Windows Server 2025 changes

This page's changes and edits · All guidance changes

Microsoft's edit · 5 Mar 2025 22:29 UTC

Edits

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit d624bf3 · +26 ~~−19~~ lines · also on GitHub

⋯ 3 unchanged lines

44 ms.topic: article

55 author: xelu86

66 ms.author: alalve

7 −ms.date: 02/28/2025

7 +ms.date: 11/18/2024

88 ---

1010 # What's new in Windows Server 2025

⋯ 123 unchanged lines

134134 - **Improved security for confidential attributes**: DCs and AD LDS instances only allow LDAP to add, search, and modify operations that involve confidential attributes when the connection is encrypted.

135135 - **Improved security for default machine account passwords**: Active Directory now uses default computer account passwords that are randomly generated. Windows 2025 DCs block setting computer account passwords to the default password of the computer account name.

136136

137 − To control this behavior, enable the Group Policy Object (GPO) setting **Domain controller: Refuse setting default machine account password** located in

137 + To control this behavior, enable the Group Policy Object (GPO) setting **Domain controller: Refuse setting default machine account password** located in

138138 *Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options*.

139 −␣␣

139 +

140140 Utilities like Active Directory Administrative Center (ADAC), Active Directory Users and Computers (ADUC), `net computer`, and `dsmod` also honor this new behavior. Both ADAC and ADUC no longer allow creation of a pre-Windows 2000 account.

141141

142142 - **Kerberos PKINIT support for cryptographic agility**: The Kerberos Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) protocol implementation is updated to allow for cryptographic agility by supporting more algorithms and removing hardcoded algorithms.

143 −- **Kerberos changes for Algorithms used for Ticket Granting Tickets**: The Kerberos Distribution Center will no longer issue Ticket Granting Tickets using RC4 encryption, such as RC4-HMAC(NT).

144143 - **LAN Manager GPO setting**: The GPO setting **Network security: Don't store LAN Manager hash value on next password change** is no longer present and doesn't apply to new versions of Windows.

145144 - **LDAP encryption by default**: All LDAP client communication after a Simple Authentication and Security Layer (SASL) bind uses LDAP sealing by default. To learn more about SASL, see [SASL Authentication](/openspecs/windows_protocols/ms-adts/989e0748-0953-455d-9d37-d08dfbf3998b).

146145 - **LDAP support for Transport Layer Security (TLS) 1.3**: LDAP uses the latest SCHANNEL implementation and supports TLS 1.3 for LDAP over TLS connections. Using TLS 1.3 eliminates obsolete cryptographic algorithms and enhances security over older versions. TLS 1.3 aims to encrypt as much of the handshake as possible. To learn more, see [Protocols in TLS/SSL (Schannel SSP)](/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-) and [TLS Cipher Suites in Windows Server 2022](/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022).

⋯ 62 unchanged lines

209208 - **Post-authentication action support for terminating individual processes**: A new option is added to the **Post-authentication actions** (PAA) Group Policy setting, `Reset the password, sign out the managed account, and terminate any remaining processes`, which is located in **Computer Configuration** > **Administrative Templates** > **System** > **LAPS** > **Post-authentication actions**.

210209

211210 This new option is an extension of the previous option, `Reset the password and log off the managed account`. After configuration, the PAA notifies and then terminates any interactive sign-in sessions. It enumerates and terminates any remaining processes that are still running under the local account identity managed by Windows LAPS. No notification precedes this termination.

212 −␣␣

211 +

213212 The expansion of logging events during the execution of PAA provides deeper insights into the operation.

214213

215214 To learn more about Windows LAPS, see [What is Windows LAPS?](/windows-server/identity/laps/laps-overview).

⋯ 50 unchanged lines

266265 Administrators can enable auditing of the SMB server and client for support of SMB signing and encryption. If a non-Microsoft client or server lacks support for SMB encryption or signing, it can be detected. When a non-Microsoft device or software states it supports SMB 3.1.1, but fails to support SMB signing, it violates the [SMB 3.1.1 Pre-authentication integrity](/archive/blogs/openspecification/smb-3-1-1-pre-authentication-integrity-in-windows-10) protocol requirement.

267266

268267 You can configure SMB signing and encryption auditing settings by using Group Policy or PowerShell. You can change these policies in the following Group Policy paths:

269 −␣␣

268 +

270269 - *Computer Configuration\Administrative Templates\Network\Lanman Server\Audit client does not support encryption*

271270 - *Computer Configuration\Administrative Templates\Network\Lanman Server\Audit client does not support signing*

272271 - *Computer Configuration\Administrative Templates\Network\Lanman Workstation\Audit server does not support encryption*

273272 - *Computer Configuration\Administrative Templates\Network\Lanman Workstation\Audit server does not support signing*

274 −␣␣

273 +

275274 To perform these changes by using PowerShell, run these commands in an elevated prompt where `$true` enables and `$false` disables these settings:

276275

277276 ```powershell

⋯ 54 unchanged lines

332331

333332 #### Remote Mailslot

334333

335 −The Remote Mailslot protocol is disabled by default for SMB and for DC Locator protocol use with Active Directory. Remote Mailslot might be removed in a later release. To learn more, see [Features removed or no longer developed in Windows Server](../get-started/removed-deprecated-features-windows-server.md).

334 +The Remote Mailslot protocol is disabled by default for SMB and for DC Locator protocol use with Active Directory. Remote Mailslot might be removed in a later release. To learn more, see [Features we're no longer developing](../get-started/removed-deprecated-features-windows-server-2025.md#features-were-no-longer-developing).

