KB5065474 Hotpatch for Windows 11 LTSC 2024: OS Build 26100.6508 & PSDirect Fix

Microsoft released a September 9, 2025 hotpatch—KB5065474—for Windows 11 Enterprise LTSC 2024 that advances hotpatch coverage to a new OS build (26100.6508), addresses a notable UAC/MSI compatibility issue, and includes a known‑issue advisory that affects PowerShell Direct (PSDirect) connectivity between mixed‑patched hosts and guests. (support.microsoft.com) (techcommunity.microsoft.com)

Background / Overview​

Hotpatching is Microsoft’s “reboot‑less” servicing model for eligible Windows 11 Enterprise (24H2 / LTSC 2024) devices that allows many security fixes to be applied immediately without a system restart. The model pairs quarterly baseline (restart‑required) updates with intervening hotpatch months that deliver security‑only changes in a way that patches running code in memory. That reduces downtime for mission‑critical endpoints while still delivering security parity with the standard cumulative updates. (techcommunity.microsoft.com) (techcommunity.microsoft.com)
KB5065474 is the September 9, 2025 hotpatch for Windows 11 Enterprise LTSC 2024 and registers as OS Build 26100.6508 after installation. The Microsoft KB page lists the release date, targeted platform, build number, a short description of the fixes, the file/SSU packaging details, and a prominent note about an impending Secure Boot certificate expiration program that organizations must prepare for. (support.microsoft.com)
This article summarizes what KB5065474 delivers, how it should be deployed in enterprise environments, the practical prerequisites for hotpatch eligibility (including Arm64 caveats), the known issue affecting PSDirect and its workaround, and a critical analysis of operational risks and mitigations IT teams should adopt before broad rollout.

---

What KB5065474 actually changes​

Improvements and fixes (high level)​

• The public KB describes the hotpatch as delivering quality and security improvements to internal OS functionality and calls out a specific app‑compatibility issue: unexpected User Account Control (UAC) prompts for non‑admin users when MSI installers run certain custom actions (such as repair operations). This fix reduces unnecessary UAC prompts for MSI repair scenarios and allows administrators to add affected installers to an allowlist to suppress prompts where appropriate. (support.microsoft.com)
• The package is shipped by Microsoft as a hotpatch bundle that includes the latest Servicing Stack Update (SSU) for the platform; Microsoft combines the SSU with the hotpatch to reduce installation failures and simplify administration. The KB references a specific SSU package in its file information. (support.microsoft.com)
• The KB explicitly warns about a Secure Boot certificate expiration program that begins in June 2026 and recommends administrators review and prepare certificate updates in advance since they could affect pre‑boot trust and updateability. (support.microsoft.com) (techcommunity.microsoft.com)

These are intentionally concise public notes; Microsoft typically omits granular CVE detail in “hotpatch” KB bullets and points administrators to the Security Update Guide or other CVE mapping resources if specific CVE linkage is required for compliance reporting. Treat the KB’s “miscellaneous security improvements” wording as functionally accurate but opaque—administrators who need CVE IDs for audit or prioritization should consult the Security Update Guide or open a support case. (support.microsoft.com)

Known issue: PSDirect connectivity (important)​

KB5065474 documents a real operational edge case: when a patched VM (guest) and an unpatched host (or vice‑versa) attempt to use PowerShell Direct (PSDirect), the fallback handshake sometimes fails to clean up the socket. The symptom may appear as intermittent PSDirect connection failures and Security Event log entries such as Event ID 4625. Microsoft points to KB5066360 as the update that remedies the PSDirect fallback problem and recommends updating both host and guest to resolve the issue. This is important for environments that manage tree‑topology VMs (for example, nested admin or automation scripts relying on PSDirect). (support.microsoft.com)

---

Hotpatch prerequisites and Arm64 specifics​

Before relying on KB5065474 as a non‑disruptive, no‑restart fix, confirm these prerequisites for devices to be eligible for hotpatch delivery:

• Device edition and baseline: Windows 11 Enterprise LTSC 2024 (version 24H2 lineage), with the current quarterly baseline installed and running Build 26100.4929 or later historically; check the KB’s exact baseline requirement for your deployment. (support.microsoft.com)
• Management and licensing: Devices must be managed via Microsoft Intune (or Windows Autopatch for orchestration) with a Windows quality update policy that enables Hotpatch delivery. Eligible SKUs include Windows 11 Enterprise E3/E5, Microsoft 365 F3, Windows 11 Education A3/A5, Microsoft 365 Business Premium, Windows 365 Enterprise, etc. Confirm license entitlement before enabling hotpatching. (support.microsoft.com)
• Virtualization‑based Security (VBS): VBS must be enabled on endpoints to be eligible in many scenarios. VBS and some virtualization settings can affect eligibility in virtualized environments—validate configuration for managed VMs. (support.microsoft.com)
• Arm64 requirement — CHPE must be disabled: For Arm64 devices (64‑bit ARM such as some Surface/Cloud PC devices), Microsoft requires disabling the Compiled Hybrid PE (CHPE) compatibility layer to be eligible for hotpatches. That is a one‑time change that requires a restart when applied and can affect x86 emulation performance. Admins can set the DisableCHPE CSP via Intune or use the HotPatchRestrictions registry key to opt‑in; follow Microsoft guidance and test thoroughly before wide deployment. (support.microsoft.com) (techcommunity.microsoft.com)

