Windows Monthly Updates Explained: B Releases, Preview Updates, Hotpatch, and OOB Fixes
- Level
- Beginner
- Reading time
- 17 min
- Concept
- Windows monthly update servicing model
- Last reviewed
- July 14, 2026
Table of contents
Windows monthly updates follow a structured cadence that every IT admin should understand. At its core, the model has three lanes: mandatory security updates on Patch Tuesday (the second Tuesday of each month), optional non-security preview updates in the fourth week, and emergency out-of-band fixes that ship when needed. Since 2025, a fourth lane, hotpatch, lets eligible enterprise devices apply security fixes without restarting. Per Microsoft's July 2026 Windows IT Pro Blog post, these update types work together to help organizations maintain security, compliance, and device health while keeping disruptions predictable.
Key takeaways
- Patch Tuesday (B release) delivers cumulative security updates on the second Tuesday of each month.
- Optional non-security preview updates ship in the fourth week for IT teams to validate before the next Patch Tuesday.
- Hotpatch applies security fixes in memory without a restart, with quarterly baseline updates requiring one reboot.
- Out-of-band (OOB) updates address critical security or reliability issues outside the normal monthly schedule.
- All updates are cumulative: installing the latest includes every previous fix for that Windows version.
Quick explanation
In simple terms
Windows gets security fixes every second Tuesday, optional test updates later in the month, and emergency patches whenever a critical issue arises. Enterprise devices can receive some fixes without restarting.
Technical definition
The Windows servicing model delivers cumulative Latest Cumulative Updates (LCU) on the second Tuesday (B release), optional non-security preview updates in the fourth week (formerly C/D releases), and out-of-band updates as needed. Hotpatch updates patch in-memory code on eligible Windows 11 Enterprise 24H2/25H2 and Server 2025 devices via Autopatch, following a quarterly baseline cycle.
Analogy
Think of it like a highway with three lanes: the mandatory security lane runs on a fixed schedule (Patch Tuesday), the preview lane lets early adopters test upcoming changes, and the emergency lane opens only when something urgent needs fixing. Hotpatch adds a fast-pass that skips the toll booth (restart).
Definition
The Windows monthly update servicing model is Microsoft's structured cadence for delivering security fixes, quality improvements, and features to Windows devices. It includes mandatory Patch Tuesday releases, optional preview updates, restart-free hotpatch security fixes, and emergency out-of-band updates.
Microsoft delivers Windows updates through a predictable monthly rhythm. The core is Patch Tuesday, the second Tuesday of each month, when cumulative security updates ship for all supported Windows versions. On top of this, Microsoft publishes optional non-security preview updates in the fourth week for early validation, offers hotpatch updates that apply security fixes without a restart on eligible enterprise devices, and releases out-of-band (OOB) updates for urgent security or reliability issues outside the normal cycle.
This model replaced the older 'ship-when-ready' approach that Microsoft used before October 2003. The cumulative update model, introduced with Windows 10 in 2015, means each monthly update includes all previously released fixes. Administrators can't cherry-pick individual patches; they deploy the full cumulative package or defer it entirely.
Why it matters
Core concepts
Patch Tuesday (B Release)
The mandatory monthly security update released on the second Tuesday of each month at 10:00 AM Pacific Time.
Patch Tuesday is the cornerstone of Windows servicing. Every second Tuesday, Microsoft publishes cumulative security updates for all supported Windows versions. These updates include security fixes, reliability improvements, and all content from the previous month's security and optional preview updates.
The term 'B release' refers to the second week of the month. Per Microsoft's Windows IT Pro Blog, people use 'B release,' 'quality update,' 'security update,' 'monthly cumulative update,' and 'Latest Cumulative Update (LCU)' interchangeably. All refer to the same Patch Tuesday package.
Microsoft formalized Patch Tuesday in October 2003. Before that, updates shipped whenever they were ready, creating unpredictable workloads for IT teams. The Tuesday schedule gives admins Monday to clear weekend issues, then the rest of the week to test and deploy patches.
