rss.livelink.threads-in-node

Arm 64 mseries windows server

vasundharamareedu — Fri, 24 Jul 2026 18:46:30 GMT

I have downloaded and done every step tht is possible at the end i have recieved this error I have tried all the prompts to correct the error but couldnt
FYI: VMware fusion on m series mac

Could anyone please lead.

Cannot Connect to VMs in Windows Admin Center

jr2299 — Fri, 24 Jul 2026 10:09:29 GMT

Hi all,

I have 1 Server Cluster made up of 3 Server 2022 Hosts on which there is a large number of VMs running on Hyper-V.

The typical process for accessing the VMs has been through Windows Admin Center, which is hosted on one of the VMs in the cluster.

Around 1 week ago, it was no longer possible to connect to the VMs through Windows Admin Center as an infinite loading screen was presented. Sometimes, the following error shows up in VMConnect:

The cluster and servers are still connected to WAC and all the VMs that are expected are present on WAC.

Since then, the following things have been attempted:

- Restart all servers
- Rebuild WAC on Current VM
- Build WAC on Fresh VM with the same and different network configuration, using current (2606) and previous (2511) versions of WAC
- Build WAC on one of the hosts

All these attempts result in the same error as seen before.

Has anyone experienced this issue before? Or does anyone have any advice?

Thank you in advance!

Resize-StorageTier / Expand Volume on Windows Server 2025 Campus Cluster does not work

ThomasS-aus-S — Thu, 23 Jul 2026 11:27:53 GMT

Hi Insider Community!

Want to expand a CSV on an S2D Windows Server 2025 Campus Cluster. (4-nodes)

I get an error message.

Resize-StorageTier : Not enough available capacity

FullyQualifiedErrorId : StorageWMI 40000,Resize-StorageTier

Any hint for me?

Does Microsoft know about the issue?

Best regards

Thomas

Windows Server Datacenter: Azure Edition preview build 29621 now available in Azure

StaceyCL_RM — Wed, 15 Jul 2026 16:38:53 GMT

Hello Windows Server Insiders!

We welcome you to try Windows Server vNext Datacenter: Azure Edition preview build 29621 in both Desktop experience and Core version on the Microsoft Server Operating Systems Preview offer in Azure. Azure Edition is optimized for operation in the Azure environment. For additional information, see Preview: Windows Server VNext Datacenter (Azure Edition) for Azure Automanage on Microsoft Docs. For more information about this build, see Announcing Windows Server vNext Preview Build 29621 | Microsoft Community Hub.

How to check RDP access to the server

MC2026 — Wed, 15 Jul 2026 13:26:35 GMT

Hello,

I have a virtual machine running Windows Server 2019 Datacenter with Active Directory, and all users access it via RDP. No specific access configurations have been set up; I wanted to know if it is possible to check how many times a specific user has connected and from which IP address—is that possible? Also, I wanted to ask if it is possible to determine whether a specific user copied files to their local PC using copy/paste during a session.

Thank you

HLK test failing for a KMDF driver with error “A lower driver failed IRP_MN_QUERY_STOP_DEVICE”

RakeshAgrawal — Wed, 15 Jul 2026 12:17:40 GMT

Subject: HLK DF‑PNP Rebalance Fail Restart Device: E: target widens to all volumes; QueryStop fails even without my driver installed.

Hi all,
I’m trying to pass all HLK tests for my driver.

Driver: KMDF PnP volume upper‑filter (attached via UpperFilters to the Volume/Disk class)
OS: Windows Server 2016 Datacenter, build 14393
HLK: 10.1.14393.8069
Test: DF - PNP Rebalance Fail Restart Device (Reliability)
Target volume: E: (NTFS)
Storage: PERC H330 Mini (DELL) (HBA)

Observed behavior

The DQ initially targets E:, but the test later widens to all STORAGE\Volume devnodes:

WDTF_TARGETS : INFO : - Query("IsDevice AND (DriverBinaryNames!='i8042prt.sys') AND (Class!=hdc) AND (Class!=scsiadapter) AND (DsmDevice!=TRUE) AND (IsDevice AND (DriverBinaryNames!='i8042prt.sys') AND (Class!=hdc) AND (Class!=scsiadapter) AND (DsmDevice!=TRUE) AND (DeviceID='STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000'))")
WDTF_TARGETS : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6..
WDTF_SUPPORT : INFO : - ClearSetupAPILogs()
WDTF_TARGETS : INFO : - Query("IsDevice AND (SemiUniqueTargetHardwareIdentifier='STORAGE\Volume')")
WDTF_TARGETS : INFO : Target: Volume STORAGE\VOLUME{01FEB6..
WDTF_TARGETS : INFO : Target: Volume STORAGE\VOLUME{01FEB6..
WDTF_TARGETS : INFO : Target: Volume (C:) STORAGE\VOLUME{01FEB6..
WDTF_TARGETS : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6..

Failures report A lower driver failed IRP_MN_QUERY_STOP_DEVICE and PNP.RestartDevice() Win32=1 - Incorrect function.
For each of the 4 target volumes, it shows this error,

DTF_PNP : INFO : - EDTTryStopDeviceFailRestart()
WDTF_PNP : INFO : Target: Volume (C:) STORAGE\VOLUME{01FEB6EF-3717-11F1-9707-806E6F6E6963}#000000001F500000
WDTF_PNP : INFO : Result: A lower driver failed IRP_MN_QUERY_STOP_DEVICE. Rebalance tests cannot proceed...
WDTF_PNP : INFO : - EDTTryStopDeviceFailRestart()
WDTF_PNP : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000
WDTF_PNP : INFO : Result: A lower driver failed IRP_MN_QUERY_STOP_DEVICE. Rebalance tests cannot proceed...
WDTF_PNP : ERROR : PNP.RestartDevice() Win32=1 - Incorrect function.