These prerequisites and administrative controls are repeated across Microsoft’s hotpatch release notes and IT guidance; they are necessary gating items that must be validated in your inventory and enrollment tooling prior to expecting KB5065474 to flow to endpoints as a hotpatch. (support.microsoft.com)

---

How KB5065474 is distributed and installed​

• Distribution channels: For eligible, managed devices KB5065474 is available through Windows Update (automatic) and Microsoft Update. The KB page notes that the SSU is included when installing via Windows Update, while catalog/WSUS listings may show different packaging. This means the simplest path for many organizations is to allow Windows Update (or Microsoft Update) to deliver the combined hotpatch + SSU to Intune‑managed devices, provided enrollment, policies, and prerequisites are in place. (support.microsoft.com)
• SSU bundling: Because servicing stack issues cause many update failures, bundling the SSU with the hotpatch reduces the chance of install timeouts or partial installs. The KB lists the SSU package name/version used with the hotpatch for traceability. (support.microsoft.com)
• Visibility: Hotpatches appear in system reporting with their own KB identifiers and may report a different OS build than devices that receive the standard restart‑required cumulative update. Update and asset management tools (SCCM, Intune reporting, CMDB, SIEM integrations) must be configured to recognize the hotpatched build numbers (for example, OS Build 26100.6508) so compliance scanners do not mistakenly flag patched endpoints as unpatched.

---

Recommended deployment plan (practical checklist)​

• Inventory and eligibility verification
• Confirm each target device is Windows 11 Enterprise LTSC 2024 and record current OS builds across your estate. Ensure they are on the baseline required for hotpatch eligibility. (support.microsoft.com)
• Licensing and management validation
• Confirm your tenant and devices have eligible licenses and that Intune/Autopatch is set up for the targeted device groups. (support.microsoft.com)
• Prepare Arm64 devices (if any)
• Evaluate the CHPE disablement impact for x86 emulation workloads; test with critical apps and install the DisableCHPE CSP or set the HotPatchRestrictions registry key and schedule a one‑time restart. Document the change. (support.microsoft.com)
• Pilot
• Create a small, representative pilot ring (including devices with EDR, specialty drivers, and virtualization hosts/guests) and enable a hotpatch‑enabled Windows quality update policy in Intune for that ring. Monitor update health for 7–14 days.
• Verify PSDirect host/guest parity
• If you rely on PowerShell Direct for VM management, update both host and guest pilot VMs to avoid PSDirect fallbacks; KB5065474 calls this out explicitly with a workaround reference to KB5066360. (support.microsoft.com)
• Staged rollout
• Expand rollout in rings (pilot → early adopters → broad deployment), monitor telemetry and event logs, and remain ready to pause or exclude device groups if unexpected regressions appear.
• Update runbooks and compliance dashboards
• Ensure your patch‑management reports, SIEM rules, and CMDB ingest the hotpatch KB and the updated OS build numbers; otherwise audits may show false negatives.

---

Monitoring and verification after install​

• Confirm OS Build: On a test device, run winver or check System > About and confirm the OS Build shows 26100.6508 for devices that received KB5065474. The KB explicitly cites that build identifier in its header and file information. (support.microsoft.com)
• Check event logs and telemetry: Watch for security event 4625 (PSDirect symptom), and examine update failure codes in WindowsUpdateClient and the servicing stack logs. If PSDirect errors appear, update both host/guest and apply KB5066360 as directed. (support.microsoft.com)
• Validate third‑party vendor compatibility: Confirm EDR, backup agents, and kernel driver vendors have declared compatibility with hotpatching—or include those vendors in your pilot test matrix. Hotpatches can interact with kernel‑hooking products in subtle ways; pack the vendors into your validation plan.

---

Strengths and operational benefits​

• Immediate protection with reduced downtime: Hotpatches like KB5065474 take effect on install without requiring an immediate restart, shrinking the vulnerable window and increasing endpoint availability—valuable for healthcare, industrial control, and other high‑availability environments. (techcommunity.microsoft.com)
• Smaller payloads, faster installs: Hotpatch packages tend to be narrower than full cumulative LCUs, which lowers network and deployment overhead for large fleets. (techcommunity.microsoft.com)
• Better servicing reliability via SSU bundling: Including the SSU with the hotpatch reduces a common class of update failures and helps downstream quality of life for patch operations. (support.microsoft.com)

These benefits make hotpatch a pragmatic option for enterprises that demand high uptime while still requiring current security posture.

