# The Hotpatch Restart Calendar for Windows Server 2025 Domain Controllers: Baseline Months, Hotpatch Months, and How to Plan Maintenance Windows Around Them

> A hotpatched Windows Server 2025 domain controller restarts four times a year plus any unplanned baseline. The cadence rule, the calendar and the windows.

Canonical: https://o365hq.com/blog/hotpatch-restart-calendar-for-windows-server-2025-domain-controllers-planning-maintenance-windows
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-10-18 · IT Partner

A domain controller on hotpatch still restarts: in every baseline month, when Microsoft ships a full cumulative update, and whenever an urgent fix cannot ship as a hotpatch. One planned baseline every three months with two hotpatch months between means four restarts a year plus any unplanned baseline. Here is the calendar, what a baseline month means for Active Directory, and how to lay out the windows.

## The cadence, answered first

Microsoft's Hotpatch article states the rule: hotpatch first establishes a baseline with the current cumulative update; every three months the baseline refreshes with the latest cumulative update; the two months after each refresh bring hotpatch releases. A planned baseline carries that month's full cumulative update and requires a restart; a hotpatch patches the in-memory code of running processes and does not. An unplanned baseline, released for an urgent fix such as a zero-day that cannot ship as a hotpatch, replaces that month's hotpatch and brings a restart that cannot be predicted.

| Month type | What installs | Restart |
|---|---|---|
| Planned baseline month | The month's cumulative update, as the new baseline | Yes |
| Hotpatch month | Security fixes applied to running code | No |
| Unplanned baseline | A cumulative update in place of the hotpatch; announced in the month's release note | Yes |

So a domain controller on hotpatch restarts four times a year for planned baselines, plus once per unplanned baseline, where a DC patched the ordinary way restarts twelve times. The Azure Arc connection, Virtualization-Based Security and the enrollment it needs first are in the companion article on [hotpatching Windows Server 2025 domain controllers](/blog/hotpatching-windows-server-2025-domain-controllers-azure-arc-vbs-and-what-is-charged).

## The calendar: the rule, an illustration, and the live source

Microsoft publishes the schedule as the Windows Server Hotpatch Calendar on its Windows Server release information page, and each baseline month gets a release note on Microsoft Support under the Windows Server 2025 Datacenter Azure Edition overview. Baselines land on the second-Tuesday release day.

The table is a worked illustration of the rule for a year whose first planned baseline falls in January. It is not Microsoft's calendar; read the live one before you fix a window.

| Quarter under the rule | Baseline month (restart) | Hotpatch months (no restart) |
|---|---|---|
| First | January | February, March |
| Second | April | May, June |
| Third | July | August, September |
| Fourth | October | November, December |

At the time of writing, the excerpts of Microsoft's 2026 calendar we could reach matched the four planned months above and added two unplanned baselines, in June and September 2026, for fixes that could not be applied without a restart; that is why the monthly window stays on the calendar in hotpatch months.

Non-security Windows updates, .NET updates and drivers sit outside the program and arrive in hotpatch months the ordinary way; plan as if any of them can ask for a restart.

## What a baseline month means for a domain controller

A restart of a domain controller is a short outage of everything that DC answers: authentication, LDAP for applications bound to it by name, DNS for clients that list it first, and the operations master roles it holds. Three rules keep that outage from becoming a ticket.

Two per site, never in the same window. The two carry different wave tags and restart on different nights; a failed restart then leaves the site on one DC, not none. The [order of operations for replacing 2016 domain controllers](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations) builds the pairs; the windows inherit them.

Replication checked before and after. Before the window, repadmin /replsummary shows no failures and SYSVOL replication is healthy; after it, replication has converged, the DC advertises again (dcdiag /test:advertising) and its DNS zones have loaded. Update Manager keeps at least ten minutes of the window before restarting a Windows machine and waits up to 25 minutes after an Arc-enabled server's restart before marking the run failed.

Operations master holders in the later wave. The PDC emulator is the domain's time source and the DC password changes and lockouts are referred to; restart it in the second wave, after its partner is back clean, and keep the schema master's night written down so no schema preparation lands on it.

## Azure Update Manager windows for domain controllers across time zones

Dynamic scopes by tag. Update Manager groups machines by subscription, resource group, location, resource type, OS type and tags, evaluated at run time, so a DC tagged with site, time-zone group and wave joins the right window the day it is onboarded.

One set of windows per time zone, in local time. Each maintenance configuration carries its own time zone, and at the time of writing Microsoft's reference states the window is created in that zone and adjusted when daylight time begins and ends. Each time-zone group gets its own set: a monthly schedule repeats on the second Tuesday with an offset of up to six days, so plus two days is wave 1 and plus four is wave 2.

