Hello Windows Server Insiders!

Today we are pleased to release a new build of the next Windows Server Long-Term Servicing Channel (LTSC) Preview that contains both the Desktop Experience and Server Core installation options for Datacenter and Standard editions and Azure Edition (for VM evaluation only). Branding remains Windows Server 2025 in this preview - when reporting issues please refer to Windows Server vNext preview. 

Build 29531 established a new Server preview baseline build.  Please perform a clean install of Build 29531 (or later) using the installation media linked below. 

Please note: Upgrades from Windows Server vNext preview builds older than 29531 are not supported. We encourage all Windows Server vNext preview users to perform a clean install using 29531 or later to successfully upgrade to future Windows Server vNext preview builds.   

• While upgrades from earlier Windows Server previews (Build 26525 and older) are not technically blocked by setup.exe, a number of known issues have been identified related to upgrades necessitating the establishment of a new baseline build for our Server vNext Preview Program. 
• The new baseline build (29531) will not be Flighted due to upgrade issues. Flighting support resumed with preview build 29550 or later. 

What's New 

[NEW] Introducing MSHardenedPolicyEval: Evaluating new default hardened security settings on Windows Server Core

Windows Server Core ships with a broad set of security-related configuration options spanning authentication, credential protection, cryptography and TLS, auditing, event logging, exploit mitigations, networking, PowerShell, printing, remote management, SMB, UAC, firewall policy, and more. Knowing whether a given machine is actually configured to the new default hardened values for all of these areas — and getting it there consistently — has traditionally required stitching together multiple tools and manual checks. MSHardenedPolicyEval.exe  is a new built-in command-line tool that consolidates this into a single, authoritative mechanism. It evaluates the current machine state against a curated catalog of hardening policies spanning the registry, Local Security Authority (LSA) rights and SID assignments, audit subcategories, and SAM settings, and reports a per-group and overall hardening score. It can also apply the hardened values directly, or revert them back to their Windows Server 2025 defaults, making it useful both as a standalone assessment tool and as the mechanism behind scheduled hardening tasks on the system.

The tool exists to give administrators and Insiders a transparent, scriptable way to answer "how hardened is this server, and in what areas am I falling short?" without having to manually inspect dozens of registry keys, audit policies, and LSA settings. Because the same policy tables drive evaluation, apply, and revert, there's no drift between what's measured and what's enforced — a setting that counts toward your score is exactly the setting  -ap  will configure. Scores and policy bitmasks can be surfaced through the Windows event log and, optionally, TraceLogging, so the results are consumable by monitoring and telemetry pipelines rather than only by someone watching a console.

For supported usage: %SystemRoot%\System32\MSHardenedPolicyEval.exe must be run from an elevated administrator prompt and only runs on Windows Server SKUs. Running it with no arguments performs a read-only evaluation.

-v for verbose per-group and overall scores

-ap [selectors] to apply hardened values

-rp [selectors] to revert to non-hardened values 

Omit the selector list to act on every supported group, or target specific categories/groups (e.g., -ap registry, -rp Printing, or -ap Audit,LSA) using comma-, semicolon-, or vertical-bar-separated, case-insensitive selectors. 

-l [path] persists output to a log file (defaulting under %SystemRoot%\System32\LogFiles\MSHardenedPolicyEval\)  

-t emits scores via TraceLogging

Note: Keep in mind that applying or reverting policy can require a reboot before the change is fully in effect, and some operations affect security-sensitive configurations — review the selectors you intend to use before running -ap / -rp broadly in critical environments.

Feedback Hub app is available for Server Desktop users!  The app should automatically update with the latest version, but if it does not, simply Check for updates in the app’s settings tab. 

Known Issues 

A race condition in the TLS hybrid key exchange implementation may cause the LSASS service to crash when hybrid groups are negotiated by a TLS server. To avoid this issue until the fix is released, please disable hybrid groups (X25519_MLKEM768, SecP256r1_MLKEM768, SecP384r1_MLKEM1024) using TLS cmdlets or Group Policy, as outlined here.

Server Core Upgrades and AppCompat FOD: Enabling AppCompat FOD after reinstall may fail due to legacy 3rd-party license compatibility issues on Server Core devices. Server Core users may be unable to install the latest AppCompat FOD after upgrading to build 29574. This appears to be limited to Server Core installations with 3rd-party application licenses that fail compatibility checks after upgrade. This will be addressed in a future build.

Upgrading from older builds of Windows Server vNext previews (26525 or older) are not supported. Please perform a clean install of build 29531 or later. Users may experience failures when attempting to upgrade from earlier previews (build 26525 and older). VMs may fail to upgrade or start after upgrade from older preview builds impacting live migration and failover cluster scenarios. 

Download Windows Server Insider Preview (microsoft.com)  Flighting: The label for this flight may incorrectly reference Windows 11. However, when selected, the package installed is the Windows Server vNext update. Please ignore the label and proceed with installing your flight. This issue will be addressed in a future release. 

Available Downloads 

Downloads to certain countries may not be available. See Microsoft suspends new sales in Russia - Microsoft On the Issues. 

• Windows Server Long-Term Servicing Channel Preview in ISO format in 18 languages, and in VHDX format in English only.  
• Windows Server Datacenter Azure Edition Preview in ISO and VHDX format, English only. 
• Microsoft Server Languages and Optional Features Preview  

 Keys: Keys are valid for preview builds only  

• Server Standard: MFY9F-XBN2F-TYFMP-CCV49-RMYVH 
• Datacenter: 2KNJJ-33Y9H-2GXGX-KMQWH-G6H67 
• Azure Edition does not accept a key. 

Symbols:  Available on the public symbol server – see Using the Microsoft Symbol Server.  

Expiration: This Windows Server Preview will expire October 15, 2027. 

How to Download

Registered Insiders may navigate directly to the Windows Server Insider Preview download page.   If you have not yet registered as an Insider, see GETTING STARTED WITH SERVER on the Windows Insiders for Business portal.

We value your feedback! 

The most important part of the release cycle is to hear what's working and what needs to be improved, so your feedback is extremely valued. Please use the new Feedback Hub app for Windows Server if you are running a Desktop version of Server. If you are using a Core edition, or if you are unable to use the Feedback Hub app, you can use your registered Windows 10 or Windows 11 Insider device and use the Feedback Hub application.  In the app, choose the Windows Server category and then the appropriate subcategory for your feedback. In the title of the Feedback, please indicate the build number you are providing feedback on as shown below to ensure that your issue is attributed to the right version: 

     [Server #####] Title of my feedback 

See Give Feedback on Windows Server via Feedback Hub for specifics.  

The Windows Server Insiders space on the Microsoft Tech Communities supports preview builds of the next version of Windows Server. Use the forum to collaborate, share and learn from experts.  For versions that have been released to general availability in market, try the Windows Server for IT Pro forum or contact Support for Business. 

Diagnostic and Usage Information

Microsoft collects this information over the internet to help keep Windows secure and up to date, troubleshoot problems, and make product improvements. Microsoft server operating systems can be configured to turn diagnostic data off, send Required diagnostic data, or send Optional diagnostic data.  During previews, Microsoft asks that you change the default setting to Optional to provide the best automatic feedback and help us improve the final product.

Administrators can change the level of information collection through Settings. For details, see http://aka.ms/winserverdata. Also see the Microsoft Privacy Statement.

Terms of Use

This is pre-release software - it is provided for use "as-is" and is not supported in production environments. Users are responsible for installing any updates that may be made available from Windows Update. All pre-release software made available to you via the Windows Server Insider program is governed by the Insider Terms of Use.