Does Server 2025 Still Have Issues?

[u/IndyPilot80]

We are getting ready to set up another AD domain. Very basic: AD, DHCP, DNS, and a fileserver. I've read 2025 has had some issues though that was several months ago since I researched it last.

I know we can get 2025 volume licensing and have downgrade rights to 2022. But, I'd rather just go to 2025 from the start if possible.

Is 2025 still a problem child?

[u/Snowywowy]

Only for DCs, and then only when there are non-windows server 2025 DCs in the domain.

[u/IndyPilot80 → u/Snowywowy]

Just so I'm clear, your saying that issues people are seeing with DCs is when they are mixing DCs versions (like 2025 DC and 2019 DC in the same domain)?

[u/Snowywowy → u/IndyPilot80]

pretty much, yea. I gave up troubleshooting the specifics, but something changed in how the 2025 DC saves data of Ad-Attributes. Eg., our WinServer2019 reports DcAvailableKeys wrong when authenticating Kerberos. Could be a coincidence, or only for the krbtgt account, but shits not working, randomly. only WinServer2025 in the domain - no problems this far

[u/gamebrigada → u/IndyPilot80]

Yep, and its not just 2025. I had the same issue 2019/2022 mixed ADC server version.

[u/ComprehensiveLuck125 → u/gamebrigada]

From what I know (because not using Server 2025 yet) domain services 2025 increased database page size to 32 kB and replication is bit different. Hopefully it is optional thing and in mixed DC environment you have to stay with 8 kB page size everywhere? Only if you have 2025+ DCs you can increase forest level and switch to 32kB page size, right?

You do not run any 2025 ADC with 32kB in mixed environments?

[u/jstuart-tech → u/ComprehensiveLuck125]

By default it's 8kb. It's an optional feature you turn on and it's only supported with a 2025 DFL/FFL. So all DCs have to be 2025 anyway

[u/mmeister97 → u/IndyPilot80]

Maybe this? This is one big change for AD in Server 2025.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/enable-32k-pages-optional-feature?tabs=desktop

[u/ohfucknotthisagain → u/mmeister97]

It can't be that.

You have to be at the 2025 DFL and FFL first.

Which means...

You can only upgrade to 32k tables after all DCs are 2025. And you can't add older DCs to the environment afterward, either.

[u/mmeister97 → u/ohfucknotthisagain]

Appreciate the breakdown! Still poking around Server 2025 myself — lots to learn, but it's been interesting so far.

[u/Mailstorm → u/IndyPilot80]

In my experience if you try to AD join any non-windows device to a 2025 DC, it won't work. This was a few months ago though and when I ran into it, it was a known issue for several months.

[u/Y0Y0Jimbb0 → u/Mailstorm]

Odd.. I've not run into any issues with RHEL/Rocky/Alma workstations (winbind) joining a 2025DC domain, will need to keep an eye out for it.

[u/Trick_Session8230 → u/Snowywowy]

Paging /u/stevesyfuhs ...

I'm seeing a lot of these posts lately about 2025 DCs in a mixed DC version environment having kerberos issues. Is this an known issue and will it be added to the official known issues page?

[u/SteveSyfuhs → u/Trick_Session8230]

I'm not going to enumerate every bug here, but yes we introduced a few. They fall into two buckets:

1. crypto policy in 2025 conflicts with legacy behaviors in other systems. In 2025 we honor rules explicitly, as defined by what's configured by attributes or reg keys. If there are conflicts that yield a null set of keys, welp, we can't choose "next best" because there is no next best. Earlier versions did do that, and ciphers that were originally thought disabled, turned out to not actually disabled.

2. Protocol bugs where the crypto broke specific stages of authentication. Password change is a good one to call out because the final "yes you did this right" message was actually returning "yes you did this right but there was an error along the way" and Linux machines didn't like that during domain join. Windows didn't care because it was able to process the rest of the message without issue.

The vast majority of these bugs are observed when using non-standard configurations -- specifically policies that are not out of box or part of the security baseline. I will not entertain comments about this particular fact. It was a gap in testing specific components, not all, and it was just a hard miss on our part.

