Microsoft’s September 2025 hotpatch for Windows 11 Enterprise eliminates unnecessary User Account Control (UAC) prompts that have been plaguing non-admin users during MSI repair operations—no restart required. KB5065474, released on September 9, 2025, advances eligible Windows 11 Enterprise 24H2 and LTSC 2024 devices to OS Build 26100.6508, packing targeted quality and security improvements alongside a crucial servicing stack update (SSU). But the no-reboot convenience comes with a sharp edge for Hyper-V administrators: PowerShell Direct (PSDirect) connections can break when host and guest virtual machines fall out of patch parity, demanding immediate coordination.

The UAC Fix at the Heart of the Hotpatch

The update directly addresses a known app-compatibility snag where non-admin users would encounter unexpected UAC elevation dialogs during MSI installer custom actions. Installers performing repair or configuration tasks in the background—like those from Office Professional Plus 2010 or Autodesk’s AutoCAD—could block unprivileged accounts from using the software. Microsoft’s fix refines the repair mechanism, scaling back unnecessary prompts and enabling IT admins to exclude specific applications via an allowlist, restoring seamless workflows without elevating privileges. Administrators who have been wrestling with support tickets since the August 2025 security update should see immediate relief after deploying this hotpatch.

The PSDirect Conundrum: When Hotpatches Collide

While the hotpatch reduces downtime, it surfaces a critical interoperability issue for Hyper-V environments that rely on PowerShell Direct. The KB warns that PSDirect connections may fail intermittently when a guest VM and its host are not on matching update states. In practice, an updated guest trying to connect to an unpatched host—or the reverse—can trigger socket cleanup failures and Event ID 4625 in the Security log. The fallback handshake intended to keep sessions alive falters, causing connection drops that disrupt automation scripts, lab management workflows, and remote administration.

Microsoft published a companion hotpatch, KB5066360, to remediate the host/guest parity problem. The workaround is straightforward but operationally demanding: update both host and guest VMs together, or apply KB5066360 to all affected systems. For organizations that lean heavily on PSDirect as a primary management surface, planning a coordinated maintenance window is essential. The KB further recommends using WinRM-based PowerShell remoting or SSH as temporary fallbacks until full parity is restored.

The Hidden Partner: Servicing Stack Update Bundling

KB5065474 exemplifies Microsoft’s evolving hotpatch delivery model. When installed via Windows Update, the package bundles the latest SSU (identified as KB5064531, version 26100.5074) to improve installation reliability. This bundling reduces the risk of servicing failures that plagued early cumulative updates, but it also means that administrators using offline deployment tools must account for a slightly larger payload and verify that their compliance checks recognize the hotpatched build number—26100.6508—rather than a traditional cumulative update identifier.

Eligibility and the Arm64 Caveat

Hotpatching isn’t a universal feature. Devices must run Windows 11 Enterprise (LTSC 2024 or 24H2) and meet a baseline build level dictated by Microsoft’s quarterly update cycle. Management through Intune or Windows Autopatch is mandatory, and Virtualization-based Security (VBS) often must be enabled. For organizations with Arm64 devices, an additional step is required: the Compiled Hybrid PE (CHPE) compatibility layer must be disabled. This one-time change forces a restart and can degrade x86 emulation performance, so thorough testing in a pilot ring is critical. Microsoft provides a DisableCHPE configuration service provider (CSP) and HotPatchRestrictions registry key to facilitate the opt-in.

Distribution Channels and Visibility

KB5065474 is delivered via Windows Update and Microsoft Update for eligible managed devices, making it the simplest path for Intune-managed fleets. Organizations using WSUS or Configuration Manager must confirm that their infrastructure can detect the hotpatched build; otherwise, compliance dashboards may flag updated systems as missing patches. Hotpatches use different KB numbers and increment the UBR (Update Build Revision) rather than the main OS build number, so inventory scripts must query both CurrentBuild and UBR from the registry to accurately reflect patch state.

Secure Boot Certificate Expiry: A Looming Deadline

Buried within the KB advisory is a reminder that Secure Boot certificates trusted by many devices begin expiring in June 2026. While unrelated to the hotpatch, the note serves as a critical planning trigger: without firmware or certificate authority updates, devices may fail to boot or apply future updates. Microsoft urges administrators to initiate cross-team planning with OEMs and firmware vendors now, inventorying endpoints susceptible to the expiry and scheduling remediation ahead of the deadline.

Practical Deployment Roadmap

A phased rollout remains the safest path. Start with a comprehensive inventory of all Windows 11 Enterprise 24H2 devices, checking both the build number and UBR via a simple PowerShell command:

$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($cv.CurrentBuildNumber).$($cv.UBR)"

Next, create a pilot ring that includes a representative mix: Hyper-V hosts and guests, Arm64 endpoints, systems with kernel-mode drivers, EDR agents, and backup software. Validate functional workloads after the hotpatch is applied, paying special attention to MSI repair flows for non-admin users and PSDirect connectivity. Monitor the Security event log for Event ID 4625 and WindowsUpdateClient logs for installation errors during the 7–14-day observation period.

For Hyper-V administrators, the pilot must enforce host/guest update parity. Apply KB5065474 to both hosts and guests in the same maintenance window, or preemptively deploy KB5066360. Test fallback remoting methods to ensure business continuity if PSDirect failures recur beyond the pilot.

Post-Deployment Validation

After rolling out the hotpatch, verify the OS build using winver or the registry query above. Confirm that no new UAC regressions appear in critical line-of-business apps, especially those using MSI installers from Autodesk or legacy Office suites. Test PSDirect connections explicitly:

Enter-PSSession -VMName <VMName>

If failures occur, check Event ID 4625 and correlate with patch levels on both sides. Apply the corrective KB5066360 as needed. Finally, update asset management databases and SIEM ingestion rules to recognize the 26100.6508 build string, preventing false compliance alerts.

A Strategic Shift in Patch Management

KB5065474 underscores Microsoft’s push toward hotpatching as a primary rapid-response mechanism for enterprise Windows. The ability to fix a UAC prompt regression that affected daily workflows—without forcing a restart—is a tangible productivity win. However, the PSDirect issue illustrates that even targeted patches can have cascading effects in virtualized environments. As hotpatching becomes more common, administrators must evolve their deployment cadences to include host/guest parity checks, robust fallback options, and extended pilot validations that go beyond standard application testing.

For now, the takeaway is clear: deploy KB5065474 to quell UAC prompt disruptions, but treat the Hyper-V environment with extra care. The Secure Boot expiry notice, while not immediate, demands a separate workstream that should begin in parallel. Microsoft has provided the tools and the warnings; the rest falls to disciplined patch orchestration.