Example
The June 2026 Patch Tuesday (KB5094126) shipped on June 9 and served as both a security update and a quarterly hotpatch baseline for eligible devices.
Why it matters — Patch Tuesday is the only regular release that includes new security fixes. Delaying deployment leaves endpoints exposed to vulnerabilities that attackers actively reverse-engineer from the patch.
Optional Non-Security Preview Updates
Preview releases published in the fourth week of the month, containing non-security fixes and features that will ship in the following month's Patch Tuesday.
These updates, historically called 'C release' (third week) or 'D release' (fourth week), give IT teams early access to upcoming quality fixes and features. Microsoft's preferred term is now 'optional non-security preview update.'
Preview updates are cumulative and only offered for the most recent supported Windows versions. As of July 2026, per Microsoft's blog post, those are Windows 11 versions 26H1, 25H2, and 24H2. These updates are optional, meaning they won't install automatically on managed devices unless an admin explicitly approves them.
The primary purpose is validation. Enterprise IT teams can deploy preview updates to a pilot group, catch any compatibility issues, and then confidently roll out the following month's Patch Tuesday knowing the non-security content has already been tested.
Example
An optional preview update released in the fourth week of May 2026 lets admins test non-security fixes before they're included in the June 2026 Patch Tuesday.
Why it matters — Preview updates reduce the risk of Patch Tuesday surprises. Testing non-security content early means fewer unexpected issues in production when the mandatory security update ships.
Hotpatch Updates
Security-only updates that patch running code in memory without requiring a device restart, available for eligible Windows 11 Enterprise and Windows Server 2025 devices.
Hotpatch is a significant evolution in Windows servicing. Instead of updating files on disk and requiring a reboot, hotpatch modifies the in-memory code of running processes. The original binaries on disk stay unchanged until the next quarterly baseline update synchronizes them.
The cadence follows a quarterly rhythm: baseline months (January, April, July, October) deliver a full cumulative update requiring a restart. The two months following each baseline deliver hotpatch updates that install without a restart. This means roughly 8 hotpatch months and 4 baseline months per year, per Microsoft Learn documentation.
Hotpatch requires Windows 11 Enterprise (24H2 or 25H2) or Windows Server 2025, Virtualization-Based Security (VBS) enabled, and management through Windows Autopatch or Microsoft Intune. Since May 2026, hotpatch is enabled by default for all eligible devices in Autopatch.
Example
In May 2026, eligible devices received KB5089466 as a hotpatch update. No restart was needed. The previous baseline was the April 2026 cumulative update.
Why it matters — Hotpatching reduces restart frequency from 12 times per year to 4, cutting disruption for end users while maintaining the same security coverage as standard cumulative updates.
Out-of-Band (OOB) Updates
Updates released outside the normal monthly cadence to address urgent security vulnerabilities or critical reliability issues.
OOB updates break the predictable Patch Tuesday rhythm when waiting until the next second Tuesday would be too risky. Microsoft uses them for actively exploited zero-day vulnerabilities, widespread reliability problems, or critical defects that affect many devices.
Most OOB updates are cumulative, meaning they include all previously released fixes plus the urgent fix. Some are optional (fixing a quality issue), while others are classified as security updates requiring prompt deployment. Per Microsoft's servicing blog, enterprise environments can deploy OOB updates through Windows Autopatch, the Microsoft Update Catalog, and standard enterprise tools.
OOB releases are relatively uncommon compared to the regular monthly cycle. When they do ship, they often signal a high-severity issue that warrants immediate attention from IT teams.
Example
In March 2026, Microsoft released out-of-band hotpatch updates (KB5085518 and KB5084897) for Windows 11 Enterprise to address urgent security issues between the regular Patch Tuesday releases.
Why it matters — OOB updates exist because attackers don't follow a monthly schedule. When a zero-day is being exploited or a critical defect is breaking devices, waiting for the next Patch Tuesday isn't an option.