WDTF_PNP : ERROR : PNP.RestartDevice() Win32=1 - Incorrect function.

Q1. I have tried multiple variations of the DQ query, and each successfully targets the E volume only. Why does this test later widen to all volumes even when DQ targets only E:? How can I force it to stay on E: ?

Q2. I also ran this on a physical server client and a VM client, but faced the same issue both times. I understand the system/boot volume may veto QueryStop, but why does each volume report ‘a lower driver failed IRP_MN_QUERY_STOP_DEVICE’ in this test?

Q3. I uninstalled my driver completely and still see the same failures when the test is running with only inbox drivers (e.g., msdmfilt.sys, volsnap.sys, volume.sys) listed by Driver Verifier for target E in the logs. That makes me suspect setup/config rather than my driver. Why would only these drivers fail the test as well, what am I missing here?

WDTF_DRIVER_VERIFIER : INFO : - EnableOnAllDriversOfDevices()
WDTF_DRIVER_VERIFIER : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000
WDTF_DRIVER_VERIFIER : INFO : Driver: msdmfilt.sys
WDTF_DRIVER_VERIFIER : INFO : Driver: volsnap.sys
WDTF_DRIVER_VERIFIER : INFO : Driver: volume.sys

Thanks for any guidance!

Announcing Trusted Launch for Virtual Machines for Windows Server Insiders

Christina_Curlette — Thu, 16 Jul 2026 01:53:49 GMT

Trusted Launch for virtual machines

We are excited to announce Trusted Launch for virtual machines (TVMs) in Windows Server Insider Preview. Trusted Launch is a security feature you can enable when creating Hyper-V Generation 2 VMs. It enables Secure Boot, installs a virtual Trusted Platform Module (vTPM), protects vTPM state at rest, and supports boot integrity verification (ability to verify if the VM started in a well-known good state).

Further, when the VM runs in a Failover Cluster, the vTPM state is automatically made available when the VM live migrates or fails over to other nodes in the cluster – this ensures the VM remains available after migration or failover. This is unlike a Generation 2 VM with a vTPM, which will not start after migration or failover to another node in the cluster – the TPM state protection key needs to be moved to the destination node manually so the VM can start.

With boot integrity verification, the entire boot path is measured and boot integrity is verified by Microsoft Azure Attestation service. This helps detect any alterations to the boot path or boot components. Such alterations, e.g. implanting malware in the boot path, can be detected by boot integrity verification.

Increasingly attackers prefer implanting malware in the boot path for a variety of reasons: the OS layer is usually well protected, while firmware – as highly privileged code – can be used to alter what gets loaded (boot loader and drivers). Such alterations are not easily detectable by anti-virus software running at the OS layer. Boot integrity verification helps detect such alterations so a relying party (such as an app or service) can take suitable remediation actions, e.g. shutting down the VM. Boot integrity verification is an important part of establishing trust by verifying that the virtual machine started in a well-known good state.

Insider preview

TVMs are available for preview starting with Windows Server Insider preview build 29621. This initial preview only supports some of the Trusted Launch capabilities: Secure boot, vTPM, and vTPM state protection (at rest). You can create and manage TVMs using PowerShell.

Guest state protection: The guest state (including the vTPM state) for each TVM is protected using a unique key that is stored in a KSP (Key Storage Provider) local to the server. Without this key, the VM will not start. Moving the VM to another server is not supported in this release.

Not supported in this release:

Moving TVMs to another server.

TVMs in Failover Clusters or Hyper-V Replica.

Boot integrity verification.

Support for TVMs in Windows Admin Center (WAC).

Instructions

At a high-level, the steps involve:

Install Windows Server Insider preview build on your server

Enable Hyper-V

Enable Trusted Launch feature

Verify guest state protection

1. Install Windows Server Insider preview build
Trusted Launch for virtual machines is available starting with the Windows Insider preview build number 29621. Install this build or a later build on your server. (Join Windows Server Insiders if you haven’t already!)

2. Enable Hyper-V (if it is not already enabled)

Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -Restart

After enabling Hyper-V, the server needs to be restarted.

3. Set registry key property value (required to enable the Trusted Launch feature)

New-Item -Path "HKLM:\SOFTWARE\Microsoft\AszIgvmAgent" -Force New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\AszIgvmAgent" -Name "TvmWinServer" -Value 1 -PropertyType DWord -Force

Setting the above regkey informs relevant system components that the Trusted Launch feature is being used in a Windows Server environment.

4. Enable Trusted Launch feature

Enable-WindowsOptionalFeature -Online -FeatureName "IsolatedGuestVm" -NoRestart

5. Verify if IgvmAgent is running

IgvmAgent (Isolated Guest Virtual Machine agent) is a system-level service that helps support Trusted Launch capabilities.

Get-Service -Name "IGVmAgent"

The output should show Status as Running.

If the Status is Running, you can skip to next step.

If the Status is not Running, please report the issue. Add the following event logs to the report:

Event Viewer: Applications and Services Logs => Microsoft => Windows => IGVmAgent => Operational
Event Viewer: Applications and Services Logs => Microsoft => Windows => IGVmSystem => Operational

You can open Event Viewer via the Run dialog:

Press Win + R → type "eventvwr.msc" → press Enter

6. Create an external virtual switch (if you don't already have one you can use)

Create and configure a virtual switch with Hyper-V | Microsoft Learn  

To see available external virtual switches:

(Get-VMSwitch | Where-Object { $_.SwitchType -eq "External" }).Name

7. Create TVM

If you already have a virtual hard disk (VHD or VHDX) for a Gen 2 VM with an installed guest OS, run:

New-VM -Name <VMName> -Generation 2 -GuestStateIsolationType TrustedLaunch -SwitchName <virtual switch name> -VHDPath <path to vhdx> -Path <path to where VM config files will be stored>

Else, run:

New-VM -Name <VMName> -SwitchName <virtual switch name> -NewVHDPath <path to where new VHD will be stored> -NewVHDSizeBytes 40GB -Generation 2 -GuestStateIsolationType TrustedLaunch -Path <path to where VM config files will be stored>

Then, add to the VM a virtual DVD drive containing an ISO image for the guest OS (Windows or Linux OS-compatible with Hyper-V Gen 2 virtual machine).

