Windows Server removed features

This page's changes and edits · All guidance changes

Microsoft's edit · 3 Jul 2025 17:05 UTC

update

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 1a891da · +20 ~~−20~~ lines · also on GitHub

⋯ 60 unchanged lines

6161 |--|--|

6262 | Host Guardian Service Active Directory attestation mode | We're no longer developing Host Guardian Service Active Directory attestation mode. Instead, a new attestation mode is added, [host key attestation](../security/guarded-fabric-shielded-vm/guarded-fabric-create-host-key.md). Host key attestation is simpler and as compatible as Active Directory-based attestation. This new mode provides equivalent functionality with a setup experience, simpler management, and fewer infrastructure dependencies than the Active Directory attestation. Host key attestation has no extra hardware requirements beyond what Active Directory attestation required, so all existing systems remain compatible with the new mode. To learn more about your attestation options, see [Deploy guarded hosts](../security/guarded-fabric-shielded-vm/guarded-fabric-configure-hgs-with-authorized-hyper-v-hosts.md). |

6363 | IIS Digest Authentication | This authentication method will be replaced. You should start using other authentication methods, like Client Certificate Mapping. To learn more, see [Configuring One-to-One Client Certificate Mappings](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) and [Application Settings](/iis-administration/configuration/appsettings.json). |

64 −| IIS 6 Management compatibility | Specific features being considered for replacement are: <li>IIS 6 Metabase Compatibility (Web-Metabase)</li><li>IIS 6 Management Console (Web-Lgcy-Mgmt-Console)</li><li>IIS 6 Scripting Tools (Web-Lgcy-Scripting)</li><li>IIS 6 WMI Compatibility (Web-WMI)</li> IIS 6 Metabase Compatibility acts as an emulation layer between IIS 6-based metabase scripts and the file-based configuration used by IIS 7 or newer versions. You should start migrating management scripts to target IIS file-based configuration directly, by using tools such as the `Microsoft.Web.Administration` namespace. You should also start migration from IIS 6.0 or earlier versions, and move to the latest version of IIS, which is always available in the most recent release of Windows Server. |

64 +| IIS 6 Management compatibility | Specific features being considered for replacement are: <li>IIS 6 Metabase Compatibility (Web-Metabase)</li><li>IIS 6 Management Console (Web-Lgcy-Mgmt-Console)</li><li>IIS 6 Scripting Tools (Web-Lgcy-Scripting)</li><li>IIS 6 WMI Compatibility (Web-WMI)</li> IIS 6 Metabase Compatibility acts as an emulation layer between IIS 6-based metabase scripts and the file-based configuration used by IIS 7 or newer versions. You should start migrating management scripts to target IIS file-based configuration directly by using tools such as the `Microsoft.Web.Administration` namespace. You should also start migrating from IIS 6.0 or earlier versions to the latest version of IIS, which is always available in the most recent release of Windows Server. |

6565 | Internet Storage Name Service (iSNS) | The Server Message Block (SMB) feature offers essentially the same functionality with more features. See [Server Message Block Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831795(v=ws.11)) for background information on this feature. |

66 −| IPv4/6 Transition Technologies | 6to4 is disabled by default since Windows 10, version 1607 (the Anniversary Update). ISATAP is disabled by default since Windows 10, version 1703 (the Creators Update). Direct Tunnels is disabled by default. Use native IPv6 support instead. |

67 −| Key Storage Drive in Hyper-V | We're no longer working on the Key Storage Drive feature in Hyper-V. If you're using generation 1 VM, check out [Generation 1 VM Virtualization Security](../virtualization/hyper-v/learn-more/generation-1-virtual-machine-security-settings-for-hyper-v.md) for information about options going forward. If you're creating new VMs, use Generation 2 VM with TPM devices for a more secure solution. |

68 −| New EKUs for VBS enclaves | VBS enclaves are supported on Windows Server 2025 and later. *Existing* enclaves with the EKU 1.3.6.1.4.1.311.76.57.1.15 signature are still supported on Windows Server 2019 as long as they remain unchanged and don't require re-signing. |

69 −| OneSync service | The OneSync service synchronizes data for the **Mail**, **Calendar**, and **People** apps. A sync engine to the Outlook app that provides the same synchronization was added. |

70 −| Remote Differential Compression API support | Remote Differential Compression API support enabled synchronizing data with a remote source using compression technologies, which minimized the amount of data sent across the network. |

71 −| RSA/AES Encryption for IIS | This encryption method is being considered for replacement because the superior Cryptography API: Next Generation (CNG) method is already available. To learn more, see [About CNG](/windows/win32/seccng/about-cng). |

66 +| IPv4/6 transition technologies | 6to4 is disabled by default since Windows 10 version 1607 (the Anniversary Update). ISATAP is disabled by default since Windows 10 version 1703 (the Creators Update). Direct Tunnels is disabled by default. Use native IPv6 support instead. |

