# Hotpatching Windows Server 2025 Domain Controllers: What Azure Arc, Virtualization-Based Security and the Hotpatch Enrollment Require, and What Each Is Charged > What hotpatching Windows Server 2025 domain controllers requires (Azure Arc, VBS, the enrollment) and what Microsoft charges for each piece. Canonical: https://o365hq.com/blog/hotpatching-windows-server-2025-domain-controllers-azure-arc-vbs-and-what-is-charged Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book Published: 2026-10-18 · IT Partner Hotpatching is why many teams pick Windows Server 2025 for new domain controllers: security updates land in memory without a restart, and planned restarts drop to one a quarter. It needs three things a 2016 build never had: an Azure Arc connection, Virtualization-Based Security and an enrollment. Here is what each requires, what Microsoft charges, and why to do it before promotion. ## What hotpatching is, what it needs, and what is charged Hotpatching applies Windows security updates to the code of running processes without restarting the server. The cadence, from Microsoft's Hotpatch article: a baseline cumulative update installed with a restart, then hotpatch releases that install without one. The baseline refreshes every three months, so a hotpatched domain controller plans for four restarts a year instead of twelve, plus an unplanned baseline whenever a fix cannot ship as a hotpatch. A domain controller qualifies when three things are true: it runs Windows Server 2025 Datacenter: Azure Edition inside Azure, or on-premises Windows Server 2025 Standard or Datacenter at build 26100.1742 or later connected to Azure Arc; Virtualization-Based Security is enabled and running; and the hotpatch enrollment is switched on for that machine, in the Azure portal or by script. What is charged: the Azure Arc control plane carries no charge from Microsoft, and the hotpatch subscription charge was removed on 19 May 2026, as our [deadlines page](/deadlines) records; Microsoft's enablement page now states the feature is available at no extra cost. Azure Update Manager, Change Tracking, Defender for Servers and Log Analytics are separate meters, set out in the table below. ## Prerequisite one: the Arc agent and what the firewall must allow The Azure Connected Machine agent registers the domain controller as an Azure resource and talks outbound only, over TCP 443. Microsoft's Connected Machine agent network requirements page lists the URLs; the families are Microsoft Entra ID sign-in (login.microsoftonline.com), Azure Resource Manager (management.azure.com), the Arc hybrid identity service (*.his.arc.azure.com), guest configuration and extensions (*.guestconfiguration.azure.com), the notification service (*.servicebus.windows.net), and the download hosts for the agent and extensions (download.microsoft.com and Azure Storage). For a domain controller this needs a change request rather than a technical fix, because DCs usually sit on segments with no outbound internet path by design. The options are a proxy the agent is configured to use, the Arc gateway, or an allow-list of the families above. Decide once per site before the build: an agent with no path registers nothing, and a machine that stays Disconnected for 45 days can expire and has to be reconnected by hand. ## Prerequisites two and three: Virtualization-Based Security and the enrollment VBS uses the Windows hypervisor to isolate a region of memory from the running operating system, and hotpatching depends on it because the patch rewrites code in memory. Microsoft's VBS page requires Secure Boot, which means UEFI firmware, on a 64-bit processor with virtualization extensions and second-level address translation. On a physical server, including a Hyper-V host, that is a firmware setting plus the Windows feature. On a virtual domain controller the hypervisor has to expose those extensions to the guest. Microsoft's VBS page says VBS works on virtual machines with nested virtualization support or Guest Virtual Secure Mode enabled, the latter on by default for Generation 2 virtual machines on Hyper-V. A Generation 2 VM with Secure Boot qualifies; a Generation 1 VM cannot change generation in place, so it is rebuilt. Confirm in msinfo32, where "Virtualization-based security" should read Running. The enrollment is the smallest step. In the Azure portal, under Azure Arc, Machines, select the server, choose Hotpatch, then Confirm; Microsoft's page says the change takes about ten minutes and that the portal first checks whether Virtual Secure Mode is running; the same page gives the PowerShell and command-prompt checks for VBS that belong in a build runbook. ## Domain controllers and Hyper-V hosts: what applies and in what order Microsoft's prerequisites are stated per machine, by edition, build, VBS and Arc connection, not per role. Nothing on the hotpatch page or the enablement page excludes the Active Directory Domain Services role or the Hyper-V role; Microsoft lists Standard, Datacenter and Datacenter: Azure Edition, with Essentials absent, and supports both Server Core and Server with Desktop Experience. For a domain controller the restart calendar changes shape. Plan one baseline restart per quarter per DC and keep the rules you already have: two DCs per site, never restarted together, and one DC per site on a host that does not need Active Directory to boot. At the time of writing Microsoft's published 2026 hotpatch calendar shows baseline restarts in June and September in addition to