 Add-VMDvdDrive -VMName <VMName> -Path <Guest OS ISO image path>

Note: The guest OS will be installed when the VM starts up. When connecting to the VM you will be prompted to install the guest OS from the DVD drive. Make sure that the DVD drive is at the top of the boot order specified in the firmware so the VM will boot from the DVD drive.

For more information, see New-VM.

8. Verify VM guest state isolation type

(Get-VM -name <VMName>).GuestStateIsolationType

should return "TrustedLaunch".

9. Verify guest state protection

To verify guest state protection, stop IGVmAgent service and restart the VM.

Without IGVmAgent in Running state, a TVM with guest state protection will not start.

Call to action

Trusted Launch brings foundational VM security — Secure Boot, a vTPM, and protected guest state — to Windows Server, helping safeguard your VMs against boot-level and firmware threats. Please try out TVMs and provide your feedback via the Windows Server Insiders Forum.

—
Christina Curlette and Ram Jeyaraman (and the Windows Server team)

Announcing Windows Server vNext Preview Build 29621

StaceyCL_RM — Thu, 16 Jul 2026 00:11:28 GMT

Hello Windows Server Insiders!

Today we are pleased to release a new build of the next Windows Server Long-Term Servicing Channel (LTSC) Preview that contains both the Desktop Experience and Server Core installation options for Datacenter and Standard editions and Azure Edition (for VM evaluation only). Branding remains Windows Server 2025 in this preview - when reporting issues please refer to Windows Server vNext preview.

Build 29531 established a new Server preview baseline build. Please perform a clean install of Build 29531 (or later) using the installation media linked below.

Please note: Upgrades from Windows Server vNext preview builds older than 29531 are not supported. We encourage all Windows Server vNext preview users to perform a clean install using 29531 or later to successfully upgrade to future Windows Server vNext preview builds.

While upgrades from earlier Windows Server previews (Build 26525 and older) are not technically blocked by setup.exe, a number of known issues have been identified related to upgrades necessitating the establishment of a new baseline build for our Server vNext Preview Program.
The new baseline build (29531) will not be Flighted due to upgrade issues. Flighting support resumed with preview build 29550 or later.

What's New

[NEW] We're excited to announce Trusted Launch for virtual machines (TVMs) on Windows Server—a security feature you can enable when creating Generation 2 VMs.

This initial preview supports TVMs with Secure Boot, vTPM, and vTPM state protection (at rest), managed via PowerShell.

⚠ Not supported in this release:

Moving TVMs to another server

TVMs in failover clusters or Hyper-V Replica

Boot integrity verification

TVMs in Windows Admin Center (WAC)

Instructions

1. Install the latest ServerInsider preview build.

2. Enable Hyper-V (restarts the server):

Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -Restart

3. Set the registry keys:

New-Item -Path "HKLM:\SOFTWARE\Microsoft\AszIgvmAgent" -Force 

New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\AszIgvmAgent" -Name "TvmWinServer" -Value 1 -PropertyType DWord -Force

4. Enable Trusted Launch:

Enable-WindowsOptionalFeature -Online -FeatureName "IsolatedGuestVm" -NoRestart

5. Verify IGVmAgent is running (should show Running):

Get-Service -Name "IGVmAgent"

If it isn't running, report the issue with the IGVmAgent and IGVmSystem Operational logs (Event Viewer → Applications and Services Logs → Microsoft → Windows).

6. Create an external virtual switch (if needed):

(Get-VMSwitch | Where-Object { $_.SwitchType -eq "External" }).Name

7. Create the TVM. With an existing Gen 2 VHDX:

New-VM -Name <VMName> -Generation 2 -GuestStateIsolationType TrustedLaunch -SwitchName <switch> -VHDPath <path to vhdx> -Path <config path>

Or with a new VHD, then attach a Gen 2–compatible guest OS ISO:

New-VM -Name <VMName> -SwitchName <switch> -NewVHDPath <new VHD path> -NewVHDSizeBytes 40GB -Generation 2 -GuestStateIsolationType TrustedLaunch -Path <config path> 

Add-VMDvdDrive -VMName <VMName> -Path <Guest OS ISO path>

Ensure the DVD drive is first in the firmware boot order so the VM boots from it.

8. Verify isolation type (should return TrustedLaunch):

(Get-VM -Name <VMName>).GuestStateIsolationType

9. Verify guest state protection: Stop the IGVmAgent service and restart the VM—without IGVmAgent running, a Trusted launch VM with guest state protection won't start.

For more information, please review our blog post: Announcing Trusted Launch for Virtual Machines for Windows Server Insiders | Microsoft Community Hub

Quick Machine Recovery available in Windows Server vNext Insider Previews.

Quick machine recovery (QMR) is now available for Server vNext Insiders to test. This feature enables the recovery of Windows Server devices when they encounter boot critical errors that prevent them from booting. QMR can automatically search for cloud‑based remediations to recover from widespread boot failures significantly reducing the burden on IT administrators when multiple devices are impacted. This supports the goals of the Windows Resiliency Initiative by enabling applicable fixes to be delivered through trusted Windows Update to restore affected devices, helping reduce downtime and minimize manual recovery efforts across enterprise environments.

