About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.
A Windows server that runs business software should expect to install a cumulative update every month and, in most months, to restart. Hotpatching on Windows Server 2025 can remove some of those restarts, but not all of them: Microsoft's published January to November 2026 calendar shows six baseline months requiring restarts among eleven released months. That is historical evidence, not a forecast. The practical job is to agree a regular maintenance window with the business, decide how quickly updates go in after release, and make sure the application comes back cleanly after each restart.
Why it matters
Monthly updates are how Windows vulnerabilities get closed. Microsoft says of its monthly security release that Most organizations consider monthly security updates as mandatory. In Australia, the Australian Signals Directorate's Essential Eight maturity model sets time frames for patching operating systems, including that patches for non-internet-facing servers are applied within one month of release at the lower maturity levels, with shorter times for internet-facing servers and where exploits exist.
For the people who use a business application, the update itself is invisible. The restart is not. An accounting system or practice-management server that restarts during business hours, or that comes back with a service stopped, is what users remember. Planning patching is mostly planning restarts.
How it works
When the monthly update arrives
Microsoft publishes the monthly cumulative update on the second Tuesday of each month. Its release-cycle page, written for Windows clients, describes the monthly security update as published on the second Tuesday of each month, typically at 10:00 AM Pacific Time (PST/PDT). Windows Server follows the same pattern: the Windows Server release information table lists the November 2026 update for Windows Server 2025, 2022 and 2019 as "2026-11 B", available 10 November 2026, which was the second Tuesday.
In eastern Australia, 10:00 am US Pacific on a Tuesday is early on Wednesday morning: about 5:00 am during Australian daylight saving (Pacific Standard Time against AEDT) and about 3:00 am in the middle of the year (Pacific Daylight Time against AEST). That conversion is ours, not Microsoft's. The practical result is that updates are available at the start of the Australian business day on Wednesday.
Monthly updates are cumulative. Microsoft says the release includes both new and previously released security fixes, along with non-security content introduced in the prior month's Optional non-security preview update. A server that misses a month catches up by installing the latest one, but it carries the earlier exposure until it does.
Microsoft also releases an optional non-security preview update in the fourth week of each month, and occasional out-of-band updates for urgent problems. Most business application servers do not need the preview. Out-of-band updates usually fix a specific security or reliability problem and should be judged on what they fix.
What hotpatching changes on Windows Server 2025
Hotpatching installs some security updates without a restart. Microsoft describes it as a way to install OS security updates on Windows Server without having to restart your machine, by patching the in-memory code of running processes without the need to restart the process.
It works in a quarterly cycle. A normal cumulative update is the baseline and needs a restart. Microsoft explains: Every three months, the baseline periodically refreshes with the latest Cumulative Update. You then receive Hotpatch releases for the next two months after the Cumulative Update. In a plan with no surprises, that is four restarts a year instead of twelve.
Surprises happen. When an important fix cannot be delivered as a hotpatch, Microsoft releases an unplanned baseline instead, and an unplanned baseline is a full cumulative update that needs a restart. Microsoft notes that developers can't predict unplanned baselines in advance.
The published calendar shows how often that has happened. In the Windows Server 2025 hotpatch calendar for 2026, January, April, June, July, September and October are marked Baseline (Restart), while February, March, May, August and November are hotpatch months. That is six baseline restart months among eleven released months from January to November, already more than the four in the ideal annual cycle. Plan for hotpatching to reduce restarts, not to remove them.
Other limits from Microsoft's hotpatch page:
- You still need to restart your machine to install updates that aren't included in the Hotpatch program. Hotpatches cover Windows security updates only. Application updates, drivers and other Microsoft products such as SQL Server have their own restart needs.
- For the Azure Arc route outside Azure, a server needs Windows Server 2025 Standard or Datacenter, an Azure Arc connection, Virtualization-Based Security (VBS) enabled and explicit hotpatch enrolment/enablement. Microsoft's May 2026 announcement gives these requirements and says hotpatch is available at no additional cost for Windows Server 2025. Confirm the hosted platform supports VBS and the provider supports the required Arc management access and enrolment before treating the server as eligible.
- On Windows Server 2022, hotpatching is limited to the exact Datacenter: Azure Edition publisher, offer and SKU combinations listed for Azure and Azure Local on the supported-platform page. A typical hosted 2022 Standard server does not get it. Windows Server 2019 is not a supported hotpatch platform.
How restart timing is controlled
Windows Update restart behaviour on servers is usually set by Group Policy or by the patch management tool the administrator uses. The Windows Server Update Services guidance lists policies such as "Configure Automatic Updates", "No auto-restart with logged on users for scheduled automatic updates installations" and "Always automatically restart at the scheduled time". For the last of these, Microsoft says that when it is enabled, a restart timer of any value from 15 to 180 minutes starts after installation, and that When the timer runs out, the restart proceeds even if the computer has signed-in users.
That timer can interrupt Remote Desktop users and lose unsaved work. However, Microsoft also states that Always automatically restart at the scheduled time has no effect when No auto-restart with logged on users for scheduled automatic updates installations is enabled. Check the effective policies and patch-management tool settings on the exact server before predicting restart behaviour. Schedule maintenance outside working hours and arrange warnings and session draining where needed.
