Microsoft released a hotpatch for Windows 11 Enterprise LTSC 2024 today — KB5064010 (OS Build 26100.4851) — delivering targeted security and quality improvements while bundling the latest servicing stack update and extending hotpatch availability to eligible Arm64 Enterprise devices.
Hotpatching is Microsoft’s reboot‑reducing servicing model that lets eligible Windows 11 Enterprise devices receive security-only updates without an immediate restart, while quarterly baseline updates still require a restart to bring the system fully in line with disk images. The hotpatch cadence reduces forced restarts from twelve times per year to four, by making January, April, July, and October the baseline months (restart required) and offering hotpatch security updates in the intervening months. Microsoft’s August 12, 2025 release of KB5064010 follows that cadence and is published as a hotpatch for Windows 11 Enterprise LTSC 2024 (OS Build 26100.4851). (support.microsoft.com, techcommunity.microsoft.com)
This release is a combined package: the hotpatch itself is bundled with the servicing stack update (SSU) to reduce installation failures and simplify deployment. Administrators who already installed earlier updates will download only the delta contained in this package. The KB’s public note summarizes the content as “miscellaneous security improvements to internal OS functionality” and confirms there are no additional documented issues with this specific release.
Enterprises ready to adopt hotpatching should treat KB5064010 as the next step in a measured migration: verify prerequisites, run a constrained pilot, validate rollback behavior, and coordinate closely with ISV partners for compatibility. The reward is reduced user downtime and faster security compliance — provided the prerequisite and compatibility work is done first. (support.microsoft.com, learn.microsoft.com, techcommunity.microsoft.com)
Source: Microsoft Support August 12, 2025—KB5064010: Hotpatch for Windows 11 Enterprise LTSC 2024 (OS Build 26100.4851) - Microsoft Support
Background / Overview
Hotpatching is Microsoft’s reboot‑reducing servicing model that lets eligible Windows 11 Enterprise devices receive security-only updates without an immediate restart, while quarterly baseline updates still require a restart to bring the system fully in line with disk images. The hotpatch cadence reduces forced restarts from twelve times per year to four, by making January, April, July, and October the baseline months (restart required) and offering hotpatch security updates in the intervening months. Microsoft’s August 12, 2025 release of KB5064010 follows that cadence and is published as a hotpatch for Windows 11 Enterprise LTSC 2024 (OS Build 26100.4851). (support.microsoft.com, techcommunity.microsoft.com)This release is a combined package: the hotpatch itself is bundled with the servicing stack update (SSU) to reduce installation failures and simplify deployment. Administrators who already installed earlier updates will download only the delta contained in this package. The KB’s public note summarizes the content as “miscellaneous security improvements to internal OS functionality” and confirms there are no additional documented issues with this specific release.
What KB5064010 actually does (short answer)
- Installs a hotpatch update targeted at Windows 11 Enterprise LTSC 2024, updating the OS build to 26100.4851.
- Bundles and updates the servicing stack (the KB notes the SSU included), which helps ensure future updates install reliably.
- Confirms hotpatch availability and guidance for Arm64 Enterprise devices, and reiterates prerequisites and enrollment paths for hotpatching. (support.microsoft.com, techcommunity.microsoft.com)
Why this matters for enterprises
Hotpatching fundamentally changes how organizations manage security patching for many endpoints:- Higher availability, fewer interruptions. Security fixes are applied with no immediate interruption for most hotpatch months, keeping productivity higher on managed endpoints.
- Faster compliance window. Because hotpatches take effect immediately in memory, the vulnerable window between patch availability and effective mitigation is reduced. This is especially valuable for fast‑moving threats.
- Smaller payloads and quicker installs. Hotpatch packages are narrower in scope than full LCUs, which can reduce network and deployment overhead.
- Bundled SSU reduces flakiness. Combining the SSU with the hotpatch reduces installation issues caused by an outdated servicing stack.
Key technical details and prerequisites
Administrators must confirm their environment meets the hotpatch eligibility criteria before expecting devices to receive KB5064010 as a hotpatch.Supported OS and build
- Applies to Windows 11 Enterprise LTSC 2024 — OS Build 26100.4851 after installation.
