Servicing brief · Tech
Three rules define the restart-free path
Hotpatch reduces interruption only when licensing, device state and update timing keep the machine attached to the current baseline.
- A baseline restart buys the next two hotpatch monthsThe first month of the quarter installs a cumulative baseline and requires a restart. The following two months can apply eligible security fixes without an immediate restart.
- Eligibility is a chain rather than a switchLicense, Windows version, x64 hardware, VBS, Intune policy and the current baseline all have to remain true together.
- A version upgrade can create restart debtUpgrade during a hotpatch month and the device moves to standard updates until the following baseline returns it to the hotpatch cycle.
Windows 11 Hotpatch is usually sold in one sentence: security updates without a restart. That sentence describes the benefit, not the operating model. A hotpatch device is still part of the Windows servicing calendar, and the calendar begins with a quarterly cumulative baseline that does require a restart.
The practical gain is narrower and more useful. A well-managed fleet can replace three monthly restart events with one planned baseline restart and two restart-free security-update months. The risk is that a device can leave this path through missed prerequisites, an old baseline or a badly timed version upgrade while every policy screen still appears broadly correct.
Hotpatch eligibility is a chain of six conditions
Microsoft requires an eligible enterprise, education, business or Windows 365 license; Windows 11 version 24H2 or later; x64 hardware; Virtualization-based Security; Microsoft Intune management through a hotpatch-enabled Windows quality update policy; and the current baseline. Treating any one of these as a proxy for the others creates false confidence.
Eligibility constellation
Every node must remain lit
A licensed device can still fall back to standard servicing. A current baseline is a runtime condition, not a procurement fact.
EntitlementEligible Windows or Microsoft 365 license
PlatformWindows 11 24H2 or later on x64
Security stateVirtualization-based Security enabled
Servicing stateIntune policy and current baseline
The quarterly rhythm matters more than the monthly label
Microsoft’s normal pattern is a baseline cumulative update in the first month of each quarter, followed by hotpatch updates in months two and three. The 2026 calendar also shows why the word “quarterly” should not be interpreted too mechanically: June became an additional baseline month for security reasons, while July remained the planned next-quarter baseline.
Month oneBaselineInstall the cumulative base and complete one controlled restart.
Month twoHotpatchApply eligible security fixes without an immediate restart.
Month threeHotpatchStay protected on the same base until the cycle turns again.
The Eligibility Rail exposes where a device leaves the cycle
Signature module · The Eligibility Rail
Follow one device from policy assignment to protected state
A fleet dashboard becomes useful only when it explains which gate failed and what servicing route the device entered instead.
Gate 01Target and evaluateConfirm license, version, architecture and VBS before assuming policy success.
Gate 02Attach the baselineInstall the current cumulative base and record the completed restart.
Gate 03Receive the hotpatchMonitor deployment status and errors in the Hotpatch quality update report.
Gate 04Verify effective protectionConfirm the installed KB and OS build, not merely the assigned intent.
Rail intact Current baseline plus eligible policy produces the restart-free security path.
Rail broken Record the failed gate and the standard update route; do not report the machine as merely “pending.”
This module is not a checklist dressed as a feature. It is a device-state trace: each gate changes the possible next state, and the final check compares assigned policy with the installed update. That makes it specific to Hotpatch and prevents a green assignment status from standing in for evidence that a device is actually on the restart-free path.
Version upgrades create the most avoidable restart debt
Microsoft’s operational guidance draws a sharp timing boundary. Upgrade a hotpatch-enrolled device to the newest Windows version during a baseline month and it remains on the hotpatch cycle. Upgrade it during a hotpatch month and it switches to standard updates, needs a restart to apply them and resumes hotpatch only after the following baseline.
Upgrade in a baseline month
Stay on the rail
The new version establishes its compatible base within the planned restart window, so hotpatch continues in the next months.
Upgrade in a hotpatch month
Return to standard updates
The device leaves the restart-free path until the next baseline. Plan the restart rather than discovering it inside a compliance exception.
A fleet report should count state transitions, not restart promises
For each deployment ring, report how many devices are eligible, attached to the current baseline, successfully hotpatched, routed to standard updates and waiting for the next baseline. Keep version upgrades in the same operational view because they can change the servicing route even when the Hotpatch policy itself has not changed.
This is different from Quick Machine Recovery readiness, which asks whether an unbootable PC can reach repair below login. It is also different from the File Explorer context-menu budget, which audits latency and command placement on a healthy shell. Hotpatch is a servicing-state problem: the device must remain on a valid rail through time.
Questions about Windows 11 Hotpatch
Does Hotpatch mean a Windows 11 device never has to restart?
No. The quarterly baseline is a cumulative update that requires a restart. Hotpatch normally removes the immediate restart from the following two monthly security updates.
Can users still restart a device after a hotpatch?
Yes. Microsoft says the fixes are effective when installed, and an optional user or administrator restart does not remove the hotpatch KB or OS version.
What happens if a device misses the current baseline?
During a hotpatch month, an enrolled device that is not on the latest baseline receives the baseline, which requires a restart, together with the latest hotpatch.
Is Hotpatch available on Windows 11 version 26H1?
Microsoft’s current Windows 11 release information states that hotpatching is not available on version 26H1. Check release health before changing fleet assumptions.
