Planning Upgrade and Migration
- Editions and lifecycle, desktop experience updates: Windows Terminal, WinGet, file compression, Bluetooth and Wi-Fi
- Direct upgrade from Windows Server 2012 R2 onwards, or a clean install with migration: weighing up the approach
- Migrating file servers with Storage Migration Service, replacing domain controllers step by step
- Checking deprecated and removed features: including WSUS, NTLM, Network Load Balancing, WMIC, VBScript, Windows PowerShell 2.0, SMTP Server
What’s New in Active Directory
- New domain and forest functional level, optional 32k database pages, schema extensions
- Delegated managed service accounts (dMSA) as the successor to classic service accounts
- LDAP encryption enabled by default, LDAP over TLS 1.3, protection of confidential attributes, random default passwords for computer accounts
- Kerberos changes (PKINIT, no RC4 for ticket-granting tickets), replication priority, NUMA support and new performance counters
- Windows LAPS: automatic account management, passphrases, detection of image rollbacks
Security
- Credential Guard enabled by default, Hypervisor-Enforced Paging Translation (HVPT)
- VBS enclaves and VBS key protection
- Security baseline with OSConfig and over 350 preconfigured settings
- TLS 1.0 and 1.1 disabled by default, OpenSSH Server installed by default, changed IPsec key modules
SMB and File Services
- SMB over QUIC now available in Standard and Datacenter, client access control and alternative ports
- SMB signing required by default, enforcing encryption, blocking NTLM, authentication rate limiting, dialect control
- Auditing of signing and encryption, more restrictive firewall rules, SMB compression with LZ4
Storage
- Optimised NVMe performance, block cloning on ReFS and Dev Drive
- Storage Replica with compression and Enhanced Log
- Storage Spaces Direct: thin provisioning and conversion of fixed volumes, ReFS deduplication and compression
Hyper-V and Containers
- Higher scalability limits for hosts and virtual machines, Generation 2 as the default
- GPU partitioning with live migration and high availability in a cluster
- Dynamic processor compatibility and workgroup clusters with live migration
- Portability of Windows containers
Networking and Software-Defined Networking
- Network ATC for intent-based host network configuration in a cluster
- Network Controller as a failover cluster service, tag-based segmentation and default network policies
- SDN multisite and more powerful Layer 3 gateways
- Hardening Routing and RAS: PPTP and L2TP disabled by default on new installations
Hybrid Management with Azure Arc
- Connecting servers with Azure Arc Setup, pay-as-you-go licensing
- Hotpatch: installing security updates without a restart, the process with baseline and hotpatch months
- Windows Server Management enabled by Azure Arc: Windows Admin Center in Azure, Azure Update Manager, Best Practices Assessment
- Troubleshooting with DTrace and Windows Admin Center
