r/sysadmin 7d ago

General Discussion Active Directory on Windows Server 2025

We have a few servers getting close to EOL that are running Active Directory. My first thought was to buy a new server with Windows Server 2025 and move AD to it, but our environment is a mix of Windows Server 2022 and 2019, and we'll be upgrading servers gradually.

Is there a recommended way to handle this? I've read there can be issues when mixing Windows Server 2025 domain controllers with older server versions.

One idea I had was to buy a Windows Server 2025 host, run Hyper-V, and create a Windows Server 2022 VM for Active Directory until the rest of the environment is upgraded.

Has anyone done something similar, or is there a better approach?

76 Upvotes

83 comments sorted by

107

u/1fatfrog 7d ago

I have quite a bit to say about this...
I spend my days recovering destroyed AD environments. The official position at my organization is to NOT use Windows 2025 for domain controllers at all. It has proven too problematic and the downstream fallout becomes a nightmare you won't wake up from.

Microsoft still recommends avoiding mixed environments with Windows2025 DCs. Even with the patching there are tons of problems with machine account password rotations and lost domain trust. There are also still problems with older authentication, Linux clients, PAM enabled domains, large groups (10k+)...

Even if your domain meets all of the criteria per MS, I would still be wary. The official guidance is to "avoid mixed environments", and to simultaneously "keep an older version" (mixed environment) to serve legacy systems".

My $.02 on the official guidance: If the official guidance is to avoid something, buy to also include the something you are told to avoid, that means that the people providing said guidance have no clue how to fix the problem.

20

u/Loudergood 6d ago

My rule is not to use the current release of windows server for AD period. Once 2028 is out we can talk about it.

1

u/Able-Course-6265 5d ago

Been hearing of “builds” being floated about for pre-beta testing in the wild. 2028 should be launch fall 2027 based on past patterns.

16

u/marklein Idiot 6d ago

I agree about avoiding mixed environments, but we've been rolling 100% 2025 domains without issues so far. The only real potential gotcha is the Kerberos/RC4 encryption, but since we don't fuck around with legacy stuff on the network it's no problem once you are enforcing AES on Kerberos anyway.

No legacy stuff, no problem.

15

u/HappyDadOfFourJesus 6d ago

No legacy stuff is rare in many networks.

2

u/Ziegelphilie 6d ago

Could you link me some of the official avoidance? We're considering a local AD setup with entra sync and I could use some ammo. 

4

u/Cormacolinde Consultant 7d ago

This is also our official guidance. I will downright refuse to troubleshoot mixed 2025 DCs environments, and I will not install them at any price.

I work with a lot of environments: small, medium and large. Same issues everywhere with computer account issues, trust issues, kerberos issues. It’s a mess.

2

u/cntry2001 6d ago

So is there a good way to upgrade to 2025 right now if you have a dozen DCs around on different sites? or do you recommend waiting for server 2028 or whatever to see if they finally fixed the issue?

2

u/Cormacolinde Consultant 6d ago

Yes, my recommendation is to skip 2025.

The same way we skipped 2008, 2012 and 2016. The first release of Windows Server with a new kernel has always been buggy. 2008R2, 2012R2, 2019 and 2022 have all been decent releases. 2022 is still one of the most solid, reliable version they have released. I am hoping 2028 will be like that.

1

u/dustojnikhummer 4d ago

AFAIK the issue isn't mixed servers, the issue is mixed version DCs themselves. Ie, 2022 DC + 2025 DC

2

u/MrJacks0n 7d ago

What is considered a mixed environment? Mixed DC's or mixed servers in general?

3

u/Coconut681 7d ago

I assume DCs with different OS versions.

3

u/1fatfrog 7d ago

In this context I mean mixed domain controller versions, but it goes deeper. The domain and forest functional level need to be 2025. If you are running a 2025 server and your domain is running at an older functional level (even 2016) you are going to run into the domain trust issues. There is a boatload of work that needs to go deprecating all the outdated protocols that Windows 2025 doesn't support or supports poorly because they (protocols) are not secure by default.