This feature is currently enabled in the latest Server vNext Insider builds for customers to experience test mode. A Group Policy option to enable or disable the feature will be introduced in upcoming builds to provide additional administrative control.

To simulate the quick machine recovery experience, use the following commands from an elevated command prompt:

Enable test mode:

reagentc.exe /SetRecoveryTestmode

Configure Windows to boot to Windows Recovery Environment on the next boot:

reagentc.exe /BootToRe

Reboot your device. The system goes through autoremediation of a simulated crash safely and reboots back to Windows Server.

For more information, please review Quick machine recovery (QMR) and Windows Resiliency Initiative. When providing feedback using Feedback hub, please select QMR from the Recovery and Uninstall category in the app.

NVMe-over-Fabrics (NVMe-oF) extends the NVMe protocol—originally designed for local PCIe-attached SSDs—across a network fabric. Instead of using legacy SCSI-based protocols such as iSCSI or Fibre Channel, NVMe-oF allows a host to communicate directly with remote NVMe controllers using the same NVMe command set used for local devices. In this Insider build, Windows Server supports:

NVMe-oF over TCP (NVMe/TCP), allowing NVMe-oF to run over standard Ethernet networks without specialized hardware.
NVMe-oF over RDMA (NVMe/RDMA), enabling low-latency, high-throughput NVMe access over RDMA-capable networks (for example, RoCE or iWARP) using supported RDMA NICs.

For more information, please visit: Introducing the Windows NVMe-oF Initiator Preview in Windows Server Insiders Builds | Microsoft Community Hub

ReFS Boot is enabled for Windows Server vNext preview builds.

Known Limitations

ReFS Boot systems create a minimum 2GB WinRE partition.
When WinRE cannot be updated due to space constraints, the system may disable WinRE. Disabling WinRE does not remove the partition.
If the WinRE partition is deleted and the boot volume is extended over it, this operation is unrecoverable without a clean install.

For more information, please visit: Resilient File System (ReFS) overview | Microsoft Learn

Feedback Hub app is available for Server Desktop users!  The app should automatically update with the latest version, but if it does not, simply Check for updates in the app’s settings tab.

Known Issues

A race condition in the TLS hybrid key exchange implementation may cause the LSASS service to crash when hybrid groups are negotiated by a TLS server. To avoid this issue until the fix is released, please disable hybrid groups (X25519_MLKEM768, SecP256r1_MLKEM768, SecP384r1_MLKEM1024) using TLS cmdlets or Group Policy, as outlined here.

Server Core Upgrades and AppCompat FOD: Enabling AppCompat FOD after reinstall may fail due to legacy 3rd-party license compatibility issues on Server Core devices. Server Core users may be unable to install the latest AppCompat FOD after upgrading to build 29574. This appears to be limited to Server Core installations with 3rd-party application licenses that fail compatibility checks after upgrade. This will be addressed in a future build.

Upgrading from older builds of Windows Server vNext previews (26525 or older) are not supported. Please perform a clean install of build 29531 or later. Users may experience failures when attempting to upgrade from earlier previews (build 26525 and older). VMs may fail to upgrade or start after upgrade from older preview builds impacting live migration and failover cluster scenarios.

Download Windows Server Insider Preview (microsoft.com) Flighting: The label for this flight may incorrectly reference Windows 11. However, when selected, the package installed is the Windows Server vNext update. Please ignore the label and proceed with installing your flight. This issue will be addressed in a future release.

Available Downloads

Downloads to certain countries may not be available. See Microsoft suspends new sales in Russia - Microsoft On the Issues.

Windows Server Long-Term Servicing Channel Preview in ISO format in 18 languages, and in VHDX format in English only. 
Windows Server Datacenter Azure Edition Preview in ISO and VHDX format, English only.
Microsoft Server Languages and Optional Features Preview

 Keys: Keys are valid for preview builds only 

Server Standard: MFY9F-XBN2F-TYFMP-CCV49-RMYVH
Datacenter: 2KNJJ-33Y9H-2GXGX-KMQWH-G6H67
Azure Edition does not accept a key.

Symbols:  Available on the public symbol server – see Using the Microsoft Symbol Server. 

Expiration: This Windows Server Preview will expire September 15, 2026.

How to Download

Registered Insiders may navigate directly to the Windows Server Insider Preview download page. If you have not yet registered as an Insider, see GETTING STARTED WITH SERVER on the Windows Insiders for Business portal.

We value your feedback!

The most important part of the release cycle is to hear what's working and what needs to be improved, so your feedback is extremely valued. Please use the new Feedback Hub app for Windows Server if you are running a Desktop version of Server. If you are using a Core edition, or if you are unable to use the Feedback Hub app, you can use your registered Windows 10 or Windows 11 Insider device and use the Feedback Hub application.  In the app, choose the Windows Server category and then the appropriate subcategory for your feedback. In the title of the Feedback, please indicate the build number you are providing feedback on as shown below to ensure that your issue is attributed to the right version:

     [Server #####] Title of my feedback

See Give Feedback on Windows Server via Feedback Hub for specifics.

The Windows Server Insiders space on the Microsoft Tech Communities supports preview builds of the next version of Windows Server. Use the forum to collaborate, share and learn from experts.  For versions that have been released to general availability in market, try the Windows Server for IT Pro forum or contact Support for Business.

Diagnostic and Usage Information

Microsoft collects this information over the internet to help keep Windows secure and up to date, troubleshoot problems, and make product improvements. Microsoft server operating systems can be configured to turn diagnostic data off, send Required diagnostic data, or send Optional diagnostic data. During previews, Microsoft asks that you change the default setting to Optional to provide the best automatic feedback and help us improve the final product.

