In the digital age, ensuring business continuity is essential, no longer just an added value. For many companies, frequent interruptions, even of short duration, are unacceptable for their critical workloads. However, ensuring that continuity can be complex, whereas the management of virtual machines (VM) with Windows Server operating system is in some respects complex, especially in relation to applying security patches and updates. With the advent of the hotpatching feature from Microsoft, a new chapter in VM management has opened: a more efficient approach that minimizes disruption, guaranteeing servers that are always up-to-date and protected. This article looks at the features and benefits of this innovative solution.
What is Hotpatching?
Hotpatching, introduced by Microsoft, is an advanced technique that allows you to update Windows Server operating systems without the need to restart. Imagine you can “change tires” of your moving car without having to stop it. This is the "magic" of hotpatching.
Where you can use Hotpatching
Hotpatch functionality is supported on “Windows Server 2022 Datacenter: Azure Edition”, that you can use it for VMs running in Azure and Azure Stack HCI environment.
The Azure images available for this feature are:
- Windows Server 2022 Datacenter: Azure Edition Hotpatch (Desktop Experience)
- Windows Server 2022 Datacenter: Azure Edition Core
Note that Hotpatch is enabled by default on Server Core images and that Microsoft recently extended hotpatching support to include Windows Server with Desktop Experience, further expanding the scope of this feature.
Updates supported
Hotpatch covers Windows security updates and maintains an alignment with the content of security updates issued in the regular Windows update channel (non hotpatch).
There are some important considerations for running a Windows Server Azure Edition VM with hotpatch enabled:
- reboots are still required to install updates that are not included in the hotpatch program;
- reboots are also required periodically after a new baseline has been installed;
- reboots keep the VM in sync with non-security patches included in the latest cumulative update.
Patches not currently included in the hotpatch program include non-security updates released for Windows, .NET updates and non-Windows updates (as driver, firmware updates, etc.). These types of patches may require a reboot during the Hotpatch months.
Benefits of Hotpatching
The benefits of this technology are many:
- Better security: with hotpatching, security patches are applied quickly and efficiently. This reduces the window of vulnerability between the release of a patch and its application, offering fast protection against threats.
- Minimization of downtime: one of the main benefits of hotpatching is the ability to apply updates without the need to restart the server. This means fewer outages and higher availability for applications and services.
- More flexible management: system administrators have the freedom to decide when to apply patches, without the worry of having to do careful planning to ensure that running processes are not interrupted while applying updates.
How hotpatching works
During a hotpatching process, the security patch is injected into the operating system's running code in memory, updating the system while it is still running.
Hotpatch works by first establishing a baseline with the current Cumulative Update for Windows Server. Periodically (on a quarterly basis), the baseline is updated with the latest Cumulative Update, after which they are released hotpatch for the next two months. For example,, if a Cumulative Update is released in January, February and March would see the release of hotpatch. For the hotpatch release schedule, you can consult the Release Notes for Hotpatch in Azure Automanage for Windows Server 2022.
The hotpatch contain updates that do not require a restart. Because Hotpatch fixes the in-memory code of running processes without the need to restart the process, applications hosted on the operating system are not affected by the patching process. This action is separate from any performance and functionality implications of the patch itself.
The following image shows an example of an annual update release schedule (including examples of unplanned baselines due to zero-day corrections).
Figure 1 – Outline of a sample yearly schedule for releasing Hotpatch updates
There are two types of baselines:
- Planned Baselines: are released on a regular basis, with hotpatch releases in between. Planned Baselines include all updates in a newer Cumulative Update and require a restart.
- Unplanned Baselines: they are released when a major update is released (like a zero-day correction) and that particular update cannot be released as a hotpatch. When unscheduled baselines are released, a hotpatch release is replaced with an unplanned baseline in that month. Unplanned Baselines also include all updates in a newer Cumulative Update and require a restart.
The programming shown in the example image illustrates:
- four baseline releases planned in a calendar year (five total in the diagram) and eight hotpatch releases;
- two unplanned baselines that would replace the hotpatch releases for those months.
Patch orchestration process
Hotpatch is to be considered as an extension of Windows Update and patch orchestration tools vary depending on the platform in use.
Hotpatch orchestration on Azure
Virtual machines created in Azure are enabled by default for automatic patching when using a supported image of "Windows Server Datacenter: Azure Edition”:
- patches classified as Critical or Security are automatically downloaded and applied to the VM;
- patches are applied during off-peak hours considering the time zone of the VM;
- Azure handles patch orchestration and patches are applied following the availability principles;
- the health status of the virtual machine, determined through Azure platform health signals, is monitored for patching failures.
Hotpatch orchestration on Azure Stack HCI
Hotpatch updates for active VMs in Azure Stack HCI environment can be orchestrated using:
- Group Policy to configure Windows Update client settings;
- Windows Update client settings or SCONFIG per Server Core;
- a third-party patch management solution.
Considerations and Limitations
However, like any technology, even hotpatching has its nuances. Not all patches are suitable for hotpatching; some may still require a traditional restart. Furthermore, before applying any patches, it remains crucial to test it in a controlled environment to avoid potential problems.
Installing Hotpatch updates does not support automatic rollback. In fact,, if a VM experiences a problem during or after an upgrade, you need to uninstall the update and install the latest known good baseline update. After the rollback you will need to restart the VM.
Conclusion
The introduction of hotpatching by Microsoft represents a significant step forward in the management of VMs running Windows Server operating system. With the ability to apply security patches and updates non-disruptively, administrators can ensure that their servers are protected and updated in a faster and more effective way. In a world where safety is paramount and where every second counts, hotpatching is positioned as a valuable solution for any company that uses Windows Server in an Azure environment or in an Azure Stack HCI environment.
