We currently run Windows Server 2016 as our domain controller platform and are planning an upgrade. Most of our other servers, including on-premises Exchange, have already been migrated to Windows Server 2025. We are deciding whether to move directly to Server 2025 for the longer support lifecycle or use Server 2022, which has had more time to mature.
I remember seeing reports about problems with Server 2025 domain controllers, especially in mixed-version environments. For anyone running Server 2025 in production, how has it been with Active Directory, DNS, replication, Group Policy, Kerberos, and workstation trust relationships? Would you recommend moving directly from 2016 to 2025 and then retiring the older domain controllers, or would 2022 be the safer choice for now?
4 Answers
The experiences are very mixed. Several environments run entirely on 2025 without trouble, but the risky scenario appears to be introducing 2025 into an existing domain with older DCs. Reported problems include intermittent Kerberos failures, machines losing their trust relationship, computer-password rotation issues, and authentication failures that only show up after the system has been running for a while. Mixed 2016/2019/2022/2025 environments deserve especially careful testing.
I would not make the first 2025 DC the foundation of a production migration without a lab test and a staged rollout. Build a temporary 2025 DC, leave the functional level where it is, and monitor authentication, replication, SYSVOL, DNS, GPO processing, endpoint trust, and application compatibility. If the environment is complex or contains legacy systems, 2022 is the more conservative choice. If testing is clean and every DC will be upgraded promptly, 2025 is reasonable, but do not assume that having all other member servers on 2025 makes the AD upgrade risk-free.
My default recommendation for domain controllers is to stay one release behind unless you need a specific feature. Server 2022 is mature, stable, and receives security updates for years. I would introduce a 2022 DC, transfer the roles, verify DNS, replication, SYSVOL, backups, and authentication, then plan the move to 2025 after it has had more time in production.
That is the approach we took moving from 2016. The 2022 replacement was uneventful, while our first attempt to promote a 2025 DC caused sign-in and SYSVOL problems.
2025 can work, particularly in a small or uncomplicated environment where all DCs are 2025. I have seen installations run for a year with no major AD, DNS, or replication issues. Before deploying it, audit legacy Kerberos encryption, LDAP signing and channel binding, service accounts, Group Policy, machine identity settings, and any non-Microsoft security software. Test restore procedures and keep a rollback plan.
Do not enable RC4 as a blanket fix. It may get an old service working, but it weakens Kerberos security. Identify and update the systems that still depend on obsolete encryption instead.
We had occasional trust errors while older DCs remained online. After the older DCs were retired, the problems stopped. The stricter security defaults exposed several legacy dependencies that had not been audited.