67 +| Key Storage Drive in Hyper-V | We're no longer working on the Key Storage Drive feature in Hyper-V. If you use generation 1 VMs, check out [Generation 1 VM Virtualization Security](../virtualization/hyper-v/learn-more/generation-1-virtual-machine-security-settings-for-hyper-v.md) for information about options. If you're creating new VMs, use generation 2 VMs with TPM devices for a more secure solution. |

68 +| New EKUs for VBS enclaves | VBS enclaves are supported on Windows Server 2025 and later. Existing enclaves with the EKU 1.3.6.1.4.1.311.76.57.1.15 signature are still supported on Windows Server 2019 as long as they remain unchanged and don't require re-signing. |

69 +| OneSync service | The OneSync service synchronizes data for the Mail, Calendar, and People apps. A sync engine to the Outlook app that provides the same synchronization was added. |

70 +| Remote Differential Compression API support | Remote Differential Compression API support enabled synchronizing data with a remote source by using compression technologies, which minimized the amount of data sent across the network. |

71 +| RSA/AES Encryption for IIS | We're considering replacing this encryption method because the superior Cryptography API: Next Generation (CNG) method is already available. To learn more, see [About CNG](/windows/win32/seccng/about-cng). |

7272 | Storage Spaces in a Shared configuration using a SAS fabric | Deploy [Storage Spaces Direct](/azure/azure-local/concepts/storage-spaces-direct-overview?context=/windows-server/context/windows-server-storage) instead. Storage Spaces Direct supports the use of HLK-certified SAS enclosures, but in a non-shared configuration, as described in the [Storage Spaces Direct hardware requirements](../storage/storage-spaces/storage-spaces-direct-hardware-requirements.md). |

73 −| Trusted Platform Module (TPM) management console | The information previously available in the TPM management console is now available on the [Device security](/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security) page in the [Windows Defender Security Center](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center). |

74 −| WFP lightweight filter switch extension | The WFP lightweight filter switch extension enables developers to build [simple network packet filtering extensions for the Hyper-V virtual switch](/windows-hardware/drivers/network/using-virtual-switch-filtering). You can achieve the same functionality by creating a full filtering extension. As such, we'll be removing this extension in the future. |

75 −| Windows PowerShell 2.0 | Migrate to Windows PowerShell 5.0 or later for the best features and performance. For more information, see the [PowerShell Documentation](/powershell/index?view=powershell-5.1&preserve-view=true). |

76 −| Windows Server Essentials Experience | We're no longer developing the Essentials Experience role for the Windows Server Standard or Windows Server Datacenter SKUs. If you need an easy-to-use server solution for small-to-medium businesses, check out our new [Microsoft 365 for business](https://www.microsoft.com/microsoft-365/business) solution, or use [Windows Server 2016 Essentials](/windows-server-essentials/get-started/get-started). |

73 +| Trusted Platform Module (TPM) management console | The information previously available in the TPM management console is now available on the [Device security](/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security) page in [Windows Security settings](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center). |

74 +| WFP lightweight filter switch extension | The WFP lightweight filter switch extension enables developers to build [simple network packet filtering extensions for the Hyper-V Virtual Switch](/windows-hardware/drivers/network/using-virtual-switch-filtering). You can achieve the same functionality by creating a full filtering extension. Therefore, we're removing this extension in the future. |

75 +| Windows PowerShell 2.0 | Migrate to Windows PowerShell 5.0 or later for the best features and performance. For more information, see [PowerShell Documentation](/powershell/index?view=powershell-5.1&preserve-view=true). |

76 +| Windows Server Essentials Experience | We're no longer developing the Essentials Experience role for the Windows Server Standard or Windows Server Datacenter SKUs. If you need an easy-to-use server solution for small-to-medium businesses, check out [Microsoft 365 for business](https://www.microsoft.com/microsoft-365/business), or use [Windows Server 2016 Essentials](/windows-server-essentials/get-started/get-started). |

7777 | [MultiPoint Services](../remote/multipoint-services/multipoint-services.md) | We're no longer developing the MultiPoint Services role as part of Windows Server. MultiPoint Connector services are available through [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) for both Windows Server and Windows 10. You can use [Remote Desktop Services](../remote/remote-desktop-services/remote-desktop-services-overview.md), in particular the Remote Desktop Services Session Host, to provide RDP connectivity. |

78 −| [Offline symbol packages](/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs) | We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](/archive/blogs/windbg/update-on-microsofts-symbol-server). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access. |

79 −| [Software Restriction Policies](../identity/software-restriction-policies/software-restriction-policies.md) in Group Policy | Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control). You can use AppLocker and Windows Defender Application Control to manage which apps users can access and what code can run in the kernel. |

78 +| [Offline symbol packages](/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs) | We're no longer making the symbol packages available as a downloadable MSI. Instead, [Microsoft symbol server is becoming an Azure-based symbol store](/archive/blogs/windbg/update-on-microsofts-symbol-server). If you need the Windows symbols, connect to the Microsoft symbol server to cache your symbols locally, or use a manifest file with SymChk.exe on a computer with internet access. |

79 +| [Software Restriction Policies](../identity/software-restriction-policies/software-restriction-policies.md) in Group Policy | Instead of using Software Restriction Policies through Group Policy, you can use [AppLocker](/windows/security/threat-protection/applocker/applocker-overview) or [Application Control for Windows](/windows/security/threat-protection/windows-defender-application-control). You can use AppLocker and Windows Defender Application Control to manage which apps users can access and what code can run in the kernel. |

8080

8181 # [Windows Server 2016](#tab/ws16)

8282

⋯ 3 unchanged lines

8686 | NetCfg custom APIs | Installation of PrintProvider, NetClient, and ISDN using NetCfg custom APIs is deprecated. |

8787 | Remote management | `WinRM.vbs` is deprecated. Instead, use functionality in the WinRM provider of PowerShell. |

8888 | Sconfig.exe | Use [Sconfig.cmd](./sconfig-on-ws2016.md) instead. |

89 −| SMB 2+ over NetBT | SMB 2+ over NetBT is deprecated. Instead, implement SMB over TCP or RDMA. |

89 +| SMB 2 and later over NetBT | SMB 2 and later over NetBT is deprecated. Instead, implement SMB over TCP or RDMA. |

9090

9191 ---

9292

9393 ## Features removed

9494

95 −We're removing the following features and functionalities from the installed product image in Windows Server. Applications or code that depend on these features won't function in future releases unless you use an alternate method. Removal occurs when a feature or functionality is no longer available for use and are eliminated from a product or service. The removal of features and functionalities can take place in any release of Windows Server. Some features are deprecated yet still ship in current versions of Windows Server. Components aren't removed from generally available supported versions that are within their product lifecycle.

95 +We're removing the following features and functionalities from the installed product image in Windows Server. Applications or code that depend on these features won't function in future releases unless you use an alternative method. Removal occurs when a feature or functionality is no longer available for use and is eliminated from a product or service. The removal of features and functionalities can take place in any release of Windows Server. Some features are deprecated but still ship in current versions of Windows Server. Components aren't removed from generally available supported versions that are within their product lifecycle.

9696

9797 # [Windows Server 2025](#tab/ws25)

9898

9999 | Feature | Explanation |

100100 |--|--|

101 −| Data Encryption Standard (DES) | DES, the symmetric-key block encryption cipher, is considered insecure against modern cryptographic attacks, and replaced by more robust encryption algorithms. DES was disabled starting with Windows Server 2008 R2 and is removed from Windows Server 2025 and later releases. |

102 −| Internet Information Services (IIS) 6 Management Console (Web-Lgcy-Mgmt-Console) | The console is removed after being no longer developed in Windows Server 2019. You should also start migration from IIS 6.0 or earlier versions, and move to the latest version of IIS, which is always available in the most recent release of Windows Server. |

103 −| NTLMv1 | Replace calls to NTLM by calls to [Negotiate](/windows/win32/secauthn/microsoft-negotiate), which tries to authenticate with Kerberos and only falls back to NTLM when necessary. For more information, see [The evolution of Windows authentication](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-evolution-of-windows-authentication/ba-p/3926848). |

104 −| SMTP Server | As SMTP Server features were removed from Windows Server 2025, there's no replacement within the operating system. Consider using Exchange Server or a non-Microsoft SMTP server as an alternative. To learn more about enabling SMTP connection in Exchange Server, see [Receive connectors in Exchange Server](/exchange/mail-flow/connectors/receive-connectors). |

105 −| Wordpad | We recommend Microsoft Word for rich text documents like `.doc` and `.rtf` and Windows Notepad for plain text documents like `.txt`. |

101 +| Data Encryption Standard (DES) | DES, the symmetric-key block encryption cipher, is not considered secure against modern cryptographic attacks. It's replaced by more robust encryption algorithms. DES was disabled starting with Windows Server 2008 R2 and is removed from Windows Server 2025 and later releases. |

102 +| IIS 6 Management Console (Web-Lgcy-Mgmt-Console) | The console is removed after being no longer developed in Windows Server 2019. You should also start migrating from IIS 6.0 or earlier versions to the latest version of IIS, which is always available in the most recent release of Windows Server. |

103 +| NTLMv1 | Replace calls to NTLM with calls to [Negotiate](/windows/win32/secauthn/microsoft-negotiate), which tries to authenticate with Kerberos and only falls back to NTLM when necessary. For more information, see [The evolution of Windows authentication](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-evolution-of-windows-authentication/ba-p/3926848). |

104 +| SMTP Server | Because SMTP Server features were removed from Windows Server 2025, there's no replacement within the operating system. Consider using Exchange Server or a non-Microsoft SMTP server as an alternative. To learn more about enabling SMTP connection in Exchange Server, see [Receive connectors in Exchange Server](/exchange/mail-flow/connectors/receive-connectors). |

105 +| Wordpad | We recommend Microsoft Word for rich text documents like `.doc` and `.rtf`, and Windows Notepad for plain text documents like `.txt`. |

106106

107107 # [Windows Server 2022](#tab/ws22)

108108

⋯ 32 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.