Windows 11 OOBE Now Installs Updates Before First Login, Microsoft Ships Hotpatching and Backup GA

Microsoft has closed a longstanding security gap by embedding quality updates directly into the Windows Out-of-Box Experience, part of an August 2025 servicing wave that also brings Windows Backup for Organizations to general availability, extends hotpatching to client and server, and rolls out staged AI features. The changes represent the most operationally significant shift in Windows servicing in months, forcing IT teams to rethink provisioning workflows, image management, and update compliance strategies. OOBE quality updates now ensure devices are fully patched before a user ever signs in, backed by new Intune controls and a revamped Enrollment Status Page. Meanwhile, Windows Backup for Organizations moves from preview to GA with streamlined Intune enablement, and hotpatching promises fewer reboots—but only for properly licensed, VBS-enabled machines. Combined with a suite of on-device AI improvements gated by Copilot+ hardware and Microsoft 365 subscriptions, the release demands careful piloting and clear communication.

OOBE Quality Updates: Patching Before the First Login

For years, the “day-one patch gap” forced IT to rush security updates onto freshly provisioned machines after user sign-in, leaving a window of vulnerability. Microsoft now ships OOBE servicing packages—KB5065813 for Windows 11 22H2/23H2 and KB5065847/KB5065848 for 24H2—that allow eligible devices to download and install quality updates during the final step of the Out-of-Box Experience. These payloads include the monthly Latest Cumulative Update (LCU) and Servicing Stack Update (SSU) where applicable, but exclude feature upgrades and broad driver rollouts. The result: devices reach the user already aligned with the organization’s security baseline.

The control surface lives in Microsoft Intune’s Enrollment Status Page. New ESP profiles created after the servicing payloads are present default to enabling quality-update install during OOBE, while existing profiles remain unchanged and must be edited to opt in. This cautious default prevents unintended rollouts, but administrators must audit all new ESP profiles in pilot and production tenants. Supported devices must be Microsoft Entra joined or hybrid-joined and managed by Intune (or an MDM that supports ESP), running Windows 11 version 22H2 or later, or Windows Server 2025 where applicable.

Operational Impact and Mitigations

Installing quality updates during OOBE adds provisioning time and network load. Large fleets may see extended Autopilot enrollments or imaging cycles, and update installs can trigger automated reboots before first sign-in. Microsoft advises IT teams to:
- Validate that golden images include the OOBE servicing payload (June 2025 non-security update or later) or ensure devices can reach Windows Update during OOBE.
- Review and edit existing ESP profiles to toggle on “Install Windows quality updates” when ready.
- Pilot deployments across different network segments, measuring average provisioning time and capturing failures to tune ESP timeout settings.
- Prestage updates using WSUS, Delivery Optimization, or offline servicing to reduce download volumes for bulk deployments.
- Document rollback and recovery playbooks, since SSUs applied in place are effectively non-removable without image reapplication.

Network and authentication issues can cause OOBE timeouts or enrollment failures. Mitigations include realistic provisioning-time benchmarks, increased ESP timeouts for pilot groups, and ensuring DNS/Intune endpoints and the Microsoft Activity Feed Service are reachable through Conditional Access.

Windows Backup for Organizations Hits General Availability

Windows Backup for Organizations, now GA, is an enterprise-grade cloud backup that preserves user settings and a list of installed Microsoft Store apps (Start menu layout), enabling fast restore during enrollment or OOBE. It is not a full disk or server backup; it does not replace traditional disaster recovery strategies. Rather, it slashes the time required to get a user back to a familiar environment after a device refresh or reimage.

Requirements and Limits

Backup requires Microsoft Entra ID sign-in and supported Windows 10/11 builds (for Windows 11, the baseline starts with 22H2 as documented). Restore demands Windows 11 devices on specific minimum builds and Microsoft Entra join; Autopilot self-deploying mode is unsupported—user-driven mode is required. Availability excludes GCC-High, Sovereign clouds, and China/21Vianet as of the August announcements.

Enabling in Intune

Administrators must configure two areas within the Microsoft Intune admin center:
1. Create a Settings Catalog profile (Platform: Windows 10 and later, Profile type: Settings Catalog), search for “Sync your settings,” and enable “Enable Windows backup.” Save the policy.
2. Under Devices → Enrollment → Windows → Enrollment options, locate “Windows Backup and Restore” and turn “Show restore page” to On. This surfaces the OOBE restore user experience during Autopilot enrollment.

Before rollout, validate tenant-wide prerequisites: ensure the Microsoft Activity Feed Service is accessible through Conditional Access and that device builds meet documented minimums. Pilot with representative users who have complex settings and Store apps, and set expectations that the backup restores personalization and app lists—not large user data repositories. Complement with OneDrive or other data backup guidance.

Hotpatching Reaches Windows Client and Server

Hotpatching, once exclusive to Azure, now extends to on-premises Windows Server 2025 and Windows 11 Enterprise clients, enabling in-memory patching of certain security updates without a reboot. The technology shrinks scheduled restarts from monthly to quarterly baselines and narrows exposure windows for critical fixes. For servers, hotpatching is delivered via Azure Update Manager/Azure Arc with a published subscription cost of approximately $1.50 USD per CPU core per month for Azure Arc-enabled hotpatching.

Client hotpatching is gated behind subscriptions (Windows 11 Enterprise E3/E5/F3, Education A3/A5, or Windows 365 Enterprise), Intune management, and Virtualization-based Security (VBS) enabled. The baseline build is Windows 11 Enterprise 24H2 build 26100.2033 or later with the latest baseline update. Arm64 devices remain in public preview and require additional registry or CSP configuration to disable CHPE.

Adopting Hotpatching

Admins must:
- Verify licensing entitlements for the tenant.
- Confirm device baselines and enable VBS, documenting potential performance or compatibility impacts for specialized apps.
- For Arm64: set HotPatchRestrictions or use the DisableCHPE CSP, followed by a restart.
- In Intune, create a Windows quality update policy (Devices → Windows updates → Create Windows quality update policy) and toggle “Allow hotpatch updates.” Pilot with non-production devices before expanding.

Hotpatching does not eliminate the need for periodic reboots for baseline updates, firmware, or feature upgrades—plan for quarterly restarts. Licensing costs apply, so budget and ROI analyses are essential.

Staged AI Features and Productivity Enhancements

The August wave also pushes a suite of on-device AI improvements into staged rollouts. Recall offers personal snapshots for resumption, Click to Do provides contextual on-screen AI actions, and File Explorer AI actions support image edits and document summarization. Copilot UI refinements, redesigned permission dialogs, and Settings-embedded AI agents for natural-language control round out the productivity push.

These features are gated by Copilot+ hardware eligibility, on-device NPU availability, and Microsoft 365 licensing. Privacy controls are paramount: Recall requires opt-in snapshot collection secured by Windows Hello or equivalent authentication. Organizations must assess data residency, discovery implications, and compliance before enabling.

A practical testing plan includes:
- Inventorying devices for Copilot+ eligibility and local NPU presence.
- Creating a pilot ring of Copilot+ hardware and licensed users to validate end-to-end experiences.
- Testing fallback behavior on non-Copilot devices to ensure graceful UI degradation.
- Reviewing Conditional Access and data flows for cloud-dependent features, documenting data residency and consent flows.

Image Hygiene, Secure Boot, and Long-Running Operational Items

August’s cumulative updates reaffirm the combined SSU+LCU model, which simplifies patch sequencing but makes SSUs effectively permanent—rollback requires updated images. Microsoft also sounded the alarm on upcoming Secure Boot certificate expirations for CA chains issued in 2011, urging multi-quarter remediation across firmware and image pipelines to avoid pre-boot validation errors in mid-to-late 2026. IT teams should treat this as a near-term program.

Image hygiene best practices include:
- Keeping golden images current with the latest non-security servicing payloads.
- Pretesting combined SSU+LCU payloads in a lab mirroring production hardware and firmware.
- Using Microsoft Update Catalog and offline servicing to create base images with SSU applied where rollback complexity is unacceptable.

Prioritized Action Plan for IT Leaders

To capitalize on the August 2025 servicing wave while minimizing risk, IT leaders should execute three parallel workstreams now:

1. Update Image Baselines and ESP Profiles for OOBE Quality Updates
   - Rebuild golden images with June/July 2025 non-security servicing payloads or later.
   - Audit and edit ESP profiles in Intune to toggle on quality-update install during OOBE.

2. Enable and Pilot Windows Backup for Organizations
   - Deploy the Settings Catalog policy and turn on the restore page under Enrollment options.
   - Pilot with representative users, documenting expectations around settings and app list restores.

3. Evaluate Hotpatching for Servers and Eligible Clients
   - Confirm licensing and VBS enablement.
   - Create and test Intune quality update policies with hotpatch enabled on non-production devices.
   - Validate reboot cadence and application compatibility.

Additionally, convene security, privacy, and legal stakeholders to sign off on Recall and Click to Do pilots, and document controls and opt-in flows. Simulate OOBE provisioning at scale with Delivery Optimization and pre-caching strategies to manage network bandwidth.

The Bottom Line

August 2025 marks an operational inflection point for Windows servicing. OOBE quality updates shrink the attack surface from the moment a device is handed to a user. Windows Backup for Organizations cuts recovery time from reset to familiar desktop. Hotpatching slashes reboot frequency—though with clear prerequisites. Coupled with staged AI features, the release demands disciplined image management, Intune profile hygiene, and careful pilot testing. Organizations that move now on the three pillars—OOBE updates, backup GA, and hotpatching—will gain faster, more secure provisioning and a smoother recovery experience, while those that delay risk provisioning surprises and missed security baselines.