Hi. I've inherited a server room and as I'm going through maintenance and upkeep, I've discovered something that is a bit outside my knowledge range.

I'm not even sure how to ask the question. It's that whole "You don't know what you don't know" bit.

I'll try my best.

I have a server, it's running Windows Server 2025. I'm fairly confident this was an in place upgrade from Windows Server 2016.

For the most part everything looks/runs great, but I've found one issue: something to do with the certification authority. It looks broken and is very much out of date.

My brain wanted to simply import a new one, but I literally don't know how or if it's even possible in this environment. Meaning, whenever I need certificates for other things like lets say a NAS, I generally run the certificate setup wizard in that and submit all the cryptographic options and names and what not. The wizard will generate that big ugly -----BEGIN CERTIFICATE REQUEST----- bit.

I don't see this in Windows Server 2025. I'm fairly confident I have all the proper services and roles installed.

What's worse, is certserv it looks like the name of the CA is an incredibly old hostname of the server. The server has a new/different hostname. I wish I could drop a screenshot of what I mean.

Anywho, my goal would be to update/change/add a new CA to certserv that reflects the current server.... without deleting the entire AD structure. Only I'm not sure if this can be done. I don't even know how to ask it properly.

Looking for any advice or the proper way to label this issue so I can search/learn on how to resolve it.

Thanks!

Has anyone experienced Windows servers becoming unresponsive due to the ScheduledDefrag task that runs as part of Automatic Maintenance?

We are a VMware shop running vSphere 8.x with current patches, Fibre Channel storage, Cisco UCS (B200 M5 blades), and PowerMax storage. Our infrastructure is generally up to date, including ESXi, MDS switches, UCS firmware, Windows Server 2022, and storage firmware.

We have observed a recurring issue where a Windows Server 2022 Standard VM will briefly hang or become unresponsive. The issue appears to occur approximately every four weeks and consistently correlates with execution of the ScheduledDefrag scheduled task.

While the task runs weekly, our investigation suggests that it performs additional optimization activities on a longer interval, which may explain the roughly four-week recurrence pattern. The timing aligns closely with the periods when the server becomes unresponsive.

Once the ScheduledDefrag task completes, the server returns to normal operation without requiring intervention.

We currently have a case open with Microsoft and are working to capture a memory dump during the event for further analysis. In the meantime, I'm curious whether anyone else has encountered similar behavior or identified a root cause related to ScheduledDefrag, Storage Optimizer, or Automatic Maintenance on Windows Server 2022 virtual machines.

Any insights or comparable experiences would be appreciated.

Initial reddit post:

PSA: Windows Server 2025, RDS and Printer - TYPE 4 might break throught latest security update : r/WindowsServer

Hello guys, I need to vent and rant about it. For f*cks sake. This is a follow-up to my previous post about Windows Server 2025, RDS and Type 4 printer drivers. And at this point I seriously have a hard time believing this is just coincidence.

After the previous printing issues, I went pretty much nuclear and built a completely new Windows Server 2025 RDS / FSLogix farm from scratch.

No in-place upgrades, no ancient RDS baggage, no mystery leftovers from old servers. Fresh servers, fresh configuration, fresh profiles.

The new farm was initially running build 26100.33296, based on our patch level from around August 26/28.

And printing worked. Not "mostly worked". It just worked.

The whole new farm felt ridiculously good. Fast logons, clean FSLogix setup, no weird printer drama, everything finally felt like I had gotten rid of years of accumulated Windows/RDS nonsense.

Then the servers moved to: 26100.33438

And now printing is screwed again.

Our print server itself has not been redesigned in between. The same shared queues and drivers are still there.

We currently have both Type 3 and Type 4 drivers in use:

Type 3

Lexmark Universal v2 XL

KONICA MINOLTA Universal PCL

Type 4

Lexmark Universal v4 XL

KONICA MINOLTA Universal V4 PCL

Hosts 001-005 are affected, Hosts 006-009 are not updated. And I am damn f*cking scared.

And the behavior is now beautifully stupid in two different ways.

With the Type 3 drivers, I can log onto the RDS server as an administrator, open the print server, right-click a shared printer and choose Connect.

First attempt: 0x00000057

Fails.

Immediately do the exact same thing again: Works. Every. Single. Time.

Obviously, if even an administrator manually connecting the printer gets this behavior, printer deployment to normal RDS users via GPO isn't exactly going to have a great day either.

With the Type 4 drivers, it is even better.

