Windows 11 Hotpatching Explained: How Much Does It Really Reduce Reboots?

Windows updates and inconvenient restarts have been uneasy roommates for decades. Microsoft is now trying to make them see much less of each other.

Windows 11 hotpatching allows eligible business PCs to install certain monthly security updates without restarting. Combined with Microsoft’s newer effort to consolidate other Windows updates around a single monthly restart, the company is making a broader push to reduce one of the most disruptive parts of enterprise patch management.

But hotpatching does not mean the end of the Windows reboot. For IT teams considering the feature, the more useful questions are how many restarts it can actually eliminate, which organizations need to use it, and where the exceptions begin.

What is Windows 11 hotpatching?

Hotpatching allows Windows to apply eligible security fixes to a running operating system without requiring an immediate device restart.

According to Microsoft’s Windows hotpatch documentation, hotpatches are monthly security updates designed to reduce downtime and help organizations keep devices patched with fewer interruptions.

Hotpatches also have another practical advantage for businesses managing large device fleets: Microsoft says their package sizes are significantly smaller than standard cumulative updates, allowing them to install faster and consume less network bandwidth.

The technology has also expanded to Arm64 PCs. Microsoft’s August 2026 Windows 11 hotpatch release made hotpatching generally available for eligible Windows 11 versions 24H2 and 25H2 Arm64 devices.

There is an additional setup requirement for those systems. Arm64 devices must have Compiled Hybrid PE, or CHPE, disabled because Microsoft says the compatibility layer is incompatible with hotpatch updates. Disabling CHPE requires a one-time restart before the device is ready for hotpatching.

TechRepublic readers have already seen the technology put to practical use. In March, Microsoft used an out-of-band hotpatch to address critical Windows 11 RRAS vulnerabilities without requiring affected systems to restart.

That ability becomes particularly valuable when a serious security problem appears in the middle of a workday. Instead of choosing between delaying an important patch and interrupting users, administrators may be able to install an eligible security fix while systems remain running.

Hotpatching doesn’t eliminate Windows restarts

There is, however, a sizable asterisk attached to the “no restart” description.

Microsoft normally divides its hotpatch schedule into quarterly cycles. Under its planned schedule, the first month of each quarter receives a baseline cumulative update, which requires a restart. Eligible devices can then receive security hotpatches during the following two months without restarting.

The normal schedule looks like this:

Microsoft’s Windows hotpatch guidance describes a planned annual cadence of four baseline months and eight hotpatch months. That does not mean administrators should expect exactly four security-related restarts every year.

Microsoft can add baseline months when necessary. Its servicing documentation specifically warns that additional baseline releases can occur, changing the normal hotpatch schedule.

There are other ways devices can leave the expected cadence. If a device enters a hotpatch month without the latest baseline installed, Microsoft says it will receive both the baseline update, which requires a restart, and the latest hotpatch.

Upgrading Windows versions can also affect the cycle. An eligible device upgraded during a baseline month can remain on the hotpatch cycle. Upgrade it during a hotpatch month, however, and Microsoft says the device switches to standard updates until the next baseline release, requiring a restart.

Firmware, application, operating system, emergency, and other updates may also require reboots.

IT administrators should therefore treat Microsoft’s four-baseline, eight-hotpatch pattern as a planned servicing cadence, not a guaranteed annual reboot count.

Microsoft is attacking the reboot problem from another direction, too

Hotpatching isn’t Microsoft’s only attempt to make Windows updating less disruptive.

Beginning with updates released on or after July 28, 2026, Microsoft started rolling out an update experience that groups several restart-requiring Windows updates together rather than letting them trigger separate restarts throughout the month.

Under Microsoft’s “one restart a month” Windows Update approach, driver, .NET, firmware, and monthly security updates can be coordinated to share a single scheduled restart. The feature is rolling out gradually, however, and Microsoft cautions that it may not yet be available on every eligible device. Emergency and out-of-band updates can still install immediately, as can critical or expedited driver updates.

The distinction between Microsoft’s two approaches is important. The one-restart initiative consolidates updates that still require a reboot. Hotpatching, meanwhile, removes the immediate reboot requirement from eligible security updates on devices that remain eligible for hotpatching.