Licensing and management
- Devices must be licensed with an eligible Enterprise/education subscription (examples: Windows 11 Enterprise E3/E5, Microsoft 365 F3, Windows 11 Education A3/A5, Microsoft 365 Business Premium, or Windows 365 Enterprise), and must be enrolled in Microsoft Intune/Windows Autopatch.
Baseline alignment
- Devices must be on the latest baseline release to qualify for hotpatch updates; baseline updates remain the quarterly restart points. Ensure devices have the baseline in place before expecting hotpatch delivery.
Virtualization‑based Security (VBS)
- VBS must be enabled on devices to be eligible for hotpatch updates. This hardware‑assisted security requirement affects some older clients and virtual machine configurations.
Arm64 specific: CHPE (Compiled Hybrid PE) must be disabled
- For Arm64 devices, Microsoft requires disabling CHPE (the compiled hybrid PE mechanism used for x86 emulation optimizations) to be eligible for hotpatch updates. This is a one‑time change achieved by:
- Setting registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\HotPatchRestrictions = 1
- Or by using the soon‑available DisableCHPE CSP via Intune.
- A restart is required after making this change, and administrators are advised to validate application compatibility and potential performance impacts before rolling out broadly. (learn.microsoft.com, techcommunity.microsoft.com)
Enrollment and policy
- Use Microsoft Intune to create a Windows quality update policy and set hotpatch to “Allow” for the targeted device groups. Windows Autopatch can also orchestrate enrollment and deployment. (techcommunity.microsoft.com, learn.microsoft.com)
How to get KB5064010 (deployment channels)
- Windows Update (automatic for enrolled devices) — the hotpatch will download and install automatically for eligible devices.
- Microsoft Update Catalog and other enterprise distribution methods may show different availability; the KB page indicates the SSU is included for Windows Update installs. Administrators should validate in their deployment tooling.
Rollback, uninstall, and recovery behavior
- Automatic rollback is not supported for hotpatch updates. You can uninstall a hotpatch, but uninstalling a hotpatch requires a restart and administrators are advised to then install the standard Latest Cumulative Update (LCU) and restart to return to the standard servicing state. Test rollback procedures in a lab before production rollouts.
Notable security and platform advisories included in the KB
- The public KB highlights the impending Secure Boot certificate expiration beginning June 2026 and reminds administrators to review and prepare for CA/certificate updates to avoid pre‑boot trust or update issues in the future. This is a significant cross‑cutting firmware-level concern that affects updateability and secure startup. It is explicitly called out in the KB.
What the KB does not cover (important limitations)
- Hotpatch updates are security‑only by design. Nonsecurity fixes, .NET updates, drivers, and firmware updates are outside hotpatch scope and still require baseline/reboot months or out‑of‑band baselines when necessary.
- Not every patch can be hotpatched. Extremely deep kernel changes or updates that require replacing in‑memory kernel components will still need a restart; Microsoft will ship those as baseline updates.
Practical rollout guidance — recommended plan for administrators
- Inventory and eligibility check
- Confirm all target devices run Windows 11 Enterprise 24H2 (ensure the January 2025 baseline or later is applied).
- Verify licenses, Intune enrollment, and that devices are on the latest baseline.
- Configure platform prerequisites
- Enable VBS on target devices (note this can have hardware/firmware prerequisites).
- For Arm64 fleets: plan and test disabling CHPE (HotPatchRestrictions registry or DisableCHPE CSP) in a controlled pilot, and measure any application or perf impact. (learn.microsoft.com, techcommunity.microsoft.com)
- Build a pilot group
- Create a Windows quality update policy in Intune and enable Hotpatch; assign to a small set of noncritical devices first. Use this pilot to validate install, telemetry, and rollback behavior.
- Test uninstall and rollback procedures
- Practice uninstalling a hotpatch in test devices (remember uninstall requires restart) and then apply an LCU/ baseline to ensure the recovery path works.
- Monitor and iterate
- Use Intune/Autopatch reports to track hotpatch deployment, errors, and device states. Adjust rollout windows and policy rings based on telemetry.
- Broader deployment
- After a successful pilot and validation across key workloads, expand policy assignment and proceed to enterprise‑wide rollouts, maintaining a staged ring approach.
Risks, tradeoffs, and things to watch
- CHPE compatibility/performance on Arm64. Disabling CHPE may alter x86 emulation performance on Arm64 devices; for some workloads this will be noticeable. Microsoft explicitly recommends testing before mass disabling.
