Windows Server 2025 in 2026: New Features & Is It Worth It?

Two years after launch, here's what actually held up — and what it means for your upgrade timeline.

Short answer: yes, for most environments still running Windows Server 2022 or older, upgrading to Windows Server 2025 is worth it — and the calculus got noticeably better in the last few months, not at launch. Two of its headline features, hotpatching and next-generation Active Directory, have now been running in production long enough to judge on results rather than marketing slides, and one of them just got dramatically cheaper. On top of that, Windows Server 2022 loses mainstream support on October 13, 2026 — which, as I'm writing this, is about two months away.

I've spent the last several weeks going through Microsoft's own changelogs, licensing updates, and community reports to answer one question I keep getting asked: is Windows Server 2025 actually worth the migration effort, or is it another "modest, incremental" release dressed up in a new marketing deck? After digging into what changed since general availability in November 2024 — including a pricing reversal that most articles online haven't caught up to yet — my take is that this release earns its place, but not uniformly across every environment. Below, I'll walk through what's proven itself, what's still a "later" problem, and how to think about the ROI math for your specific setup.

I'm Mostafa Amaan, and on Valley4Techs I write practical, hands-on guides for IT pros and sysadmins. Let's get into the details.

Windows Server 2025, Two Years In: Where It Actually Stands

Windows Server 2025 became generally available on November 1, 2024. When it launched, most coverage focused on the Windows Server 2025 launch feature breakdown Microsoft published in the datasheet: hotpatching, "next generation" Active Directory, SMB over QUIC for non-Azure editions, GPU partitioning, and faster NVMe storage. That's a reasonable launch-day summary, but it tells you almost nothing about whether the release holds up once real organizations run it under real workloads for a year and a half.

Here's what changed in the meantime that most "what's new" articles haven't updated to reflect:

• Hotpatching flipped from a paid add-on to a free feature. It launched as a $1.50-per-core-per-month subscription in July 2025, and as of May 19, 2026, Microsoft made it free for all Azure Arc-connected Windows Server 2025 machines — Standard or Datacenter, on-premises or multicloud. I'll get into why this matters below, because it quietly removes the single biggest objection IT budgets had to this release.
• NVMe support reached general availability in the October 2025 cumulative update (KB5066835), delivering the roughly 70% IOPS improvement Microsoft promised back at the roadmap stage — though it's still opt-in, not on by default.
• Windows Server 2022's clock started running out. Mainstream support ends October 13, 2026. After that date, 2022 keeps getting security-only updates through extended support (until October 14, 2031), but no new features and no non-security fixes — which changes the upgrade-timing conversation for anyone still deciding.

None of that was true when Windows Server 2025 shipped. That's the gap I want to fill here — most guides freeze the feature list at launch day and never revisit it, which means a lot of what's circulating right now is quietly out of date on cost and maturity.

The Features That Actually Proved Themselves

Every Windows Server release ships with a long feature list, and most of it is incremental noise you'll never touch. Three features in this release, though, are genuinely operationally different from what came before — and all three have now been tested outside of Microsoft's own lab.

1. Hotpatching (Now Free)

Hotpatching lets Windows Server 2025 apply security updates directly to the in-memory code of running processes, without the traditional reboot. Instead of a monthly "Patch Tuesday" restart, servers only need to reboot on baseline months — January, April, July, and October — which works out to roughly four planned restarts a year instead of twelve. Microsoft's own internal Xbox team has cited cutting patch cycles from weeks down to a couple of days after adopting it.

This existed exclusively for Windows Server Datacenter: Azure Edition before 2025. What changed with this release is that it became available to on-premises and multicloud servers through an Azure Arc connection — and for almost a year, that access came with a real bill attached: $1.50 per CPU core, per month. On a 32-core server, that's $576 a year. For a fleet of a hundred 64-core servers, licensing sites were quoting figures north of $100,000 annually. That price tag is the reason a lot of admins wrote hotpatching off as "nice idea, budget killer" and moved on.

The requirements are still worth knowing before you plan around it: your server needs to be on Windows Server 2025 Standard or Datacenter, connected to Azure Arc, and running with Virtualization-Based Security (VBS) enabled, which itself requires UEFI with Secure Boot. If you're running older hardware without Secure Boot support, that's your actual blocker now — not the price.

Azure Arc Gateway architecture allowing restricted enterprise subnets to validate hotpatch tokens without direct internet access.