the four planned months, so the monthly window stays reserved even in a hotpatch month. For a Hyper-V host the same applies, and a host restart takes its guests with it unless they live-migrate first. Order: enroll at build time, before promotion. The agent, VBS, the restart and the enrollment happen on a member server with no FSMO roles and no clients; retrofitting them onto a promoted DC means restarting a server that answers authentication. Azure Update Manager then runs the baseline months inside a maintenance configuration you assign. ## What each piece is charged The rule from Microsoft's Azure Arc overview is short: the control plane is offered at no extra cost, and any Azure service used on an Arc-enabled server is charged at that service's own price. Every row is billed by Microsoft directly to your Azure subscription. | Item | What it does for a hotpatched DC | Microsoft charge | Rule | |---|---|---|---| | Azure Arc control plane | Resource, tags, RBAC, Resource Graph, extensions | No charge | Inventory layer | | Hotpatch | Security updates without a restart; baseline restart every three months | No charge since 19 May 2026 | 2025 Standard or Datacenter on Arc, enrolled per machine | | Azure Update Manager | Schedules baseline months, reports compliance | Included with Windows Server Management enabled by Azure Arc (attestation to active Software Assurance or Windows Server subscription licenses), with ESU through Arc and with Defender for Servers Plan 2 on the subscription; otherwise a per-server monthly charge | Prorated for the days the machine is Connected and managed | | Change Tracking and Inventory | The change record an auditor asks for | Included with attestation or ESU; otherwise purchasable | Log Analytics ingestion billed | | Microsoft Defender for Servers | Endpoint protection, vulnerability management | Per the Defender for Cloud price list | Not a Software Assurance benefit | | Log Analytics | Logs behind Change Tracking, VM insights, Sentinel | Ingestion and retention per workspace pricing | The meter most likely to surprise | Attestation is explicit. Azure Update Manager is included at no extra charge from Microsoft for an Arc-enabled server that is attested under Windows Server Management enabled by Azure Arc (active Software Assurance or Windows Server subscription licenses, or Windows Server pay-as-you-go through Arc), enrolled in Extended Security Updates through Arc, or in a subscription with Microsoft Defender for Servers Plan 2 enabled; any other Arc-enabled server is charged per server per month, prorated for the days it is Connected and managed, and Microsoft states that eligibility is not inferred from the Arc connection itself. Record each server's license status at onboarding, or the meter runs. ## A worked example: fourteen domain controllers, enrolled at build time A hardware manufacturer with six sites on three continents is replacing about ten Windows Server 2016 domain controllers in one forest and one domain, and hotpatching is the stated reason for choosing Windows Server 2025 over 2022: an ERP and factory and lab equipment authenticate against Active Directory, and a monthly restart at every site across three time zones is the recurring task. Two DCs per site, with two new sites planned for the first quarter of 2027, turns the count into fourteen. The plan treats Arc onboarding and the hotpatch enrollment as part of the build of each new DC. The runbook for a member server reads: a Generation 2 VM with Secure Boot, VBS confirmed Running, the agent registered through the site's proxy, the hotpatch enrollment confirmed, then promotion in the site's overnight window once the schema is at version 91. At least one DC per site goes on a host that does not depend on the cluster it authenticates, and the older hosts at two sites are where VBS is checked first. Retrofitting the same steps onto fourteen promoted DCs later means fourteen restarts on servers answering authentication. Phase 1 replaces the ten 2016 DCs before 12 January 2027; Phase 2 adds the new sites. Windows Server 2016 ESU is priced as the safety valve, not the plan. The replacement sequence is in our [order of operations for a multi-site forest](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations). ## When not to bother Hotpatching is a build-time decision, and some servers should not get it. A DC that retires within a year. A domain controller built only to carry a site until it consolidates gets a handful of restarts out of the work. Patch it monthly. A host without VBS. BIOS-era hardware, or a hypervisor that cannot expose virtualization extensions to the guest, fails the enrollment check. Fix the host first or accept monthly restarts; do not build a Generation 1 DC hoping to convert it later. A site with no outbound path. No proxy, no Arc gateway and no allow-list means no Arc, so no hotpatch, no Update Manager and no inventory. That decision is made once per site, and it is the same one that [central management of all servers as an audit requirement](/blog/central-management-of-all-servers-as-an-audit-requirement-azure-arc-update-manager-change-record) turns on. ## What it costs on our side [Azure Arc Hybrid Server Management Implementation](/services/azure-arc-hybrid-server-management) is $25 per server plus a $1,950 tenant fee over two weeks: connectivity design per site, agent rollout, licensing attestation, the VBS check on each host, the hotpatch enrollment and the Update Manager maintenance configurations