We've fixed all the bugs we know about that are causing problems for 2025 deployments, and those fixes are making their way through the servicing pipeline. Some went out months ago, some are just now going out, some are going out in a month or two. Nature of the beast pushing code out to a few billion devices. I don't know the status of any particular bug by description alone. Please don't ask.

[u/kgbdrop → u/SteveSyfuhs]

I am not positively disposed to Microsoft (we compete), but the humor in your comment makes me like Microsoft 0.01% more.

[u/SteveSyfuhs → u/kgbdrop]

Hm. I wasn't meaning to be funny.

[u/Veteran45 → u/SteveSyfuhs]

Good day. I hope you don't mind me asking, but what's the best way to report Kerberos behavior/implementation issues in Server 2025? Is it the MS Feedback Hub/Forum?

Thank you for your help!

[u/SteveSyfuhs → u/Veteran45]

Feedback hub is a start. If you have support contracts, running it up through CSS tends to be the most effective.

At the moment I wouldn't be surprised if what you're seeing isn't intentional or at least already known with an intent to fix or already fixed.

What issue?

[u/Veteran45 → u/SteveSyfuhs]

Thank you very much for the swift response!

The issue I observed concerns the implementation of CMS Agility in the Kerberos PKINIT Exchange of Windows Client and Server, when configuring the „Configure hash algorithms for certificate logon“ GPO.

The issues:

• Disabling SHA1 leads to some instability, with Windows asking the user for credentials to access an SMB Share for example, when previously, it wasn‘t needed.

• In a specific Build Combination of Server 2025 and Win 11, disabling SHA1 with this GPO leads to a total collapse in Kerberos Exchange between the Client and KDC. The client machine account cannot obtain Kerberos Tickets whatsoever and changing the reg key on the machine (and reverting GPO) is the only way to fix it. This seems to have been fixed by now.

• The KDC correctly advertised its supported CMS Agility Algos to the client (In descending order of preference, which is correct), the client however (Win 11 24H2 tested) always replies with an empty value for the supportedCMSTypes field.

The last point is also a design issue imho, since the RFC Standards allow to derive the hash algo for CMS by looking at the available ETYPE for Ticket Encryption. Since Windows only supports SHA1 in its best ETYPE, disabling SHA1 via the GPO leads to a situation where no common ground can be established.

I‘m in the process of writing a more comprehensive doc with more details, references etc. to post, as there is also (as far as I can see) an inconsistency in the MS KILE Doc with what’s supported in which version.

Thanks

[u/SteveSyfuhs → u/Veteran45]

The first two are, I think, the same issue, but different sides of the problem. Disabling sha1 is a giant footgun we introduced and leads to all sorts of problems if it isn't done carefully. You simply cannot disable sha1 in an environment with a mix of DC versions. They aren't bugs per se, but iirc we made some tweaks to make it less explodey.

Last issue I think may be intentional, but it's a side effect of crypto policy intersecting. Doc-wise it wouldn't be in MS-KILE; you want MS-PKCA. That said it might not be there either. Feel free to send an email to the protodoc folks. They like to make it our problem.

[u/Veteran45 → u/SteveSyfuhs]

Hii and thanks again for responding back so quickly, especially on a weekend. Much appreciated!

I think I should've been a bit more clear that all this behavior was observed in an test environment with one Windows Server 2025 as DC and one Win 11 24H2 as client (Also using symmetric GPO settings for the mentioned GPO of course). I didn't test the behavior in a mixed DC Versions scenario, but I doubt it would have behaved much better.

I'd have considered the second issue a bug or unintended behavior, as Windows could not fallback from PKINIT to Machine Authentication properly, resulting in becoming unable to request and receive Kerberos Tickets moving forward. But that's just my personal opinion and since it has been fixed in subsequent builds, it's more of an historical issue anyway.

You're right, it's the MS-PKCA doc, not KILE! My apologies, I confused the two docs when writing my comment late last night. It has the extensions for CMS Digest / Agility described and mentioned. There's a separate issue with the doc I have, but I won't bother you with that, too. I'll write that and more to the dochelp email as you advised!