Administrators can change the level of information collection through Settings. For details, see http://aka.ms/winserverdata. Also see the Microsoft Privacy Statement.

Terms of Use

This is pre-release software - it is provided for use "as-is" and is not supported in production environments. Users are responsible for installing any updates that may be made available from Windows Update. All pre-release software made available to you via the Windows Server Insider program is governed by the Insider Terms of Use.

Patch the Kernel, Skip the Reboot: The Case for Arc-Enabled Hotpatching on Windows Server 2025

Jeff-Woolsey — Mon, 13 Jul 2026 17:29:33 GMT

For decades, applying a security fix to core OS components meant swapping files on disk and restarting so the loader could map the new image into memory. Rebooting to patch is a workaround for a limitation we no longer must accept. Windows Server 2025 removes that constraint with Arc-enabled hotpatching: in-memory patching of running code, delivered at no additional charge through Azure Arc.

Let me say this again: Hotpaching for Arc-enabled Windows Server 2025 AT NO COST.

This post is for the engineers who run the fleet. Let's get into how it works, what it requires, and why you should Arc-enable a server this week.

The Real Cost of an Unpatched Window

The interval between a CVE's public disclosure and active exploitation in the wild is now frequently measured in hours. Automated scanners fingerprint exposed services and match them against known vulnerabilities faster than most change-management processes can approve a maintenance window. Every reboot you defer widens the exposure window on a known, documented, fixable attack path.

Traditional patching forces a trade-off:

Patch aggressively and absorb frequent reboots, service interruptions, failover events, and the operational risk of something not coming back cleanly.
Patch conservatively and accept a standing backlog of unremediated vulnerabilities on production systems.

Hotpatching removes that trade-off. You patch aggressively and keep the process running.

How Hotpatching Actually Works

Hotpatching operates on the in-memory image of running code rather than requiring the OS to reload a new binary from disk on restart. At a high level:

The hotpatch engine applies fixes by patching the loaded code of target processes and kernel components in place, so a fix takes effect immediately on the running system—no reboot, no process restart.
Updates are organized around a baseline plus hotpatch model:
A baseline is a standard cumulative update (new on-disk binaries) applied on a scheduled cadence—typically once per quarter—which does require a reboot.
Between baselines, hotpatches deliver the intervening security fixes with no reboot required.
The practical outcome on Windows Server 2025: reboots drop from a roughly monthly rhythm to about four planned reboots per year (the quarterly baselines), while security content lands continuously in between.

Because the hotpatch payload targets the same code paths the corresponding cumulative update would have, you get equivalent security coverage without the restart. When a fix genuinely can't be hotpatched, it's rolled into the next baseline—so nothing is silently skipped.

What It Requires

Arc-enabled hotpatching for Windows Server 2025 hinges on three things:

Windows Server 2025 (Standard or Datacenter).
Azure Arc connectivity: the machine is projected into Azure via the Azure Connected Machine agent (`azcmagent`), giving it a resource identity in an Azure subscription and resource group.
The Hotpatch capability enabled managed through Azure Update Manager, which orchestrates baseline/hotpatch scheduling and reports per-machine hotpatch compliance.

Notably, for Windows Server 2025 connected through Arc, the hotpatching capability itself carries no additional charge. There's no separate SKU to buy and no premium tier to unlock—just the Arc onboarding step.

Arc Is the Control Plane, Not Just a Prerequisite

Connecting a server with the Connected Machine agent does more than switch on hotpatching—it registers that machine as a first-class Azure resource. Everything Azure's governance and security stack does for native VMs now extends to your on-prem, edge, and multi-cloud servers:

Microsoft Defender for Cloud

Onboard Arc machines to Defender for Servers to get agent-based EDR (via the Defender for Endpoint sensor), vulnerability assessment, file integrity monitoring, and continuous Secure Score-based posture management. Findings surface in the same portal and APIs as the rest of your Azure estate, so on-prem is no longer a monitoring blind spot.

Azure Monitor

Deploy the Azure Monitor Agent (AMA) via Arc to stream performance counters, event logs, and custom logs into a Log Analytics workspace. From there you get KQL queries, VM Insights, workbooks, and metric/alert rules. Hotpatch and update status can be correlated with performance and security signals in one query surface.

Azure Policy

Use Azure Policy and Machine Configuration (guest configuration) to audit and enforce in-guest state—required agents installed, hotpatch enabled, baseline hardening applied—at fleet scale. Assign a policy initiative once and let Azure continuously evaluate drift and, where configured, remediate it automatically.

And the rest of the toolchain

Azure Update Manager — centralized patch orchestration, scheduling, and compliance reporting across the whole fleet (and the control point for hotpatch).
Change Tracking & Inventory — track software, files, registry, and service changes over time.
Extended Security Updates via Arc — for the down-level Windows Server versions still in your environment.

The Layered Result

Put together, this is defense in depth expressed as an integrated platform rather than a pile of point tools:

Layer	Capability	What it closes
Patch	Arc-enabled hotpatching	The disclosure-to-remediation gap, minus the downtime
Detect	Defender for Cloud / Servers	Active threats and exploit attempts
Observe	Azure Monitor + Log Analytics	Blind spots in health and behavior
Enforce	Azure Policy + Machine Config	Configuration drift and compliance gaps

Each layer reinforces the others, and all four are driven from the same Azure control plane against the same resource inventory.

Arc-Enable One Server. Try It.

At this point you may still be skeptical. You may be thinking, “Windows Server 2025 hotpatching for free? No downtime? No cost? There must be a catch.”