A longer window in baseline months. The plain design is one monthly configuration per wave and time zone at the 3 hour 55 minute maximum with Reboot if required: in hotpatch months the run installs the hotpatch and ends without a restart; in baseline months it uses the window. If the change board wants a shorter configuration in hotpatch months, the recurrence format documents a frequency in months with a weekday and an offset, so a quarterly January-start configuration carries the long window and quarterly February- and March-start ones the 1 hour 30 minute minimum. All stay on Reboot if required; Microsoft notes a restart can occur even under Never reboot.

Pre- and post-checks as events. Update Manager raises a pre-event through Event Grid at least 30 minutes before the window and a post-event when installation ends. The pre-event has about 20 minutes and can cancel that one run, not the schedule, up to ten minutes before the start: use it for the replication and partner-DC checks. The post-event re-runs them and writes the change record.

An unplanned baseline is announced in the month's release note; treat the month as a baseline month and let the configurations run, since the reboot setting and the window already allow one DC's restart per night. In a change freeze, cancel that run from the pre-event.

## Hosts and guests: a Hyper-V host on hotpatch with domain controllers

A host's hotpatch enrollment is its own: a hotpatched host does not patch its guests, and a host baseline restart takes every guest down unless they are moved first. Microsoft's guidance for domain controllers in virtual hosting environments says a clustered host's nodes, disks and resources need a DC in the domain to answer authentication at startup, that startup fails when the only DCs able to answer sit on that clustered host, and that at least two DCs belong on an independent hosting solution outside the cluster. For virtual DCs it adds: two per domain on different hosts, host time synchronization off, no snapshots, no long pauses or saved state.

The order in a baseline month follows: first the off-cluster DC of each site, in wave 1; second the DC on the cluster, in wave 2, once the first is back and replicating; third the hosts, one node at a time on a third night, with the DC guest live-migrated off the node being restarted. A standalone host without live migration restarts with its DC guest, so its night is that DC's wave night. Whether the hosts qualify is the hardware question in [Hyper-V hosts as old as the guests](/blog/hyper-v-hosts-as-old-as-the-guests-upgrade-the-cluster-to-windows-server-2025-or-leave-on-premises).

## A worked example: three overnight windows, one DC per site first

A hardware manufacturer with six sites on three continents is replacing about ten Windows Server 2016 domain controllers in one forest with Windows Server 2025, two per site. Hotpatching is the stated reason for the version: factory and lab equipment authenticate against Active Directory, and a monthly restart at every site is the task the plan removes. Phase 1 replaces the 2016 DCs before 12 January 2027; Phase 2 adds two sites in the first quarter of 2027, which makes fourteen.

The windows sit in three time-zone groups, each with its own configurations at 22:00 local: wave 1 on the second Tuesday plus two days, wave 2 plus four days, hosts the following week. Every DC is tagged with site, time-zone group and wave at Arc onboarding, so the scopes fill as 2025 DCs are promoted.

The enrollment is staged; the prerequisites are not. Every new DC is built with VBS running and the Arc agent connected, and the hotpatch toggle goes on the first 2025 DC at each site at build time. That DC is watched through a full quarter, a baseline month with its restart and the two hotpatch months after it, with the post-event checks as evidence. The second DC at each site, in wave 2, patches with a monthly restart in its own window until that review, then gets the toggle inside the same window. Windows Server 2016 ESU stays priced as the safety valve, never as the plan.

## What it costs

From Microsoft: hotpatching for Arc-enabled Windows Server 2025 Standard and Datacenter has carried no charge since 19 May 2026, as our [deadlines page](/deadlines) records, and the Azure Arc control plane is offered at no extra cost. Azure Update Manager is included for servers attested under Software Assurance or subscription licensing and for servers on Extended Security Updates through Arc, otherwise a per-server monthly meter; what the connection gives the rest of the estate is in [Azure Arc for the servers you are keeping](/blog/azure-arc-for-the-servers-you-are-keeping). Every Microsoft meter named here is billed to your Azure subscription, not by us.

From us: [Azure Arc Hybrid Server Management Implementation](/services/azure-arc-hybrid-server-management) is $25 per server plus a $1,950 tenant fee over two weeks and covers the scopes, configurations, events and enrollment above. For an audited estate, [Azure Arc Onboarding with Azure Update Manager for an Audited Estate](/services/azure-arc-update-manager-onboarding-audited-estate) is the same fee, one week, up to 25 servers. [WSUS Replacement with Azure Update Manager](/services/wsus-replacement-azure-update-manager), $15 per server plus a $1,950 tenant fee over two weeks, brings the member servers onto the same windows.

## Frequently asked questions

### How often does a hotpatched domain controller still restart?

In every planned baseline month, every three months, and whenever an unplanned baseline replaces a hotpatch: four planned restarts a year plus the unplanned ones, against twelve the ordinary way.

