Windows Server 2025: What’s New — A 2026 Overview

This overview walks through the areas Microsoft itself highlights, in plain English, with honest notes on the caveats and requirements. It is written for administrators sizing up an upgrade in 2026, not a reference manual — always confirm specifics against Microsoft Learn before you deploy.

Hotpatching: security updates without the reboot

Hotpatching is the feature everyone talks about first, and for good reason. It patches the in-memory code of running processes, so a server can take a security update without restarting. Fewer reboots means smaller maintenance windows and less exposure between a fix shipping and it being applied.

How the cadence works: hotpatch establishes a baseline from the current cumulative update, then that baseline refreshes on a roughly quarterly rhythm. In a typical year you get about four baseline months that do require a reboot and eight hotpatch months that do not. An unplanned baseline (for example a zero-day that cannot ship as a hotpatch) also forces a reboot for that month.

Security hardening: the quiet centrepiece

If hotpatching is the headline, security hardening is the substance. Windows Server 2025 turns on, or tightens, a long list of defaults so that a fresh install is safer out of the box — Microsoft's What's new in Windows Server 2025 states, for example, that Credential Guard is now enabled by default on devices that meet the requirements:

• Credential Guard on by default on hardware that meets the requirements, protecting derived domain credentials from theft.
• SMB signing required by default for all outbound connections (previously only for SYSVOL and NETLOGON), plus SMB over QUIC — encrypted, TCP-free file access over untrusted networks — now available in Standard and Datacenter, not just Azure Edition.
• SMB NTLM blocking, an authentication rate limiter to slow brute-force attacks, dialect control, and restrictive firewall rules that no longer open legacy NetBIOS ports.
• Virtualization-based security (VBS) enclaves and VBS key protection, isolating secrets and cryptographic keys from even administrator-level attackers.
• A built-in security baseline (via OSConfig) with hundreds of preconfigured settings you can enforce from first boot.

These are meaningful improvements, but a few — required SMB signing and encryption in particular — can surface older or non-compliant clients that quietly relied on weaker settings. Plan a compatibility pass before you flip a fleet.

Active Directory: a genuinely next-generation directory

Active Directory Domain Services received its most significant architectural change in years. The database engine can now use a 32k page size (up from the 8k design in place since Windows 2000), lifting long-standing limits — for example, multivalued attributes can hold far more values. There is a new functional level (DomainLevel 10 / ForestLevel 10), and moving to the 32k format is a forest-wide decision that requires every domain controller to be 32k-capable.

Other AD improvements worth knowing:

• Delegated Managed Service Accounts (dMSA) to ease migration off standing service accounts, with fully randomised, managed keys.
• LDAP encryption and signing required by default, and LDAP over TLS 1.3.
• Kerberos hardening: the KDC no longer issues RC4-encrypted ticket-granting tickets, and PKINIT gains cryptographic agility.
• NUMA support so AD can finally use CPUs beyond the first 64 cores.

Storage: faster where it counts

Storage work in Windows Server 2025 targets real bottlenecks rather than headline numbers:

• NVMe performance is optimised for higher IOPS at lower CPU cost.
• Storage Replica compression reduces data sent over the wire during replication, and an Enhanced Log improves block replication performance.
• Thin provisioned volumes with Storage Spaces Direct, including converting fixed volumes to thin to reclaim unused capacity back to the pool.
• ReFS native deduplication and compression, and block cloning on Dev Drive for near-instant file copies.
• SMB compression with LZ4, added to the existing set of algorithms.

If you already run Storage Spaces on a workstation or small server, our companion Storage Spaces guide explains the pooling concepts these server features build on.

Networking: intent-based and lower-latency

On the networking side, Network ATC brings an intent-based model to cluster host networking — you declare what an adapter is for (management, compute, storage) and the configuration is deployed and kept consistent, which cuts configuration drift. Accelerated Networking (in preview) simplifies SR-IOV for VMs to shave latency and CPU. Software-Defined Networking gains a Network Controller that runs as a Failover Cluster role (no dedicated VMs), tag-based segmentation, default deny-inbound network policies, and SDN Multisite for stretched layer-2/3 connectivity. A Wake-on-LAN setup on the client side is a small, related convenience for managing machines remotely.

Hyper-V and GPU partitioning

Virtualization is where Windows Server 2025 stretches furthest. GPU partitioning (GPU-P) lets you carve a single physical GPU into dedicated fractions across multiple VMs — and, crucially, it now supports high availability (a GPU-P VM restarts on another node after an unplanned outage) and live migration for planned maintenance and load balancing. That combination makes GPU-P viable for production AI and graphics workloads, not just labs.

Alongside it: Hypervisor-enforced paging translation (HVPT) for stronger memory-integrity protection, updated dynamic processor compatibility across mixed CPU generations, Generation 2 as the default for new VMs, and big scalability jumps — up to 4 PB of memory and 2,048 logical processors per host, with generation 2 VMs supporting up to 240 TB of memory and 2,048 virtual processors, all figures published by Microsoft in the Windows Server 2025 release notes. Workgroup clusters even allow live migration between hosts that are not domain-joined.

Editions and who should consider upgrading

The two general editions are Standard and Datacenter, licensed per physical core. Standard fits physical or lightly virtualized workloads; Datacenter unlocks datacenter-scale capabilities — unlimited virtualization rights, Storage Spaces Direct, Software-Defined Networking, and shielded VMs — and is the edition most of the software-defined features above assume. A Datacenter: Azure Edition is tuned for Azure and Azure Local, and is where features like free hotpatching first appeared. Very small deployments may still be served by Essentials-class options; confirm current availability with your licensing partner.

Consider upgrading if you: want to cut reboot-driven downtime with hotpatching; run Active Directory at scale and would benefit from the 32k page size and Kerberos hardening; need denser or GPU-accelerated virtualization; or want the tighter security defaults without hand-configuring them. If your workloads are stable, fully on-premises, and you have no appetite for Azure Arc, weigh the benefits against the licensing and the migration effort — a clean, planned move beats a rushed one.

The servicing picture: LTSC and the Annual Channel

Windows Server 2025 is a Long-Term Servicing Channel (LTSC) release under Microsoft's Fixed Lifecycle Policy — the Microsoft Lifecycle entry for Windows Server 2025 gives a mainstream end date of 14 November 2029 and an extended end date of 15 November 2034, roughly a decade in all. Separately, an Annual Channel exists mainly for containers and cloud-native workloads, on a faster cadence. Most on-premises servers should stay on LTSC; the Annual Channel is a container and Azure Edition story. Check the Microsoft Lifecycle pages for the latest support details.

A note on “a server at home”

If you arrived here looking for a home server, the enterprise Windows Server line probably is not what you want. Microsoft’s consumer answer to “a server at home” was Windows Home Server — a mid-2000s product for household backups, media streaming, and remote access. It was discontinued long ago, but its ideas live on in NAS boxes and cloud backup. We keep that history in our Home Server hub, and the community discussion of it survives in the windows-now.com archive.