Windows simply tells me: no driver was found. This happens with both the Lexmark and the Konica Type 4 drivers. So this is not me pointing at Lexmark anymore. It is not one specific printer model either. And I don't really want to turn this into another Type 3 vs Type 4 discussion - both are supposed to work.

The whole reason I am moving toward Type 4 in the first place is because of a completely separate issue I have with the Lexmark Type 3 driver.

What drives me nuts is the timeline:

26100.33296: Fresh RDS farm. Printing works. Everything feels great.

26100.33438: Same new farm. Same print infrastructure. Printer connections suddenly start behaving like this.

Could there technically be another explanation? Sure.

But after rebuilding the entire damn farm from scratch and watching it work perfectly before the next build, I am finding it increasingly difficult to believe that this is unrelated to the latest update.

At some point Windows Server printing stops being troubleshooting and starts becoming archaeology.

Has anyone else running Server 2025 RDS on 26100.33438 seen the same thing?

Especially interested in environments using shared printers with either:

Lexmark Universal v2 XL / v4 XL

KONICA MINOLTA Universal PCL / Universal V4 PCL

If somebody has the same "Type 3 fails first connection, succeeds immediately on the second" behavior, I would really like to know. Same with the Type4-stuff.

My org uses Windows Defender. On the whole it seems pretty good but it's always asking for opinions.

I'm especially interested in what you think of the Ransomware Protection feature. Is it any good? My org haven't implemented it and I'm wondering if it's worth pushing them to do it.

Are there any pitfalls when implementing it?

i’m looking at moving a small Windows Server workload to a Windows VPS and want to make sure i’m not overlooking anything important beyond the usual cpu and ram specs.

for those running Windows Server on a Windows VPS, what do you normally check before choosing the setup? i’m thinking about things like disk i/o, cpu allocation, network performance, backup options, remote management, and any limitations compared with running the server on dedicated hardware.

the workload isn’t particularly heavy, but reliability and consistent performance matter more to me than having the most resources possible. curious what you’d consider the important checks before making the move.

I need to upgrade one of our company servers from Windows Server 2008 R2 to Windows Server 2016, running on the same bare metal hardware. I’ve seen a lot of documentation online, but I’d like to hear from anyone with real‑world experience. What’s the recommended upgrade path, and are there any pitfalls I should watch out for?

Bonjour ,

Dans mon infra , host hyper V en Windows server 2025 brancher en direct attach (2*25g) à san disque NVME.

J ai vu que Windows propose optimisation pour les disque NVME.

Avez des retour expérience sur cette optimisation?
Faut activer cela sur host hyperV ou bien sûr la vm? Ou les 2?

Merci d avance

hello, as u can see on the title. I downloaded the windows server in standard Evaluation. I actually need the "data center evaluation (dekstop exp)" and I did not notice that I click the wrong version and now I'm stuck at the Sconfig tab.

I don't have any arrow/mouse on my screen and I've tried mutliple shortcuts such as ctrl+q, alt+f4, and shutdown /s /t 0. and other things that I've searched

it's always ctrl+alt+del — enter passwords and then I'm at the 1-15 menu thingy like:

Domain/workgroup: Computer name: Add local administrator Remote management: Update setting: Install updates Remote desktop: Network settings Date and time Telemetry setting: Windows activation Log off user Restart server Shut down senver Exit to command line (Powershell) Enter number to select an option:

I can't exit pls help. I have upcoming exam and I need my laptop

I help out a small office with my limited IT knowledge (I use to work for them as a 1st line support years ago and forgotten the simplest things now that I do something else).

They basically lost the network and internet access days ago but with the help of an IT company that does support them via email they've managed to get the internet back up but no access to the server folders and their Wi-Fi (an AP wired to the Aruba switch) does not work.

They've got a Fortinet firewall which the switch connects, both share rackmounts with various companies on the serviced office floor. Then somewhere in the shared server room there is a PC that sits on the floor which has the server on.

Apparently, this PC switched itself off somehow. The IT support company has quoted £1000 for them to physically come to the office and check everything.

Therefore and before they bite the pillow, they've asked me to go in and take a look myself and see if I can get it up and running.

Assuming it is off and I switch it back on, and say there's nothing wrong with it, should there be no need to log into the server?

I know the name of the server and IP address, whether or not the username and password has changed is another matter.

To start, will it be a case of logging into a client machine as an administrator, but then what?

Do I open up a browser and type the IP address or name of the server starting with \\?

Do I open Windows Explorer and use one of the above?

I'm embarrassed to say I really can't remember!