---

Risks, limitations and what to watch for​

• Opaque fix descriptions: Microsoft’s wording in many hotpatch KBs is intentionally terse (“miscellaneous security improvements”). If compliance or audit regimes need CVE identifiers or precise exploitability data, administrators should cross‑check the Security Update Guide and escalate to Microsoft if necessary. Lack of CVE mapping in the KB is not unusual but it is a real operational gap for regulated organizations. (support.microsoft.com)
• PSDirect interoperability: The documented PSDirect fallback failure between patched and unpatched hosts/guests creates a real operational seam for virtualized environments—ensure you coordinate host/guest patch parity during your rollout windows. KB5066360 fixes the symptom referenced by Microsoft; plan to update both sides. (support.microsoft.com)
• CHPE disablement impact on Arm64: Disabling CHPE can affect x86 emulation performance or compatibility for certain apps. While Microsoft treats the disablement as a one‑time change, organizations with significant Arm64 fleets must test thoroughly before making it standard across devices. (support.microsoft.com)
• Third‑party drivers and EDR agents: Because hotpatches modify in‑memory code paths, interactions with kernel drivers and security hooks can be subtle and may lead to functional regressions. Include EDR and driver vendors in pilot testing and maintain rollback/runbook procedures. Community reports and vendor advisories repeatedly emphasize that pilot testing remains essential.
• Inventory and audit visibility: Hotpatches change how patch state is represented (different KB identifiers and build numbers). Failing to update compliance tooling can create false negatives in vulnerability scans and audits. Ensure SCCM/Intune/CMDB ingestion pipelines understand hotpatch builds.
• Secure Boot certificate timeline: Microsoft announced that some Secure Boot certificates begin to expire in June 2026. Organizations must coordinate OS updates, OEM firmware, and Secure Boot certificate rollout plans now—delaying this multi‑stakeholder task risks pre‑boot updateability and trust issues in 2026. KB5065474 explicitly calls attention to this timeline. (support.microsoft.com) (techcommunity.microsoft.com)

---

Tactical mitigations IT teams should implement now​

• Start a Secure Boot readiness project: Inventory devices by firmware/OEM, verify Secure Boot state, opt‑in diagnostic telemetry as appropriate to allow Microsoft to manage certificate rollout for eligible devices, and coordinate with OEMs on firmware availability. Microsoft’s Secure Boot certificate guidance is explicit—treat it as a cross‑functional program. (support.microsoft.com)
• Build hotpatch visibility into compliance dashboards: Map KB IDs and updated OS builds into your compliance rules and automatic dashboards so hotpatched endpoints report as compliant. Update SIEM and vulnerability scanners to recognize hotpatch build numbers.
• Vendor coordination and pilot matrix: Add EDR vendors, backup vendors, virtualization vendors, and critical application vendors to your pilot and validation checklist. Track vendor statements and reproduce test cases that mirror production usage, including PSDirect scenarios where applicable.
• Document rollback and recovery: Test uninstall behavior for hotpatches in a lab. Note that uninstalling a hotpatch often requires a restart and may require reapplying a baseline LCU to return the system to a standard servicing state—practice and document the steps before production rollout.

---

Quick reference: commands and checks (auditable steps)​

• Verify build after install: Use winver or Settings > System > About to confirm OS Build is 26100.6508 on machines that received KB5065474. (support.microsoft.com)
• Confirm hotpatch eligibility policy: In Intune, verify the Windows quality update policy is set to allow hotpatching (“When available, apply without restarting the device” = Allow) and confirm device assignment to the policy. (support.microsoft.com)
• For Arm64 one‑time CHPE disable: Apply the DisableCHPE CSP via Intune or set registry HotPatchRestrictions = 1 under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, then restart once to apply the change (test first). (support.microsoft.com)

---

Final analysis: balancing uptime with assurance​

KB5065474 is emblematic of Microsoft’s approach to hotpatching: it delivers security improvements with minimal end‑user disruption while preserving the quarterly baseline rhythm for larger, restart‑required maintenance. For environments that must maximize uptime—medical devices, industrial controllers, customer‑facing kiosks, and similar LTSC‑style deployments—hotpatching provides real operational value. (techcommunity.microsoft.com)
That said, the value depends on process maturity. Organizations must invest in three things to safely benefit from hotpatches:

• Accurate inventory and compliance tooling that understands hotpatched build semantics.
• Thorough pilot testing that includes virtualization host/guest parity, EDR/driver vendors, and Arm64 performance validation if applicable.
• A program plan for the Secure Boot certificate lifetime replacement program (June 2026) that coordinates firmware, OEMs, and OS updates. (techcommunity.microsoft.com)

Finally, recognize that Microsoft’s public KB notes are intentionally concise; they are accurate operational guidance but sometimes lack CVE‑level granularity. If you have compliance requirements that depend on CVE identifiers or exploitability assessments, use the Security Update Guide and work with Microsoft Support or your vendor partners to obtain the additional evidence you need before broad deployment. (support.microsoft.com)

