Hot patching in arc enabled OnPrem server(2025 Std)

On an Arc-enabled Windows Server 2025 Standard machine, hotpatching is managed and surfaced through Azure Update Manager. To verify that hotpatching is enabled and see how it is behaving, use these checks:

1. Confirm hotpatch enrollment/status for that server
   1. In the Azure portal, go to Azure Update Manager.
   2. Under Resources, select Machines and then select the specific Arc-enabled server.
   3. On the Arc-enabled machine | Updates page, under Recommended updates, check the Hotpatch section:
      • Status values mean:
        • Enabled – license enrolled and the machine is enabled for hotpatch updates.
        • Not enrolled – license available but not enrolled on this machine.
        • Disabled – license enrolled but machine not enabled for hotpatch.
        • Pending – enrollment in progress.
        • Canceled – license canceled on this machine.
   If the status is Enabled, the server is configured to receive hotpatch updates.
2. Check hotpatch status at scale (optional)
   1. In Azure Update Manager → Machines, select Edit columns.
   2. Add the Hotpatch status column and Save.
   3. Filter Resource type to Arc-enabled server to see the hotpatch status for all Arc-connected servers, including this one.
3. Verify hotpatch updates and reboot behavior
   1. On the same Arc-enabled machine | Updates page, use Recommended updates → Check for updates to trigger an on-demand assessment, or ensure periodic assessment is enabled.
   2. After assessment completes, review the list of available/installed updates and the Reboot required column.
      • For hotpatch months, hotpatch-classified security updates should normally show as installed without requiring a reboot.
      • A reboot is still required when a new baseline (cumulative update) is released, typically every three months, so seeing a reboot prompt in a baseline month is expected behavior.

Because hotpatch is orchestrated via Windows Update and Azure Update Manager, the authoritative indication that it is working is:

• Hotpatch status = Enabled for the server, and
• Security updates in hotpatch months installing with Reboot required = No, except when a new baseline is applied.

If the March update required a reboot, verify whether March was a baseline month for Windows Server 2025; baseline months always require a reboot even with hotpatching enabled.

References:

• Manage hotpatches (preview) on Arc-enabled machines
• Cloud-native patch management with Azure Arc-enabled servers
• Hotpatch for Windows Server
• Hotpatch updates