Microsoft published advisory MC1527979 yesterday: the security updates for November and December 2026 will ship as standard updates rather than hotpatches on Windows Server 2022 machines that have hotpatch enabled. Which means a restart. With those two, the official calendar for the year closes at eight months with a reboot and four without. The feature is sold the other way round: four stops a year and eight quiet months. What broke is not the reboot — that is unavoidable — but the one thing that made paying for it worthwhile: knowing in advance when it is due.
What the advisory says, with its dates
The text is short and does not hide anything. Microsoft's stated reason, verbatim: "Some of the security improvements in these updates change components that cannot be updated without a restart." There is nothing to configure and you do not lose your enrolment in the programme: the instruction to the administrator is simply to "plan for device restarts" when deploying those two updates.
The dates, which are what ends up on somebody's calendar:
- Tuesday 10 November 2026 — standard update. Restart. Thirteen days from today.
- Tuesday 8 December 2026 — standard update. Restart.
- Tuesday 12 January 2027 — start-of-quarter baseline. Restart — this one was always on the plan.
- February 2027 — if the design holds, hotpatch updates resume. Microsoft's calendar does not publish 2027 yet, and this year has shown why that matters.
Add it up: from September 2026 through January 2027, five consecutive restart months on a platform whose selling point is not restarting. And the notice for the last two landed yesterday.
The year's tally, with Microsoft's own table in front of you
This is not an impression or a calculation of ours: it is in the Windows Server hotpatch calendar Microsoft keeps on its release-information page, updated on 26 October. Put the Windows Server 2022 column next to the Windows Server 2025 one and 2026 looks like this.
The baselines that exist by design are the first month of each quarter: January, April, July and October. On Windows Server 2022, on top of those four, June, September, November and December have landed as well. Four extra. And the comparison with the same operating system's two previous years, taken from the same table, is the part worth carrying into a meeting:
2025 came out exactly as advertised: four and eight. 2024 overshot by one — August, and the table carries its asterisk. 2026 has doubled the number. This is not a product regression or a breach of anything: it is that the brochure figure was never a commitment, and until this year nobody had noticed.
The clause that allows it has been written down for years
The hotpatch documentation distinguishes two kinds of baseline, and the second one explains the year. Planned baselines are the calendar ones: "a planned one year release period might include four planned baseline releases in a calendar year and eight Hotpatch releases". Unplanned baselines are released "during an unplanned important update, such as a zero-day fix, when that particular update can't be released as a Hotpatch". And then the sentence that belongs on the first slide of any pitch for the feature: "because these events are unplanned, developers can't predict unplanned baselines in advance".
Read in full, hotpatch does not promise eight months without a reboot. It promises eight months without a reboot unless one is needed. What changed in 2026 is how often one was needed. And when something you were using as a planning floor turns out to have an escape clause that gets exercised four times in a year, it stops being a floor: it is an expectation.
It sounds familiar, because it is the same pattern we have written about on another stack: patching a system kernel ends up being a reboot, however loudly the tool of the day promises otherwise. There are parts of a system where in-memory code cannot be swapped without restarting the process, and no salesperson wins that argument.
Windows Server 2025 is not in the same boat
The advisory says it explicitly: hotpatch updates for Windows Server 2025 and Windows 11 are unchanged. And the table confirms it: in the Windows Server 2025 column, November and December are still marked as hotpatch. That is the most interesting divergence of the year — it is the first time the two columns part ways in a given month — and it forces a choice between two explanations: either the 20348 codebase cannot take live what 26100 can, or the branch that has just left mainstream support stopped being a priority. Microsoft does not say which. We lean towards the second, but that is our reading, not a fact.
Context helps make sense of it without resorting to theories: mainstream support for Windows Server 2022 ended on 13 October 2026 — fifteen days ago — and security updates continue to 14 October 2031. Hotpatching on that release exists because Microsoft extended it in June through to October 2027, and only for the Datacenter: Azure Edition SKU. It is a feature on borrowed time. But beware the easy reading: Windows Server 2025 did not stay at four either. It stands at six of twelve. Half the year with a restart on the new release, the one nobody had to extend.
Three things hotpatch never covered
If yesterday's advisory took you by surprise, these three probably will too — and all of them are in the official documentation, not on a forum.
- 1. It only covers Windows security updates. Explicitly excluded: nonsecurity updates for Windows, .NET updates, and non-Windows updates such as drivers and firmware. For those "you still need to restart your machine", even in the months marked as hotpatch. Translated: a green month on the calendar is not a month without a window, it is a month without that window.
- 2. There is no automatic rollback. If something breaks during or after an update, the documented procedure is to uninstall the latest one and install "the last functional baseline update", and that process "requires that you restart the VM". In other words: the good month saves you the reboot only if everything goes well. If it does not, you pay with a reboot and a rollback to an earlier base.
