Event details
Join us for our March 9 “Ask Microsoft Anything” chat about Windows Server updates and upgrades. We’ll cover your questions on how to stay more secure by upgrading older servers (2008 and 2012 versions), the importance of running regular updates, and security features for Windows Server 2022 and Windows Server on Azure.
Please take a look at our recent blog for some additional context and information: https://azure.microsoft.com/en-us/blog/4-bestpractices-to-keep-your-windows-server-estate-secure-and-optimized/
For this March 9 AMA we’ll have members of Windows Servicing and Delivery team, Windows Server engineering, and security product managers available to answer your questions via chat.
This AMA is text only – meaning there will not be any video nor audio.
An AMA is a live online event similar to an “Ask Me Anything” on Reddit. This AMA gives you the opportunity to connect with members of Microsoft trainers and the product engineering team who will be on hand to answer your questions and listen to feedback.
Feel free to post your questions anytime in the comments below beforehand, if it fits your schedule or time zone better, though questions will not be answered until the live hour.
126 Comments
- devramdinOccasional ReaderHello! We have a use case for Reserved Storage but I can't find any documentation on how it works in Windows Server 2022 and very little for Windows 10.
- Artem Pronichkin
Microsoft
Hi Dev,
Reserved storage feature works in Windows Server 2022 similarly to how it works on latest versions of Windows 10 and Windows 11. Here's some documentation to get you started.
- Windows 10 and reserved storage
- Managing reserved storage in Windows 10 environments
- Get-WindowsReservedStorageState
- Set-WindowsReservedStorageState
Is there anything specific you're wondering about?
- devramdinOccasional Reader
Set-WindowsReservedStorageState doesn't actually turn it on. It appears successful and returns no errors but running Get-WindowsReservedStorageState afterwards shows it's not enabled so I was questioning if it's actually a supported feature on Windows Server.
- ms_edrusiBrass ContributorHello form Wisconsin, Lets close the triangle ;-)
- Janine-Patrick
Microsoft
Love it! Welcome Eduard! - Jeff-Woolsey
Microsoft
Hello and thanks for attending.
- User_ID_205188Brass ContributorOn SDC 2019 conference there was a talk about "Monolithic Cloud SSD driver" for Hyper-V VMs. Is it still in development? SAS emulation feels more and more dated https://www.snia.org/educational-library/cssd-new-monolithic-cloud-nvme-storage-driver-2019
- Jeff-Woolsey
Microsoft
There is nothing to share at this time.
- mtisdelCopper ContributorI'm a random I.T. dude/generalist at a Random MSP from Spartanburg SC. We have a lot of servers to update. I could not find the *supported* in-place scenarios page. If you can point me to that, I would appreciate it. For instance, does MS support going from 2012r2 to 2022? What about 2012 to 2022?
- Cliff_Fisher
Microsoft
The typically supported scenario is that you can upgrade up to 2 OS versions above what you're currently running. There's a table in the following doc: https://learn.microsoft.com/en-us/windows-server/get-started/upgrade-overview#which-version-of-windows-server-should-i-upgrade-to
- ViniciusApolinario
Microsoft
Hey Folks, Vinicius here working on Windows containers and Kubernetes. If you have applications running on older versions of Windows Server, specially web applications, but also background apps, console apps, schedule tasks, etc. you should also consider moving to Windows containers. The upgrade after the initial containerization process is much simpler and smooth. I'd be happy to take questions on this if you're interested!- ViniciusApolinario
Microsoft
In fact, we documented a lot of information you should know when moving an existing application to Windows containers: https://learn.microsoft.com/virtualization/windowscontainers/quick-start/lift-shift-to-containers
- ABarone19Copper Contributor
Are there any scenarios that you do not recommend doing an upgrade such as VMware hosted, or a server with a particular role?
- Jeff-Woolsey
Microsoft
Lots of questions about in place upgrades. Keep in mind that we invested time and resources in Windows Server 2019, and even more in Windows Server 2022, to make in place upgrades "just work." The Windows Server team support in place upgrades (up to N+2), but in place upgrades is more than the operating system. Ask yourself two questions:
What is the app you are upgrading?
Is this an inbox app (role) like file server, IIS, print? It should just work. (NOTE: Domain controllers are a special case. For DCs, install new DC, sync with old, promote new and demote old.)
Is this an app installed on the OS? SQL Server? Exchange? SharePoint? 3rd Party App? Consult their documentation. Some apps may support it, some may not. The support decision is up to the app owner. For example, if you have some Oracle app running on Windows Server and Oracle states they don't support in place upgrades, that's their support decision.
What is the underlying platform?
Is this app running in a virtual machine or on hardware?
If the app is running in a VM, things are easier because the virtualized hardware will likely look the same. For Hyper-V, the guest drivers are automatically updated, so it's EASY. For third party virtualization, see them and don't forget to update the guest drivers. A common support issue is that folks are running ancient 3rd party VM guest drivers.