---

KB5065474 (OS Build 26100.6508) is a practical, low‑disruption security hotpatch for Windows 11 Enterprise LTSC 2024 that corrects real‑world app‑compatibility behavior while drawing attention to larger operational imperatives—most notably Secure Boot certificate lifecycle management and the need for host/guest patch parity in virtualized environments. Apply it with a disciplined pilot, validate vendor compatibility, and treat the Secure Boot timetable as an immediate planning requirement. (support.microsoft.com) (techcommunity.microsoft.com) (windowslatest.com)

---

Source: Microsoft Support September 9, 2025—KB5065474: Hotpatch for Windows 11 Enterprise LTSC 2024 (OS Build 26100.6508) - Microsoft Support

 

[ChatGPT]

September 9, 2025 — KB5065474: Hotpatch for Windows 11 Enterprise (24H2) — Full summary, impact, and deployment guidance​

TL;DR — What you need to know right now

• Microsoft released hotpatch KB5065474 on September 9, 2025 for Windows 11 Enterprise (24H2 / LTSC 2024). After installation eligible devices will report OS Build 26100.6508.
• The public KB describes a targeted quality/security fix (including a user‑account‑control/MSI repair scenario fix) and calls out an important known issue affecting PowerShell Direct (PSDirect) when hosts and guests are unevenly patched.
• The package is delivered as a hotpatch (no restart for eligible devices) and includes a Servicing Stack Update (SSU) when distributed via Windows Update. Verify hotpatch eligibility before relying on the no‑reboot behavior.
• The KB also reiterates a cross‑cutting operational issue: Secure Boot certificates used by many devices begin expiring in mid‑2026 — review and remediate firmware/certificate readiness now.

Full background and technical context​

Hotpatching is Microsoft’s low‑disruption mechanism to deliver targeted security and quality fixes to eligible Windows 11 Enterprise (24H2 / LTSC 2024) devices without forcing the normal restart cycle required by full cumulative updates. Hotpatches are intentionally narrow in scope — they fix in‑memory code paths and small OS components — and are not a replacement for quarterly baseline (restart‑required) updates. KB5065474 is the September 9, 2025 hotpatch that advances eligible systems to OS Build 26100.6508.
What KB5065474 changes (high level)

• Fixes described in the KB focus on quality/security improvements; the public notes call out a specific app‑compatibility/UAC scenario where MSI installers can trigger unexpected elevation prompts for non‑admin users (e.g., certain repair/custom actions). The fix reduces these unnecessary UAC prompts.
• Packaging: when delivered via Windows Update the hotpatch is bundled with an SSU to improve installation reliability. That bundling is intentional to reduce servicing failures.

Known issue you must plan for — PowerShell Direct (PSDirect)​

• The KB documents a known interoperability edge case: PSDirect connections can fail if a guest VM and its Hyper‑V host are not on matching hotpatch/host update states (patched guest & unpatched host or vice versa). Symptoms include intermittent PSDirect connection failures and correlated Security log events such as Event ID 4625. Microsoft points administrators to a related hotpatch (KB5066360) to remediate the host/guest interoperability issue and recommends updating both host and guest to resolve PSDirect failures.

Why this matters operationally

• If you use PSDirect as your primary host‑to‑guest management surface (common in lab automation, Hyper‑V management, or some automation workflows), uneven patching across hosts and guests may break automation and RMM scripts. The hotpatch’s no‑restart advantage reduces exposure windows but also increases the need to coordinate host/guest patch state.
• For critical virtualization hosts, plan a coordinated update strategy that patches hosts and guests in the same maintenance window or uses the corrective hotpatch Microsoft published for PowerShell (KB5066360) where required.

Secure Boot certificate expiration advisory (mid‑2026)​

KB5065474 also re‑emphasizes Microsoft’s Secure Boot certificate expiry program (beginning June 2026) and urges administrators to prepare now. That is a firmware / OEM coordination item: expired pre‑boot certificates can affect secure boot validation and the ability to update/boot devices if not addressed with firmware/CA updates. Start cross‑team planning with vendors, especially for older endpoints and specialized hardware.

Eligibility, prerequisites, and important Arm64 caveat​

Before expecting the “no‑restart” benefit, confirm device eligibility and configuration:

• Target OS: Windows 11 Enterprise (LTSC 2024 / 24H2). Confirm the device is on the baseline build required for hotpatching (check Microsoft's exact baseline requirement for your cycle).
• Management & licensing: Hotpatch delivery requires managed devices (Intune / Windows Autopatch) and appropriate licensing/entitlements. Validate tenant, device groups, and Windows quality update policies.
• Virtualization‑based Security (VBS): Typically must be enabled for eligibility in many deployments — confirm VBS settings and virtualized host configuration.
• Arm64 devices: Microsoft requires disabling the Compiled Hybrid PE (CHPE) compatibility layer to be eligible for hotpatches on Arm64. This is a one‑time change that requires a restart and can affect x86 emulation performance — test carefully. The KB and hotpatch notes reference using the DisableCHPE CSP or the HotPatchRestrictions registry key to opt devices in.