- 3. On Windows Server 2022 it does not exist outside Azure. Hotpatching on 2022 only exists on Datacenter: Azure Edition images (on Azure and Azure Local). The Azure Arc-connected variant — now at no extra cost — is Windows Server 2025, Datacenter or Standard edition. If your Windows Server 2022 machines run on your own iron, yesterday's advisory is not about you: you never had hotpatching, and every Patch Tuesday has always been a window.
We are not going to pretend the feature is bad
Time to say the part that cuts against our own headline. Four months without opening a window is four months. The documentation lists a real benefit and it is not hot air: fewer binaries, faster installs, less disk and CPU consumption, and it "reduces the time exposed to security risks and change windows". A patch that goes in the same day instead of waiting for Saturday genuinely shrinks the exposure window, and that is worth money. If someone asks us tomorrow whether to enable hotpatching where it is available, the answer is still yes.
The criticism is not aimed at the feature: it is aimed at planning on top of it.
The right question is not whether it reboots
This is where the advisory stops being a Microsoft note and becomes a diagnosis of your infrastructure. Because the question is not how many months it reboots. It is: what does a reboot cost here?
If the answer is "an email to all users, a Saturday night and crossed fingers", Microsoft's calendar is the least of it. That server is a single point of failure, and what hotpatching was doing was not fixing it: it was hiding it eight months a year. A component breaks, gets patched or gets rebooted: that is a failure, and it is unavoidable. Your company stopping because of it is an outage, and that is a design decision somebody made — probably without realising they were making it.
In infrastructure built for this, 10 November is paperwork. You update machine by machine, the service keeps being served by the others, and nobody in the office notices there was a window at all. It can be done during office hours, with people awake and the team on hand, which is exactly when you want to be touching production. In the other kind, that same Tuesday is a phone call at three in the morning. The update is identical; the outcome is the opposite.
What we would write down this week
Thirteen days left. This is what we would do, in this order, and none of it requires buying anything.
- Split the list in three. Windows Server 2022 with hotpatch (affected on 10 November and 8 December), Windows Server 2025 with hotpatch (not affected), and everything else (always rebooted). Those are three different calendars, and until now they lived on the same sheet.
- Put both dates in the calendar today, not on the 9th. And January's as well: the 12th is a baseline regardless. And if the design holds, February returns to normal.
- Order the reboots by service, not by machine. What depends on what, what cannot go down at the same time, and what has to come back first. The patching system does not hold that list: a person does, or nobody does.
- Check who decides the hour. On Azure, VMs created from a supported image ship with automatic guest patching enabled by default and apply patches "during off-peak hours in the VM time zone". That is a reasonable criterion, but it is the platform's criterion, not your business's. If your peak is month-end close rather than the afternoon, they do not match.
- Verify the rollback exists. Hotpatch does not rewind by itself, and going back to the last good baseline is another reboot. If plan B is "call someone", it is not a plan B.
- Use the moment to count what is already out of support. While the list is open, look at the versions. It is the same conversation as the bill that lands when a Windows Server runs out of support, and it resolves far better in October than in January.
In short
November and December reboot. With them, 2026 closes at eight of twelve on Windows Server 2022 — twice what the design describes — and six of twelve on Windows Server 2025. The feature is not broken, and the clause that allows this has been published for years. What is broken is using "it does not reboot" as a foundation. The reboot is not the problem; a reboot stopping your business is.
Where this fits into what we do
Our IT maintenance starts with the boring half of this post: a record for every machine with its build, its update channel and the date it stops receiving patches. It is an inventory, not a product, and it is what turns an advisory like yesterday's into a line in the calendar rather than a surprise. The other half is 24x7 support: somebody present for the 10 November window, who watches the service come back — not the ping, the service — and who decided the order before powering down the first box.
And if what comes out of this exercise is that there are three machines you cannot reboot without stopping the company, that is the thing to fix, and it has nothing to do with Microsoft. Say so and we will tell you what it costs and what does not need touching.
Sources (verified on 28 October 2026): Microsoft 365 Message Center advisory MC1527979, "The November and December 2026 security updates require a restart for hotpatch-enabled Windows Server 2022 devices", published 27 October 2026 — mc.merill.net. Month-by-month hotpatch calendar for Windows Server 2022 and 2025, plus lifecycle dates (mainstream support to 13 Oct 2026, updates to 14 Oct 2031) — Windows Server release information (updated 26 Oct 2026). Planned and unplanned baselines, programme coverage, absence of automatic rollback, supported platforms and automatic guest patching — Hotpatch for Windows Server. Release notes and baselines for September (8 Sep 2026) and October (13 Oct 2026) — support.microsoft.com. The June 2026 extension of Windows Server 2022 hotpatching — The Register. Cover photo: "Datacenter Server Racks" by Carl Lender, CC BY 2.0, via Wikimedia Commons.
Do you know which of your machines reboot on 10 November?
If the answer takes more than a minute, the problem is not Microsoft's advisory: it is that there is no list. We build it with you, tell you which windows are genuinely needed and what can be left alone. And if your inventory is already current, we will tell you so and sell you nothing.
Talk to everyWAN
Microsoft 365
ES 
CAT 
EN