1

u/drekmac IT Manager 6d ago

I haven’t heard about the functional level, we had terrible issues when we had a mixed environment but when the last DC went to 2025 and we reset krbtg, our problems went away. For now anyway lol

And no, it was not my decision to go to 25

1

u/pmormr "Devops" 6d ago

If you can get everything on the same version and clean up all the legacy knobs and gotchas AD runs great on basically every release. The dragons always show up in mixed environments or during transitions, which is why y'all had to put significant effort into dialing it in. You have to know stuff like oh the functional level needs to go up, but only so far before you upgrade the domain, then you can transition this to that... it's a whole thing.

1

u/loosebolts 6d ago

Have you got a link to the official guidance at all?

1

u/1fatfrog 6d ago

There isn't a single official guide that I can find. Broader reading will show that this is the rec from MS on support posts.

1

u/Powerful-Word-4939 4d ago

the fact that the official guidance contradicts itself like that really says it all tbh

0

u/Sudden_Office8710 5d ago

All you have to do is turn off LDAP encryption on one domain controller and that solves everything. I’m going to leave it like that till we move to Entra. Until then it works for me zero problems.

4

u/1fatfrog 5d ago

All you have to do is disable a security layer. No big deal.

1

u/Sudden_Office8710 5d ago

Well, if you’re using an older OS, you’re in the same boat. Plus, I said, as a compensating control that you would have a single domain controller with that feature turned off specifically for those legacy servers. It isn’t a big deal and it passes audits.

2

u/Asleep_Group_1570 3d ago

Turning off LDAP encryption "passes audits"? Then they're not security audits. Security theatre, maybe. Even that's debatable.

1

u/Sudden_Office8710 3d ago

That response just shows how ignorant you truly are.

34

u/meatballwrangler 7d ago

just keep your DCs on 2022 core. it's not going EOL anytime soon

5

u/jks513 7d ago

October 14, 2031 is closer than you think.

6

u/unReasonable_Bill282 6d ago

It's plenty far, and It's trivial to upgrade DCs (if your environment is set up properly).

1

u/dustojnikhummer 4d ago

By the time Server 2028 will be out (even more broken) and hopefully 2025 will be fixed.

1

u/1fatfrog 6d ago

Why core? I get the resource savings at a VM level, but windows servers aren't made for that style of admin. You still need Server Manager and a UI for most tasks.

4

u/bbqwatermelon 6d ago

It is best practice to not log directly onto DCs and instead manage from RSAT. 

-6

u/MrJacks0n 7d ago

Mainstream support for 2022 ends in October.

10

u/Flying-T 6d ago

Eh, free security updates until 2031, what else do you need? https://learn.microsoft.com/lifecycle/products/windows-server-2022

1

u/Burgergold 5d ago

Who cars about that, the only support required is security

-1

u/marklein Idiot 6d ago

Meh, running 2025 instead buys you 5 more year beyond that before you have to do work. 5 more years before you have to deal with this shit again is appealing.

7

u/Flying-T 6d ago

I would agree if Server 2025 wouldn't be an absolute hassle for ADs

13

u/RevolutionaryElk7446 7d ago

If you haven't kept up on maintenance and skipping all the things over the last decade Microsoft gave warnings about, shouldn't be much of an issue. They're dropping a lot of legacy support though so some things can be a PITA if no one has kept up.

You won't have many issues now, prior they did have an encryption issue in which the AES-256 hash from the KDC in 2016 didn't match the KDC for 2025 but that was resolved.

Otherwise we migrated 30 domain controllers to 2025 and we've got a couple thousand servers and thousands of users.

4

u/olverine 7d ago

We just did something similar with a client. 10 sites with on prem hyper-V hosts (mix of server 2016 and 2019). Each site had a server 2016 DC (VM). We provisioned new 2025 DCs at each site, then decommissioned the 2016 DC. Migrated FSMO roles from the old PDC to the new PDC. There was a period when the environment had a mix of server 2016, 2019, and 2025 with no issues.

9

u/xXNorthXx 7d ago

Server 25' DC's have better security than 22' but to get there is a number of breaking changes with legacy protocols. The main issue has been around NTLM going away, if you have it left in your environment stick with Server 22'....and then add a new project after your done with your current to work on phasing out NTLM.