336335

337336 #### Routing and Remote Access Services hardening

338337

⋯ 1 unchanged line

340339

341340 Existing configurations retain their behavior. For example, if you run Windows Server 2019 and accept PPTP and L2TP connections, and you upgrade to Windows Server 2025 by using an in-place upgrade, connections based on L2TP and PPTP are still accepted. This change doesn't affect Windows client operating systems. To learn more about how to reenable PPTP and L2TP, see [Configure VPN protocols](../remote/remote-access/configure-vpn-protocols.md).

342341

343 −## Hyper-V, AI, and performance

342 +### IPsec default keying protocol change

344343

345 −The following sections discuss Hyper-V, AI, and performance.

344 +The default keying modules have been changed to IKEv1 and IKEv2 for IPsec connections authenticated with machine certificates. For other authentication methods, the default AuthIP and IKEv1 remain. This applies to both Windows Server 2025 and Windows 11 24H2 clients. In the registry path `HKLM:\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters`, the `IpsecRestoreLegacyKeyMod` entry with a value of **0** utilizes the new sequence, IKEv2 and IKEv1. A value of **1** utilizes the previous sequence, AuthIP and IKEv1. To revert to the previous behavior, add the following registry key on systems using the new default keying protocol sequence. A reboot is required for changes to take effect.

346345

347 −### Accelerated Networking (preview)

346 +```powershell

347 +New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters" -Name "IpsecRestoreLegacyKeyMod" -PropertyType "DWORD" -Value 1

348 +```

348349

349 −Accelerated Networking (AccelNet) simplifies the management of single root I/O virtualization (SR-IOV) for virtual machines (VMs) hosted on Windows Server 2025 clusters. This feature uses the high-performance SR-IOV data path to reduce latency, jitter, and CPU utilization. AccelNet also includes a management layer that handles prerequisite checking, host configuration, and VM performance settings. To learn more, see [Accelerated Networking (preview)](/windows-server/networking/technologies/accelerated-networking/accelerated-networking).

350 +## Hyper-V, AI, and performance

350351

351 −### Dynamic processor compatibility

352 +The following sections discuss Hyper-V, AI, and performance.

352353

353 −The dynamic processor compatibility mode is updated to take advantage of new processor capabilities in a clustered environment. Dynamic processor compatibility uses the maximum number of processor features available across all servers in a cluster. The mode improves performance compared to the previous version of processor compatibility.

354 +### Accelerated Networking

354355

355 −You can also use dynamic processor compatibility to save its state between virtualization hosts that use different generations of processors. The processor compatibility mode now provides enhanced, dynamic capabilities on processors capable of second-level address translation. To learn more about the updated compatibility mode, see [Dynamic processor compatibility mode](../virtualization/hyper-v/manage/dynamic-processor-compatibility-mode.md).

356 +Accelerated Networking (AccelNet) simplifies the management of single root I/O virtualization (SR-IOV) for virtual machines (VMs) hosted on Windows Server 2025 clusters. This feature uses the high-performance SR-IOV data path to reduce latency, jitter, and CPU utilization. AccelNet also includes a management layer that handles prerequisite checking, host configuration, and VM performance settings. To learn more, see [Accelerated Networking at the Edge (preview)](/windows-server/networking/technologies/accelerated-networking/accelerated-networking).

356357

357358 ### Hyper-V Manager

358359

⋯ 9 unchanged lines

368369

369370 GPU-P Live Migration provides a solution to move a VM (for planned downtime or load balancing) with GPU-P to another node whether it's standalone or clustered. To learn more about GPU partitioning, see [GPU partitioning](../virtualization/hyper-v/gpu-partitioning.md).

370371

372 +### Dynamic processor compatibility

373 +

374 +The dynamic processor compatibility mode is updated to take advantage of new processor capabilities in a clustered environment. Dynamic processor compatibility uses the maximum number of processor features available across all servers in a cluster. The mode improves performance compared to the previous version of processor compatibility.

375 +

376 +You can also use dynamic processor compatibility to save its state between virtualization hosts that use different generations of processors. The processor compatibility mode now provides enhanced, dynamic capabilities on processors capable of second-level address translation. To learn more about the updated compatibility mode, see [Dynamic processor compatibility mode](../virtualization/hyper-v/manage/dynamic-processor-compatibility-mode.md).

377 +

378 +### Workgroup clusters

379 +

380 +Hyper-V workgroup clusters are a special type of Windows Server Failover Cluster where the Hyper-V cluster nodes aren't members of an Active Directory domain with the ability to live migrate VMs in a workgroup cluster.

381 +

371382 ### Network ATC

372383

373384 Network ATC streamlines the deployment and management of network configurations for Windows Server 2025 clusters. Network ATC uses an intent-based approach, where users specify their desired intents, such as management, compute, or storage for a network adapter. The deployment is automated based on the intended configuration.

⋯ 5 unchanged lines

379390 With Windows Server 2025, Hyper-V now supports up to 4 petabytes of memory and 2,048 logical processors per host. This increase allows for greater scalability and performance for virtualized workloads.

380391

381392 Windows Server 2025 also supports up to 240 TB of memory and 2,048 virtual processors for generation 2 VMs, providing increased flexibility for running large workloads. To learn more, see [Plan for Hyper-V scalability in Windows Server](../virtualization/hyper-v/plan/plan-hyper-v-scalability-in-windows-server.md).

382 −

383 −### Workgroup clusters

384 −

385 −Hyper-V workgroup clusters are a special type of Windows Server Failover Cluster where the Hyper-V cluster nodes aren't members of an Active Directory domain with the ability to live migrate VMs in a workgroup cluster.

386393

387394 ## Storage

388395

⋯ 82 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:22 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.