Air-Gapped & Offline Environments: The Azure Arc Reality Check

While free hotpatching is a massive win for standard hybrid setups, it introduces an architectural hurdle for highly restricted, classified, or air-gapped enterprise environments. Because hotpatch licensing verification and patch catalog orchestration rely on periodic communication with Azure Resource Manager via Azure Arc, servers that are completely isolated from outbound internet traffic cannot use hotpatching out of the box.

To address this, Microsoft introduced the Azure Arc Gateway (and supported Private Endpoints for Arc), which allows enterprise IT teams to consolidate all outbound management traffic through a single, tightly controlled proxy server or dedicated egress point. This means your production Windows Server 2025 machines don't need direct internet access to benefit from rebootless patching — they only need network reachability to your internal Arc Gateway proxy.

However, for strictly air-gapped networks (such as industrial SCADA systems, defense enclaves, or isolated financial databases with zero egress capacity), hotpatching remains unavailable. In those zero-connectivity scenarios, sysadmins must continue relying on traditional WSUS or offline cumulative update packages (which still mandate reboot cycles). Understanding this distinction early prevents architectural missteps during your migration planning.

2. Next-Gen Active Directory

"Next generation Active Directory" sounds like marketing language for what's actually a fairly narrow, but genuinely useful, set of changes — AD hasn't had a structural overhaul like this since Windows Server 2016. The core change is that the AD database can now use 32 KB pages instead of the 8 KB limit that's existed since the early days of the directory service. In practical terms, that raises the ceiling on how much data a single attribute can hold — roughly 2.6x more entries per multi-valued attribute — which matters most for large organizations running big security groups or heavily populated schema extensions.

Alongside the page size increase, Windows Server 2025 adds:

• LDAP encryption support for TLS 1.3, letting you retire older, weaker cipher suites.
• Stronger default machine account passwords. New computer accounts no longer get predictable default passwords — AD generates long, random ones instead, closing off a low-effort attack path that's existed for years.
• Built-in AD object repair and diagnostic tooling, aimed at reducing how often admins need third-party tools just to find and fix a corrupted or orphaned object.
• Kerberos support for AES-SHA256/384, tightening authentication beyond the older algorithm set.

From what I've seen discussed in admin communities, none of this requires a forest-wide re-architecture — you raise the domain and forest functional level, and new domain controllers on 2025 pick up the benefits. Existing DCs don't automatically get the 32 KB page size; that's something you plan for when you promote new controllers or rebuild existing ones.

3. SMB over QUIC for Everyone

SMB over QUIC lets clients securely reach a file server over the internet, encrypted, without a traditional VPN — useful for branch offices and remote staff hitting a central file share. It existed in Windows Server 2022, but only on the Datacenter: Azure Edition SKU, which most on-premises shops never touched. Windows Server 2025 brings it to Standard and Datacenter editions across the board, and adds client access control, so you can restrict which certificates are allowed to connect rather than trusting any client with a valid cert.

The setup requirements are specific: your file server needs a TLS certificate with a Subject Alternative Name matching the FQDN clients will use, and you open UDP/443 outbound instead of exposing TCP/445 directly to the internet — which, on its own, is a meaningful security improvement over how a lot of small organizations have historically exposed file shares to remote workers. If your team has been maintaining a site-to-site or client VPN architecture purely so remote staff can reach a file share, this is worth a serious look before your next VPN license renewal.

SMB over QUIC routes encrypted file traffic over UDP/443 with TLS 1.3 certificate validation, eliminating external TCP/445 exposure.

4. Storage Spaces Direct (S2D) & Native ReFS Deduplication

For hyperconverged infrastructure (HCI) and storage admins, Windows Server 2025 delivers critical enhancements to Storage Spaces Direct (S2D) and the Resilient File System (ReFS) that directly impact storage economics. Historically, file deduplication on Windows Server was restricted to cold data or traditional NTFS volumes, making it unsuitable for live virtual machine disks (VHDX files) running on active Hyper-V clusters.

Windows Server 2025 changes this by integrating block-level ReFS deduplication and compression optimized specifically for active virtualization workloads. In real-world cluster deployments, this delivers up to 50–60% storage footprint savings on Hyper-V virtual disk repositories without incurring the performance penalty that plagued older deduplication engines. When paired with the 70% IOPS boost from the optimized native NVMe storage driver path, S2D clusters running on 2025 achieve significantly higher IOPS density per node.