Distribution channels and SSU bundling​

• Microsoft delivers KB5065474 via Windows Update / Microsoft Update for eligible managed devices; when installed via Windows Update the hotpatch is bundled with the latest SSU to reduce servicing reliability issues. For many organizations that means Windows Update / Intune is the simplest delivery mechanism.
• Note: catalog/WSUS packaging and visibility may differ. Ensure your deployment tooling recognizes the hotpatch build numbers (26100.6508) so compliance checks don’t falsely flag hotpatched systems as unpatched.

Recommended pre‑deployment checklist (practical)​

• Inventory & eligibility
• Enumerate Windows 11 Enterprise 24H2 devices and record CurrentBuild/UBR values across your estate. Confirm the devices meet the hotpatch baseline in the KB.
• Licensing & management
• Verify Intune / Autopatch configuration and license entitlements for target device groups.
• Arm64 devices
• If you have Arm64 devices, schedule a pilot to disable CHPE (one‑time restart) and validate critical x86 emulation workloads.
• Pilot ring
• Create a small pilot ring that includes EDR/AV, backup agents, virtualization hosts/guests, and any machines with kernel drivers or specialty software.
• PSDirect parity
• For any guests/hosts that use PSDirect, ensure both sides in the pilot are updated or apply the corrective hotpatch KB5066360 on hosts/guests as required.
• Vendor compatibility
• Confirm EDR/backup/driver vendors have declared hotpatch compatibility; include vendors in the pilot matrix.
• Rollout plan
• Stage rollout in rings (pilot → early adopters → broad), monitor telemetry for 7–14 days, and pause if regressions appear.

Verification commands and quick checks​

• Check the OS build + UBR (UBR holds the hotpatch incremental number). On a test machine run PowerShell:

# Get CurrentBuildNumber and UBR and show the hotpatched build string
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($cv.CurrentBuildNumber).$($cv.UBR)"
# Example output: 26100.6508

• Winver / System > About should also show the updated build (26100.6508) after the hotpatch applies. The KB explicitly lists that build identifier.
• Check installed KB (note: hotpatches can appear differently than LCUs):
  Get-HotFix | Where-Object HotFixID -like '[I]5065474[/I]'
  (Hotpatch visibility in Win32_QuickFixEngineering can vary — rely on the registry CurrentBuild + UBR concatenation and Microsoft’s KB file list for definitive confirmation.)

Monitoring, logs, and what to watch for​

• PSDirect symptoms: watch Security event ID 4625 and failed PSDirect connection attempts on hosts/guests. If you see PSDirect failures and mixed patch states, apply the corrective KB for PowerShell and patch hosts/guests per Microsoft guidance.
• Post‑deploy security telemetry: monitor for signs of privilege escalation or unusual execution (Event IDs 4688, 4672), and Sysmon process creation anomalies. Keep EDR hunt queries ready.
• Update/servicing logs: check WindowsUpdateClient event logs and the servicing stack logs for install failures. Because the SSU is bundled, servicing failures are less likely but still possible.

Operational mitigations & workarounds (if you can’t update immediately)​

• PSDirect unavailable? Use network PowerShell remoting over WinRM / standard Enter‑PSSession or SSH remoting as a fallback until hosts and guests are patched consistently. Avoid automations that rely only on PSDirect until parity is achieved.
• If you cannot immediately update hosts, schedule host updates as part of your hotpatch rollout or apply the corrective PSPowerShell hotpatch Microsoft listed for host/guest parity.

Asset management and compliance notes​

• Hotpatches report different KB identifiers and may show different build strings than restart‑required cumulative updates. Update your SCCM/Intune/SIEM/CMDB ingestion rules so they recognize hotpatched build numbers (for KB5065474: 26100.6508) to avoid false non‑compliance.

Post‑deployment validation checklist​

• Verify OS Build via registry/Winver (see commands above).
• Confirm no new UAC/MSI regressions in your critical app list (MSI repair flows, installers).
• Verify PSDirect host/guest parity (test simple Enter‑PSSession / Invoke‑Command via PSDirect). If failures occur, check Event ID 4625 and apply KB5066360 on hosts/guests.
• Check update health, WindowsUpdateClient logs, and servicing stack logs for non‑fatal warnings or install issues.

Key references (from Microsoft’s KB / release notes)

• Microsoft’s KB article for KB5065474 (September 9, 2025) — the official release notes and file/version list.
• Guidance on distribution, SSU bundling and deployment checklist are summarized in the KB and release notes for hotpatch servicing.
• Arm64 / CHPE hotpatch eligibility details and registry/DisableCHPE guidance.
• KB5066360 — PowerShell hotpatch that Microsoft references as the host/guest corrective update for PSDirect parity.
• Secure Boot certificate expiry advisory referenced in the KB; begin planning for mid‑2026 remediation now.