Here’s what I tell everyone when I have this conversation, “Don’t believe a word I just said. Just try it. Setup one server, Arc-enable the server and enable Windows Server 2025 hotpatching through Azure Update Manager.” You don't need a project plan, a steering committee, or a budget line to evaluate this. Pick one non-critical Windows Server 2025 box and Arc-enable it:

In the Azure portal, go to Azure Arc → Servers → Add, and generate an onboarding script (or grab a service-principal script for at-scale later).
Run the script on the server to install and configure the Connected Machine agent (`azcmagent connect`).
In Azure Update Manager, enable Hotpatch for the machine.
Watch the next hotpatch land—and enjoy the lack of reboot and peace of mind.

That's it. Arc-enabling a server cost nothing, and hotpatching on Windows Server 2025 through Arc costs nothing. You risk one afternoon on one server and get back reboot-free security patching, plus a live demo of Defender, Azure Monitor, and Azure Policy reaching a machine that used to be invisible to Azure.

Free tooling, free hotpatching, less downtime, and a stronger security posture. Who doesn't want free hotpatching? Arc-enable one server. Try it. Then decide how fast you want to roll it out to the rest.

Cheers,

-Jeff Woolsey

Unable to Build Switchless Storage using Network ATC

Slivers — Fri, 10 Jul 2026 15:12:37 GMT

3-Node HV/S2D Cluster using Switchless Storage and Network ATC getting Network HUD Error

I have a Dell 3-node server cluster being used to host Hyper-V with S2D. Each node is identical and certified to pass S2D requirements. The networking consists of 2 onboard 1 Gbps and 2 quad-port PCI(e) NICs at 10/25 Gbps. The 2 onboard ports are being used for the management intent, 2 ports from each of those NICs are being connected to 2 top-of-rack switches for the compute intent at a total of 12 10 Gbps connections, and the other 2 ports from each of those NICs are being connected directly to the other nodes in a dual mesh method for the storage intent at a total of 6 25 Gbps connections. Very similar to the Microsoft diagram for a three-node storage switchless, dual TOR, dual link deployment network reference pattern for Azure Local, but I am using Windows Server 2025 Datacenter, not Azure Local.

The problem I am encountering is when I attempt to create the switchless storage intent, I get an error (shown below) that reads "Failed to fetch physical NIC mapping from the Network HUD service. Please diagnose..." If I leave off the switchless option, it builds without issue. The error only occurs when I attempt to use the switchless option.

I tried without configuring the NIC IP addresses first, as well as trying configuring the NIC IP addresses beforehand. I tried without having a cluster built first, as well as building a failover cluster without storage before running the network intent command. The error I posted below shows my last attempt after having the NICs configured with IP addresses and having a failover cluster established before running the command. The error has remained the same throughout the process.

Has anyone else run into an issue like this with switchless storage? It seems like everything that I am trying to do is within scope and should be a supported solution. My fallback plan is to use my existing switches, but that drops my connection speeds down from 25 Gbps to 10 Gbps due to hardware limitations.

PowerShell DSC Pullserver stops working with SQL database

PatHel — Thu, 09 Jul 2026 07:10:23 GMT

After updating Windows Server 2025, our DSC Pull Server stopped communicating with its SQL backend database. The issue was not present before the update, and reverting to the previous version of Microsoft.PowerShell.DesiredStateConfiguration.Service.dll immediately restored normal functionality.

With the newer DLL version, the service starts successfully and the endpoint remains available, but no connection is established to the SQL Server database. As a result, database initialization does not occur, required tables are not created or updated, and node registration fails. No database sessions are observed on the SQL Server during registration attempts, indicating that the service does not reach the SQL connection phase.

We compared the previous working DLL version with the updated version and confirmed that the regression is introduced by the newer DLL. Replacing the updated DLL with the earlier version consistently restores SQL database connectivity and normal Pull Server Operation.

Installing NDES on Windows 2025, Virtual Directories "CertSrv\mscep" and "mscep_admin" are missing.

IbTornoee — Wed, 08 Jul 2026 06:54:33 GMT

Installing NDES on Windows 2025 the installation ends with no errors, but Virtual Directories "CertSrv\mscep" and "mscep_admin" is missing.

Any ideas?

Regards Ib Tornøe

Storage migration service operational log is empty

agobum365 — Mon, 06 Jul 2026 09:38:11 GMT

Hi I can not find logs for operational but only for debug and admin for Storagemigrationservice and storagemigrationservice-proxy.

I justy disable and re-enable operational log from the gui and also from powershell but nothing change.

There is some trick in the registry? I find the registration in

C:\ProgramData\Microsoft\StorageMigrationService but there is a edb and their relative logs that are not txt format.

I need to trace the duration of the past process because I need to sync the migration in scheduled manner

Windows Server 2022 File Server Cluster | Network Teaming

aleemsyed12 — Wed, 08 Jul 2026 02:59:01 GMT

Hello Microsoft Community,

I have a Windows Server 2022 File Server Cluster (all physical nodes) running with SMB shares. At present, it is not configured with NIC teaming.

We are planning to setup NIC teaming. I am going to add an additional network adapter to achieve this.

Since this is a production file server server. It tried to perform NIC teaming in a test environment. Upon setting up network teaming, File server clustered roles do not come online and fail. It registers an Event ID 1049 about duplicate IPs despite the fact that I have deleted old network adapter via device manager (show hidden devices). New network adapter comes online without any previous knowledge of IPs. When setting up old IP scheme on a new individual network adapter, File server clustered roles come online successfully. However, setting up the old IP scheme on teamed network adapter, it registers Event ID 1049 about duplicate IPs and roles shows a status of Failed instead of Stopped. Duplicate IPs are only registered for clustered file server roles. They are not registered for node IPs and cluster management IPs.