Additionally, S2D stretched cluster resiliency has been overhauled with faster automatic repair cycles and granular sync bandwidth controls. If your organization is evaluating whether to remain on-premises or migrate to Azure Stack HCI, these native S2D improvements give traditional Windows Server Datacenter hyperconverged clusters a much longer enterprise lifespan.

ReFS block-level deduplication saving over 50% storage capacity on live Hyper-V cluster CSV volumes.

5. Containers, Podman, and Cloud-Native Sysadmin Tools

While containerization is often associated with Linux distributions, Windows Server 2025 represents Microsoft's most refined release for Windows Container workloads and hybrid Kubernetes deployments. In previous releases, Windows container base images (Server Core and Nano Server) were criticized for their large disk footprint and slow pull times compared to Linux Alpine containers.

In Windows Server 2025, base container image sizes have been trimmed by up to 30%, noticeably shortening cold-start startup times and CI/CD deployment pipelines. Crucially, Microsoft has added native support for Podman alongside Docker CE, giving sysadmins OCI-compliant, daemonless container management directly out of the box. This allows security-conscious teams to run rootless containers without needing a persistent background Docker daemon.

For Kubernetes admins running mixed-OS clusters, Windows Server 2025 introduces enhanced HostProcess containers and improved GPU pass-through inside Windows containers. This enables running containerized AI inferencing models and machine learning pipelines directly on Windows worker nodes, bridging the feature gap between Linux and Windows container host capabilities.

Native Podman container orchestration and HostProcess Kubernetes worker node architecture in Windows Server 2025.

Windows Server 2025 vs Windows Server 2022: What Actually Changed

Here's the side-by-side that matters for planning, not the full 40-item feature comparison you'll find in Microsoft's datasheet:

CALs are also version-specific — a Windows Server 2022 CAL doesn't grant access to a 2025 server, so a version upgrade means budgeting for new Client Access Licenses alongside the core licenses, not just the server license itself.

Use Cases: When to Upgrade Now vs. When You Can Wait

"Should we upgrade" isn't a yes/no question that applies the same way to every environment. Here's how I'd break it down based on what you're actually running today.

Upgrade Now (or Actively Plan It)

• You're still on Windows Server 2022 and reboot windows are a real pain point. Free hotpatching alone can justify the migration cost if your organization runs anything close to always-on — reducing twelve mandatory reboot cycles to four is a genuine operational win, not just a checkbox feature.
• You're running large AD security groups or schema-heavy environments and have hit attribute size limits before, even indirectly (replication slowness, group membership caps). The 32 KB page size removes a ceiling you may not have realized you were bumping into.
• You're compliance-driven — finance, healthcare, government-adjacent, or anyone subject to audits that specifically flag TLS versions and authentication algorithms. The LDAP TLS 1.3 support and stronger Kerberos ciphers are the kind of thing that shows up directly on a compliance checklist.
• Your organization is already hybrid with Azure Arc, or planning to be. Windows Server 2025 was clearly designed with Arc as the connective tissue, and you'll get more value out of the hotpatching and monitoring story than an on-premises-only shop will.
• You need GPU-accelerated workloads — AI inferencing at the edge, ML pipelines, or graphics-intensive line-of-business apps — where GPU partitioning across VMs is a capability Windows Server 2022 simply doesn't have.
• You manage Hyper-V clusters or Storage Spaces Direct (S2D) repositories and need live ReFS block-level deduplication to reclaim 50%+ disk capacity on active VHDX stores.
• You run Windows Containers or hybrid Kubernetes worker nodes and want native Podman OCI tooling, 30% smaller base container image pulls, and containerized GPU pass-through.

You Can Reasonably Wait

• You're on Windows Server 2022 with no urgent pain points and no compliance deadline. You have until October 2026 for feature updates and until 2031 for security patches — there's real runway here, not a cliff edge.
• Your hardware doesn't support Secure Boot or Virtualization-Based Security. A chunk of 2025's headline value — hotpatching included — depends on VBS. If that means a hardware refresh anyway, it's reasonable to bundle the OS upgrade with your next planned hardware cycle rather than rushing it.
• You're running specialized line-of-business software with a narrow, tested compatibility list that hasn't certified Windows Server 2025 yet. Chasing the OS ahead of your vendor's support matrix is how you end up in an unsupported configuration for both products.

The ROI Case: Security and Admin Time, Not Just Features

When I talk to admins weighing this upgrade, the conversation almost always centers on features. The stronger argument, though, is time and risk — the two things that actually show up in a budget justification.