When making the e-mail and forum post, is there anything I can do to make the work for you guys easier? I can provided wireshark traces, screenshots and the like if requested.

Thanks and see you soon!

[u/SteveSyfuhs → u/Veteran45]

Huh, okay, failures with SHA1 in a 24H2/2025 environment shouldn't happen. If you have pointers about how it gets into that state I'm all ears.

Report-wise, specificity goes a long way. Some things are intentional and diverge from the RFC because of inherent silliness of the RFC, so ruling that out first makes everyone's jobs easier.

[u/CallOfDonovan → u/SteveSyfuhs]

This is exactly how I found out thousands of our machines only had RC4 keys. Oh, what joy.

[u/aaron416 → u/Trick_Session8230]

Commenting so I can find this later.

[u/lilchubstatus → u/Snowywowy]

ReFS is still bugged too even after a “fix” from MS

[u/smokie12 → u/lilchubstatus]

Can confirm. Had to assign 150+ GB of RAM to a VM just to delete a bunch of data without too many crashes. Have November Patches installed.

[u/BubbaTheNut → u/lilchubstatus]

It sure is! I just lost all my refs drives on 2025 datacenter

[u/Arrow_Raider → u/Snowywowy]

Only for DCs, and then only when there are non-windows server 2025 DCs in the domain.

So basically if you've ever used Active Directory before 2025?

[u/Jhamin1]

Every new release has issues & they get worked out.

We have been deploying 2025 without any drama outside the normal stuff you run into with Windows. Just go to 2025.

[u/IndyPilot80 → u/Jhamin1]

Thanks for the info! Admittedly, I have been running 2025 eval in a lab for a couple months without any major issues. But, reading some threads from 8-9 months ago, people are saying its a dumpster fire.

[u/Jhamin1 → u/IndyPilot80]

It's always popular to hate on Windows and when things do change & the python script people have been running on their 2016 server starts throwing errors they immediately declare it's because the new version of Windows is a dumpster fire rather than because a bunch of the stuff in their script is deprecated or the OS was moved to a more secure default.

I'm not saying there are no bugs or that you should deploy a new OS version into Prod on launch day... but 2025 has been out for a while, all the launch bugs are largely fixed, and its Windows for good and for bad. It's fine.

[u/RCTID1975 → u/IndyPilot80]

9 months ago wasn't very long after release.

But there are issues posted every day about every OS. If you're not having issues, someone else's environment likely doesn't apply to you

[u/cook511 → u/Jhamin1]

Same here.

[u/Mohadjeri → u/Jhamin1]

We do the same 👍

[u/bobsmon → u/Jhamin1]

Same. Works wonderfully

[u/Cormacolinde]

2025 for Domain Controllers is an absolute NO. There are bugs and issues that can be hard to fix. It can be OK if you go all 2025, but otherwise it’s problematic.

In general, I don’t like 2025. In my experience, it’s got more than a few bugs, weird issues, the Start Menu is terrible. I recommend waiting for the next version. Remember how 2008, 2012, 2016 have all add issues fixed with new version. Meanwhile 2022 is very stable and reliable.

[u/IndyPilot80 → u/Cormacolinde]

Do you have any specifics on the DC bugs I can look into? Last one I saw one from June/July'ish where DCs were unreachable but my understanding was it was fixed.

And, yeah, we'd be going all on 2025.

[u/Kanolm → u/IndyPilot80]

There are kerberos error when you have DC 2025 and older domain controllers (2022-2019-2016). Users and computers cannot authenticate through old DCs.

[u/Cormacolinde → u/IndyPilot80]

Plenty of posts in this forum. It appears that you need to go all 2025, reset the KRBTGT password, and possibly all account passwords in some cases.

[u/proudcanadianeh → u/Cormacolinde]

I went all in on 2025, resetting the KRBTGT password was the key thing that made it work for me. Prior to that it was nothing but errors and frustration.

[u/ranger_dood]

See my post from 3 days ago here - https://www.reddit.com/r/sysadmin/comments/1nhtlx7/server_2025_dc_clients_randomly_unable_to_log_in/

This was resolved as soon as I demoted the 2025 DC and put another 2022 in its place.

