old setup, idk that is just a feeling obviously, not rooted in logic.

 

[windwhirl]

Holy s**t I thought this day would never come.

I heard about this when they released the feature for Windows Server around a year ago or so, IIRC. I knew they were testing it internally for client devices but yeah, I was starting to wonder if they had scrapped the idea after all.

 

[Hyderz]

Let’s just say Microsoft doesn’t have a good track records of applying updates… dunno how this gonna pan out

 

[bonehead123]

NOOOOOOOOOOOOOOOO.......

Please M$, don't take away my 12x mandatory reboots per year, I love them soooooooo much I can barely wait for the next one to come along.........






n.O.t......

/s

 

[Shihab]

instead of going on with half still depending on the old setup,

"That's the neat part, you don't."

They system, and any running applications, would be using the "patched" binaries after a live patch, no differently than it would post restarting from a cold patch.
Not exactly the same thing (considering how differently they run), but you can check this: https://en.wikipedia.org/wiki/Kpatch#Internals

The update schedule follows a quarterly cycle. In January, April, July, and October, devices install a complete security update with new features and fixes that do require a restart. In the two months that follow each of these baseline updates, devices receive hotpatch updates that only include security fixes and do not need a reboot.

This does imply that patches that require restart will be deferred up to 3 months, which goes against the whole "better security" thing.
Sure, they'd release critical patches immediately, but that still leave the less-than-critical ones. And if the latter were unimportant enough to wait months, why wouldn't they be unimportant enough to wait 24 hours (given how they force every computer to restart to finish updates these days)?

Yes. I'm just just trivialising this because it's Microsoft. Sue me.

 

[wNotyarD]

Although I'd very much like it to work just fine like it does on Linux, I don't know if I trust MS to get live patching done right.

 

[Redwoodz]

That's the last thing keeping them from total control of your OS. Forced reboot requires user action. Without it, one day you will wake up and your OS will be different than it was when you went to sleep. Great.

 

[R-T-B]

Holy s**t I thought this day would never come.

It's been trialing pretty well in server 2025 for a bit now. No real issues.

That's the last thing keeping them from total control of your OS. Forced reboot requires user action. Without it, one day you will wake up and your OS will be different than it was when you went to sleep. Great.

That's pretty much FUD. Use group policy. Those keys work.

 

[_roman_]

I would be happy with just one single reboot for a windows update. I would be very happy when with one click windows update would just do it's job without installing incompatible amd gpu driver, failed audio driver, stuck on reboot, hang during update, failed to install update, .... To name a few issues from yesterday.

Yesterday I initialised a refurbished notebook with a official microsoft refurbish windows 11 pro 24h2 license. Lot's of issues with 4.5 year old notebook.

Marketing news piece - vs real life scenario.

 

[Tomorrow]

Holy s**t I thought this day would never come.

Now if only they would discover delta patching too...

Delta update - Wikipedia

en.wikipedia.org

The article states that MS has used this since XP but considering every Win11 monthly roll-up is 700MB+ i doubt there are 700MB+ worth of changes every month.
This would save massive amount of resources if properly implemented in terms of bandwidth, disk space etc.

 

[blinnbanir]

Just make Windows stable for F's sake,

 

[Assimilator]

Just make Windows stable for F's sake,

What a stupid, stupid comment.

 

[windwhirl]

The article states that MS has used this since XP but considering every Win11 monthly roll-up is 700MB+ i doubt there are 700MB+ worth of changes every month.

They have used delta patching since forever, though perhaps not at the byte level, but rather file level. That's why Windows Update packages are smaller than using the actual full-size packages from the Download Center or whatever.

 

[blinnbanir]

What a stupid, stupid comment.

I guess you have not seen the countless posts all over YT about Win 11 issues. Where is my News media on the left? I don't know either. Just because you may be good does not mean that everyone that complains about Win11 is talking smack.

 

[Tomorrow]

They have used delta patching since forever, though perhaps not at the byte level, but rather file level. That's why Windows Update packages are smaller than using the actual full-size packages from the Download Center or whatever.

That would explain it. Time for an upgrade.
But since this is MS they'll problably just add more emoji's, becauyse who cares about how long it takes to do the updates.

 

[Ordy]

I guess you have not seen the countless posts all over YT about Win 11 issues. Where is my News media on the left? I don't know either. Just because you may be good does not mean that everyone that complains about Win11 is talking smack.

View attachment 393171

Windows 10 is stable. But to keep everything (all the other apps etc) stable, then a shutdown at the end of the day helps a lot. (and with fastboot disabled).
Windows 11 is just shite though, basically a downgrade to 10 so far & not looking forward to their end of support.

 

[Easo]

Just make Windows stable for F's sake,

You will have to specify. From my experience most issues are on user or driver manufacturers, not Windows itself.

 

[blinnbanir]

You will have to specify. From my experience most issues are on user or driver manufacturers, not Windows itself.

I already posted a Screen shot that shows I have no News Feed in the bottom left corner. How about Gmail refuses to load on this Machine, How about every 2nd or 3rd Background change I get a Driver time out. On all of my Win 11 PCs? How about no matter what I did I could not install Epic. The version on the MS Store worked fine though.

 

[Easo]

I already posted a Screen shot that shows I have no News Feed in the bottom left corner. How about Gmail refuses to load on this Machine, How about every 2nd or 3rd Background change I get a Driver time out. On all of my Win 11 PCs? How about no matter what I did I could not install Epic. The version on the MS Store worked fine though.

Profile corruption, you have tried some "cleaners/optimizers", you have turned off that feed (never hurts to check the simplest things first), you have installed something really strange/esoteric which touches where it shouldn't (injection into Windows processes for example), etc. etc.
Windows simply does not do "driver timeouts on background pics changes", it even sounds insane.
If you do a clean install without literally anything else but the latest official drivers and funky crap still happens then you either have a failing hardware or you have that one 0.01% specific combination of it which could not be tested (since no one tests for 0.01%).

 

[Ordy]

I already posted a Screen shot that shows I have no News Feed in the bottom left corner. How about Gmail refuses to load on this Machine, How about every 2nd or 3rd Background change I get a Driver time out. On all of my Win 11 PCs? How about no matter what I did I could not install Epic. The version on the MS Store worked fine though.

Sounds like a typical malware infected home users pc.

 

[blinnbanir]

Sounds like a typical malware infected home users pc.

Yep and Malwareantibytes finds nothing.

 

[freeagent]

I will probably reboot anyways just because.. old habits die hard

 

[Easo]

I will probably reboot anyways just because.. old habits die hard

Heh, even Macs like a monthly reboot from what I have seen. With the modern hardware you are logged back in within a minute, lol.