Enable Hotpatch for Azure Edition virtual machines on Azure Stack HCI

Hotpatch for Windows Server 2022 Datacenter: Azure Edition virtual machines (VMs) hosted on Azure Stack HCI allows you to install security updates on an ISO-deployed machine on Azure Stack HCI without requiring a reboot after installation. You can use Hotpatch with both Desktop Experience and Server Core. This article will teach you how to configure Hotpatch after installing or upgrading the operating system using an ISO.

When using Hotpatch for your ISO deployed machine on Azure Stack HCI, there are a few important differences with the Hotpatch experience compared with using Hotpatch as part of Azure Automanage for Azure VMs.

The differences include:

• Hotpatch configuration isn't available via Azure Update Manager.
• Hotpatch can't be disabled.
• Automatic Patching orchestration isn't available.
• Orchestration must be performed manually (for example, using Windows Update via SConfig).

Prerequisites

To enable Hotpatch, you must have the following prerequisites ready before you start:

• Windows Server 2022 Datacenter: Azure Edition hosted on a supported platform, such as Azure or Azure Stack HCI with Azure benefits enabled.
  • Azure Stack HCI must be version 21H2 or later.
• Review the How hotpatch works section of the Hotpatch for new virtual machines article.
• Outbound network access or an outbound port rule allowing HTTPS (TCP/443) traffic to the following endpoints:
  • go.microsoft.com
  • software-static.download.prss.microsoft.com

Prepare your computer

Before you can enable Hotpatch for your VM, you must prepare your computer using the following steps:

1. Sign-in to your machine. If you're on Server core, from the SConfig menu, enter option 15, then press Enter to open a PowerShell session. If you're on the desktop experience, remote desktop into your VM and launch PowerShell.

2. Enable virtualization-based security by running the following PowerShell command to configure the correct registry settings:

   $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
   $parameters = $parameters = @{
       Path = $registryPath
       Name = "EnableVirtualizationBasedSecurity"
       Value = "0x1"
       Force = $True
       PropertyType = "DWORD" 
   }
   New-ItemProperty @parameters
   

3. Restart your computer.

4. Configure the Hotpatch table size in the registry by running the following PowerShell command:

   $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"
   $parameters = $parameters = @{
       Path = $registryPath
       Name = "HotPatchTableSize"
       Value = "0x1000"
       Force = $True
       PropertyType = "DWORD"
   }
   New-ItemProperty @parameters
   

5. Configure the Windows Update endpoint for Hotpatch in the registry by running the following PowerShell command:

   $registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Update\TargetingInfo\DynamicInstalled\Hotpatch.amd64"
   $nameParameters = $parameters = @{
       Path = $registryPath
       Name = "Name"
       Value = "Hotpatch Enrollment Package"
       Force = $True
   }
   $versionParameters = $parameters = @{
       Path = $registryPath
       Name = "Version"
       Value = "10.0.20348.1129"
       Force = $True
   }
   New-Item $registryPath -Force
   New-ItemProperty @nameParameters
   New-ItemProperty @versionParameters
   

Now you've prepared your computer, you can install the Hotpatch servicing package.

Install Hotpatch servicing package

To be able to receive Hotpatch updates, you'll need to download and install the Hotpatch servicing package. In your PowerShell session, complete the following steps:

1. Download the (KB5003508) Microsoft Update Standalone Package from the Microsoft Update Catalog and copy it to your computer using the following PowerShell command:

   $parameters = @{
        Source = "https://go.microsoft.com/fwlink/?linkid=2211714"
        Destination = ".\KB5003508.msu"
   }
   Start-BitsTransfer @parameters
   

2. To install the Standalone Package, run the following command:

   wusa.exe .\KB5003508.msu
   

3. Follow the prompts. Once it's completed, select Finish.

4. To verify the installation, run the following command:

   Get-HotFix | Where-Object {$_.HotFixID -eq "KB5003508"}
   

Next steps

Now you've set up your computer for Hotpatch, here are some articles that might help you with updating your computer:

• Patch a Server Core installation.
• Learn more about Windows Server Update Services (WSUS).