Cumulative Update Model
Microsoft's approach where each monthly update contains all previously released fixes, so installing the latest update brings a device fully up to date.
Since Windows 10, all quality updates are cumulative. This replaced the older model where admins could pick individual patches. The cumulative approach simplifies servicing: you install one package per month, and it contains every fix for that Windows version.
The trade-off is that administrators can no longer selectively deploy specific patches. If a cumulative update causes an issue, the only option is to roll back the entire update.
Starting with Windows 11 24H2, Microsoft introduced checkpoint cumulative updates. These create intermediate baselines so that subsequent updates only need to include changes since the last checkpoint, reducing download sizes.
Example
Installing the July 2026 cumulative update includes all security and quality fixes from January through July 2026, regardless of whether previous months' updates were installed.
Why it matters — The cumulative model prevents 'update fragmentation' where devices have mismatched patches, reducing support complexity but removing selective patching flexibility.
How it works
Microsoft develops and tests monthly fixes
Throughout the month, Microsoft identifies vulnerabilities, develops patches, and tests them. Security fixes are prioritized based on severity and active exploitation status.
Development & Testing
Example — Microsoft's AI-driven deployment models analyze device telemetry to predict update experience.
Patch Tuesday releases on the second Tuesday
At 10:00 AM Pacific Time on the second Tuesday, the monthly security update (B release) publishes. Vulnerability details appear in the Security Update Guide.
Patch Tuesday (B Release)
Example — June 9, 2026: KB5094126 ships as both a security update and quarterly hotpatch baseline.
IT teams deploy through rings
Enterprise admins deploy updates in stages. A pilot group receives the update first. If no issues surface, broader groups follow. Hotpatch-eligible devices receive security fixes without a restart during hotpatch months.
Ring-based Deployment
Example — An MSP deploys to a 5% pilot on Patch Tuesday +2 days, then to production after two weeks.
Optional preview ships in the fourth week
Around the fourth Tuesday, Microsoft publishes the optional non-security preview update containing fixes planned for the next Patch Tuesday. IT teams deploy it to validation groups.
Preview Release (C/D)
Example — A preview update in the fourth week of June lets admins test quality fixes before July Patch Tuesday.
OOB updates ship when needed
If a critical vulnerability is being actively exploited or a major defect is breaking devices, Microsoft releases an out-of-band update outside the normal schedule.
OOB (Emergency)
Example — A zero-day exploit triggers an OOB security update three days after regular Patch Tuesday.
Use cases
Enterprise patch management
IT administratorsDeploy Patch Tuesday through rings, use previews for validation, hotpatch to reduce restarts.
A financial firm uses Autopatch with hotpatch for 5,000 trading desktops.
Benefit — Predictable cadence with minimized disruption.
MSP multi-client management
MSPsMSPs schedule deployments across clients, staggering rings to catch issues early.
An MSP deploys to pilot on Wednesday, validates by Friday, production Monday.
Benefit — Efficient multi-tenant patching.
Security compliance
Security teamsMeet SLA requirements for patch timelines with hotpatch enabling faster compliance.
Healthcare org meets 72-hour patching SLA using hotpatch.
Benefit — Faster compliance with fewer change windows.
Benefits
Predictable schedule
The second-Tuesday cadence lets teams plan maintenance windows in advance.
IT teams block the second Wednesday for post-patch validation.
Reduced restarts with hotpatch
Hotpatch cuts mandatory restarts from 12 per year to 4 quarterly baselines.
Hotpatch-enrolled devices go April to June with minimal restarts.
Early validation through previews
Optional preview updates let teams test non-security fixes before Patch Tuesday.
A pilot group catches a printer driver issue before production rollout.
Cumulative simplicity
Each update includes all previous fixes; one package brings a device current.
A device offline for three months installs one update to catch up.
Limitations
No selective patching
MediumThe cumulative model is all-or-nothing. Can't choose individual patches.
Workaround — Use Known Issue Rollback (KIR) when available.