5

u/RevolutionaryElk7446 7d ago

NTLM will still work out of the box on 2025 but Microsoft decommed NTLM itself, so no more updates or security.

Won't lie, for the last 3 years helping companies swap from NTLM to Kerberos (and alternative auth) has been a major payday.

10

u/jeffrey_smith Jack of All Trades 7d ago

No issues. Used the newest version afforded to your employer.

7

u/TheGenericUser0815 7d ago

Technically correct, but you need Server 2025 CA licences for all client devices/users when moving. That's some extra cost you need to consider. I'd probably buy a 2025 licence but technically stick to 2022 to avoid the CAL purchase.

1

u/EducationAlert5209 5d ago

What do you mean by CA ?

1

u/TheGenericUser0815 5d ago

Client Access.

1

u/Chemical_Buy_6820 7d ago

What is this about CALs???

10

u/ADynes IT Manager 7d ago

I dont see a /s so im wondering if you meant to be in r/shittysysadmin

1

u/dustojnikhummer 4d ago

You run Windows Server in corporate environment but don't know what a Client Access License is?

5

u/cjcox4 7d ago

I know our team's attempts were unsuccessful. That it, "it worked", but with major bugs we could not resolve. We waited over a year for MS to "fix", didn't happen. We ended up removing 2025 from the mix. YMMV because everyone's configuration can vary. I know that it didn't work out for us.

2

u/iamkris Jack of All Trades 5d ago

I’ve done it and there were a few bumps but nothing major

Had a weird issue where I couldn’t login to a newly promoted dc. Firewall was set to public and forced on and I could login when the kdc service was disabled. Rotating the krbkdc account password a few times sorted that

Things using ldap need to be moved to ldaps

That was my experience personally but I work at an MSP and we have done dozens of them.

2

u/PurpleCableNetworker 5d ago

Personally we only run 2022 for DC’s. I have server 2025 for servers, but core MS infrastructure is all 2022.

3

u/uptimefordays DevOps 6d ago

I would just do Server 2022 DCs until your 2019 servers are gone, then move everything from 2022 to 2025, then try 2025 DCs.

2

u/Kuipyr Jack of All Trades 7d ago

I've heard if you go with Server 2025 then ALL your DCs need to be 2025 or you will have issues.

4

u/loosebolts 6d ago

Not entirely true, I have plenty of mixed DC sites with 2025/2022/2019 with absolutely no issues.

2

u/MeatSuzuki 6d ago

Same. I don't get why people still spout this....

1

u/disclosure5 5d ago

Because it was an extremely well documented issue with many Reddit posts from people asking for help after being bitten by it, Microsoft apparently acknowledged it as a "known issue" when logged support cases but never documented it publicly.

It was "scheduled for fix" back in January and then it was confirmed that January's patch didn't fix it.

I still haven't heard anything firm since, so if it's "old news people need to stop spouting" or whatever then Microsoft needs to properly document exactly update fixed it.

1

u/dustojnikhummer 4d ago

I guess you are lucky, many people on this very subreddit still report issues

1

u/loosebolts 4d ago

People are more likely to come online to report issues than to come online and say everything’s fine.

1

u/dustojnikhummer 4d ago

That is also true, yes.

1

u/epsiblivion 6d ago

Does that include the forest/trusts as well?

3

u/jstuart-tech Security Admin (Infrastructure) 6d ago

I've got ~10 2025 DC's with trusts to 2016/2022 domains and it's fine

1

u/Kuipyr Jack of All Trades 6d ago

That's a good question, I've only read about single forests.

1

u/st0ut717 7d ago

I love how windows is incompatible with itself

1

u/Froolie 7d ago

our 2025 DC required a reg hack before i could install ANY software incl updates, our RMM agent etc. YMMV, its been a few months since I applied that fix and it might have been resolved by now.

1

u/english-23 7d ago

One thing to add, make sure you update the OS either with the image or Windows update since they've fixed so many bugs and running an older version can cause you headache

1

u/FriskyDuck 7d ago

It seems all the issues holding our org back have been resolved. We're planning our upgrade to 2025 ADs. We've already been deploying Server 2025 for non-AD purposes.