Patch cycle time. Going from twelve reboot-required patch cycles a year to four is a concrete, measurable reduction in planned downtime windows. If your organization runs change-control processes around every reboot — scheduling, notifying stakeholders, staffing an after-hours window — cutting that from monthly to quarterly is real hours back, multiplied across every server in your fleet. And now that hotpatching itself is free on Arc-connected 2025 machines, the only cost left is the Arc onboarding effort, which is largely a one-time setup task.

Security posture. The faster your servers apply security patches without disruption, the smaller your exposure window on newly disclosed vulnerabilities. Combine that with stronger default machine account passwords, TLS 1.3 for LDAP, and Kerberos improvements, and you're closing off several lower-effort attack paths that have existed in AD environments for years — not by adding new tools, but by changing defaults.

Avoided ESU costs. If you let Windows Server 2022 ride past its 2031 extended support end date without a migration plan, you're looking at Extended Security Update (ESU) fees — a paid, security-only bridge that gets more expensive the longer you delay. Migrating on your own schedule, rather than under deadline pressure, is almost always the cheaper path.

None of this replaces a proper cost model for your specific environment — server count, core count, CAL mix, and hardware refresh timing all move the number meaningfully. But directionally, the ROI story on this release got measurably better in mid-2026, and it's worth re-running your numbers if you shelved the decision last year based on the hotpatching subscription cost.

Planning the Upgrade: What I'd Check First

Before you touch a production domain controller, run through this checklist — it's the order I'd actually work through it, not an alphabetical feature dump:

1. Inventory hardware for UEFI Secure Boot and VBS support. If hotpatching is your main driver, this is the gate everything else depends on. Older bare-metal servers may need a firmware update or, in some cases, aren't eligible at all.
2. Confirm your line-of-business software's compatibility matrix explicitly lists Windows Server 2025 support, not just "should work" forum comments.
3. Run ADPREP (forestprep/domainprep) from 2025 media before introducing your first 2025 domain controller, and plan functional level increases separately from the DC promotion itself.
4. Budget CALs as a separate line item from the server license — they're version-specific and easy to forget until license compliance flags it.
5. Pilot on a non-critical file or app server first to validate Azure Arc onboarding and hotpatch enrollment before rolling it out fleet-wide.
6. Schedule domain controllers last, not first. Get comfortable with the OS on lower-risk roles before touching the servers that, if something goes wrong, take authentication down with them.

If your servers currently run inside Hyper-V or you're weighing a hypervisor change alongside this upgrade, it's worth reading our VMware vs Proxmox comparison first — GPU partitioning and live migration behave differently depending on your virtualization layer, and it's easier to decide that before the OS migration than after.

And since Secure Boot and TPM readiness gate several 2025 features, our Windows Boot Toolkit guide is a fast way to check TPM and Secure Boot status on a machine without digging through five different Control Panel menus first.

Mistakes I See Admins Make With This Upgrade

1. Assuming hotpatching still costs money. I've seen this cost objection repeated in forum threads and internal budget proposals dated after May 2026 — it's simply outdated. Re-verify current pricing directly from Microsoft's Azure Arc documentation before you write it off.
2. Treating the AD schema update as optional busywork. The 32 KB page size and other AD improvements only apply going forward — running ADPREP and raising functional levels isn't automatic, and skipping it means new domain controllers won't actually deliver the benefit you upgraded for.
3. Upgrading domain controllers before validating application compatibility. AD is the one place where "we'll fix it in production" is the most expensive mistake on this list. Pilot everything else first.
4. Forgetting CALs are version-locked. A clean server license purchase with old CALs still attached is a license compliance gap waiting to be found in an audit.
5. Exposing SMB over QUIC incorrectly. The whole point is replacing direct TCP/445 exposure with UDP/443 and certificate-based trust — leaving 445 open "just in case" defeats the security benefit you upgraded for in the first place.
6. Assuming Hotpatching works without an Arc Proxy Gateway in air-gapped subnets. Disconnected enterprise networks must route management traffic through an Azure Arc Gateway proxy endpoint; otherwise, token verification fails and servers revert to standard reboot-required updates.
7. Overlooking ReFS deduplication on Hyper-V CSV volumes. Skipping block-level ReFS deduplication configuration on active virtualization stores misses out on reclaiming over 50% of disk space across VM repositories.

Frequently Asked Questions

These are the questions I get most often from readers weighing this exact decision. If yours isn't here, drop it in the comments.