14-04-2025
No Reboot Security Updates Come To Windows 11 — But There's A Catch
Security hotpatching comes to Windows 11 Enterprise.
Windows updates, especially Windows security updates, are an essential yet often annoying consequence of using Microsoft's operating system. Without them, you would be unable to stay on top of the threat from newly discovered vulnerabilities, for example. However, when one of these updates installs a mysterious new folder, without proper explanation, and sets off a whole new social media privacy conspiracy, the annoying side comes to the fore. It's not as annoying, though, as having to wait for your device to go through the reboot cycle that installing Windows security updates brings to the party. Microsoft has taken note and introduced a new 'hotpatching' function to Windows 11 that enables security updates to download and install in the background, deploying them within running process in-memory code, and without any rebooting required. If you are using the correct version of Windows 11, that is. And there, dear reader, comes the catch.
The really good news is that in confirming the arrival of the new security update hotpatching process, Microsoft said that it means 'users can continue their work without interruptions while hotpatch updates are installed,' with no restarts required for the remainder of that quarter. All of which while taking effect immediately to provide 'rapid protection against vulnerabilities.'
If you could see me, you would notice me standing up and cheering at this point. You might also spot that I have sat straight back down again with a glum expression. That's because the April 2 Microsoft announcement quickly poured water on the excitement by adding that the feature is only available to Windows 11 Enterprise, version 24H2 for x64 (AMD/Intel) CPU device users. Oh, and they will need Microsoft Intune for deployment as well.
Don't get me wrong, this is great news for organizations that meet the requirements. As David Callaghan, who authored the announcement, said: 'With hotpatch updates, you can quickly take measures to help protect your organization from cyberattacks, while minimizing user disruptions.' But it does leave the rest of us wondering when we will get the same treatment.
There is one glimmer of hope for Windows 11 users, and that comes in the form of the 0patch micro-patching service, which uses a patching agent to apply fixes in memory without disturbing the individual Windows process concerned. This a subscription-based service, although it releases zero-day micro patches for free to bridge the gap between them becoming known and Microsoft fixing them officially. Maybe Microsoft should buy 0patch and then roll it out to everyone.