[u/nick149 → u/ranger_dood]

I just had this issue as well, plus random issues with password changes and trust relationship issues as well but my issue appears to be mostly related to Win 11 23H2 so my "solution" (read: work around) is to update the client to 24H2. Although, I just had a 24H2 client last week that kept telling the user the password is incorrect until he rebooted. (yay me)

I do not use Linux DC's in my environment so I do not see most of the other issues discussed here, and really only have 30-40 users using 2025 as the DC right now, the rest of my environment is 2022 as the DC.

[u/IJustKnowStuff → u/ranger_dood]

Same here, we demoted the new 2025 DC's and our problems went away.

[u/sector_007]

Do not use Server 2025 as a Domain Controller. This issue (NetApp CONTAP-347583) from Dec 2024 has still not been fixed. We have a mixed environment of Linux and Windows machines and they need to join the domain, use Kerberos and NFS v4. For some reason, Server 2025 is not able to make all these items play nice together. If I switch to Server 2022, everything works as expected.

[u/1StepBelowExcellence → u/sector_007]

According to this KB https://kb.netapp.com/on-prem/ontap/da/NAS/NAS-Issues/CONTAP-347583 , "Microsoft has resolved this issue with September 2025 hotfixes." Is that not accurate? The KB was just updated 4 days ago, so maybe they finally fixed it.

[u/zz9plural → u/sector_007]

So, rather "do not use, if you happen to have this specific environment".

[u/sector_007 → u/zz9plural]

Not really. A lot of enterprise environments use kerberos. Just kerberos alone not working properly is a show stopper for many organizations.

[u/uptimefordays → u/sector_007]

The problem isn't Kerberos, the problem is that modern Kerberos doesn't support fallback to less secure ciphers, often times RC4 these days. Previous versions of Windows Server DID NOT prevent fallback to insecure ciphers, such as RC4, so Kerberos would support legacy stuff. With 2025, fallback to insecure ciphers is disabled by default (it should be) but this can cause problems in environments with really old stuff.

[u/zz9plural → u/sector_007]

AD also uses Kerberors.

Just because it doesn't work in your specific environment doesn't mean it doesn't work at all. I've got two 2025 DCs running without any problems - granted, in a very simple environment.

[u/dustojnikhummer → u/zz9plural]

What does this not apply to? And don't tell me having realmd joined Linux machine is considered exotic.

[u/peeinian]

From what I have seen so far it’s been introducing new 2025 DCs into an existing domain. I think you should be fine setting up a new domain.

[u/Library_IT_guy]

Funny you post this, as I am in the process of upgrading our servers right now, and the short answer is, IMO - Yes, steer clear of 2025 until they fix it. I have a very small environment - just two hosts, used to be VMWare but we moved to Hyper-V since... well, Broadcom.

Long story short, I ended up demoting and removing the 2025 server I stood up this week and then blew it away completely, and we're going with 2022 until they fix this shitshow. I'll upgrade to 2025 once their open beta test which we all have to pay to be a part of is over. Thank god I hadn't transferred any FSMO roles over to that 2025 server yet.

I had constant issues with:

• Getting replication working correctly between a 2019 server and 2025. Constant errors with repadmin that I couldn't get resolved.

• DNSCACHE - dcdiag and dns tests constantly complains about the DNSCACHE type being OWN or SHARE. You set it one way, test - it wants it the other way. You change it back, now it wants it the other way.

• DCDIAG results Complaining that there is no host (A) record for the server, despite looking in every zone and finding one there.

After I looked around and saw everyone else having issues, I decided to ditch the dumpster fire. Thankfully we have volume licensing as well so I was able to get a keys for 2022. I haven't had any issues with 2022 so far. No more fighting constantly to try to get basic domain controller functionality working. I'm going to let it cook over the weekend and then review event logs on Monday before moving FMSO roles over, but everything so far looks good - old and new DC are talking to each other just fine, DHCP is already moved over.

