What's new in Windows Server 2025

Summary

Windows Server 25 introduces several groundbreaking features, including secure SMB over QUIC for remote file sharing, security improvements like default SMB signing, and in-place OS upgrades via Windows Update. It also brings enhancements like Wi-Fi and Bluetooth support, a modern package manager (WiGet) for easy app installation, and Azure Arc integration for simplified hybrid cloud management. Additionally, it offers a flexible subscription-based purchasing model while maintaining traditional licensing options. The update focuses on security, ease of use, and cloud integration, aiming to streamline IT management in modern infrastructures.

Takeaways

• 😀 **SMB Over Quick (QUIC)**: Windows Server 25 introduces SMB support over QUIC, offering secure, fast file sharing over the internet without requiring a VPN, using TLS 1.3 encryption over port 443.
• 😀 **Enhanced SMB Security**: SMB signing is enabled by default to prevent relay attacks, phishing, and man-in-the-middle attacks, while also introducing stronger password retry limits to thwart brute-force attacks.
• 😀 **Simplified App Management with WinGet**: WinGet now serves as a package management tool for Windows Server, allowing easy installation, updates, and management of apps like SQL Server, Sysinternals tools, and others directly from the terminal.
• 😀 **OS Upgrades via Windows Update**: Windows Server 25 allows administrators to perform OS upgrades through Windows Update, streamlining the process and reducing friction for upgrading, especially in cloud environments like Azure.
• 😀 **Flexible Licensing Models**: Windows Server 25 introduces a new subscription-based purchasing model through Azure Commerce, alongside traditional perpetual licenses, offering flexibility to cloud-focused businesses.
• 😀 **Improved Azure Integration**: Azure Arc integration wizards are simplified, making it easier to manage hybrid cloud environments and deploy Windows Server 25 in Azure-based setups.
• 😀 **Bluetooth & Wi-Fi Support**: Windows Server 25 now supports Bluetooth and Wi-Fi, enabling connections for peripherals and devices like keyboards, mice, and networking in remote or branch office setups.
• 😀 **Security Hardening**: SMB firewall rules have been hardened, reducing the number of open ports and providing more granular controls for SMB dialects and NTLM, helping prevent security vulnerabilities.
• 😀 **Zero-Configuration Remote File Access**: With SMB over QUIC, users can access files remotely, such as from a coffee shop, without requiring changes to the client-side setup, as all server-side configurations are done in Windows Admin Center.
• 😀 **Group Policy Control for OS Updates**: Admins can use Group Policy to control Windows Server 25 OS updates, preventing unauthorized upgrades and ensuring that only approved versions are deployed across enterprise environments.
• 😀 **Streamlined Server Experience**: Windows Server 25 features a modernized user experience with improvements to both the server interface and overall administrative tools, offering a smoother and more intuitive management process.

Q & A

What is SMB over QUIC and how does it benefit Windows Server 2025 users?

SMB over QUIC is a secure and reliable transport protocol built on UDP, introduced in Windows Server 2025. It allows SMB traffic to run over port 443, offering encrypted communication via TLS 1.3, making it ideal for accessing file shares over the internet without requiring a VPN. This is especially useful for remote workers or telecommuting users who need secure file access from public networks.

What are the security improvements introduced in Windows Server 2025 for SMB?

Windows Server 2025 has several key security enhancements for SMB. These include enabling SMB signing by default to protect against relay attacks, phishing, and MITM attacks. Additionally, password retry attempts are limited to slow down brute-force attacks, and NTLM can be disabled for better control over authentication mechanisms. The firewall has been hardened by reducing the number of open ports for SMB traffic.

How does the WiGet package manager enhance the management of Windows Server 2025?

WiGet is a new package management tool that acts as a store for discovering, installing, and upgrading apps on Windows Server 2025. It simplifies the process of installing applications like PowerShell, Sysinternals tools, and even large software like SQL Server directly from the command line. This makes managing and maintaining server environments much easier and more efficient.

What is the role of Bluetooth and Wi-Fi support in Windows Server 2025?

Bluetooth and Wi-Fi support in Windows Server 2025 allow server environments to operate with wireless devices like keyboards and mice, and provide the ability to connect to Wi-Fi networks. This is particularly useful for branch offices, retail stores, or other environments where traditional wired connections are not feasible.

How does Windows Server 2025 simplify OS upgrades compared to previous versions?

Windows Server 2025 simplifies OS upgrades by allowing them to be performed directly through Windows Update, much like on Windows client devices. Admins can download and install updates with just a few clicks. This is especially beneficial for cloud-based servers, where upgrades can now be completed with minimal friction.

What is the new subscription-based licensing model for Windows Server 2025?

Windows Server 2025 introduces a subscription-based licensing model, which allows customers to be billed through Azure Commerce. This flexible model is useful for customers heavily invested in Azure, offering an OPEX (operating expenses) model instead of the traditional perpetual licensing. However, perpetual licenses are still available for those who prefer them.

What are the main advantages of SMB signing being enabled by default in Windows Server 2025?

Enabling SMB signing by default enhances the security of file-sharing protocols by preventing relay attacks and man-in-the-middle attacks. This default setting reduces the risk of malicious activity and ensures that communications over the SMB protocol are authenticated and secure without requiring manual configuration.

What changes have been made to SMB firewall rules in Windows Server 2025?

Windows Server 2025 introduces tighter SMB firewall rules, reducing the number of open ports by default. This minimizes the attack surface for potential vulnerabilities and improves the overall security of the server by making it harder for unauthorized access to occur.

Can SMB over QUIC work with existing clients or does it require updates to client machines?

SMB over QUIC in Windows Server 2025 requires only server-side configuration. Clients do not need any updates to support the feature, making it easier for organizations to enable secure file sharing without having to modify all client systems.

How can administrators control the upgrade process in Windows Server 2025 if they don't want junior admins upgrading servers?

Administrators can control the upgrade process in Windows Server 2025 using group policies. This allows them to prevent unauthorized or unapproved upgrades, ensuring that only authorized personnel can install updates and maintain control over the server environment.