- Hardware and firmware prerequisites (VBS). VBS depends on virtualization and firmware features — older devices, VMs, or BIOS/UEFI configurations may not support it, making them ineligible for hotpatches and forcing them back onto standard LCUs (with restarts).
- Uninstall requiring restart. While hotpatch reduces immediate restarts, rollback/uninstall operations do require a restart — it’s not a “no‑restart” safety net. Plan for the restart impact during remediation.
- Third‑party dependencies. Some vendor drivers, security agents, or backup products may have expectations around baseline cadence or kernel-level behavior. Coordinate testing with critical ISVs and backup vendors to avoid regressions. Community threads show partners like backup vendors are often first to notice regressions and test pre-release fixes.
- Certificate/firmware timing. The KB’s Secure Boot certificate expiration advisory is not directly tied to this hotpatch, but it is a near-term firmware-level action item that can affect secure boot and pre-boot updateability; treat it as a separate urgent program in your patch calendar.
Community reaction and interoperability notes
Community and vendor testing has been active through the public preview and early production windows. Windows Forum archives and IT community threads show widespread interest and active validation around hotpatch behavior, CHPE impacts, and specific edge cases such as file-system and backup interactions. Administrators should consult vendor advisories (for backup, endpoint protection, and virtualization vendors) when planning mass adoption.Quick checklist — deploy KB5064010 safely
- [ ] Confirm device OS version (Windows 11 Enterprise LTSC 2024) and baseline presence.
- [ ] Confirm Intune/Autopatch enrollment and licensing eligibility.
- [ ] Enable VBS where required and verify hardware/firmware support.
- [ ] For Arm64 devices, disable CHPE and test workloads after a restart.
- [ ] Create a Windows quality update policy in Intune and assign a pilot ring.
- [ ] Validate uninstall/rollback on test machines (remember uninstalls require restart).
- [ ] Monitor for Secure Boot certificate advisories and schedule firmware/KEK/DB updates as required.
Final analysis: strengths and potential risks in one view
Strengths
- Operational continuity. Hotpatching minimizes forced downtime while preserving security parity with standard LCUs. This is a strong operational win for high‑availability desks and remote workforces.
- Improved deployment reliability. Bundling the SSU with the hotpatch reduces update failures and simplifies the servicing chain.
- Modernized lifecycle management. The Intune/Autopatch integration gives enterprises policy control and reporting that adapts to modern zero‑touch management goals.
Potential risks
- Eligibility friction. VBS, baseline alignment, Intune enrollment, and licensing requirements create blocks for mixed or legacy estates.
- Arm64 tradeoffs. Disabling CHPE is required but may impact emulation performance; organizations must test to avoid regressions for x86 dependent applications.
- Rollback complexity. Although hotpatches are uninstallable, the requirement to restart for rollback undermines the “no restart” narrative in remediation scenarios.
- Firmware/tamper surface (Secure Boot). The KB’s Secure Boot certificate expiration advisory is a separate, high‑impact operational program that must not be deferred. Ignoring it risks devices failing secure boot or missing pre‑boot updates.
Bottom line
KB5064010 is a routine‑looking but strategically important hotpatch: it advances the hotpatch roll‑out for Windows 11 Enterprise LTSC 2024, bundles the servicing stack update to improve reliability, and reinforces Microsoft’s guidance for Arm64 readiness and broader hotpatch enrollment via Intune/Autopatch. The update demonstrates the real productivity gains hotpatching can deliver for enterprises — but it carries prerequisites and operational tradeoffs (VBS, licensing, CHPE disablement, Secure Boot planning) that demand disciplined testing and a staged rollout.Enterprises ready to adopt hotpatching should treat KB5064010 as the next step in a measured migration: verify prerequisites, run a constrained pilot, validate rollback behavior, and coordinate closely with ISV partners for compatibility. The reward is reduced user downtime and faster security compliance — provided the prerequisite and compatibility work is done first. (support.microsoft.com, learn.microsoft.com, techcommunity.microsoft.com)
Source: Microsoft Support August 12, 2025—KB5064010: Hotpatch for Windows 11 Enterprise LTSC 2024 (OS Build 26100.4851) - Microsoft Support
