Struggling with Windows Server Hotpatch showing ‘Not Applicable’ or failing to install? We’ll dive into why your Azure VMs are stuck, explain the dreaded ‘baseline’ issue, and provide three real-world fixes to get your servers patched and compliant.

Why Windows Server Hotpatch is a Headache (And How to Fix It)

I remember it like it was yesterday. It was 10 PM, the night before a major compliance audit. A junior engineer, bless his heart, sends a frantic message: “Darian, `prod-sql-az02` is failing the vulnerability scan, but Azure Update Manager says it’s 100% patched! The auditor is going to kill us.” I logged in, and sure enough, Update Manager was a sea of green checkmarks. But the security scanner was screaming about a kernel vulnerability that a patch, released two weeks ago, was supposed to fix. This, my friends, is the classic “Hotpatch Paradox,” and if you’ve landed here, you’ve probably just lived through a similar nightmare.

So, What’s Actually Going On? The “Baseline” Problem

Before we start running commands, let’s understand the “why.” This isn’t just a random bug; it’s a fundamental part of how Hotpatch is designed, for better or worse. Think of it like this:

• The Baseline: Once a month (usually on Patch Tuesday), Microsoft releases a big “Cumulative Update” (CU). This is the Baseline. It contains all the security and non-security fixes up to that point. It’s a full-system patch and requires a reboot.
• The Hotpatches: In the weeks *between* baselines, Microsoft releases smaller, targeted security fixes. These are the Hotpatches. They are designed to be applied *on top of a specific baseline* without a reboot.

The problem you’re hitting is when a server misses a new Baseline. If your server is still on the May baseline, but Microsoft has released the June baseline, all the hotpatches released for the June baseline will look at your server and say, “Nope, you’re not the right version for me.” They’ll show up as “Not Applicable” or simply won’t be offered, leaving you vulnerable, even though your console *thinks* it’s applying all available hotpatches.

The Fixes: From Quick & Dirty to Architecturally Sound

Alright, enough theory. You’ve got a server that’s out of compliance and a manager breathing down your neck. Here are three ways to tackle this, depending on your situation.

Fix #1: The “It’s 2 AM and I Just Need This Fixed” Method

This is the manual override. We’re going to force the server to check for *all* updates, including the missing baseline, and install it. This will require a reboot, so schedule a maintenance window, even if it’s a short one.

Your best bet is to use PowerShell. Hop on the affected VM and run this:

# First, install the PowerShell module if you haven't already
Install-Module -Name PSWindowsUpdate -Force -AcceptLicense

# Now, check for and install ALL available updates (including the baseline)
Get-WindowsUpdate -Install -AcceptAll -AutoReboot

This command bypasses the “Hotpatch only” logic and tells the server to grab everything from Windows Update, including that critical baseline CU. After the reboot, Hotpatch will start working as expected again. It’s a hacky, manual fix, but it gets the job done in a crisis.

Fix #2: The “Let’s Not Do This Again” Permanent Fix

Doing manual PowerShell heroics doesn’t scale. The real, architectural fix is to ensure your servers *never* miss a baseline. You need to configure your patching strategy to handle both types of updates.

In Azure Update Manager, this means creating a maintenance configuration or scheduled update deployment that explicitly includes updates classified as “Critical” and “Security,” not just those tagged as “Hotpatch.”

The goal is a two-tiered schedule:

1. Monthly Baseline Schedule: A schedule that runs once a month, shortly after Patch Tuesday. This deployment targets all updates and is configured to allow reboots. This keeps your baselines current.
2. Hotpatch Schedule: Your regular, more frequent schedule that applies hotpatches without reboots.

This way, your servers automatically stay on the latest baseline, and the zero-reboot hotpatches can apply cleanly in the interim. This is the “set it and forget it” solution that lets you sleep at night.

Pro Tip: You can check your server’s current baseline by looking at the installed Windows Updates. The latest Cumulative Update is your baseline. If it’s more than a month old, you’ve found your problem.

Fix #3: The “Nuke and Pave” DevOps Option

Sometimes, a server is just too far gone. It’s missed multiple baselines, someone’s messed with the Windows Update components, and you’re spending more time troubleshooting the patching agent than doing actual work. In the cloud, your servers should be cattle, not pets.

This is the nuclear option: terminate the instance and redeploy from a fresh, fully-patched golden image.

Using a tool like Azure Image Builder, you can create a pipeline that automatically:

• Pulls the latest Windows Server image from the Azure Marketplace.
• Applies all current Windows Updates (including the baseline).
• Installs your standard applications and configurations.
• Saves the result as a new version of your golden image.

When a server like `prod-sql-az02` becomes problematic, you simply fail over to its secondary, terminate the old instance, and spin up a new one from the latest golden image. It’s often faster and more reliable than in-place troubleshooting.

Warning: This approach only works if you’re practicing Infrastructure as Code and have a solid, automated deployment process. Do NOT do this on a server where data is stored locally and not replicated or backed up elsewhere. You’ve been warned.

Summary: Choosing Your Battle

Here’s a quick breakdown to help you decide which path to take.

Hotpatch is a powerful concept, but it’s not a magic bullet. It’s a specialized tool that depends on a foundation of solid, regular patching. Keep your baselines current, and you’ll avoid the late-night panic. Stay safe out there.

– Darian Vance, Senior DevOps Engineer & Lead Cloud Architect, TechResolve

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions