Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Note
This article covers OOB releases of the Windows cumulative update. Microsoft can also release other packages out of band, such as servicing stack, setup, or standalone updates. Each package has its own KB guidance.
Microsoft releases out-of-band (OOB) updates when an issue can't wait for the next scheduled monthly update. These updates address security vulnerabilities that need urgent protection or significant regressions from a recent update. Where possible, Microsoft first mitigates the issue with a workaround or Known Issue Rollback (KIR) as a deliberate interim protection.
OOB updates are part of the larger Windows servicing mechanism that exists to help maintain devices in a protected and productive state.
What you do with an OOB update depends on the type of OOB update and its specific KB guidance, as explained in this documentation.
Note
"Out-of-band" describes release timing. It doesn't, by itself, indicate new security content or the severity of the issue. The accompanying KB article includes those authoritative details.
Cumulative nature of OOB updates
OOB updates are cumulative. They include improvements and fixes from previous applicable Windows updates, so you generally don't need to install an earlier Windows cumulative update first.
Fixes included in an OOB update are also part of subsequent cumulative updates. That way, if your organization doesn't install an optional OOB update, your devices still get these fixes through a later cumulative update. Any issues that aren't fixed are tracked and addressed in later updates.
Important
Cumulative doesn't mean prerequisite-free. Before applying an OOB update, review its KB article for servicing stack, checkpoint, enablement, hotpatch, or other prerequisites, along with applicability and restart requirements. Hotpatch-enabled devices often have different OOB requirements.
Types of OOB updates
OOB updates can be security or non-security updates, available through different channels. Classification, availability, and deployment behavior can differ by Windows version for the same incident. Check the corresponding KB article as the authoritative source of information and guidance.
Security OOB updates
Security OOB updates aim to protect your organization. They can include new or updated security protections, including fixes associated with common vulnerabilities and exposures (CVEs), along with any non-security fixes. These updates often require a restart. Evaluate and approve them according to your organization's security update policies.
Non-security OOB updates
Non-security OOB updates aim to keep your organization productive. They are optional and generally address quality issues from a previous update. These updates can include previously released security fixes without introducing new fixes for common vulnerabilities and exposures (CVEs). They're intended for devices affected by the issues addressed by the update.
OOB updates for hotpatch-enambled devices
Hotpatch OOB updates primarily address security issues. In individual cases, Microsoft can also release a hotpatch OOB update for a critical non-security issue that requires an immediate response.
When you deploy an OOB update to hotpatch-enabled devices, the applicable KB article provides information on supported Windows versions, the required baseline and other prerequisites, deployment instructions, and restart requirements. If the KB doesn't list a hotpatch package for your Windows version, the update likely deploys like a standard OOB update and requires a restart, as detailed in its applicability and installation guidance.
There are two ways to check whether your device is configured for hotpatch updates:
Windows 11:
- In Settings, go to Windows Update > Advanced options > Configured update policies.
- Check for Enable hotpatching when available.
- Verify that the device is targeted by a Windows quality update policy, and that the configuration When available, apply without restarting the device ("Hotpatch") is set to Allow in Microsoft Intune.
Windows Server on Azure, applicable to Azure VMs (Azure Arc and Azure Local have separate management guidance):
- In the Azure portal, open the virtual machine, then select Operations > Updates.
- Check the hotpatch status and update history.
Note
An OOB update might not address every issue associated with the previous monthly update. Match the device's symptom and Windows version to the KB's resolved issues and review remaining known issues before deployment. See known and resolved issues for your version of Windows on Windows release health.
What to do when Microsoft releases an OOB update
Check the KB article. It says whether the update is security or non-security for each Windows version, how to get it, its prerequisites, and its restart behavior. Sometimes one release can include both security and non-security content. If the device is enrolled in hotpatch updates, follow the hotpatch KB.
Act according to the type of the OOB update:
For security OOB: Deploy it promptly, with at least the priority you give a monthly security update. Windows Update offers it automatically, and it synchronizes to WSUS.
If you use Windows Autopatch or Microsoft Intune, consider an expedite policy. It accelerates installation of eligible OOB updates through urgent, targeted deployments. Expedited deployment bypasses normal deferral settings and deployment timing, so use it for time-bound scenarios in which the standard rollout is too slow. Confirm device prerequisites, update eligibility, targeting, restart behavior, and reporting before deployment. See also Programmatic controls for expedited Windows quality updates.
Note
Expedited updates are only available for a limited set of the latest released updates.
For non-security OOB: Install it on devices that have an issue that the OOB update fixes. If your devices aren't affected, you don't need to do anything. The fixes are also in the next monthly security update.
Don't uninstall the OOB. When the next monthly update arrives, install it as usual. It includes the OOB fixes and overrides the installed OOB update. You don't need to uninstall earlier updates.
If you applied a Known Issue Rollback (KIR) or a workaround, follow the KB's guidance on removing it after you install the fix. Learn more about KIR.
Checks before you deploy an OOB update
Important
Before importing or deploying an OOB update, review supersedence rules, WSUS cleanup and package-retention settings, active deployments, deadlines, maintenance windows, and device collections. Confirm that cleanup or expiration settings won't remove content that an active deployment still needs.
Before deploying an OOB update:
- Confirm that the device's symptom and Windows version match the issues resolved by the OOB update KB.
- Review remaining known issues, approved workarounds, availability of Known Issue Rollback, and installation guidance.
- Verify applicability, prerequisites, architecture, disk space needs, and restart requirements.
- Review deployment channels, synchronization and approval state, supersedence, cleanup, retention, active deployments, and reporting expectations.
Deployment availability
Review the corresponding KB article for each OOB update before deployment for supported deployment channels. It also confirms whether action is automatic or requires administrator approval.
| Channel | Security OOB updates | Non-security OOB updates |
|---|---|---|
| Windows Update | Offered automatically. Note: Hotpatch OOB updates use only this channel. |
Client: Typically optional. Installs when the user selects it or specifically turns on Get the latest updates as soon as they're available. Server: Typically not offered; use the Catalog. Note: Hotpatch non-security OOB updates are rare, decided case by case. |
| Windows Update client policies, Microsoft Intune, Windows Autopatch |
Offered like a monthly security update. Deferral settings apply. Expedite updates where eligible. |
Optional where the KB lists it. The admin opts in through an optional-updates policy or expedites it. |
| Windows Server Update Services (WSUS), Microsoft Configuration Manager |
Synchronizes automatically. You still approve and deploy the update. |
Doesn't synchronize. Import the update from the Catalog. |
| Microsoft Update Catalog | Available when listed in the KB. Action required to obtain, stage, approve, and deploy the package. |
Common path for Catalog-only releases. Action required to obtain, stage, approve, and deploy the package. |
Catalog-only deployment for managed environments
If the KB lists the Microsoft Update Catalog but the update doesn't synchronize to WSUS or Configuration Manager, treat it as a Catalog-only deployment.
- Download the package identified by the KB.
- Validate applicability and architecture.
- Stage it in your software-distribution process.
- Test it and approve it for the intended device collection.
- Monitor deployment results.
If an update doesn't appear in WSUS or Configuration Manager, it might be because:
- Its classification or publication metadata isn't included in the configured synchronization scope.
- The release is Catalog-only.
The release note KB articles include the classification for WSUS under the section "Install this update". Review your product, classification, language, synchronization, and approval settings. For Microsoft Configuration Manager, follow the supported software update synchronization and Catalog import guidance and the manual software update deployment process.
Verify installation and compliance reporting separately
Confirm installed protection on the device by verifying the installed KB and OS build against the applicable KB. Then review compliance, detection, and reporting status in each management or scanning tool separately.
Important
In two cases, build information isn't sufficient. Hotpatch OOB devices might have a lower build yet be successfully patched. Check against the corresponding hotpatch KB article. For standalone security update packages, check the installed update, not the build.
A device can have the OOB installed while a management or vulnerability tool still reports an earlier monthly update as required. Detection metadata and supersedence evaluation might not be updated immediately or consistently across tools. Before treating the result as an installation failure, investigate:
- The tool's synchronization status
- Detection rules
- Supersedence metadata
- Scan time
- Client reporting state
Frequently asked questions
Do I need to install an OOB update?
It depends on the type of the OOB update and whether your devices experience issues.
Security OOB update: Evaluate it under your organization's security-update policies and the release-specific KB guidance.
Optional non-security OOB update: Deploy it to devices affected by an issue that the update resolves. If your devices aren't affected, you can generally wait for a subsequent applicable cumulative update, subject to the release-specific guidance.
Before deciding, match the device's Windows version and symptoms to the KB's resolved issues, remaining known issues, applicability, prerequisites, and restart requirements. Approved workarounds or Known Issue Rollback might provide mitigation while a permanent fix is prepared. In all cases, follow the release-specific guidance.
Why isn't it in WSUS?
The update might be Catalog-only, outside your configured products or classifications, not yet synchronized, or published differently for your Windows version. Check the KB, synchronization scope and status, and approval state. If the KB specifies Catalog deployment, use the supported import or software-distribution process.
Must I install the earlier monthly update first?
No. You don’t need to uninstall OOB updates or any earlier Windows updates before installing the next monthly update. All cumulative updates are designed to efficiently supersede the previous updates.
Does it require a restart?
It might. Restart behavior depends on the update, installation path, device state, and whether the device is hotpatch-enabled. Check the KB article and plan maintenance windows accordingly.
Why not recall and re-release an update with a fix instead of an OOB?
There is a meaningful risk in recalling a Windows cumulative update, fixing it, and then re-releasing it, even when the original update contains a serious regression. In many cases, targeted mitigation plus an OOB update is operationally safer than withdrawing the entire update. Risks include:
Security exposure. A Windows cumulative update contains many fixes, including security fixes. Recalling it can prevent devices that haven't installed it from receiving those protections. Microsoft specifically identifies uninstalling or skipping an entire update as problematic because it leaves organizations without the latest security updates. Learn more in Known Issue Rollback.
You create two populations of devices. By the time you identify a regression, some machines already installed the cumulative update while others didn't. A recall doesn't remove the cumulative update from machines that already have it. Operationally, you now have machines with the problematic update, machines held on the previous update, and eventually machines receiving the corrected update. That fragmentation increases support, validation, and troubleshooting complexity for customers.
Re-release validation carries its own regression risk. Fixing the known defect isn't sufficient. The replacement needs to preserve all the other fixes and security protections in the original cumulative update and avoid introducing another regression. In other words, you're effectively creating another servicing event, not simply changing one binary.