Enable hotpatching (preview) in Azure Arc

Navigating to Azure Arc to the Server 2025 VM to enable hotpatching.

When we try to enable hotpaching we’re getting the following alert

So how do we enable VBS?

First we connect to the machine through Windows Admin Center in Arc
And we’re using the PowerShell blade to connect through it

Note: you can also add it manually through the Registry blade.

We’re following best practices and checking Microsoft Learn: Enable memory integrity | Microsoft Learn

Enable VBS through adding registry entries:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f

After this we’re rebooting the machine also through PowerShell

shutdown -r -t 0

Wait a few minutes and try to enable it again in Azure Arc

VBS is enabled and hotpatching too!

Supported versions of windows server for hotpatching

Publisher	OS Offer	SKU
MicrosoftWindowsServer	WindowsServer	2022-Datacenter-Azure-Edition-Core
MicrosoftWindowsServer	WindowsServer	2022-Datacenter-Azure-Edition-Core-smalldisk
MicrosoftWindowsServer	WindowsServer	2022-Datacenter-Azure-Edition-Hotpatch
MicrosoftWindowsServer	WindowsServer	2022-Datacenter-Azure-Edition-Hotpatch-smalldisk
MicrosoftWindowsServer	WindowsServer	2025-Datacenter-Azure-Edition
MicrosoftWindowsServer	WindowsServer	2025-Datacenter-Azure-Edition-smalldisk
MicrosoftWindowsServer	WindowsServer	2025-Datacenter-Azure-Edition-Core
MicrosoftWindowsServer	WindowsServer	2025-Datacenter-Azure-Edition-Core-smalldisk