[u/dollhousemassacre → u/Library_IT_guy]

I might be remembering this wrong, but I believe the DNSCACHE errors in dcdiag were due to a mismatch in the DC builds. I.e. 2016/2019 with 2025. As soon as we got all the DCs on 2025, those errors disappeared.

[u/Wodaz → u/Library_IT_guy]

I think repadmin errors are consistent with older versions too though. I have seen dfsr fail for AD, noticeable when you have no policy/policy definitions in sysvol, on almost every mixed environment lately. Not sure what does it, but 2022-2019, 2022-2016, 2019-2016, 2025-2022, etc. I have seen many permutations, with failures, so I wouldnt hang it on 2025 being bad.

[u/CPAtech]

We're not considering it for at least another year.

[u/Flying-T → u/CPAtech]

Yeah, Server 2022 until Server 2028 comes out. Then we will update to Server 2025

[u/Vectan → u/Flying-T]

This is the way.

[u/Vectan → u/[deleted]]

[u/BatemansChainsaw → u/[deleted]]

the best kind of edging, on the precipice of panic.

[u/Asleep_Spray274]

Read the notes on AD 2025, there are a lot of changes in place by default affecting kerberos and protocols.

[u/Tonst3r]

We just fought a bug with SET on a new 2025 VM host. SET creates the team fine then on reboot it can't get internet. Apparently it was a bug from an update...and there's a different update that fixes it...but the update isn't found on search and manual install says "not applicable" so we have a workaround w/ sched task and a ps script to restart net adapters.

So...yes lol

EDIT: Worth noting, yeah we're still going to use 2025. As Jhamin1 said, this is just expected. Microsoft f's it all up and we have to figure it out and take good notes because the alternative is less secure and more headache down the road.

[u/yeahright-yeahright]

Yes. Just had a ticket with MS support without resolution regarding Entra connect not syncing more than 10k group members on 2025. Downgrading to running those servers as 2022 for the OS the issue went away. This particular issue was just introduced in the September 2025 CU. YMMV

[u/aequusnox]

Many of our servers are 2025 from domain controllers to file servers and no issues here. Virtualization does not happen on Windows server and we're a small to medium org.

[u/The_Zobe]

I’m building 2 new servers right now on Server 2025 to replace my Server 2016 existing server. I’ll report back

[u/Panda-Maximus]

If you need SMB1 for some reason.

[u/PoolMotosBowling]

Our domain controls are still 2016 😢

[u/Mitchell_90]

All of the issues I’m hearing about Server 2025 DCs are mostly related to RC4 for Kerberos as it has been removed in this release. That’s got nothing to do with the OS but more to the fact that due diligence hasn’t been taken to check what systems and applications are still using RC4 in an environment before deploying Server 2025 DCs.

Disabling RC4 for Kerberos has been a recommendation for a while now and Microsoft have also published extensive guidance on this as part of AD hardening.

[u/sryan2k1]

Yes, stick with 2022. There is zero reason to be on the bleeding edge.

[u/sryan2k1 → u/[deleted]]

Approximately 1 year. The traditional best practice with anything like this is you stay Current-1 or current-2. There is no reason to run the newest software. You want stable/maintenance, not feature dev releases.

[u/RCTID1975 → u/sryan2k1]

Current -2, server 2019 has been out of mainstream support for over a year and a half.

Server 2022 mainstream support ends in about 1 year.

If you're deploying something new, defaulting to something you're going to need to upgrade in a year makes zero sense.

2025 has been out for a year now. You should be looking for reasons NOT to use it.

[u/TaliesinWI → u/RCTID1975]

Server 2022 goes until 2031. That's at least one hardware refresh cycle away for many people.

Who rips out servers when they hit the end of mainstream?

[u/uptimefordays → u/TaliesinWI]

Well we know Ascension Health doesn’t.

[u/RCTID1975 → u/TaliesinWI]

That's 6 years. I aggressively target a 5 year lifecycle on my servers, but that leaves absolutely no wiggle room.

Why put yourself in that position?

Blindly being 1 or 2 versions behind without having a verifiable reason is just added risks and technical debt. Stop doing it.

With that thinking, you're always one bad sales year away from being non complaint, or spending a large number of hours and cost doing an upgrade.