Hotpatch prerequisites limit eligibility
MediumRequires Win11 Enterprise 24H2+, VBS enabled, Intune/Autopatch. Consumer editions excluded.
Workaround — Non-eligible devices get standard LCU with restart.
Preview updates only for latest versions
LowOlder supported versions don't receive optional preview updates.
Workaround — Stay on recent Windows versions.
OOB updates disrupt schedules
MediumEmergency updates arrive unpredictably, breaking planned maintenance windows.
Workaround — Build an expedited OOB deployment process.
Architecture
The Windows update delivery architecture uses Windows Update (WU) as the primary client-side component, with multiple server-side distribution channels.
Windows Update client
Checks for, downloads, and installs updates on each device.
The Settings > Windows Update UI on Windows 11.
WSUS
On-premises server that downloads updates from Microsoft and distributes them to managed devices.
A WSUS server caching updates for 500 endpoints.
Microsoft Intune / Autopatch
Cloud-based management controlling update deployment policies, ring scheduling, and hotpatch.
Autopatch enrolls eligible devices in hotpatch since May 2026.
Microsoft Update Catalog
Web repository for manually downloading specific update packages.
An admin downloads an OOB update for offline deployment.
Servicing Stack
Internal Windows component responsible for installing updates.
SSUs are now bundled into the LCU for recent Windows 11 builds.
Data flow
Microsoft publishes updates to Windows Update servers. Enterprise tools sync and distribute to managed devices based on policy. Each device's servicing stack processes the package.
Integrations: Microsoft Configuration Manager, Azure Update Manager, Group Policy (Windows Update for Business), Third-party patch management tools
Architecture limitations
Examples
Standard Patch Tuesday deployment
Enterprise with 2,000 devices deploys June 2026 Patch Tuesday through three rings.
Ring 1 (IT staff) on Patch Tuesday, Ring 2 (pilot) three days later, Ring 3 (production) the following Monday.
Hotpatch quarterly cycle
500 hotpatch-eligible devices go through the April-May-June 2026 quarter.
April: baseline with restart. May: hotpatch, no restart. June: baseline again. Devices stay protected with minimal reboots.
Comparisons
Patch Tuesday vs. Preview Updates vs Optional non-security preview updates
Patch Tuesday is mandatory with security fixes. Previews are optional with non-security fixes for early validation.
| Criterion | Patch Tuesday vs. Preview Updates | Optional non-security preview updates |
|---|---|---|
| Timing | Second Tuesday | Fourth week |
| Content | Security + non-security | Non-security only |
| Required | Yes | No, optional |
| Availability | All supported versions | Most recent versions only |
When to choose — Deploy Patch Tuesday to all devices. Use previews on pilot groups.
Standard LCU vs. Hotpatch vs Hotpatch updates
Standard LCUs update disk files and restart. Hotpatch patches in-memory code without restart, security-only.
| Criterion | Standard LCU vs. Hotpatch | Hotpatch updates |
|---|---|---|
| Restart | Yes | No (except quarterly baselines) |
| Content | Security + non-security + features | Security only |
| Eligibility | All editions | Enterprise 24H2+, VBS required |
| Management | Any tool | Intune/Autopatch required |
When to choose — Hotpatch on eligible enterprise devices; standard LCU for everything else.
Myths, corrected
Myth
You can pick and choose which patches to install from a cumulative update.
Correction
Since 2016, cumulative updates are all-or-nothing. Individual patch selection is no longer supported.
Why it happens: IT pros from the Windows 7 era remember selecting individual hotfixes.
Myth
Hotpatch eliminates all restarts for patching.
Correction
Quarterly baselines still require a restart. Feature updates, firmware, and drivers also need restarts.
Why it happens: Marketing emphasis on 'no restart' obscures the quarterly baseline requirement.
Myth
Optional preview updates are beta-quality and risky.
Correction
Preview updates are production-quality cumulative releases, not Windows Insider builds.
Why it happens: The word 'preview' implies instability.
Myth
Patch Tuesday only includes security fixes.
