Original publish date: April 25, 2025
KB ID: 5059277
In this article
Introduction
Hotpatch updates are monthly security updates that get installed and take effect without the need to restart your Windows device. This represents a significant advancement in helping you stay secure and productive using Windows as you can get secure faster, with minimized disruption.
If your device is eligible, you might start seeing fewer notifications reminding you to restart it. Normally, the IT department at your organization decides whether you will take advantage of this new technology. You do not need to do anything to make it happen.
How to check if your device has installed a hotpatch update
You can be certain that your device is protected with the latest security update, even if you are not asked to restart it.
If your organization has enrolled your work device into hotpatching, check that it has the latest security update as follows:
-
Go to Start > Settings > Windows Update.
-
Look for a green banner under the Check for updates button. If your device has installed a hotpatch update, there will be a message saying, “Great news! The latest security update was installed without a restart.”Note You will only see this message for the first six hotpatch updates.
Another way to tell whether you have received a hotpatch update is to compare your OS version and KB number against Windows release notes. These numbers are different for hotpatch and standard monthly updates for the same month.
-
Find the latest update installed on your device by either of the following:
-
Check your OS build number: Go to Start > Settings > System > About. Under Windows specifications, note your OS build number (xxxxx.xxxx).
-
Or check the KB number of your latest update: Go to Start > Settings > Windows Update > Update history. Under Quality Updates, note the KB number in the top listed update (KBxxxxxxx).
-
-
Compare your devices update information with the Windows release notes for hotpatch updates and standard monthly updates:
-
Find the last entry listed on Release notes for hotpatch on Windows 11, version 24H2. If your OS build and KB numbers coincide with the numbers listed in the release notes title, you are on the latest hotpatch update and secure!
-
Or compare your OS build and KB numbers with the ones listed in the last entry for Windows 11, version 24H2 release notes. If they coincide, you are not on a hotpatch update; you are on the latest monthly update and secure!
-
Note Your organization's IT policies will determine when you receive these updates.
Comparing hotpatch and standard monthly security updates
You are equally secure by taking either a hotpatch or a standard Windows monthly update. The hotpatch updates have the same number of net new security fixes as the standard monthly updates. The main differences are in the device restart schedule and in the schedule of new features and non-security fixes that you get.
How often are you required to restart your device to get the latest update?
-
For standard Windows monthly updates, you are required to restart the device at least once every month for the update to take effect.
-
Hotpatch updates take effect immediately, without requiring a restart. The first month of each calendar quarter is designed to be a baseline month, for a total of four baseline updates a year. During these months, in addition to security updates, your device will get additional enhancements and non-security fixes that are normally part of the standard Windows monthly updates. These baseline updates will require a restart for the update to take effect.
Quarter
Baseline updates (requires restart)
Hotpatch (no restart required)
1
January
February and March
2
April
May and June
3
July
August and September
4
October
November and December
What is the schedule for new features and non-security fixes?
-
For standard Windows monthly updates, you get new features, enhancements, and non-security fixes every month after you restart your device. If you install Windows updates as soon as they are available, you get these up to twelve times a year.
-
For hotpatch updates, you get new features, enhancements, and non-security fixes only during the baseline update months after you restart your device. If your device remains enrolled in hotpatching for the entire year, you get these at least four times a year. The number and quality of non-security features and fixes level out with each baseline update and are equivalent for all devices updated with hotpatch or standard updates.
More Frequently Asked Questions (FAQs)
Yes. Hotpatch updates are security updates that contain the same number and quality of standard Windows monthly updates. They do not require a restart for the update to take effect. Therefore, your device is as secure as any other device that receives the most recent monthly update, with or without restarting.
Hotpatch updates are installed with the same update policy settings as standard quality updates. Many organizations use policies to only install Windows updates during inactive hours. If that is the case in your organization, then hotpatch updates will follow those policies and will only be installed during inactive hours.
Check with your IT admins if your PCs are eligible for hotpatch updates. You need to be on Window 11, version 24H2 (or later). Only the IT admin that manages the Microsoft Intune or Windows Autopatch Windows Update policy can enroll your eligible PCs to receive hotpatch updates.
Check your PC eligibility and enrollment dates with your IT admins.
To be eligible for hotpatch updates, your PC needs to be:
-
Enrolled into hotpatch enabled Windows Update policy
-
On the correct OS version
-
On a hotpatch baseline
If your eligible PC is enrolled after PC has installed a regular monthly update (non-baseline update), then your device will start receiving hotpatch updates after the next baseline month.
Note The hotpatch baselines are the monthly security updates released on the second Tuesday of the first month of each quarter: in January, April, July, and October. The baseline updates start the hotpatch update cycle.
You are likely not to even notice that an update was installed on your device during the eight planned hotpatch releases each year.
For example, if your organization requires that all devices install the latest Windows update as soon as it becomes available, then it will happen on or right after the second Tuesday of every month. On the following day, devices enrolled in hotpatch updates will continue running as they were before installing the update, while devices on the standard update will require a restart. Both types of devices will be equally secure. On baseline months, all devices will restart as required by the update policy settings.
Note Some IT departments defer updates a certain number of days after the second Tuesday of the month, which determines when your device gets them.
Yes, but not as frequently. New features, enhancements, and non-security fixes are part of standard Windows security updates but not part of hotpatch updates. While previously you could get them once a month, you will now get them once every quarter, during the baseline months. The number and quality of these non-security updates level out with each baseline update and are equivalent for all devices updated with hotpatch or standard updates.
While you do not have to restart your device for hotpatch updates to take effect, you still can. There are many reasons why you might want or need to restart your device. Restarting the device does not unenroll your device from hotpatch updates. It will remain on the latest hotpatch update with or without restarting.
With hotpatch updates, securing devices become independent of when you or an IT admin schedules a restart.
We strongly recommend that you check with your IT department before doing this. If you manually download the standard Windows monthly update from the Microsoft Update Catalog, then your device will stop receiving hotpatch updates for a limited time. It will receive standard Windows updates until the first update after the next baseline update. Since your device is still enrolled in hotpatching, it will automatically rejoin hotpatch cadence of updates after the update released on the baseline month.
No. An important part of eligibility requirements for hotpatch updates is that devices must be enrolled in Microsoft Intune and Windows Autopatch Windows Quality Update policy for organizational IT management. Only your work devices qualify for such enrollment and, therefore, for hotpatch updates.
