Hotpatching is now available in preview for Windows Server VMs on Azure with Desktop Experience

[Guest Hilal_Asmat]

We are pleased to announce that Hotpatching is now in preview on Windows Server 2022 Datacenter: Azure Edition with the Desktop Experience installation option. You may remember our previous announcement from last February announcing the availability of Hotpatching for Windows Server 2022 Datacenter: Azure Edition (Core). We announced our intent to support Hotpatching for the Desktop Experience then, and we are excited to finally bring this capability to preview! With this release, you can now enjoy all the benefits of Hotpatching combined with all the additional features available in the desktop experience.

 

 

 

Get started now! Create a VM using the preview image published here. For in-depth instructions, follow the instructions later in this article!

 

 

 

With this new support, all Windows Server 2022 Azure Edition VMs in Azure (including Azure Stack HCI) can take advantage of rebootless updates using Preview images! This marks our continued investment in making Azure the best destination to run Windows Server, with many capabilities that optimize your server management through services such as Azure Automanage.

 

 

 

What is Hotpatching?

Hotpatching is the ability to patch and update your OS without rebooting. This is accomplished by modifying code in-memory, undetectable to the user, without hindering your workloads or compromising on security. Hotpatching provides several benefits:

 

• Lower workload impact due to less reboots
  
• Faster deployment of updates as the hotpatch packages are smaller, install faster, and have easier patch orchestration with Azure Update Manager
  
• Better protection, as the hotpatch update packages are scoped to Windows security updates that install faster without rebooting
  

 

To learn more about how hotpatching works, watch the video below.

 

 

 

 

 

How to create a new Virtual Machine with Hotpatch

 

Note: This information covers instructions on how to create a VM with Hotpatch on Azure. For instructions on how to enable a VM with Hotpatch for Azure Stack HCI, please refer to this article.

 

1a. Create a VM from Azure Portal

 

During the public preview, you will use a preview marketplace image to create a Windows Server 2022 Datacenter: Azure Edition Desktop Experience VM with Hotpatch pre-configured.

 

• Use this link to create a new Windows Server Azure Edition VM: https://aka.ms/HotpatchPreviewImage
  

• Select Windows Server 2022 Datacenter: Azure Edition Hotpatch Preview and click Create
  

 

[ATTACH=full]2095[/ATTACH]

 

• Supply VM details, with the following considerations:
  
  • Ensure that Windows Server 2022 Datacenter: Azure Edition Hotpatch Preview is selected in the Image dropdown)
    
  • Specify a Region where you want to deploy.
    
  • On the Management tab step, scroll down to the ‘Guest OS updates’ section. You should see Enable Hotpatch is set to true and Patch orchestration options is set to Azure-orchestrated.
    

 

[ATTACH=full]2096[/ATTACH]

 

• Next, create your VM.
  

 

1b. Create a VM programmatically with an ARM template and the Azure CLI

 

If you wish to create a VM programmatically, below are image details (publisher, offer, SKU, image version) and a step-by-step process to execute commands from PowerShell using an ARM template and the Azure CLI. This is especially useful if you would like to test applying Hotpatches to a new VM, even after a subsequent marketplace image has been released that already contains those updates.

 

Consider the following scenario:

 

• The WS 2022 Azure Edition Desktop Experience preview image available in the marketplace already contains the April patches by default;
  
• You would like to test installing the Hotpatches that will be released in May 2023 onto a clean, new VM of the WS 2022 Azure Edition Desktop Experience preview image.
  

 

If you create that VM programmatically from an ARM template, you can indicate which image version you would like to use – so you can specify the April marketplace image, then start up the VM. If May or June 2023 updates have released when you are creating the VM then you will see rebootless install of the Windows security update from May or June.

 

 

 

WS 2022 Azure Edition Preview Hotpatch April baseline image details:

 

 

 

"publisher": "microsoftwindowsserver",  
"offer": "windowsserverhotpatch-previews",  
"sku": "windows-server-2022-azure-edition-hotpatch",
"version": "20348.1668.230329" 

 

 

 

Step by step instructions to create a VM from an ARM template using PowerShell and Azure CLI:

 

• Start a new PowerShell session on your local device
  
• Install the ‘Az’ module
  

 

 

 

Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force -AllowClobber 

 

 

 

• Use az to browse the vm image list to find details about the image you would like to create (the query below will display all the marketplace images available for the sku specified above)
  

 

 

 

[iCODE]az vm image list --location southcentralus --publisher MicrosoftWindowsServer --offer windowsserverhotpatch-previews --sku "windows-server-2022-azureedition-hotpatch" --all --output table[/iCODE]

 

 

 

• In preparation for running command ‘New-AzResourceGroupDeployment’ in a subsequent step, create and populate ARM template files ‘template.json’ and ‘parameters.json’ with details about the VM you are going to create, and save those files to a local folder (in this example, c:\pstemp).
  
  • Details you may need to populate manually (there may be more or less depending on your
    template):
    
    • Parameters.json
      

      • Field
        Sample value
        
        
        
        adminPassword.value
        [your password here]
        
        
        
        

      [*]Template.json

      • Field
        Sample value
        
        
        
        resources.[vm].properties.storageProfile.
        imageReference
        
        
        

  [*]In your PowerShell session, connect to the Azure account that you would like to use to test. (Depending on your account, you may need to specify the tenant). You should see an interactive popup asking for Azure credentials. NOTE: Make sure this tenant matches any values populated in the ARM template created above.

 

 

 

[iCODE]Connect-AzAccount -TenantId [your tenant ID][/iCODE]

 

 

 

• Specify the subscription that you would like to use to test. NOTE: Make sure this subscription matches any values populated in the ARM template created above.
  

 

 

 

[iCODE]Set-AzContext -Subscription "[your subscription ID]" [/iCODE]

 

 

 

• Run the command New-AzResourceGroupDeployment, specifying the name of the deployment, the resource group name of the deployment, the template file location, and the template parameter file location.
  

 

 

 

New-AzResourceGroupDeployment -Name [your deployment name] ` 
-ResourceGroupName [your resource group] ` 
-TemplateFile "c:\pstemp\template.json" ` 
-TemplateParameterFile "c:\pstemp\parameters.json" 

 

 

 

• The deployment will now run synchronously, provisioning your VM. After a few minutes you will receive a status indicating success (ProvisioningState: Succeeded) or failure (with error details in red).
  

 

 

 

For an in-depth comparison of Desktop Experience vs. Server Core, please refer to this article.

 

 

 

Happy hotpatching!

 

-Hilal

 

Continue reading...