A missed reboot should never mean a missed patch.
The Windows Hotpatch program lets eligible devices receive security updates without a full restart, reducing disruption for users and servers alike. It exists because reboot cycles are one of the biggest sources of patch delay in modern fleets.
But hotpatching is not infallible. When a hotpatch fails to apply cleanly, or a device drifts out of the required baseline, the endpoint can silently remain exposed until an administrator notices and intervenes manually.
The EnableHotpatchAutoRemediation setting closes that gap. When enabled, Windows automatically detects when a hotpatch enrolled device has fallen out of compliance and triggers the remediation steps needed to bring it current, without waiting for manual patch cycles.
Enforcing it through Microsoft Intune guarantees the same remediation behavior across every hotpatch enrolled endpoint, instead of relying on individual devices or IT teams to catch the drift.
The result is an environment where the exposure window between a failed update and its correction is measured in hours, not weeks.
Why This Policy Matters
Attackers move fastest in the window between a vulnerability disclosure and the moment a patch is actually applied. Hotpatching was designed to shrink that window, but only if the update mechanism itself stays healthy.
Without automatic remediation, a single failed hotpatch cycle can leave a device carrying a known, exploitable vulnerability for an extended period, with no automated correction in place.
Without this policy:
- A failed hotpatch can leave a device unpatched with no automatic retry, extending exposure to a known CVE
- Administrators must manually identify drifted devices, delaying remediation by days or weeks
- Endpoints that cannot tolerate frequent reboots become long-term soft targets for exploitation
- Patch compliance reporting becomes unreliable because silent hotpatch failures go undetected
With this setting enforced through Intune:
- Devices that fall out of hotpatch compliance are automatically corrected without manual intervention
- The gap between vulnerability disclosure and patch application shrinks consistently across the fleet
- Reboot-sensitive endpoints stay protected without disrupting operational continuity
- Security teams gain a predictable, auditable remediation behavior instead of ad hoc manual fixes
This configuration aligns with modern security principles such as defense in depth, endpoint hardening, proactive threat detection, and Zero Trust architecture.
Security Governance
Security governance ensures that hardening controls are consistently applied, monitored, and aligned with organizational standards.
Without centralized governance, settings such as this one can drift across devices, leaving blind spots that attackers can exploit.
Managing the Enable Hotpatch Auto Remediation setting through Microsoft Intune brings several governance benefits:
- Centralized enforcement of the control across all managed Windows endpoints
- Consistent configuration aligned with corporate security baselines
- Clear visibility into deployment status and configuration compliance
- Defined ownership and accountability through scope tags and role-based administration
- An auditable policy lifecycle from creation to enforcement and validation
This level of governance ensures that the control is handled in a controlled and transparent manner, reinforcing compliance with internal security policies and regulatory frameworks.
Windows CSP Overview
This section explains how the setting is exposed at the operating system level and how Microsoft Intune interacts with it. The configuration is powered by the Windows Policy Configuration Service Provider (CSP) framework, specifically the System area.
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with KB5063878 [10.0.26100.4946] and later |
This policy setting controls whether Automatic Remediation is enabled on the hotpatch enrolled device. This policy has no effect on devices that doesn't have hotpatch updates installed.
If you enable this policy setting, Automatic Remediation is enabled on the hotpatch enrolled device.
If you disable or don't configure this policy setting, Automatic Remediation is disabled on the hotpatch enrolled device.
Description Framework Properties
This section defines how the configuration behaves at a technical level within the CSP framework.
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed Values
This section defines the valid configuration values supported by the setting. It accepts the following options:
| Value | Description |
|---|---|
| 0 (Default) (Default) | Automatic Remediation isn't enabled (Default). |
| 1 | Automatic Remediation is enabled. |
Group Policy Mapping
For organizations operating in hybrid environments, this CSP setting maps to a corresponding Group Policy configuration.
| Name | Value |
|---|---|
| Name | EnableHotpatchAutoRemediation |
| Location | Computer Configuration |
Security Considerations
Before enabling this policy, administrators should understand how it behaves and plan for its impact.
- The setting has no effect on devices that are not enrolled in the Windows Hotpatch program, so it should be scoped to hotpatch eligible hardware
- Automatic remediation may trigger an additional servicing cycle, so pilot devices should be monitored for update frequency and bandwidth impact
- This control requires Windows 11, version 24H2 with the applicable cumulative update, so older builds will report as not applicable
- Remediation actions should be correlated with existing patch compliance dashboards to avoid duplicate alerting
A phased, pilot-first deployment is recommended to validate the behavior in a controlled group and avoid unexpected impact before rolling the setting out across production devices.
How to Configure Enable Hotpatch Auto Remediation Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that hotpatch enrolled devices automatically self correct when they fall out of compliance is applied consistently across all managed Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshots.