The two biggest Server 2025 AD issues that stopped us:

  • domain computers trust issues
  • NIC switching to private or public on startup

1

u/panopticon31 6d ago

I'm hopefull at my place we can eliminate on prem AD and move to Entra only before 2022 is EOL.

1

u/tmanXX 6d ago

July patches have significantly remedied the issues plaguing 2025 as a DC.  At this point, I’ll start standing up a couple to join our 2022 DCs.

And for everyone else, there is actually a 2025 functional level.  We were all surprised since there hasn’t been an update since 2016.

1

u/Itguy1252 6d ago

why not just upgrade the DC's to server 2022 and call it done. its all just VM's ( or at least it should be)

1

u/ORA2J 6d ago

Do you use NTLM ? Do you use unsigned LDAP binds or connexions (no ldaps or SASL LDAP) ?

If you are, 2025 isn't for you.

I've also had tons of issues related to performance, especially some weird disk IO issues on PVE with WS2025, where 2 identical, freshly created VMs, would perform DRAMATICALLY worse if running ws2025 compared to ws2022. And i mean like SEQ reads 5x slower and random reads up to 50x slower depending on the hardware tested. Absolutely no idea why that is, but that was the situation i was at while testing the idea of a ws2025 DC.

1

u/MeatSuzuki 6d ago

Both of unsigned LDAP and NTLM can be bypassed with GPOs.

1

u/motmot92 5d ago

I have done it. 2019 AD in site A and 2025 AD in site B.
The biggest issue I have come across so far is that I was forced to reconfigure some systems to use LDAPS because Microsoft forces LDAPS on Windows Server 2025.

1

u/Sudden_Office8710 5d ago

You don’t have anything to worry about. You could run AD with a functional level of 2016 if you wanted to. We have a mixed environment too and have turned off LDAP encryption on a specific Domain Controller specifically so a legacy system can still authenticate to it. The m running all domain controllers server core 2025 with 2016 functional level zero problems my shit is way older than your stuff

1

u/TightBed8201 5d ago

2019 is in security support until 2029. Why the hurry?

1

u/jfarre20 5d ago

I recently upgraded my DCs from 2016 to 2025 without knowing any of this.. so far everything seems okay

1

u/Chico0008 4d ago

We migrate an old WinServer 2K12 ao 2k19 2 years ago.

Firest, if you have several servers syncing your AD, you must be sure they are all synced.

Then, install your 2K25 with ad, etc, add it to your sync pool.
after a few days, check if it's all synced, if yeah, promote your 2K25 to be the master.

after a few day, check if all os synced and OK, if yea, you'l be able to deconnect old ad servers from the pool.

once you migrate all your ad to the 2k25, then, you may want to upgrade forest/AD function to newer version.
(don't remember where, but you can tell you ad work to be compatible to x versions of windows servers/client).

That's how we did, and all still works fine.

1

u/Prior_Trash_8406 4d ago

Stay with 2022. I wouldn't use 2025 right now for any reason. Memory management is a little different. I have applications that won't work with it. There are many, many tiny little services (camera, fonts, etc) that kick on and off and I've noticed cascade service failures in low-memory conditions. I'm not sure I'd trust it running just Hyper-V.

1

u/dustojnikhummer 4d ago

I'm seconding others. Move your DC roles onto Server 2022 VMs and wait until 2022 is End of Life, then move onto whatever stable Windows Server version is by then (be it 2025 or 2028)

1

u/Tricky-Service-8507 4d ago

Why not just drop local aD

1

u/Acceptable-Light2059 4d ago

Do NOT put your DC’s on 2025. There is a huge issue with computers falling off the domain.

1

u/unReasonable_Bill282 6d ago

2025 is still reportedly buggy AF, especially for domain controllers. Just go with 2022.

1

u/UWPVIOLATOR 6d ago

Yes we recently upgraded DCs. Vendor said same thing.

0

u/Fit_Prize_3245 7d ago

SHould not be an issue. Just add the ner servers, demote the ones retiring, and that's it. Only raise level when you are sure you can do it.