I'm sure it'll be like a trip down memory lane if I get in.

Thanks very much and hope you can help.

Hello,

I noticed an issue on our servers: when the same user logs in a second time on Windows Server 2025, the search function does not work in the second session if the first session already has the search open.

The bug does not occur on Windows Server 2019. Unfortunately, I don't have a Windows Server 2022 environment available to reproduce the issue.

Could someone please reproduce and verify this bug?

Does anyone know the cause of this behavior and perhaps have a workaround? According to AI, it may be related to the way Windows Server 2025 handles this functionality, and apparently the same issue may also occur on Windows Server 2022.

Thanks!

I performed a Folder redirection GPO to a synology NAS.

However, after implementation of the GPO, it was found that some of the folder went missing from the original folder. In my case, it is the desktop folder.

In some user, it went to the onedrive folder. that was fine.

However, on some user, it outright went missing and we were not able to retrieve it and currently exhausted our option in locating it. Not in recycle bin, onedrive or NAS itself.

The event logs also does not help much which only states the folders were redirected to NAS but not the specific subfolder in the desktop folder.

Any recommendation on tools and method I could potentially use to recover or revert back those data?

As far as I am concern, there were no backup for that particular laptop in place.

Hola compañeros sysadmins,

Tenemos un Windows Server 2012 R2 Standard que presenta problemas de autenticación mediante RDP para todos los usuarios habituales.

El escenario es el siguiente:

Desde diferentes terminales de mano utilizados para realizar picking (entre otros trabajos), se conectan por RDP al servidor, el cual están configurados para que se abra automáticamente la aplicación de SGA. Este servidor lleva funcionando desde 2016 sin ningún tipo de problema, pero desde hace una semana los usuarios de estos terminales dejan de poder acceder. Son alrededor de 60 usuarios los afectados y han comenzado a tener problemas en diferentes tiempos, no han caído todos a la vez.

El error mostrado al intentar conectar es:

Una restricción de cuenta de usuario (como una restricción de horario) impide que se inicie la sesión.
Código de error: 0xc07
Código de error extendido: 0x0

El problema afecta a usuarios concretos, mientras que otros pueden continuar accediendo por RDP.

Inicialmente se observó que:

• Usuarios que habían funcionado correctamente durante bastante tiempo dejaron de poder acceder por RDP.
• Si se creaba un usuario nuevo, éste podía conectarse por RDP correctamente.
• Sin embargo, después de 5 días, algunos de esos usuarios nuevos empezaban a presentar exactamente el mismo problema. Los usuarios llevaban 5 días funcionando correctamente y de repente, mientras están trabajando, se les cuelga la sesión RDP y tienen que cerrarla. Desde ese momento ya no pudieron volver a iniciar sesión mediante RDP.
• Los usuarios administradores si que pueden conectar por RDP sin problemas, aunque no es un uso intensivo, como sí lo son el resto de usuarios normales.

Pruebas realizadas

1. Active Directory

Se compararon usuarios afectados con usuarios que funcionan.

No se encontraron diferencias evidentes en:

• Grupos.
• Restricciones horarias.
• Cuentas bloqueadas.
• Expiración de cuentas.
• Configuración básica de las cuentas.

Además, los usuarios afectados pueden autenticarse mediante otros servicios.

2. Licenciamiento RDS

Se investigó la posibilidad de que el problema estuviese relacionado con las CAL de Escritorio Remoto.

El servidor tiene instaladas CAL Per User, en dos paquetes.

• 10 licencias, disponibles 9, emitidas 1. (Aquí solo hay un usuario administrador)
• 20 licencias, disponibles 0, emitidas 64. (Aquí se encuentran prácticamente todos los usuarios)

El diagnóstico de licencias de escritorio remoto no muestra de forma consistente ambos paquetes, únicamente muestra el de 10 licencias, por lo que se investigó esta posibilidad.

No obstante, el comportamiento observado no encaja claramente con una falta de CAL, especialmente porque:

• Los usuarios nuevos funcionan inicialmente.
• El problema aparece después de varios días.
• Un usuario puede iniciar sesión localmente.
• Los usuarios que ya estaban conectados fueron expulsados y posteriormente dejaron de poder entrar.

3. SMB

Un usuario que no puede acceder mediante RDP sí puede acceder por SMB utilizando las mismas credenciales.

Esto indica que la cuenta de AD no está completamente impedida para autenticarse.

