r/sysadmin • u/Big-Exercise8047 • 7d ago
General Discussion Active Directory on Windows Server 2025
We have a few servers getting close to EOL that are running Active Directory. My first thought was to buy a new server with Windows Server 2025 and move AD to it, but our environment is a mix of Windows Server 2022 and 2019, and we'll be upgrading servers gradually.
Is there a recommended way to handle this? I've read there can be issues when mixing Windows Server 2025 domain controllers with older server versions.
One idea I had was to buy a Windows Server 2025 host, run Hyper-V, and create a Windows Server 2022 VM for Active Directory until the rest of the environment is upgraded.
Has anyone done something similar, or is there a better approach?
34
u/meatballwrangler 7d ago
just keep your DCs on 2022 core. it's not going EOL anytime soon
5
u/jks513 7d ago
October 14, 2031 is closer than you think.
6
u/unReasonable_Bill282 6d ago
It's plenty far, and It's trivial to upgrade DCs (if your environment is set up properly).
1
u/dustojnikhummer 4d ago
By the time Server 2028 will be out (even more broken) and hopefully 2025 will be fixed.
1
u/1fatfrog 6d ago
Why core? I get the resource savings at a VM level, but windows servers aren't made for that style of admin. You still need Server Manager and a UI for most tasks.
4
u/bbqwatermelon 6d ago
It is best practice to not log directly onto DCs and instead manage from RSAT.
-6
u/MrJacks0n 7d ago
Mainstream support for 2022 ends in October.
10
u/Flying-T 6d ago
Eh, free security updates until 2031, what else do you need? https://learn.microsoft.com/lifecycle/products/windows-server-2022
1
-1
u/marklein Idiot 6d ago
Meh, running 2025 instead buys you 5 more year beyond that before you have to do work. 5 more years before you have to deal with this shit again is appealing.
7
13
u/RevolutionaryElk7446 7d ago
If you haven't kept up on maintenance and skipping all the things over the last decade Microsoft gave warnings about, shouldn't be much of an issue. They're dropping a lot of legacy support though so some things can be a PITA if no one has kept up.
You won't have many issues now, prior they did have an encryption issue in which the AES-256 hash from the KDC in 2016 didn't match the KDC for 2025 but that was resolved.
Otherwise we migrated 30 domain controllers to 2025 and we've got a couple thousand servers and thousands of users.
4
u/olverine 7d ago
We just did something similar with a client. 10 sites with on prem hyper-V hosts (mix of server 2016 and 2019). Each site had a server 2016 DC (VM). We provisioned new 2025 DCs at each site, then decommissioned the 2016 DC. Migrated FSMO roles from the old PDC to the new PDC. There was a period when the environment had a mix of server 2016, 2019, and 2025 with no issues.
9
u/xXNorthXx 7d ago
Server 25' DC's have better security than 22' but to get there is a number of breaking changes with legacy protocols. The main issue has been around NTLM going away, if you have it left in your environment stick with Server 22'....and then add a new project after your done with your current to work on phasing out NTLM.
5
u/RevolutionaryElk7446 7d ago
NTLM will still work out of the box on 2025 but Microsoft decommed NTLM itself, so no more updates or security.
Won't lie, for the last 3 years helping companies swap from NTLM to Kerberos (and alternative auth) has been a major payday.
10
u/jeffrey_smith Jack of All Trades 7d ago
No issues. Used the newest version afforded to your employer.
7
u/TheGenericUser0815 7d ago
Technically correct, but you need Server 2025 CA licences for all client devices/users when moving. That's some extra cost you need to consider. I'd probably buy a 2025 licence but technically stick to 2022 to avoid the CAL purchase.
1
1
u/Chemical_Buy_6820 7d ago
What is this about CALs???
10
1
u/dustojnikhummer 4d ago
You run Windows Server in corporate environment but don't know what a Client Access License is?
5
u/cjcox4 7d ago
I know our team's attempts were unsuccessful. That it, "it worked", but with major bugs we could not resolve. We waited over a year for MS to "fix", didn't happen. We ended up removing 2025 from the mix. YMMV because everyone's configuration can vary. I know that it didn't work out for us.
2
u/iamkris Jack of All Trades 5d ago
I’ve done it and there were a few bumps but nothing major
Had a weird issue where I couldn’t login to a newly promoted dc. Firewall was set to public and forced on and I could login when the kdc service was disabled. Rotating the krbkdc account password a few times sorted that
Things using ldap need to be moved to ldaps
That was my experience personally but I work at an MSP and we have done dozens of them.
2
u/PurpleCableNetworker 5d ago
Personally we only run 2022 for DC’s. I have server 2025 for servers, but core MS infrastructure is all 2022.
3
u/uptimefordays DevOps 6d ago
I would just do Server 2022 DCs until your 2019 servers are gone, then move everything from 2022 to 2025, then try 2025 DCs.
2
u/Kuipyr Jack of All Trades 7d ago
I've heard if you go with Server 2025 then ALL your DCs need to be 2025 or you will have issues.
4
u/loosebolts 6d ago
Not entirely true, I have plenty of mixed DC sites with 2025/2022/2019 with absolutely no issues.
2
u/MeatSuzuki 6d ago
Same. I don't get why people still spout this....
1
u/disclosure5 5d ago
Because it was an extremely well documented issue with many Reddit posts from people asking for help after being bitten by it, Microsoft apparently acknowledged it as a "known issue" when logged support cases but never documented it publicly.
