Windows Server 2025 went generally available on November 1, 2024, and it’s the current Long-Term Servicing Channel release. If you’ve been running 2019 or 2022, the headline changes aren’t cosmetic. There’s a patching model that finally lets you skip most monthly reboots, an Active Directory database that can grow past its old ceiling, file sharing that no longer needs a VPN, and Hyper-V limits big enough to host workloads you’d previously have left on bare metal.
This is a practical tour of what actually matters day to day, not a press-release rundown. Some of these features are on by default, some are opt-in, and a couple come with their own licensing rules. Those distinctions matter, so they’re called out where they apply.
Read it as a planning aid: what’s new, whether it’s GA, and what you’d need to do to use it.
Hotpatching: fewer reboots, with conditions
Hotpatching applies security updates to a running Windows Server without restarting it, by patching the in-memory code of running processes. The benefit is obvious to anyone who’s wrestled a patch window for a clustered file server or a busy RDS host: fewer reboots means less disruption and shorter maintenance windows.
The model isn’t reboot-free, though, and it’s worth getting the rhythm right:
- Baseline months — January, April, July, and October — ship a normal cumulative update that requires a reboot.
- The eight months in between deliver hotpatch security updates that apply without a reboot.
- Non-security fixes and some changes still need a restart when they arrive.
So you go from roughly twelve reboots a year for security to about four, on a predictable quarterly cadence.
To use it, the server is enrolled through Azure Arc and the hotpatch capability is turned on for that machine. Microsoft’s hotpatch documentation walks through the Arc onboarding and the channel settings, including how to confirm a server is actually receiving hotpatches versus standard updates.
Active Directory: a bigger database and stronger defaults
Active Directory in Windows Server 2025 gets its most substantial update in years, and most of it is opt-in behind a new functional level.
The optional 32K database page size
AD has used an 8-KB database page since the NTDS engine’s early days. That page size capped how large individual objects and the directory could grow. Windows Server 2025 introduces an optional 32-KB page database format, which raises those limits considerably.
It’s not automatic. The 32K format depends on the updated schema and the new domain and forest functional level, and you move to it deliberately. Existing domains keep their 8-KB database until you choose to migrate, so nothing changes underneath you on upgrade.
Other AD changes worth knowing
- Delegated Managed Service Accounts (dMSA) — a new account type aimed at replacing a regular service account while blocking the credential-theft paths that plague traditional service accounts.
- Stronger Kerberos and crypto — improvements to Kerberos (including PKINIT support changes) and a move toward stronger cipher defaults.
- Replication and performance — priority replication and other plumbing improvements for large or distributed directories.
If you’re planning a domain controller refresh, pair this with our notes on the best DNS settings for domain controllers, since DNS health is still the foundation everything else in AD sits on.
SMB and file server: secure by default
The file server stack got both a reach upgrade and a security upgrade.
The big reach change: SMB over QUIC is now in Standard and Datacenter editions, not just an Azure edition. SMB over QUIC tunnels file sharing inside TLS 1.3 over UDP 443, so a remote client can open a share across the internet without a VPN and without exposing port 445. Bringing it to the mainstream editions makes it a realistic option for ordinary deployments. We cover the setup and trade-offs in detail in SMB over QUIC in Windows Server 2025.
On the security side, Windows Server 2025 tightens defaults:
SMB security defaults in Windows Server 2025
| SMB signing | Required by default for SMB connections, reducing tampering and relay risk |
|---|---|
| SMB over QUIC | Available in Standard and Datacenter, with client access control |
| NTLM blocking | SMB can be told to refuse NTLM, pushing authentication to Kerberos |
| Alternative SMB ports | QUIC and TCP can be configured on ports other than the defaults |
Hyper-V: room for much larger VMs
Hyper-V in Windows Server 2025 raises the ceilings to numbers that cover almost any single workload you’d want to virtualize.
Hyper-V scale in Windows Server 2025
| Virtual processors per VM | Up to 2,048 |
|---|---|
| Memory per VM (Gen 2) | Up to 240 TB |
| Host logical processors | Up to 2,048 |
| Host memory | Up to 4 PB |
Beyond raw capacity, the release improves GPU partitioning (GPU-P) — including live migration of VMs that use a partitioned GPU and adding GPU-P to failover clustering scenarios — which matters for AI/ML and graphics workloads that previously needed a whole GPU pinned to one VM. Workgroup clusters and other clustering improvements round out the virtualization story.
If you’re building hosts now, the basics still apply: see creating an external virtual switch in Hyper-V for getting VM networking right from the start.
The rest of the highlights
A few more changes you’ll bump into:
Other Windows Server 2025 changes
- ReFS gains block cloning and native dedup/compression improvements
- Storage and NVMe performance work for higher IOPS on modern hardware
- An updated, modernized servicing and feature-update experience
- Windows Admin Center improvements for managing 2025 features
- Security baselines and credential protections aligned to the new release
There’s also a smoother in-place upgrade path and the option to move forward via feature updates, which makes the jump from 2022 less of a forklift than previous generations.
What to actually do with this
You don’t need every feature on day one. A sane order for most teams:
- Plan domain controller upgrades carefully. New AD capabilities (32K pages, dMSA) need all DCs on 2025 and the new functional level. Build that into a project, not a quick afternoon.
- Decide on hotpatching deliberately. It’s genuinely useful for high-uptime servers, but it’s an Azure Arc subscription for Standard/Datacenter. Cost it out before promising fewer maintenance windows.
- Test SMB defaults before rollout. Signing-by-default is good security, but confirm legacy clients can cope.
- Right-size Hyper-V plans. The new limits open up consolidation, but capacity planning and licensing still apply.
Windows Server 2025 is a meaningful release for the things admins spend real time on: patching, identity, file services, and virtualization. The features are GA, but several are opt-in or carry their own licensing, so the win comes from picking the ones that solve a problem you actually have and rolling them out on a tested plan. Pair an upgrade with a security pass using the Windows Server hardening checklist so the new build starts in good shape.