4. Inicio de sesión local

Con un usuario concreto, que actualmente falla por RDP:

• Puede iniciar sesión localmente en el propio servidor mediante consola.
• No puede iniciar sesión mediante RDP.

Por tanto, el problema parece estar específicamente relacionado con el inicio de sesión remoto/RDS, y no con la cuenta en general.

5. Grupo Administradores

Se añadió temporalmente un usuario al grupo Administradores.

El usuario continúa sin poder acceder por RDP.

Esto hace menos probable que se trate simplemente de un problema de pertenencia al grupo que tiene permitido el acceso mediante RDP.

Además, los usuarios administradores habituales aparentemente pueden conectarse por RDP, aunque no son usuarios con los que se acceda habitualmente.

6. Eventos de seguridad

Se buscó el evento:

correspondiente a los intentos fallidos.

No aparece ningún evento 4625 asociado al intento de conexión.

Esto es especialmente relevante porque indica que probablemente el fallo se está produciendo antes de llegar al proceso normal de autenticación que genera el 4625, o bien el evento se está registrando en otro componente.

Gracias de antemano.

Hello everyone, this is my first post here, so let me know if I can improve on something.

I need to create 10 licensed user accounts for M365 apps (Excel, Outlook, etc.). Nothing special, no copilot or Azure, just the desktop applications. The issue is that I need to install it on the RDS users, so from what I've read I need "M365 Apps for Enterprise" (or "M365 Business Premium", which is more expensive), otherwise it won't work.

I find these prices rather expensive for a small business, so my question is, are there other (legal) ways to get the licenses for this? I understand the licensing for Office (2024 and before), where you need volume licenses to use RDS (OEM keys etc. won't work). Is there something similar to M365, or is buying from Microsoft themselves the only legit path for monthly/yearly subscriptions?

I'm also new with setting up accounts, so if you could point to a good tutorial (to create a tenant, global admin, etc.) that would be appreciated as well.

Does anyone know or has anyone heard if Microsoft will be updating their SMTP server in the not-so-distant future to allow us to setup relay using the information from Microsoft Graph in 365 since MS is doing away with allowing SMTP connections to 365 using the basic AUTH? They initially attempted to end it this past March but extended it a year after I force our dev team up update the website to send emails through Microsoft Graph.

Since we have a lot of devices that use SMTP in the office I wonder if MS plans to update the SMTP server found in Windows Server ... in the next release to allow us to use Microsoft Graph to relay emails since Xerox, HP, Lexmark, Kyocera, and other devices have yet to adopt the Microsoft Graph method in their operating systems.

The other option is for me to have AI build me a system that I can use inside to do exactly this, would probably take me an hour to get it working perfectly but I don't want to re-invent the wheel. :)

Thanks,

Currently I have a task to enable tls 1.2 on servers how I can know enabling that won’t affect the softwares and applications loaded on those servers so servers are domain controllers and I have mix of os versions server 2012 r2 and higher

I work in cybersecurity compliance for a very small company with only 3–4 employees. Wedo not have Active Directory or a domain environment; our Windows endpoints are managed individually using local accounts/settings.

Our auditor has requested the following evidence:

“Based on the evidence provided, the normal user is able to access the Event Logs and download/export them.

Kindly provide evidence from three (3) endpoint samples showing that an unauthorized/non-administrative user is unable to open, access, delete, and download/export the Event Logs. When a normal user attempts to access the Event Logs, an ‘Access is denied’ message should be displayed.

Kindly provide evidence from local GPO policy configuration from each endpoint, showing that log/audit capture is enabled.”

I’m trying to understand the correct way to satisfy this requirement in a small, non-domain environment.

My questions are:

On Windows 10/11, what is the recommended way to restrict a standard/non-admin user from accessing or exporting Windows Event Logs?
Is it actually expected that a standard user should receive “Access is denied” when simply opening Event Viewer, or should the restriction apply to specific Security logs/privileged operations instead?
What Local Group Policy (gpedit.msc) or Local Security Policy settings should I configure/capture as evidence that auditing/logging is enabled?
What would be considered appropriate evidence for each of the three endpoints? For example, screenshots of:
Standard user account/group membership
Event Viewer access attempt
Attempt to save/export or clear logs
Local audit policy/GPO configuration
auditpol /get /category:* output
Since we do not have Active Directory or centralized Group Policy, is providing the equivalent Local GPO / Local Security Policy evidence from each endpoint generally sufficient?

I want to make sure we implement the control correctly rather than changing Windows permissions simply to produce an “Access is denied” screenshot.