What to choose and why
Agree the window with the business, in writing
A useful maintenance agreement for a business application server sets out:
- The day and time. Many businesses choose a fixed evening or weekend slot in the week after release, for example the Saturday or Sunday after the second Tuesday. That leaves a few days to see whether the month's update causes widely reported problems, and stays well inside a one-month patching target.
- The length. Allow for installation, one or two restarts, and checking that the application works. On a small server an hour is common; complex servers need longer.
- Who is told and how. Users of Remote Desktop servers need a warning before sessions are ended.
- Who checks the application afterwards, and what counts as working: a test sign-in, a test transaction, a report.
- What happens if it goes wrong. Who decides whether to roll back, and from what.
Test in a ring, even a small one
Windows Server versions receive distinct builds and update packages, as the release information tables show. Roles, applications, drivers and agents also change regression risk. First test the applicable update on an isolated representative copy with the same Server version, application, dependencies and relevant agents. Keep it disconnected from live business integrations and use test data to check normal workflows, including sign-in, reports and scheduled work. A file server or domain controller can provide an additional rollout ring, but cannot prove that the business application is compatible. Move to the application server after the representative checks pass and the business accepts the maintenance window. Where available for the target version, an optional preview can provide early testing of non-security changes; it does not replace validation of the released security update.
Decide whether hotpatching is worth it
| Situation | Hotpatching value |
|---|---|
| Windows Server 2025 Standard or Datacenter with supported hosting, Azure Arc, VBS enabled and hotpatch enrolled; restarts are costly | Worth considering, but retain restart windows for planned and unplanned baselines |
| Windows Server 2022 | Only the listed Datacenter: Azure Edition images on Azure or Azure Local; not ordinary Standard or Datacenter installations |
| Windows Server 2019 | Not a supported hotpatch platform |
| Server already has a quiet weekly window and restarts in minutes | Little benefit; the regular window still has to exist for baselines |
| Application has its own monthly updates that need a restart | The application decides the window; hotpatching does not remove it |
Make the restart safe, not just scheduled
A patch-night problem can come from the update itself or from the restart exposing an existing fault: a service set to manual start, a scheduled task that starts the application only at sign-in, a dependency on a mapped drive, or a licence service that starts too late. After each restart, check that every service the application needs is running and that a user can complete a normal task. If the same fix is needed every month, fix the cause rather than repeating the workaround.
At a hosting provider
If a provider manages patching for you, ask:
- Which day and time is the window, and can it be changed for your server?
- How soon after release are updates installed, and is there a test stage first?
- Who checks your application after the restart, the provider or you?
- How are you told about out-of-band or emergency patching outside the window?
- Does the provider use hotpatching, and does it require connecting your server to Azure Arc?
Risks and limits
- Dates and calendars change. The hotpatch calendar figures are as published on 13 November 2026. Future quarters may have more or fewer unplanned baselines.
- The time conversion is approximate. Microsoft says "typically" 10:00 am Pacific; actual availability through a patch tool may be later.
- Essential Eight time frames depend on maturity level and exposure. The one-month figure quoted applies to non-internet-facing servers at the lower levels. Internet-facing servers and actively exploited vulnerabilities have shorter targets. Read the model for the level you are working to.
- Delaying updates is a trade-off. Waiting a few days to see whether problems are reported reduces one risk and extends another. For actively exploited vulnerabilities, a shorter delay is usually right.
- A snapshot before patching is a rollback aid, not a backup. Keep it only for a short time and delete it once the server is confirmed healthy.
- This article does not cover Windows client hotpatching, which Microsoft runs as a separate program.
Sources
Opened 14 November 2026.
- Microsoft Learn: Hotpatch for Windows Server, dated 2025-07-14, updated 2026-09-08.
- Microsoft Learn: Windows Server release information, dated 2026-11-12 (includes the Windows Server hotpatch calendar).
- Microsoft Tech Community, Azure Arc blog: Simplified access to Hotpatching enabled by Azure Arc for Windows Server 2025, 19 May 2026.
- Microsoft Learn: Update release cycle for Windows clients, dated 2026-09-29.
- Microsoft Learn: Step 4 – Configure Group Policy settings for Automatic Updates, dated 2025-05-02.
- Australian Signals Directorate: Essential Eight maturity model.
Related service: Managed support.
Related future topics
- Draining Remote Desktop sessions before a patch restart.
- Checking that a business application really started after a restart.
- Patching SQL Server alongside Windows in one maintenance window.
Learning notes
- Microsoft releases the monthly Windows update on the second Tuesday, which is early Wednesday morning in eastern Australia.
- Each monthly update contains all earlier fixes, so installing the latest one catches a server up.
- Hotpatching on Windows Server 2025 skips the restart in some months, but planned and unplanned baselines still need one.
- From January to November 2026, six of eleven released months were baseline restart months. Future calendars may differ.
- Restarts can expose existing faults as well as update regressions, so check the application, not just the update.
This article was originally published on .