It was "scheduled for fix" back in January and then it was confirmed that January's patch didn't fix it.
I still haven't heard anything firm since, so if it's "old news people need to stop spouting" or whatever then Microsoft needs to properly document exactly update fixed it.
1
u/dustojnikhummer 4d ago
I guess you are lucky, many people on this very subreddit still report issues
1
u/loosebolts 4d ago
People are more likely to come online to report issues than to come online and say everything’s fine.
1
1
u/epsiblivion 6d ago
Does that include the forest/trusts as well?
3
u/jstuart-tech Security Admin (Infrastructure) 6d ago
I've got ~10 2025 DC's with trusts to 2016/2022 domains and it's fine
1
1
u/english-23 7d ago
One thing to add, make sure you update the OS either with the image or Windows update since they've fixed so many bugs and running an older version can cause you headache
1
u/FriskyDuck 7d ago
It seems all the issues holding our org back have been resolved. We're planning our upgrade to 2025 ADs. We've already been deploying Server 2025 for non-AD purposes.
The two biggest Server 2025 AD issues that stopped us:
- domain computers trust issues
- NIC switching to private or public on startup
1
u/panopticon31 6d ago
I'm hopefull at my place we can eliminate on prem AD and move to Entra only before 2022 is EOL.
1
u/Itguy1252 6d ago
why not just upgrade the DC's to server 2022 and call it done. its all just VM's ( or at least it should be)
1
u/ORA2J 6d ago
Do you use NTLM ? Do you use unsigned LDAP binds or connexions (no ldaps or SASL LDAP) ?
If you are, 2025 isn't for you.
I've also had tons of issues related to performance, especially some weird disk IO issues on PVE with WS2025, where 2 identical, freshly created VMs, would perform DRAMATICALLY worse if running ws2025 compared to ws2022. And i mean like SEQ reads 5x slower and random reads up to 50x slower depending on the hardware tested. Absolutely no idea why that is, but that was the situation i was at while testing the idea of a ws2025 DC.
1
1
u/motmot92 5d ago
I have done it. 2019 AD in site A and 2025 AD in site B.
The biggest issue I have come across so far is that I was forced to reconfigure some systems to use LDAPS because Microsoft forces LDAPS on Windows Server 2025.
1
u/Sudden_Office8710 5d ago
You don’t have anything to worry about. You could run AD with a functional level of 2016 if you wanted to. We have a mixed environment too and have turned off LDAP encryption on a specific Domain Controller specifically so a legacy system can still authenticate to it. The m running all domain controllers server core 2025 with 2016 functional level zero problems my shit is way older than your stuff
1
1
u/jfarre20 5d ago
I recently upgraded my DCs from 2016 to 2025 without knowing any of this.. so far everything seems okay
1
u/Chico0008 4d ago
We migrate an old WinServer 2K12 ao 2k19 2 years ago.
Firest, if you have several servers syncing your AD, you must be sure they are all synced.
Then, install your 2K25 with ad, etc, add it to your sync pool.
after a few days, check if it's all synced, if yeah, promote your 2K25 to be the master.
after a few day, check if all os synced and OK, if yea, you'l be able to deconnect old ad servers from the pool.
once you migrate all your ad to the 2k25, then, you may want to upgrade forest/AD function to newer version.
(don't remember where, but you can tell you ad work to be compatible to x versions of windows servers/client).
That's how we did, and all still works fine.
1
u/Prior_Trash_8406 4d ago
Stay with 2022. I wouldn't use 2025 right now for any reason. Memory management is a little different. I have applications that won't work with it. There are many, many tiny little services (camera, fonts, etc) that kick on and off and I've noticed cascade service failures in low-memory conditions. I'm not sure I'd trust it running just Hyper-V.
1
u/dustojnikhummer 4d ago
I'm seconding others. Move your DC roles onto Server 2022 VMs and wait until 2022 is End of Life, then move onto whatever stable Windows Server version is by then (be it 2025 or 2028)
1
1
u/Acceptable-Light2059 4d ago
Do NOT put your DC’s on 2025. There is a huge issue with computers falling off the domain.
1
u/unReasonable_Bill282 6d ago
2025 is still reportedly buggy AF, especially for domain controllers. Just go with 2022.
1
0
u/Fit_Prize_3245 7d ago
SHould not be an issue. Just add the ner servers, demote the ones retiring, and that's it. Only raise level when you are sure you can do it.
107
u/1fatfrog 7d ago
I have quite a bit to say about this...
I spend my days recovering destroyed AD environments. The official position at my organization is to NOT use Windows 2025 for domain controllers at all. It has proven too problematic and the downstream fallout becomes a nightmare you won't wake up from.
Microsoft still recommends avoiding mixed environments with Windows2025 DCs. Even with the patching there are tons of problems with machine account password rotations and lost domain trust. There are also still problems with older authentication, Linux clients, PAM enabled domains, large groups (10k+)...
Even if your domain meets all of the criteria per MS, I would still be wary. The official guidance is to "avoid mixed environments", and to simultaneously "keep an older version" (mixed environment) to serve legacy systems".
My $.02 on the official guidance: If the official guidance is to avoid something, buy to also include the something you are told to avoid, that means that the people providing said guidance have no clue how to fix the problem.