for the baseline months. For an estate that must show the result to an auditor or an acquirer, [Azure Arc Onboarding with Azure Update Manager for an Audited Estate](/services/azure-arc-update-manager-onboarding-audited-estate) is the same per-server and tenant fee, scoped to one week and up to 25 servers, with the change record and read-only access a checklist row asks for. What the connection gives the servers that are not domain controllers, including Extended Security Updates for 2012 R2 and 2016, is in [Azure Arc for the servers you are keeping](/blog/azure-arc-for-the-servers-you-are-keeping). ## Frequently asked questions ### How do we enable hotpatching on Windows Server 2025 domain controllers and what does Azure Arc cost for that? Build the DC on Windows Server 2025 Standard or Datacenter, enable Virtualization-Based Security and restart, connect it to Azure Arc, enable Hotpatch on the machine, then promote. Arc and the hotpatch carry no charge from Microsoft; Azure Update Manager is included or metered per server depending on licensing. ### Does Azure Arc cost money? The control plane (agent, resource, tags, RBAC, Resource Graph) is offered at no extra cost; attached services such as Update Manager without a qualifying license, Defender for Servers and Log Analytics are charged at their own prices. ### Does hotpatching work on domain controllers and Hyper-V hosts? The prerequisites are per machine, not per role, and neither role is excluded on Microsoft's hotpatch or enablement pages. A Hyper-V host needs UEFI with Secure Boot and VBS; a virtual DC needs a Generation 2 VM or exposed virtualization extensions. ### What does the firewall need to allow? Outbound TCP 443 to the endpoint families on Microsoft's Connected Machine agent network requirements page, through a proxy, the Arc gateway or an allow-list. Nothing inbound. ### How many restarts does a hotpatched DC still need? One per baseline month, every three months by plan, plus any unplanned baseline when a fix cannot ship as a hotpatch. ## Hotpatch readiness checklist for a new domain controller - Windows Server 2025 Standard or Datacenter, build 26100.1742 or later - Physical: UEFI with Secure Boot. Virtual: Generation 2 VM with Secure Boot, or virtualization extensions exposed to the guest - VBS enabled, server restarted, msinfo32 reports Running - Outbound path decided per site: proxy, Arc gateway or allow-list - Connected Machine agent Connected, resource tagged by site - Windows Server Management attestation recorded where licensing qualifies - Hotpatch enabled and confirmed in the portal - Update Manager maintenance configuration for baseline months assigned; two DCs never together - Then promote; FSMO placement follows the migration plan ## Sources - Microsoft Learn, "Hotpatch for Windows Server" (windows-server/get-started/hotpatch), retrieved October 2026 - Microsoft Learn, "Enable Hotpatch for Azure Arc-enabled servers" (windows-server/get-started/enable-hotpatch-azure-arc-enabled-servers), retrieved October 2026 - Microsoft Learn, "Connected Machine agent network requirements" (azure-arc/servers/network-requirements) and "Connected Machine agent prerequisites" (azure-arc/servers/prerequisites), retrieved October 2026 - Microsoft Learn, "Virtualization-based Security (VBS)" (windows-hardware/design/device-experiences/oem-vbs), retrieved October 2026 - Microsoft Learn, "Azure Arc overview", pricing section (azure-arc/overview), and "Windows Server Management enabled by Azure Arc" (azure-arc/servers/windows-server-management-overview), retrieved October 2026 - Microsoft Learn, "Azure Update Manager FAQ", pricing section (update-manager/update-manager-faq), retrieved October 2026 - Microsoft Support, "Windows Server 2025 Datacenter Azure Edition overview", hotpatch release calendar (support.microsoft.com/help/5047443), retrieved October 2026 - Microsoft Tech Community, Azure Arc Blog, "Simplified access to Hotpatching enabled by Azure Arc for Windows Server 2025", May 2026 - IT Partner Microsoft deadlines page: Windows Server 2025 hotpatch charge removal (19 May 2026), Windows Server 2016 end of extended support (12 January 2027) ## Key takeaways - Hotpatching installs Windows security updates in memory without a restart; a baseline cumulative update with a restart returns every three months. - A domain controller needs Windows Server 2025 Standard or Datacenter at build 26100.1742 or later, Virtualization-Based Security running, an Azure Arc connection and the per-machine enrollment. - Arc's control plane and the hotpatch carry no charge from Microsoft since 19 May 2026; Azure Update Manager is included with Windows Server Management attestation, ESU through Arc or Defender for Servers Plan 2, otherwise metered per server. - The firewall change is outbound TCP 443 to Microsoft's published endpoint families, decided once per site. - Enroll at build time, before promotion; retrofitting fourteen promoted DCs means fourteen restarts on servers answering authentication. --- **Building Windows Server 2025 domain controllers and want hotpatching in the build?** [Azure Arc Hybrid Server Management Implementation](/services/azure-arc-hybrid-server-management) is $25 per server plus a $1,950 tenant fee over two weeks, quoted in writing before work starts. For the 2016 domain controllers that will not be replaced before 12 January 2027, the [Extended Security Updates Calculator](/tools/esu-calculator) prices the year of ESU through Azure Arc at Microsoft's list price.