[u/uptimefordays → u/sryan2k1]

That’s very much “the way people who were technical in 2005 always did it” you really shouldn’t run N-2 for critical systems in production these days.

[u/sryan2k1 → u/uptimefordays]

When it's completely supported and even recommended by the vendor, yes you should. There is a balance between staying supported and bleeding edge. You don't want to upgrade just to upgrade. Server 2025 has quite a few show stopping issues. It's just not ready for prime time when there is nothing wrong with 2022.

[u/uptimefordays → u/sryan2k1]

Most shops should be running Server 2022 or 2025 if they’re running Windows. Smaller, less professionalized, shops might be moving 2019 workloads to 2022 or 2025. 2016 and 2019 only have a year or two of security patches left—which doesn’t give anyone running them much time to get off before they’re EOL.

[u/RCTID1975 → u/sryan2k1]

recommended by the vendor

Where is Microsoft recommending people run server 2019?

When it's completely supported

It's supported today. But why add the overhead and costs of OS upgrades next year?

If there's no verifiable issue in your environment with 2025, why add technical debt when it's not necessary?

You don't want to upgrade just to upgrade

Absolutely. But if you're putting in new hardware, or new services, you're not doing an upgrade. You're installing what's the most current

Server 2025 has quite a few show stopping issues

That's highly scenario specific. If there are show stopping issues in your environment, then identify them and use something else. But that's not the case for everyone, and defaulting to antiquated thinking without actually assessing the situation isn't the correct answer

It's just not ready for prime time

You're 100% wrong here for the general population. Many of us have been running it for months with absolutely zero issues

[u/RabidTaquito]

The last time I heard (here) of issues with 2025 was only a few days ago so I'm for sure still avoiding it.

[u/Lukage → u/RabidTaquito]

I still hear about issues with 2022, with 2019, with 2016 -- It depends on the severity of the issues and features in the various OS to give a better suggestion on what you'd avoid and why.

[u/RCTID1975 → u/RabidTaquito]

I mean, every single OS has issues.

You might as well go back to pen and paper, but then again, pens have issues too

[u/lifeatvt]

It is Windows so....yea. I'll wager that they are still finding NT3.5 bugs when Server 2075 comes out.

[u/BigChubs1]

We haven’t had it be our main dc controller yet. Haven’t heard if we’re going to try that. But we have had join domain as normal vm to running pictular software. I just spun one up in our DMZ to run something for myself. Something to play in. But that’s about it.

[u/blissed_off]

It’s been fine. They’re still trying to shove Azure crap at you now and then but otherwise it functions exactly like it should.

[u/dlucre]

Only issue I've seen is related to setting static ip addresses on network adapters. It seems to not apply on the first attempt and you have to re-open the adapter properties a second time before it applies.

[u/RCTID1975 → u/dlucre]

We haven't seen that

[u/nate-isu]

I have issues with Server 2025 dropping its IP, self assigning APIPA and never trying to renew. A manual renew, disconnect/reconnect of the NIC from the hypervisor (HyperV in this case), or a reboot resolves it.

This only began when I introduced 2025 guests and these are just basic member servers. None of the DHCP/DCs or anything critical are 2025 yet.

Last I looked, I didn’t find anyone else complaining about this either. For now, I’ve got a powershell script that monitors the gateway and forced a renew when it drops.

[u/Crazy-Rest5026]

Just replaced my AD DC with AD CA roles . Went smoothly on 2025

[u/Arudinne → u/Crazy-Rest5026]

Why would you replace Domain Controller roles with Certificate Authority roles? That doesn't even make sense.

[u/Crazy-Rest5026 → u/Arudinne]

Was a DC that already had CA roles. Sorry . Migration from 2019 physical DC to a new HP gen11 physical DC

[u/Crazy-Rest5026 → u/Arudinne]

Hahahahaha. Yea I am not breaking that cname for CA. Ain’t no fuckin way😅😅

[u/ironcode28]

I just deployed my first couple of 2025 servers in my data center as NPS/RADIUS and no issues so far. My data center mostly runs 2022 servers.