Correction
Patch Tuesday is cumulative and includes both security and non-security content from prior months.
Why it happens: The name 'security update' suggests security-only content.
Practical implications
For admins
Plan deployment rings around Patch Tuesday. Use preview updates on pilot groups. Enable hotpatch on eligible devices. Build an expedited OOB process.
For MSPs
Standardize deployment timelines across clients. Document hotpatch-eligible devices. Use previews proactively.
For business
Predictable schedule lets business units plan around maintenance windows. Hotpatch reduces productivity interruptions.
For security
Don't delay Patch Tuesday. Attackers reverse-engineer patches within days. Use hotpatch to close the vulnerability window faster.
For end users
On managed devices, updates are handled by IT. On personal devices, keep Windows Update enabled.
Cost impact
Hotpatch is included in Windows Enterprise E3/E5. For Windows Server, Azure Arc hotpatching costs $1.50 USD per CPU core per month.
Operational impact
Hotpatch reduces restarts from 12 to 4 per year. Preview updates add testing workload but reduce production surprises.
Decision guide
Use when
- You need to keep Windows endpoints secured with a predictable patching schedule.
- You want to minimize restart disruptions on Windows 11 Enterprise (enable hotpatch).
- You want to validate upcoming fixes before they become mandatory (deploy previews to pilot groups).
Avoid when
- You're looking for feature update planning (separate topic: annual feature updates).
- You expect hotpatch to cover non-security fixes, drivers, or firmware.
Requirements
- Supported Windows version for Patch Tuesday
- Windows 11 Enterprise 24H2+ with VBS for hotpatch
- Intune or Autopatch for hotpatch management
- Enterprise update tool for ring-based deployment
Alternatives
- Windows Insider Program for pre-release feature access (different from preview updates).
- Third-party patch management tools for additional control.
Related terms
LCU (Latest Cumulative Update)
The most recent cumulative update package containing all previously released fixes.
Servicing Stack Update (SSU)
An update to the Windows component that installs future updates. Now bundled into the LCU.
Checkpoint Cumulative Update
Intermediate baselines in Windows 11 24H2 that reduce subsequent download sizes.
Controlled Feature Rollout (CFR)
Microsoft's technique for gradually enabling new Windows features.
Known Issue Rollback (KIR)
A mechanism to disable a specific fix within a cumulative update without uninstalling the whole update.
Frequently asked questions
What day is Patch Tuesday?
Patch Tuesday falls on the second Tuesday of each month at 10:00 AM Pacific Time. IT teams typically begin deployment and testing the following day.
What's the difference between B, C, and D releases?
B release is Patch Tuesday (second Tuesday, mandatory). C and D releases were optional previews in weeks 3-4. Microsoft now calls them 'optional non-security preview updates.'
Does hotpatch really mean no restarts at all?
Hotpatch eliminates restarts for 8 months per year. Quarterly baselines still require a restart. Feature updates and firmware may also need restarts.
Which devices are eligible for hotpatch?
Windows 11 Enterprise 24H2 or 25H2, or Server 2025. VBS must be enabled. Managed through Intune or Autopatch. Consumer editions aren't eligible.
Are optional preview updates safe to deploy?
Yes. They're production-quality cumulative releases for IT teams to validate non-security fixes before the next Patch Tuesday.
What should I do when an OOB update ships?
Check if it's a security update or optional fix. For security OOBs, deploy immediately through your expedited process. For optional OOBs, evaluate before deploying.
Can I still choose which individual patches to install?
No. Since 2016, cumulative updates are all-or-nothing. Known Issue Rollback (KIR) can selectively disable specific fixes within a cumulative update.
Conclusion
The Windows servicing model follows a three-lane approach: Patch Tuesday security updates, optional preview updates, and emergency OOB fixes. Hotpatch adds restart-free security patching for enterprise devices between quarterly baselines.
Main takeaway
For configuring hotpatch through Intune, see a tutorial on Windows Autopatch hotpatch setup.