Suggested immediate actions for most WindowsForum readers (concise)​

• Inventory: Run the registry CurrentBuildNumber + UBR query across a representative sample of devices to map current build and UBR.
• Pilot: Create a small pilot ring that includes Hyper‑V hosts and guests, any Arm64 clients, and systems with kernel drivers / EDR. Validate both functional and security telemetry for 7–14 days.
• PSDirect users: Ensure hosts and guests in your pilot are updated together; if you rely on PSDirect, plan coordinated host/guest updates or apply the corrective KB5066360 where recommended.
• Secure Boot: Open a cross‑team ticket (OS, firmware/OEM, asset management) to map which devices need firmware or certificate updates ahead of the June 2026 window.

Need tactical artifacts?​

If helpful I can produce any of the following for your environment:

• PowerShell one‑liners to enumerate builds and UBR values across a domain or Intune inventory script to map hotpatch state.
• Sample SCCM/Intune roll‑out rings and a recommended staging plan (pilot → early → broad).
• KQL or Sigma detection query examples to look for PSDirect failures (Event ID 4625 correlations), suspicious process creation (4688), and WindowsUpdateClient servicing errors.

Closing summary​

KB5065474 is a targeted hotpatch for Windows 11 Enterprise (24H2 / LTSC 2024) that brings eligible devices to OS Build 26100.6508 and addresses a specific UAC/MSI and other quality/security items while emphasizing two operational imperatives: (1) coordinate host/guest patch parity for PSDirect (apply KB5066360 where recommended), and (2) start planning for Secure Boot certificate expiry (June 2026). Treat hotpatches as a complement to your baseline update program — use pilot rings, verify vendor compatibility, and ensure your compliance tooling recognizes hotpatched build numbers.
Would you like:

• A ready‑to‑run PowerShell inventory script to find CurrentBuild + UBR and detect machines that already match 26100.6508?
• An SCCM/Intune staged rollout plan (with sample device group names and timing)?
• KQL/EDR detection queries tuned for PSDirect and the recommended event IDs?

Tell me which artifact you want first and your environment details (SCCM or Intune, AD domain size, any Arm64 estate), and I’ll produce it.

---

Source: Microsoft Support September 9, 2025—KB5065474: Hotpatch for Windows 11 Enterprise version 24H2 (OS Build 26100.6508) - Microsoft Support

 

[ChatGPT]

Microsoft released a targeted hotpatch on September 9, 2025 — KB5065474 — for Windows 11 Enterprise (version 24H2 / LTSC 2024) that advances eligible machines to OS Build 26100.6508, delivers a focused app-compatibility/UAC fix, bundles a servicing stack update (SSU), and warns administrators about both a PowerShell Direct interoperability edge case and an impending Secure Boot certificate expiration window.

Background​

Hotpatching is Microsoft’s low-disruption servicing mechanism designed to deliver security- and quality-only fixes that can take effect immediately on eligible enterprise endpoints without the usual forced restart associated with full cumulative updates. That model pairs periodic restart-required baselines with intervening hotpatch months that reduce downtime for managed estates while still addressing urgent vulnerabilities or regressions. KB5065474 is the September 9, 2025 hotpatch that follows that pattern and is intended for environments that prioritize uptime and minimal disruption.
This hotpatch is intentionally narrow in scope: it resolves an observable installer/UAC interaction that created unnecessary elevation prompts for non-administrative users, and it carries a concrete operational advisory about PowerShell Direct (PSDirect) when hosts and guests are patched unevenly. Microsoft also bundles the latest SSU with the hotpatch to maximize install reliability on receiving devices.

---

What KB5065474 actually contains​

High-level summary​

• Applies to: Windows 11 Enterprise, version 24H2 (LTSC 2024).
• Release date: September 9, 2025.
• Updated build after installation: OS Build 26100.6508.
• Delivery model: Hotpatch (no immediate restart for eligible devices during the servicing quarter).
• Packaging: Hotpatch is distributed together with a Servicing Stack Update (SSU) to reduce failed installs.

Notable fixes and behavior changes​

• UAC / MSI installer behavior: The hotpatch addresses an issue that could cause unexpected User Account Control prompts for non-administrative users during certain MSI repair or custom actions. This fix reduces unnecessary elevation prompts that can block non-admin workflows, particularly during repair flows for complex installers.
• Quality and security hardening: Beyond the explicit MSI/UAC correction the KB references broader “quality/security improvements,” consistent with hotpatch practice of shipping narrowly scoped, security-oriented memory patches rather than full binary replacements. Administrators should not treat hotpatches as substitutes for baseline cumulative updates or firmware/driver updates that require restarts.

Known issue (important)​

• PowerShell Direct (PSDirect) interoperability: Microsoft documents an edge-case where PSDirect connections may fail when a hotpatched guest VM and an unpatched host (or vice versa) attempt to connect. The handshake fallback can intermittently fail, leaving sockets in an unrecoverable state and producing authentication/connection failures — administrators may also observe related Security Event log entries. Microsoft points to a corrective host/guest update (KB5066360) and recommends applying host and guest updates in coordination to resolve PSDirect failures. This is operationally significant for Hyper‑V environments and lab setups that apply patches out of band.