What would be a best way to achieve network teaming on an existing file server cluster without setting up the cluster from scratch?

Issue with winlogon on Remote Desktop Services:

kris1975 — Tue, 30 Jun 2026 09:14:49 GMT

We are investigating intermittent session establishment failures on Windows Server 2019 servers used as CyberArk PSM / RDS hosts.

At unspecified intervals, new privileged sessions fail to establish or are disconnected during the initial session/logon phase. The issue is intermittent and affects new sessions. Existing sessions may continue to work.

The strongest and most consistent correlation identified so far is:

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational – Event ID 36

Application / Microsoft-Windows-Winlogon – Event ID 4005

We observed that TerminalServices-LocalSessionManager Event ID 36 can occur without a subsequent Winlogon Event ID 4005. However, every observed Winlogon Event ID 4005 is correlated with TerminalServices-LocalSessionManager Event ID 36 in the same incident window.

This suggests that Event ID 36 is a consistent precursor or required condition for the Winlogon 4005 cases.

Environment

Operating system: Windows Server 2019

Role: CyberArk PSM / RDS session host

Issue type: intermittent failure during new RDP/PSM session initialization

Impact: affected users cannot establish privileged sessions or are disconnected during session startup

Similar issue exists on previous windows server 2012 R2 and was fixed : August 16, 2016 – KB3179574 (During virtual channel management, a deadlock condition occurs that prevents the RDS service from accepting new connections.)

https://support.microsoft.com/en-us/topic/august-2016-update-rollup-for-windows-8-1-and-windows-server-2012-r2-d472b5d5-4b3a-8e6e-c22a-f62fed604caf

I'm looking forward for any ideas how to resolve this issue. Many thanks!!

Server 2025 to server 2022 downgrade keys

Tonyams — Mon, 29 Jun 2026 22:56:09 GMT

Hello,

We bought licenses with these part #'s MFR# P73-08495 and MFR# EP2-25187 which, according to searches on the internet, have downgrade rights.

We need to get downgrade keys for server 2022 standard.

Our reseller referred us to Microsoft for this.

Could someone help? The activation portal does not give us an option to do this and a microsoft support agent told us to make a post here which seems weird to us. We don't know why they couldn't help us via the phone.

Thanks

Windows Server 2025 Failover Cluster Live Migration Issue

madushan_gunarathne — Sat, 27 Jun 2026 03:06:15 GMT

Hi Everyone,

I am facing an issue in a Hyper-V Failover Cluster environment where Live Migration intermittently fails due to a service logon-related problem. The environment was previously working normally, but now whenever we attempt to Live Migrate a VM between cluster nodes, the migration fails unless we manually run “gpupdate /force” on the Hyper-V host first.

After running gpupdate /force, the migration works temporarily, but the issue returns again during the next migration attempt. This makes it appear that some policy or permission is not being applied consistently on the cluster nodes.

During troubleshooting, I attempted to add “NT VIRTUAL MACHINE\Virtual Machines” to the “Log on as a service” policy under Local Security Policy > Local Policies > User Rights Assignment. However, the account does not appear or resolve in the Object Picker when trying to add it manually.

At this stage, I am trying to understand whether this is related to a domain GPO overwriting local policy settings, a Failover Cluster permission issue, or something specific to Hyper-V virtual machine accounts.

Has anyone encountered a similar issue where Live Migration only works after running gpupdate /force? Also, is there a correct method to add “NT VIRTUAL MACHINE\Virtual Machines” to the “Log on as a service” policy, or should this permission already exist by default on Hyper-V hosts?

Any guidance or recommendations would be greatly appreciated.

Windows Admin Center version 2606 is now generally available!

Davanna-White — Fri, 10 Jul 2026 17:31:05 GMT

July 9th, 2026: The Windows Admin Center installer has been updated to build number 2.7.4. This build includes multiple security improvements such as correcting elevation of privilege and remote code execution. There are no other functionality changes in this build.

We're pleased to announce the availability of the latest release for Windows Admin Center, version 2606!

This update focuses on improving the overall reliability, accessibility, security, and user experience of the platform based on customer feedback and development partner-reported issues. It delivers important quality improvements that make everyday administration smoother and more dependable.

Version 2606 is exclusively an Administration Mode release. Not sure what this means? Check out our blog post explaining the differences between “Windows Admin Center: Administration Mode” and “Windows Admin Center: Virtualization Mode.”

We know we updated version 2511 multiple times. We're exploring a more frequent release cadence in the future so that new features, enhancements, and fixes reach you sooner.

If you'd like to see more frequent releases, give this post a 👍🏼. We'd also love your feedback. Share your thoughts in the comments and let us know what release cadence works best for you!

The Windows Admin Center: Virtualization Mode public preview build has been updated

Earlier this year, we announced an update to the public preview build of Windows Admin Center: Virtualization Mode. We’ve reviewed the ample feedback and have refreshed the build again to address critical bugs and asks. Check out the latest blog post to learn more!