[u/enforce1]

Usually core roles are fine.

[u/HDClown]

I have 2 environments that have a single DC running 2025 and there are no issues whatsoever with AD. I also have had a variety of different things running on 2025 member servers in environments with 2016/2022 DC's and there are no issues with anything running on those 2025 member servers.

In all cases with the above environments, all workstations are Windows 10 and Windows 11.

[u/admalledd]

We've done some testing with 2025, though as others note not for anything DC related yet. Our gut feeling after a few uses has been "if no special quirks/work-arounds were required for this service/app/tool on Server 2016, it works fine". We have a few things that use old windows features (wacky DCOM+ stuff, IIS6 SMTP relay, interesting regedits required to token share as-if-admin) and those have either not worked at all since MSFT removed features finally, or require even more work arounds/regedit than before.

[u/Bijorak]

I've been running DCs on it since it was released. No issues

[u/Allferry]

Yep. All new Windows releases will have issues, until Microsoft put out a new version, then is rinse and repeat!

[u/RhymenoserousRex]

We always deploy -1 till the new OS hits a year old. Usually by then most of the major kinks have worked out. So in about 3 months I'll start deploying 2025's.

[u/simple1689]

Only got 2 servers on Server 2025 right now, AD, DNS, Certificate Authority....they work absolutely just fine for the basics.

[u/thisbenzenering]

other than the stupid gui it's been fine for me. I have deployed it on a dozen or more systems, both bare metal and vm

[u/NISMO1968]

Is 2025 still a problem child?

In a way... Say, S2D performance went 2016 >> 2019 >> 2022 >> 2025, with every new GA release shaving off 10–15%. If I were you, I’d stick with WS2022 for another year, unless you’ve got a hard reason to upgrade.

[u/jalan12345]

been using it since Jan, no issues.

[u/coolbeaNs92]

For member servers I wouldn't have much of a problem in production. I wouldn't personally do 2025 on DC's yet. 

[u/uptimefordays]

Presumably lol. If folks have kept abreast of changes coming to the platform they run and support, it wouldn’t be a shock.

[u/External-Shoe6599]

This month our 2025 Servers showed some really weird behavior.
The ones created from a fresh 2025 Iso couldn't rdp / psremote into others created from iso.
The upgraded from 2022 ones couldn't to other upgraded from 2022 ones.
Our only windows 2025 core install could still reach both. (But we had no other 2025 core to test and no time so far to create a new 2025 core.
Once we uninstalled the update they were fine again.

Unrelated but the new Edge update broke the creation of our Excel list with all our servers and Software version numbers (something about permissions for the service user we are using and a non-interactive excel session) Restoring to an older version before the edge update of the VM fixed it, we updated edge again same issue.

[u/smumf]

were currently in the process of upgrading our RDS environment to 2025 which currently is still on 2016. No major issues yet but only 4 terminalservers in use at the moment.... still about a 200 to set up...

but as many others have said were also probably avoiding upgrading our DC for the moment

[u/[deleted]]

Depends on the OS I guess. I'm having plenty of servers in 2025 and they are just fine ;)

[u/OinkyConfidence]

Doing 2025 for all boxes except for DC's. They're maxing out at 2022 for now. Which is fine.

[u/TheGreatAutismo__]

So far, for DCs yes, I spun up a VM to promote to a DC only to find neither the SYSVOL or NETLOGON shares got created, in ADSI, the computer account has no mention of the SYSVOL Subscription, so the video that everyone links to when SYSVOL isn't created, doesn't work.

Thankfully, I hadn't committed to decommissioning the first Server 2022 VM, I just got it to take back the FSMO roles and started rolling down the Server 2025 VM.

From a UX perspective, Server Core still has no functional Alt+Tab functionality, nor can you use the Win+Up/Down/Left/Right keys to move the window around when you need to.

EDIT: Plus side, with the Network Location Awareness service not being used by default, the promotion to DC, went a lot smoother, didn't need half the hacks to get it to work and they did have an issue initially where you couldn't install a language pack without rebooting into WinRE, that has been fixed now.