If the app is running on hardware, proceed with caution especially in the N+2 scenario. For example, imagine you have hardware originally running Windows Server 2012 R2 and now you want to in place upgrade to Windows Server 2019. That's a big span.
- Is the new hardware certified for the new OS?
- Are there drivers for the new OS? Be sure to look at I/O. Storage controllers, Network Adapters.
Backups
Finally, always have backup before performing in place upgrades. If you're virtualized this is easy. If you're on hardware make sure you perform an appropriate backup.
- Michael PainterCopper ContributorMy experience is that Small Business Server 2011 and earlier that came bundled with Exchange and or Sharepoint can be a PITA to upgrade. Best practices dictate creating new VM with modern OS and migrate roles and features. Or for smaller organizations, just create a new Domain Structure, and either migrate accounts via domain trust relationship or manually recreate the OUs and Users, remove workstations from old domain and join to new domain.
- ABarone19Copper ContributorAh cool. Our earliest version is 2012r2 so I think we should be good on that end. Thankfully got off of onprem exchange ages ago!
- haywirez_maqCopper ContributorAre there any considerations to address when attempting to upgrade a 2008 domain controller?
- CharlieFraserCopper ContributorAbout 2 years ago I migrated our DC's to 2016. It went very well. If you have DNS scavenging rules, some of them are server specific. You will need to set them on one of the new servers. The biggest things are upgrading replication and testing.
- Jeff-Woolsey
Microsoft
The recommended way to upgrade a domain is to promote domain controllers that run newer versions of Windows Server & demote older DCs as needed. Details here: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers- Paul SabinCopper ContributorAlso be aware that you will need to change your file replication type from FRS to DFSR, if you haven’t already, before adding a 2022 DC.
- MattTheSysAdminBrass Contributor
Help me with my understanding of Kerberos and its interaction with Server 2003 please (I know, they should be long dead already, but business needs yada yada yada)
We have Server 2003's that after the November patches decided to not get Kerberos tickets anymore. Well, they can pull them but they all show as (Unknown 18), meaning they are encrypted in AES256, hence they can't read them. That is except for odd exceptions where they CAN pull HOST tokens only using RC4.
We've opened tickets, but the Microsoft Support line is 'We don't support 2003', which I completely understand, but sadly I don't have the ability to just drop them.
Question:
Can we make the Servers stop using Kerberos for anything, and make them fall back to NTLM, instead of pulling these AES Kerberos tickets they can't use?Or any other idea I haven't thought of? We've tried all documented workarounds, but they just don't work on 2003....
- Keith_HoffmanFormer EmployeeOur recommendations in this case would be to: 1. Upgrade your legacy Server 2003 systems to a supported OS that is still getting security updates 2. Air gap any legacy systems you cannot immediately upgrade 3. Place any legacy systems you cannot immediately upgrade into their own domain structure The hardening included in the November update is there to help our customers be more secure as we know RC4 and DES are easily compromised. So along the lines of keeping things as secure/safe as possible, we would not recommend doing *anything* to try to work around the hardening.
- MattTheSysAdminBrass ContributorThanks Keith. That's what we're recommending, but we're turning over all stones to try and get our domain controllers immediately patched beyond November to try and avoid even more security holes... Heaven forbid there's a zero day in the near future....
- CharlieFraserCopper ContributorWe fixed our that issue by turning them off the 2003 server just recently.
- MattTheSysAdminBrass ContributorYeah, its nice to give them this kick to actually reinforce what we've been saying! Sad it took these incidents to make them actually act, but that's people for you. Sadly we've got >200 of these damn servers clogging up my infrastructure so turning them off is a bigger project. Looking for workarounds for now so we can patch our DC's
- haywirez_maqCopper ContributorHi Mike Hayward from Iowa
- Jeff-Woolsey
Microsoft
Hi Mike, thanks for being here. - Janine-Patrick
Microsoft
Hi Mike - thanks for joining us!
- haywirez_maqCopper ContributorIs there an upgrade path from Small Business Server 2011?
- Elden_Christensen
Microsoft
Windows Small Business Server 2011 was the last version of SBS. SBS was replaced by Windows Server Essentials. Essentials in WS2022 is an OEM only release which is just a reduced price license for Standard, all of the special Essentials / SBS features have been removed. Thanks! Elden - Michael PainterCopper ContributorI am currently working a SBS 2011 upgrade project. These versions with baked-in Exchange/Sharepoint appear to be problematic. As mentioned before, most organizations using this were small, under 50 users at any rate, so the time it takes to just create a new VM with Server 2022 Essentials, and then recreate all users and OUs, as opposed to try to upgrade is most likely the best and known conclusion. I am sure that one needs to remove the Exchange and Sharepoint roles and files before an upgrade to Server 2012 R2 is even possible. An upgrade would also most likely leave a lot of AD objects and attributes that are of no use.