What’s new in Windows Admin Center 2606

Platform updates

Fixed an issue where users trying to install on a standalone machine with a non-English OS were receiving an error message about high availability installations not being supported
Fixed an issue where users were unable to add Allowed Groups containing spaces in the Access tab of gateway settings
Hardened security posture
Addressed major accessibility issues
- Improvements to keyboard navigation, dialog accessibility, screen reader support, and ARIA compliance across key management experiences
- Common workflows are now easier to navigate using assistive technologies and help improve compliance with accessibility standards

Extension updates

The GPU tool is now available for Windows Server 2025 standard edition
Fixed an issue with volume deletion operations present in versions of the Cluster Manager extension lower than 5.2.6
Fixed an issue where scheduled task status was not changing after starting task
Import VM
- A network summary has been added to the review tab of the Import VM workflow
- Fixed an issue where the VHD destination was not displaying correctly in the Storage Summary section of the review tab of the Import VM workflow
- Fixed an issue where VM name was not displaying correctly in the Review tab of the Import VM workflow
Fixed an issue where copying a physical hard disk in virtual machine settings was not working
Increased maximum network adapter limits for Gen2 virtual machines from 8 to 64 (8 is still the Gen1 virtual machine maximum)
Updated Secure Boot logic and status in the Security tool with clearer messaging and next steps

Improved error handling in the platform and tools such as Files & file shares, Processes, Virtual machines, and Services
Software-defined networking (SDN)
- Virtual networks
  - We now block deletion of virtual networks and deletion and editing of virtual subnets that are in use by virtual gateways. Previously, customers were accidentally modifying these resources which would result in a failed provisioning state.
  - Implemented critical bug fixes such as allowing the removal of network security groups from the virtual subnet resource
- Virtual gateway
  - Included a host IP form field to support a critical fix in the l3 fast path feature.
  - Added an option for users to set the unit of measurement for their bandwidth allocation
- Logical networks
  - Implemented a bugfix that allows users to update their logical networks with default network policies (no address prefix)

Partner Ecosystem

The Windows Admin Center management experience would not be complete without our development partners, who make managing your hardware and firmware through Windows Admin Center a streamlined experience. Since the last generally available release of Windows Admin Center, two partners have made updates to their extensions.

The Dell OpenManage Integration extension has been upgraded to version 3.6.0—this version contains the following improvements:
- Hardware Alert Polling - Provides configurable hardware alert polling, and severity thresholds to ensure timely and consistent notifications across all servers and clusters.
- WDAC support for Windows Server 2025 - OMIMSWAC is supported on Windows Server 2025 with Windows Defender Application Control (WDAC) enabled by using Dell provided supplemental policies.
- Custom Hardware Alert Configuration - Allows user to configure or remove iDRAC hardware alerts at the cluster or individual node level by offering granular control over alert categories, subcategories, and severity.
- Warranty Status Improvements - Improves the accuracy of warranty reporting by identifying cases where node data is unavailable and marking them as Unknown. Adds node-level warranty information in tooltips for quicker insight and easier diagnostics
- Azure Policies Onboarding Quota Handling - Provides clear information when Azure policy onboarding fails due to quota restrictions and provide guidance to help resolve the issue efficiently.
- Enhanced Hardware Configuration Policies - Extended configuration compatibility for HCP/SCP (on‑premises) and Azure onboarding policies by recognizing either On or Last as compliant for AC Power Recovery settings
- BitLocker Improvements - Ensures more reliable BitLocker management during updates and cluster expansion by reliably suspending and resuming protection. Restores the original state regardless of job status as failure, cancellation, or successful completion.
- Added support for Multi Cloud (APEX MC) platform for Azure Local.
- Added support for PowerEdge 17G models: R7725xd and R770AP
- Added support for IPv6 while connecting with iDRAC through Remote NDIS adapter.
- HCI Configuration Profile is enhanced to support a minimum of two storage drives for Azure Stack HCI operating system per server for all-flash configurations.
- AX 16G clusters now support mixed processor generations, allowing Sapphire Rapids and Emerald Rapids based nodes to run together for greater deployment flexibility
The Fujitsu ServerView Health extension has been rebranded to FSAS Technologies ServerView Health with the extension ID fsastech.sme.serverview.health-extension—this extension has also been upgraded to Angular 15
The Fujitsu ServerView RAID extension has been rebranded to FSAS Technologies ServerView RAID with the extension ID fsastech.sme.serverview.raid-extension—this extension has also been upgraded to Angular 15

Download today!

Thanks for reading along and continuing to support Windows Admin Center! We hope you enjoy this new version and the various new functionality now available.  

Download now!

As always, thanks for your ongoing support, adoption, and feedback. Your contributions through user feedback continue to be vital and valuable to us, helping us prioritize and sequence our investments. 

Windows Admin Center is continuously evolving and growing as a tool and a platform, and we are beyond thrilled to have you part of our journey. 

Thank you, 

Windows Admin Center Team (@servermgmt) 

Secure Boot update still pending on deadline day

LouisT — Wed, 24 Jun 2026 13:54:32 GMT

After checking the registry keys on 2x VMs which run services for a number of important customers I found they both have:

UEFICA2023Error 2147942750

Apparently this means they're pending a reboot.

https://blog.mindcore.dk/2026/04/secure-boot-certificate-update-intune/

I can't reboot the VM inside working hours, can they be rebooted after the deadline or do I need to disable Secure Boot on the VMs?

I'm concerned I'll have to disable Secure Boot before they're next rebooted for Windows updates.

Save the date: Secure Boot Q&A in July

Heather_Poulsen — Tue, 23 Jun 2026 23:44:27 GMT

To help, Microsoft is continuing its Q&A series with several opportunities to connect directly with Microsoft experts. Whether you're managing physical servers, virtualized workloads, or working with your hardware partners on firmware readiness, you can get answers to the questions that matter most to your environment.

Learn more and add the events to your calendar:

8:00 AM PDT July 1 - Windows Server Secure Boot AMA
8:00 AM PDT July 8 - Secure Boot Office Hours for virtualized environments
7:00 AM - 7:00 PM PDT July 15 - OEM Secure Boot Office Hours

If there's a question that's been holding up your rollout—or one you simply want to validate before moving forward—this is a great opportunity to ask. Feel free to post questions ahead of time or join the conversation live. We look forward to seeing you there.