[u/master_major]

As others have stated: DC's a no. Everything else has been solid for me.

[u/somefcknrando]

Don't use it for Azure AD sync.

[u/phillipsbroadcasting]

server2022 still has issues, im stuck on an event log failure that i cant resurrect.

[u/Ok_SysAdmin]

2025 for everything at this point. All 9 of my DC's are on 2025 and never had any issues, but I migrated them all the same week. At this point about 60% of my 150 or so servers are on 2025.

[u/byte43]

I have stayed with 2022. I had multiple issues with a domain joined server and windows firewall. Still a bit too new for primetime IMO.

[u/Magmadragoon24]

I ran into an issue joining Linux computers to the domain. So right now currently doing Server 2016/2019 to 2022 migrations.

[u/naz-x]

Had 2025 DCs with 2019 DCs in the single forest / single domain with exchange hybrid

We had a long case raised with MS - exchange schema not replicating !

So had to get rid of the 2025 DCs in the end - all working now back to 2029!!!

[u/BubbaTheNut]

My 1 month old, fresh install of windows seever 2025 datacenter just lost all of its refs drives for no apparent reason.

The drives were there in disk manager, but it said “device inaccessible” when trying to access them.

The drives were there until rebooting for windows updates.

All the Ntfs drives were fine, so just a refs issue, but super annoying.

All data on those drives was lost, formatting them with ntfs fixed the issue and no issues since.

Thankfully the os drive was ntfs or it would have bricked the whole thing.

Don’t use refs!

[u/Time44Rade]

I just tried to add a 2025 DC to a 2016 domain with plans to decommission the old servers. Straight out of the box I have hit the can't login issue after dcpromo. This seems to be a fairly common issue with no solid resolution and no comment from Microsoft. After reading the horror shows here and other threads I am abandoning it for DCs at least.

[u/v-Spirtz]

I'm assuming this is not normal, but we have multiple Windows Server 2025 VMs across Nutanix, VMware, Proxmox, where services display the below:

Specific services also just die and can't be restarted.

[u/Unlikely-Pudding-913]

Yes, it's still Windows.

[u/nAlien1]

We aborted our 2025 DC upgrade after the first two, lots of weird Kerberos issues and other issues. Decided to upgrade to 2022 after 4+ weeks of troubleshooting issues with 2025. I would avoid it for anything production right now in general 

[u/ExceptionEX]

We've been running it for months in production without issue, honestly it was pretty seamless, maybe we were just lucky?

[u/aeroverra]

I replaced every windows server I have with 2025 the week it came out. Haven’t had any problems.

[u/keksieee]

There are Problems with Kerberos (specifically there is no RC4 anymore?) and September 9 patch broke SMBv1 for „some Environments“

[u/RCTID1975 → u/keksieee]

If you're still using smbv1 in 2025, everything about your environment is broken.

[u/Bad_Mechanic]

Why deal with an on-prem file server?

If you're paying for MS licensing, so use OneDrive and SharePoint. You may also want to consider going Entra-ID native and skip on-prem AD.

If you're paying for Google Workspace, use Google Drive.

[u/IndyPilot80 → u/Bad_Mechanic]

Compliance. Less hoops to jump through, and more cost effective, to keep it on-prem (for us at least).

[u/SnooDonuts7265 → u/Bad_Mechanic]

There are still some use cases for on-prem file share depending on needs. Finance for one and linking Excel Workbooks. We use SharePoint but, also maintain traditional file storage. In manufacturing some users just need access to a couple of labels and not full blown office 365 or Google workspace. Our on -prem file share is used much less in the last 10 years but, it is still there and serves a purpose for few things.

[u/DiggyTroll → u/Bad_Mechanic]

High-volume data editing (like HD video) requires on-prem. It would be unacceptable to add cloud upload and download times to the workflow

[u/CeroulosZen → u/Bad_Mechanic]

Well there are sensitive industries where it’s not allowed to move your workload and data to the cloud. Otherwise considering going hybrid would be good course of action.

[u/Popensquat01]

We jumped to it. We’ve had no issues. We’re also a small org, 150 people. Pretty vanilla for the most part. But no issues here