Windows Server 2025: What Small and Mid-Size Organizations Need to Know Before Migrating
Windows Server 2025 brings significant security improvements. Here is a practical migration guide for organizations running Server 2019 or 2022, covering what is new, what changes, and how to do it securely.
By Tom Brennan
Microsoft released Windows Server 2025 in November 2024, bringing substantial security improvements that make a compelling case for migration — particularly for organizations running Server 2019 or earlier.
What Is New in Windows Server 2025
- Secured-core server — TPM 2.0, Secure Boot, and virtualization-based security (VBS) enabled by default
- SMB signing required by default — mitigates NTLM relay attacks
- Credential Guard enabled by default — protects domain credentials from Pass-the-Hash attacks
- Hotpatching support — security patches can be applied without rebooting in some configurations
Migration Planning
Pre-Migration Assessment
Inventory all applications running on existing servers. Identify applications incompatible with Server 2025's enhanced security defaults — legacy applications requiring NTLMv1 or unsigned SMB will fail without remediation.
SMB Signing Compatibility
SMB signing required by default is the most impactful change. Audit your environment for SMB clients that do not support signing before enabling the requirement.
Backup and Rollback Planning
Verify that your backup and recovery capability is current and tested before any migration. For virtual environments, snapshot before major changes.
Explore Related Resources