### Which months are baseline months?

The ones on Microsoft's Windows Server Hotpatch Calendar, every three months. Under the rule, a January start gives January, April, July and October; at the time of writing, the 2026 excerpts we could reach matched that and added unplanned baselines in June and September.

### Can we skip a baseline?

Not without losing the point: the next two months' hotpatches are built on that baseline, so a DC left on the old one lacks the new fixes. If a month is lost, the next cumulative baseline catches the DC up with one restart.

### How do we set Azure Update Manager maintenance windows for domain controllers across time zones?

One set of maintenance configurations per time zone, in local time on the same relative day, two waves per site so the two DCs never restart together, dynamic scopes by tag, and pre- and post-events.

### What happens when a hotpatch month becomes an unplanned baseline?

Microsoft's release note for that month says so. The configurations already allow the restart: Reboot if required and a window long enough for one DC. Run the baseline-month checks; in a freeze, cancel that run from the pre-event.

## Sources

- Microsoft Learn, "Hotpatch for Windows Server" (windows-server/get-started/hotpatch), ms.date 14 July 2025, retrieved October 2026
- Microsoft Learn, "Enable Hotpatch for Azure Arc-enabled servers" (windows-server/get-started/enable-hotpatch-azure-arc-enabled-servers), ms.date 30 October 2025, retrieved October 2026
- Microsoft Learn, Windows Server release information, "Windows Server Hotpatch Calendar" section (windows/release-health/windows-server-release-info), the page the Hotpatch article links for the schedule; not retrieved in full, October 2026
- Microsoft Support, "Windows Server 2025 Datacenter Azure Edition overview" (KB5047443) and the 2026 baseline release notes for 13 January, 14 April, 9 June, 14 July and 8 September (support.microsoft.com, servicing/os/hotpatch/windows-server-2025/2026), read in excerpt, October 2026
- Microsoft Learn, "About dynamic scoping" (azure/update-manager/dynamic-scope-overview), ms.date 21 August 2025, retrieved October 2026
- Microsoft Learn, "Schedule recurring updates for machines by using the Azure portal and Azure Policy" (azure/update-manager/scheduled-patching), ms.date 21 August 2025, retrieved October 2026
- Microsoft Learn, "An overview of pre and post events in your Azure Update Manager" (azure/update-manager/pre-post-scripts-overview), ms.date 21 August 2025, retrieved October 2026
- Microsoft Learn, "Overview of Maintenance Configurations for Azure virtual machines" (azure/virtual-machines/maintenance-configurations), ms.date 25 September 2026, retrieved October 2026
- Microsoft Learn, "Deploy updates and track results in Azure Update Manager" (azure/update-manager/deploy-updates), ms.date 7 March 2025, retrieved October 2026
- Microsoft Learn, "az maintenance configuration" (cli/azure/maintenance/configuration) and the Microsoft.Maintenance maintenanceConfigurations template reference, recurEvery and timeZone, read in excerpt, October 2026
- Microsoft Learn, "Things to consider when you host Active Directory domain controllers in virtual hosting environments" (troubleshoot/windows-server/active-directory/ad-dc-in-virtual-hosting-environment), ms.date 12 February 2026, retrieved October 2026
- Microsoft Learn, "Virtualizing domain controllers with Hyper-V" (windows-server/identity/ad-ds/get-started/virtual-dc/virtualized-domain-controllers-hyper-v), ms.date 7 March 2024, retrieved October 2026
- IT Partner Microsoft deadlines page: Windows Server 2025 hotpatch charge removal (19 May 2026), Windows Server 2016 end of extended support (12 January 2027)

## Key takeaways

- A hotpatched Windows Server 2025 DC restarts in every planned baseline month, every three months, plus any unplanned baseline: four planned restarts a year, not twelve.
- The live calendar is Microsoft's Windows Server Hotpatch Calendar; the table here illustrates the rule.
- Two DCs per site, two waves on different nights, operations masters in the later wave, replication checked before and after.
- In Update Manager: dynamic scopes by tag, one configuration set per time zone, Reboot if required, pre- and post-events.
- A hotpatched host restarts its guests: off-cluster DC first, cluster DC second, hosts last, each on its own night.

---

**Want the windows, the scopes and the enrollment in place before the first baseline month?** [Azure Arc Onboarding with Azure Update Manager for an Audited Estate](/services/azure-arc-update-manager-onboarding-audited-estate) ($25 per server plus a $1,950 tenant fee, one week, up to 25 servers) is the short version for an audited estate. For a multi-site forest, [Azure Arc Hybrid Server Management Implementation](/services/azure-arc-hybrid-server-management), $25 per server plus a $1,950 tenant fee over two weeks, quoted in writing before work starts, builds the connectivity, the attestation, the enrollment and the configurations per time zone.