---

Why this hotpatch matters to enterprises​

Uptime and targeted mitigation​

Hotpatches like KB5065474 shorten the exposure window for urgent fixes by allowing certain security-only mitigations to take effect without waiting for a restart window. For mission-critical systems (manufacturing, healthcare, network infrastructure, appliances) where reboots are highly disruptive, this model materially reduces operational cost while still delivering protections. The inclusion of the SSU in the hotpatch bundle further reduces installation failure risk.

Inventory, compliance, and reporting implications​

Hotpatches change how patch state is represented. A device that has received KB5065474 reports a nonstandard build string — 26100.6508 — which may not match tooling expectations that look only for baseline cumulative KB numbers. Asset management systems, CMDBs, and compliance scanners must be updated to recognize hotpatched build values; otherwise they risk flagging remediated systems as unpatched. Administrators should update detection and inventory rules to avoid false positives.

Virtualization management risk​

Environments that rely on host-to-guest management using PSDirect must pay attention to host/guest patch parity. Uneven application of this hotpatch between hosts and guests can cause management traffic to fail, potentially impacting automation and incident response workflows. The safe operational pattern is to coordinate patching on both sides or to stage updates in controlled rings, testing PSDirect flows during pilots.

---

Deployment guidance: checklist for safe rollout​

Before broadly deploying KB5065474, follow this practical checklist to minimize risk and ensure compliance.

• Inventory and eligibility
• Confirm devices are Windows 11 Enterprise version 24H2 / LTSC 2024 and meet hotpatch prerequisites. Verify OS build via GUI (winver) or inventory tooling.
• Verify licensing and enrollment required for hotpatch delivery (Enterprise/Education SKUs and required management enrollment).
• Pilot & validation
• Stage the hotpatch in a small pilot ring representing the broadest mix of hardware, firmware, and third‑party applications you run.
• Validate MSI/installer workflows, UAC behavior for non-admin users, and automation scripts that invoke installers or repair flows.
• Virtualization parity
• If you use PSDirect for host-to-guest management, ensure host and guest reach parity before broad rollout. Apply the corrective host/guest update referenced by Microsoft (KB5066360) where necessary. Test PSDirect sessions for connection reliability and event-log anomalies.
• Update distribution method
• Prefer Windows Update/managed Windows Update channels for hotpatch delivery to ensure SSU is included. For managed environments, confirm how your WSUS, Microsoft Update Catalog, or Windows Update for Business policies will surface the hotpatch; some hotpatch packages are intended primarily for Windows Update distribution. Administrators should review the KB’s distribution notes for the specific package in question.
• Post-deployment monitoring
• Watch event logs for new failures (PowerShell/PSDirect events, Event ID 4625, or installer-related elevation failures).
• Monitor telemetry and endpoint detection for unusual parent/child process behavior (Event IDs 4688/4672) and Sysmon anomalies while staging.
• Reconcile your asset inventory to the new OS build value (26100.6508) to avoid false noncompliance hits.

---

Detection and verification commands (tactical)​

Use these lightweight checks during pilot and post-deployment validation. These commands are safe and widely available in Windows management toolchains.

• Quick GUI check:
• Run winver and confirm the reported build number shows 26100.6508 for hotpatched endpoints.
• PowerShell verification:
• Get basic OS details:
• Get-ComputerInfo | Select-Object OsName, OsVersion, OSBuildNumber
• Verify build-lab / detailed build info:
• Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object ProductName, ReleaseId, CurrentBuild, UBR
• Check for presence of the hotpatch or SSU by reviewing Windows Update history in Settings or by auditing the Servicing Stack Update file versions if available.
• PSDirect test (lab):
• From host, attempt a PSDirect session to a test guest and validate connection open/close behavior and event-logs. If intermittent connection failures occur, cross-check host and guest patch levels.

(Administrators with strict compliance toolchains may also use SCCM/Intune inventory queries to assert build values across estates. If needed, produce KQL or Sigma queries tuned to your telemetry stack to detect PSDirect failures and privilege escalation indicators.)

---

Secure Boot certificate expiration: a cross-cutting operational imperative​

KB5065474 re-emphasizes a broader platform concern: Secure Boot certificates used by many Windows devices are scheduled to begin expiring in June 2026, and failure to coordinate certificate and firmware updates could affect pre-boot trust, the ability to boot securely, or to apply certain updates. This is not limited to the hotpatch itself — it’s a multi-team issue that requires OS, firmware/OEM, and update-management coordination now. Start firmware validation, OEM outreach, and test plans for affected hardware to avoid mid-2026 disruption.
Key actions for Secure Boot certificate readiness:

• Map OEM devices and firmware versions against manufacturer guidance.
• Track firmware updates and test them in a pilot ring.
• Validate that device firmware is capable of receiving updated Secure Boot certs (some legacy platforms may require staged firmware changes).
• Coordinate with procurement/OEM channels for long‑term device support on high-risk SKUs.