Used together, the two strategies point to a Windows servicing model in which restarts are less frequent and, when unavoidable, more predictable. That could be significant for administrators already dealing with a busy Windows security calendar. Microsoft’s July 2026 Patch Tuesday, for example, addressed a record 570 security vulnerabilities, including exploited zero-days.

Which Windows 11 devices are eligible for hotpatching?

Hotpatching is primarily intended for managed business environments, and organizations can’t simply enable it on every Windows 11 PC.

For its current Windows 11 client hotpatch releases, Microsoft supports eligible configurations running Windows 11 version 24H2 or 25H2. Administrators should verify individual Windows releases against Microsoft’s current hotpatch documentation rather than assuming every version newer than 24H2 is automatically supported.

Devices must also have the latest applicable baseline update installed and Virtualization-based security, or VBS, running.

Organizations need Microsoft Intune and must enroll devices in a Windows quality update policy with hotpatching enabled. Arm64 PCs have the additional CHPE requirement. Administrators must disable CHPE and restart those systems once before they can receive hotpatch updates.

Licensing is another consideration. Microsoft’s current hotpatch documentation lists eligible subscriptions including:

• Windows 11 Enterprise E3 or E5
• Microsoft 365 F3
• Windows 11 Education A3 or A5
• Microsoft 365 Business Premium
• Windows 365 Enterprise

Microsoft documentation should be checked for the latest qualifying subscriptions before deployment, as licensing and eligibility requirements can change.

Organizations can review Microsoft’s full hotpatch eligibility and configuration requirements before planning a rollout.

Devices that no longer meet hotpatch prerequisites aren’t simply left unpatched. Microsoft says ineligible devices receive the standard Latest Cumulative Update instead, keeping them on the normal Windows servicing path. That update requires a restart.

This fallback helps maintain security coverage, but it also means fleet consistency matters if an organization wants the operational benefits of hotpatching.

More Microsoft news

Is Windows 11 hotpatching worth enabling?

For organizations that already use Intune and hold eligible Microsoft licenses, hotpatching has a fairly straightforward appeal: fewer mandatory reboots without deliberately postponing eligible monthly security patches.

The benefit becomes larger as the number of managed endpoints grows.

A reboot that costs one employee a few minutes might seem trivial. Multiply that interruption across hundreds or thousands of devices, however, and predictable patching becomes an operational issue. Systems used for kiosks, frontline work, long-running processes, remote work, or other availability-sensitive tasks may benefit even more.

Smaller update packages could also help organizations managing PCs across constrained or remote networks.

But administrators should not mistake hotpatching for protection against every Windows update problem. Updates can still introduce compatibility issues, and baseline releases remain a necessary part of Microsoft’s servicing model.

Windows recovery capabilities matter for precisely that reason. Microsoft has also been expanding Windows 11 resilience tools, including Point-in-Time Restore to recover PCs after failed updates, driver issues, and system corruption.

The better way to think about hotpatching is not as the end of rebooting, but as another tool for reducing the operational cost of keeping Windows secure.

Fewer reboots, not zero reboots

Microsoft appears to be changing the philosophy behind Windows Update from “restart when necessary” toward “interrupt the user as little as necessary.”

Hotpatching removes the immediate reboot requirement from eligible monthly security releases for devices that remain compliant with Microsoft’s hotpatch requirements. The consolidated restart model attempts to bundle other interruptions. Recovery tools are being strengthened for situations where updates still go wrong.

For IT teams, that’s meaningful progress, but not permission to forget about maintenance windows.

Baseline updates will still require restarts. Additional baseline releases can alter Microsoft’s normal schedule. Devices that become ineligible for hotpatching fall back to standard cumulative updates, and emergency, hardware, firmware, and application updates may require additional restarts.

The prize isn’t a reboot-free Windows environment. It’s a Windows fleet where security teams can patch faster, and administrators have fewer surprise interruptions to manage.

Related reading: For organizations still managing older PCs, TechRepublic’s Windows 10 ESU cheat sheet breaks down the costs, eligibility rules, coverage, and deadlines for keeping Windows 10 systems patched after support ends.