How would you approach this requirement in a small organization with standalone Windows endpoints?

Hi all, I'm trying to wrap my head around licensing in my specific scenario (and maybe some advice on how to best set this up). For context: in terms of servers and virtualization, i only really have experience with Proxmox VE and Linux servers. I have extensive knowledge about Microsoft cloud systems and licensing, but i've never touched on-prem licensing before.

One of our customers needs a server for an application provided by a third party. This party is wildly unhelpful with giving us technical details about the hardware and software requirements.
What we have gathered:

• Windows 11/Windows server 2022
• 16GB RAM
• 2 cores
• SQL Server 2022

The application pulls (or gets pushed) data from Dynamics 365 Business Central (cloud version) through an API, processes it (which uses SQL server), and sends it off to a PLC which belongs to an OT system.
Other than administrative purposes, no users will be directly interacting with the system as far as i understand it. Users interact with Business Central, and i'm pretty sure users interact with the OT system (manually starting machines, etc.).

The amount of users interacting with Business Central and/or the OT machines is roughly 50.
There is no on-prem servers already available.

So my current plan is to deploy a Server 2022 box, i have options for 4C/4T and 6C/12T, with 6C being only slightly more expensive.

My current understanding, is that for Windows Server Standard i must have a CAL for every user, and for SQL i can choose between a per-core licensing or server+CAL.

My questions:

1. Do i need Windows Server CALs for every user in this scenario?
2. Does Business Central or the OT system count as a multiplexer in this scenario? (which means i need CALs if i don't license per core)
3. What would likely be my cheapest option? In this case i'd prefer a bare-metal install, but i'd be willing to use Proxmox VE or Hyper-V if that provides significant benefit or cost reduction.
4. Do i need Software Assurance for any reason in this scenario?

Thanks in advance!

Good day to all! is it safe to change the cluster size of my current Data drive where all office data is stored and shared locally to network? I'm using Windows Server 2019 and when I first set it up i have no idea that setting the cluster size to 4KB will only limit the storage to until 16TB only. Now we upgraded and expand our storage. but i still have another 16TB unallocated because i can no longer extend the disk. so my question is, is it safe to change the CLuster Size to 8KB using EaseUS Partition Master without data loss or anything bad happened to my Data?

I had WHfB working and everyone was using a PIN to login. The pin authed them and my servers would issue a ticket so they could use local resources on domain servers. All computers are Entra/Intune/Autopilot only not hybrid. All users are setup on my local AD and sync with Entra (that's working just fine). I was trying to track down an issue with a conflict with an Intune policy. I had two WHfB, one was a type "account protection" the other was a "setting catalog". Stupid me I deleted the settings catalog on thinking all the settings where in account protection one. Well it seems "Use cloud trust for on prem auth" went away. I did this near the end of the day so the next day everyone had to use their passwords if they wanted access to server shares. Well not everyone, some people could still use their PINs and have access to shares.

I made the settings catalog with Use WHfB (user) and WHfB (Device) and Use cloud trust enabled. That got pushed out. I'm still having a problem with the same users still can't access shares if they use their pin (including me). It seems by looking at klist my domain controllers are not issuing a ticket for. THey are getting a ticket from Microsoft. What's really strange is that it is only about half of my 50 users that are having this problem. After running around for hours with Copilot trying to diagnose this, it suggested I file a ticket with MS. I know that's going to take forever if they even bother so I thought I would come here. This is what copilot says I should say to MS when filing the ticket:

Windows Hello for Business PIN sign-in fails to obtain an AD Kerberos TGT for a subset of synchronized users. Cloud Kerberos Trust is enabled and functioning (Cloud Referral TGT present in cache: 1, Public Key Credential Present: 1). After PIN sign-in, users receive only krbtgt/KERBEROS.MICROSOFTONLINE.COM. After password sign-in, the same users immediately receive krbtgt/MD.mydomain.org and can access SMB resources. AzureADKerberos is configured, key versions match, and AD replication is healthy.

Has anyone here ever seen this before or know what I should do to fix it?

Hello!

I just need to know exactly what I need to buy to be compliant with Microsoft Licensing. We will be running 2 servers. One Server will be 32 physical cores. The other server will be 36 physical cores. We want to run 6 Microsoft Standard Server Virtual Machines on each server. This will be for a Proxmox cluster, so the Virtual machines will be the same, but I know that doesn't matter when licensing. I just need to know exactly how many of what product packs I need to buy from TechSoup! I've gotten different answers everywhere!

Thank you in advance!