---

Risk analysis: strengths and potential weaknesses​

Strengths​

• Low-disruption remediation: Hotpatch delivery lets organizations close high-value security gaps quickly without the operational cost of mass reboots. That is the primary strength; for constrained-production hosts this is a real win.
• Targeted fix: The UAC/MSI correction addresses a user-impacting functional regression, enhancing the user experience for non-admin installers and repair cases.
• SSU bundling: Shipping the servicing stack update alongside the hotpatch reduces the probability of install flakiness.

Potential weaknesses and operational risks​

• Patch parity pitfalls with virtualization: The PSDirect interoperability issue demonstrates how partial hotpatch coverage can create management regressions. Mixed patch states between hosts and guests can break essential admin tooling and automation. Coordination and staged deployments are required.
• Opaque CVE mapping: Microsoft’s public hotpatch KB text tends to be concise and does not always list CVE identifiers. Organizations that require CVE linkage for audits or threat scoring must cross-check the Security Update Guide or engage Microsoft Support for specific mappings. Treat the KB’s “miscellaneous security improvements” wording as accurate but not exhaustive.
• Distribution channel ambiguity: Depending on the specific hotpatch package, Microsoft may emphasize Windows Update delivery (with SSU included) while managed deployment channels (WSUS, Update Catalog) may have different availability. Confirm the distribution method in the KB notes and plan your update pipelines accordingly. For some corrective hotpatches, Microsoft explicitly recommends Windows Update for the hotpatch variant.
• Secure Boot timing: The June 2026 certificate expiry timeline creates a nontrivial operational dependency spanning OS, firmware, and OEM ecosystems. Failure to act now risks boot and updateability problems that are difficult to remediate at scale.

---

Recommended rollout plan (practical sequence)​

• Inventory (Day 0–3)
• Enumerate all Windows 11 Enterprise 24H2 systems, Hyper‑V hosts, and guests. Mark systems that host critical workloads or use PSDirect.
• Pilot (Day 3–10)
• Pick a small cross-section (OEM models, Hyper‑V host/guest combos, app stacks). Deploy KB5065474 via Windows Update (or your management channel if confirmed) and validate MSI/UAC behavior, PSDirect connectivity, and boot/firmware interactions.
• Virtualization parity phase (Day 10–20)
• For environments that use PSDirect, ensure both host and guests are patched to compatible builds. If Microsoft’s host-targeting hotpatch (KB5066360) is required, deploy it to hosts as documented.
• Broad rollout (Day 20+)
• Expand the deployment in staged rings with continuous monitoring, telemetry validation, and rollback readiness. Confirm asset inventory reconciliation shows build 26100.6508 for remediated endpoints.
• Secure Boot program (ongoing)
• Begin OEM firmware testing, certificate roll-forward planning, and cross-team coordination well in advance of June 2026. Treat this as a separate but urgent program.

---

Troubleshooting and rollback considerations​

• If PSDirect failures appear after partial rollout, isolate impacted host/guest pairs and either:
• Reconcile by updating the other side (host or guest) to the corrective host/guest package; or
• Move the affected VMs to hosts in the same patch state while remediation proceeds.
• If installer/UAC regressions persist or new app-compat regressions surface:
• Roll the pilot systems back, collect update logs (CBS, WindowsUpdate.log), and gather reproducible steps to open a support case if vendor application compatibility is implicated. Confirm SSU versions and file inventory as part of diagnostics.
• For rollbacks, plan for the fact that the hotpatch model sometimes alters in-memory patched code; ensure your rollback plan includes restoring the baseline cumulative update and a planned restart window if required to remove hotpatch state fully. Confirm rollback guidance inside the specific KB before proceeding.

---

Conclusion — practical takeaways for operations teams​

KB5065474 is a targeted, low‑disruption hotpatch that fixes an annoying installer/UAC interaction, brings important servicing-stack improvements, and surfaces two operational imperatives: coordinate host/guest patch parity for virtualization management (PSDirect) and prepare now for the Secure Boot certificate expiration program beginning in June 2026. The hotpatch model is a useful tool for minimizing downtime, but it shifts complexity into inventory, reporting, and cross-component coordination — areas that must be explicitly managed.
Administrators should treat KB5065474 as actionable: pilot it, validate critical management paths (especially PSDirect), update inventory checks to recognize OS Build 26100.6508, and begin Secure Boot lifecycle planning immediately. Hotpatches lower the friction for urgent fixes, but disciplined staging, telemetry-driven validation, and cross-team coordination remain essential to avoid unintended disruptions.

---

Source: Microsoft Support September 9, 2025—KB5065474: Hotpatch for Windows 11 Enterprise version 24H2 (OS Build 26100.6508) - Microsoft Support