Windows Server 2025 reached general availability on November 1, and in many of the hybrid environments I work with, that has started another round of upgrade planning. The motivation varies. Some organisations just want to stay ahead of support deadlines, while others see actual value in features like better patching and tighter security. If you run a mix of on-premises and Azure servers, Windows Server 2025 is worth a careful look, particularly where it introduces new integration points and changes how you operate your servers.

Hotpatching outside Azure requires Azure Arc and a subscription

The addition I find most interesting is that hotpatching is no longer limited to Azure VMs. With Windows Server 2025 Standard and Datacenter, you can now hotpatch on-premises servers, as long as you onboard them to Azure Arc. At launch this is still a preview feature, so treat it like one. The idea itself is appealing, though, because security updates go on without a server reboot. You need an active Azure subscription, since hotpatching is sold as an add-on service. Servers are onboarded in the Azure portal under Azure Arc → Machines → Add. In my experience it pays to try hotpatching on lab systems first and keep a close eye on the update chain. With any preview, you want a rollback plan ready.

This simple diagram shows how the hotpatching flow works once Azure Arc is involved:

flowchart TD
    OnPremiseServer["On-premises server"] --> AzureArc["Azure Arc onboarding"]
    AzureArc --> HotpatchService["Hotpatch service (preview)"]
    HotpatchService --> UpdateDeployment["Update without reboot"]

Figure: Hotpatching for Windows Server 2025 via Azure Arc onboarding

Microsoft lists all prerequisites and the current status in its documentation: What's new in Windows Server 2025 and Windows Server hotpatching.

Active Directory gets a new functional level, TLS defaults and migration options

A lot of hybrid organisations are planning Active Directory upgrades as part of their move to Windows Server 2025. The new forest functional level has some real benefits. Database pages grow to 32k, which improves performance and gives larger directories more room. The bigger change for me is that LDAP is now secured by TLS by default at this level, and that is a welcome step for security. Before you upgrade, check your legacy applications for LDAP over TLS compatibility. I regularly see authentication problems pop up when older apps run into new security defaults nobody tested against.

In-place upgrades of domain controllers are supported. Still, many teams take the gradual route, bringing up 2025 DCs next to the older ones and moving roles and services over step by step, and I think that's the sensible choice. Also make sure your backup and monitoring tools work with the new AD forest level.

Pro tip: Always have a rollback scenario for domain controller upgrades. Snapshots or system state backups will save you hours if something goes wrong.

SMB over QUIC reaches all editions and security improves further

One feature that gets overlooked: SMB over QUIC now ships in all editions. Secure, encrypted file transfer over the internet or other untrusted networks therefore becomes a realistic option for smaller environments too. In hybrid setups with Azure Files or remote access, you get more flexibility without giving anything up on security.

Credential Guard is now on by default on supported hardware, which gives you better protection against credential theft and pass-the-hash attacks. I'm glad to see this, since more and more admins I meet use Windows Server-based workstations for privileged tasks. If you're working towards strong security baselines, check the Credential Guard status regularly. Group Policy makes that easy.

Azure Arc onboarding becomes the prerequisite for modern management

Most of the headline features, hotpatching above all, only work once Windows Server 2025 is onboarded into Azure Arc. Onboarding itself is simple. In the Azure portal, go to Azure Arc → Machines → Add. You need an Azure subscription and local admin rights on the server. With larger server estates, automating this through a script or policy makes sense. Before you start using hotpatching for patch management, look closely at the billing model and at how it fits your current maintenance windows and processes.

If you want a quick overview of which servers are already connected, run this PowerShell command (on the target server, with admin rights; it requires the Az.ConnectedMachine module and an Azure login):

Get-AzConnectedMachine | Where-Object { $_.OSName -like "*Windows Server 2025*" }

I see a strong step forward, but the foundations need attention

Windows Server 2025 brings solid improvements for hybrid scenarios, and hotpatching, the new Active Directory features and SMB over QUIC are the ones I'd single out. In practice, though, Azure Arc now sits underneath much of what's new, and any larger migration project needs careful preparation and a rollback plan. If you want your hybrid setup to benefit, get the onboarding right and set aside time to test the new features safely before you rely on them.

If you'd like to read more, my earlier posts on Windows Server 2012 ESU via Azure Arc and Azure Update Manager cover a lot of ground that still applies to Windows Server 2025 deployments.