Create the Configuration Profile
In the Microsoft Intune admin center:
- Navigate to Devices › Windows › Configuration
- Select + Create policy
In the Create a profile pane:
- Platform: Windows 10 and later
- Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that enables automatic remediation for hotpatch enrolled devices.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future. As shown in the screenshot, configure the fields as follows.
The Platform field is already pre-selected as Windows, so no changes are required. Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows setting you want to enforce. To open the Settings picker panel, click Add settings.
By default, this setting is not configured, meaning hotpatch enrolled devices that fail an update cycle do not receive any automatic corrective action.
In the search field at the top of the Settings picker, type Hotpatch Auto Remediation, and then click Search to filter the results.
From the returned results, select the category System, and then choose the setting Enable Hotpatch Auto Remediation. Once selected, the setting is automatically added to the configuration profile. Back on the configuration page, change the value from its default state to Enabled (1).
When enabled, Windows automatically remediates hotpatch enrolled devices that drift from the expected update baseline. This ensures that:
- Failed or incomplete hotpatch cycles are corrected without waiting for manual intervention
- Security teams gain visibility into remediation events instead of relying on silent, unnoticed drift
- Devices maintain a consistent, evidence backed patch state across the fleet
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
- Restrict policy visibility to specific IT roles or teams
- Enforce administrative separation of duties
- Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Hotpatch Auto-Remediation
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group: GRP – MS365Education – Test Computers.
Once the group is selected, verify the following:
- The group appears under Included groups
- The group status is Active
- No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening objective.
Pay special attention to the following items:
- Policy name and description: confirm that the policy clearly reflects its purpose, enabling automatic remediation for hotpatch enrolled devices
- Configuration settings: verify that Enable Hotpatch Auto Remediation is set to Enabled (1), under System
- Scope tags: ensure the correct scope tag is assigned. In this example, the Default scope tag is used
- Assignments: confirm the policy is assigned to the intended group, GRP – MS365Education – Test Computers, and that no unintended exclusions are configured
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Hotpatch Auto-Remediation configuration profile, the next step is to verify its deployment status. This validation confirms that the policy has been successfully applied and that hotpatch enrolled devices are now capable of self remediating on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
- Triggering a manual device sync from the Company Portal
- Initiating a sync directly from the Microsoft Intune admin center
Intune provides clear indicators to evaluate the policy deployment status: Succeeded (devices have applied the policy), In progress (devices are still processing), Error (the policy failed and requires investigation), and Not applicable (the device does not support the configuration).
When devices report Succeeded, it confirms that the automatic remediation mechanism is active on the endpoint, ensuring that any future hotpatch failure will be corrected without waiting for manual patching.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the policy was successfully applied. Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
- Open Event Viewer on the target device
- Navigate to Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin
- Select Filter Current Log
- Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
- Open the event details and confirm that the System setting was applied
For deeper validation, you can confirm the effective setting directly on the device. Check the registry path HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\System\EnableHotpatchAutoRemediation and confirm the value is set to 1, matching the enforced configuration.
Remember that this setting only produces observable behavior on devices actively enrolled in the Windows Hotpatch program. On non-enrolled devices, the value will apply but no remediation activity will occur until enrollment is completed.
Why This Matters for Endpoint Security
Patch management is one of the most consistently exploited weak points in endpoint security, and hotpatching was built specifically to shrink the time attackers have to act.
Without automatic remediation, that same mechanism can quietly fail, leaving devices exposed while dashboards still report them as covered by the hotpatch program.
By enforcing Enable Hotpatch Auto Remediation through Microsoft Intune and validating the configuration locally, organizations ensure that:
- Hotpatch failures are corrected automatically instead of accumulating unnoticed
- The exposure window for known vulnerabilities stays predictably short
- Reboot-sensitive production and education endpoints remain protected without operational disruption
- Patch compliance data reflects the true security state of the fleet
This configuration provides strong security value without disrupting standard user workflows when properly validated and deployed.
Key Takeaway
A patching mechanism is only as strong as its ability to recover from its own failures.
Enforcing Enable Hotpatch Auto Remediation through Microsoft Intune guarantees that every hotpatch enrolled device carries the same self healing behavior, regardless of how the initial update cycle unfolded.
Combined with centralized deployment and client-side validation, the organization gains a fleet that closes vulnerability gaps automatically, without depending on manual follow-up.
And in modern security architecture, automatic remediation is not optional, it is essential.
More Information
For additional technical details, refer to the official Microsoft documentation below:
- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system
- https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you for reading!
🖥️ Ricardo Barbosa
🏆️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect | 💼 Technology Director at Altelix.com
💬 Follow me for more Windows endpoint hardening and Intune content.