Skip to content
fastnode_
Portal
menu

image

Windows Server 2025

For workloads that genuinely need Windows: IIS, .NET Framework, Windows build agents, vendor tools without a Linux port. Size it generously and lock RDP down on day one.

When Windows is the right answer

Windows Server 2025 reached general availability in November 2024. Microsoft lists mainstream support until November 2029 and extended security updates until November 2034. It brings hotpatching options, SMB over QUIC, a refreshed Active Directory and OpenSSH Server as an installable feature.

Choose it for work that can't run elsewhere: classic ASP.NET and WCF services, IIS-hosted applications, MSBuild agents producing Windows binaries, SQL Server Express for a line-of-business tool, or a vendor's management console that only ships as an MSI. If your application targets modern .NET, it probably runs on Linux, and a Linux image will be cheaper in RAM.

Licensing: ask first

Windows licensing on virtual servers has rules that depend on the edition, the number of cores and how the server is used. Before you order, email [email protected] with the plan you have in mind and your intended use. We'll tell you how licensing applies. Don't assume, in either direction. Client Access Licences for Remote Desktop Services multi-user sessions are a separate matter again.

Sizing: Turbo and up

A freshly installed Windows Server 2025 with Desktop Experience uses roughly 2 to 3 GB of RAM before your workload starts. Defender scans, Windows Update and .NET compilation spike CPU and disk. On the smaller plans that leaves too little room. Our recommendation:

  • Turbo (4 vCPU, 8 GB, 80 GB NVMe): the floor. A single IIS site, a small service or a light build agent.
  • Nitro (4 vCPU, 12 GB, 120 GB): IIS plus SQL Server Express, or several app pools.
  • Warp (6 vCPU, 16 GB, 160 GB): Windows CI agents running MSBuild and test suites in parallel.
  • Hyper (8 vCPU, 32 GB, 200 GB): heavy builds, larger SQL Server workloads, multiple concurrent admin sessions.

Disk matters too. Cumulative updates and the component store grow over time. Budget at least 40 GB for the OS alone.

Harden RDP on day one

An internet-facing RDP port gets brute-force attempts within minutes of booting. Do these before anything else, from the browser console or your first RDP session:

# Require Network Level Authentication
Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

# Restrict RDP to your own address range
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' |
  Set-NetFirewallRule -RemoteAddress 198.51.100.0/28

# Account lockout: 10 attempts, 15-minute window
net accounts /lockoutthreshold:10 /lockoutwindow:15 /lockoutduration:15

# Rename the built-in Administrator and create a named admin
Rename-LocalUser -Name Administrator -NewName fn-root
New-LocalUser -Name ops -PasswordNeverExpires:$false
Add-LocalGroupMember -Group Administrators -Member ops

Add a matching rule in the portal firewall so port 3389 only accepts your range. That stops the noise before it reaches the VM. Better still, keep RDP closed to the internet entirely and reach it over a WireGuard tunnel to another server.

Prefer SSH for automation

Windows Server 2025 includes OpenSSH Server as an optional feature. For scripted deploys, it beats WinRM over the internet:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Set-Service sshd -StartupType Automatic; Start-Service sshd
New-ItemProperty 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell `
  -Value 'C:\Program Files\PowerShell\7\pwsh.exe' -PropertyType String -Force

Put administrators' public keys in C:\ProgramData\ssh\administrators_authorized_keys and lock its ACL to SYSTEM and Administrators. sshd ignores the file if permissions are looser.

Patching

Set Windows Update active hours so restarts land outside business hours, and check status from PowerShell with the PSWindowsUpdate module or Get-HotFix. Patch Tuesday falls on the second Tuesday of the month. Plan a reboot window that week. Take a portal snapshot before large cumulative updates so a bad patch is a rollback, not a rebuild.

Gotchas

  • Outbound SMTP. Port 25 is blocked by default. Use an authenticated relay on 587, or request an unblock in the portal.
  • Time zone. Set tzutil /s "GMT Standard Time" for UK local time with daylight saving.
  • Server Core. If your workload doesn't need a desktop, Core uses noticeably less RAM and patches less often. Ask support about Core availability.

Questions

Is a Windows licence included in the plan price?

Confirm with support before you order. Email [email protected] with the plan you want and how you intend to use the server, and we will tell you how licensing applies.

Which plan is the minimum for Windows Server 2025?

Turbo, with 4 vCPUs and 8 GB of RAM, is our practical floor. Windows boots on less, but updates, Defender scans and the desktop experience leave little memory for your application on smaller plans.

Can I use the browser console instead of RDP?

Yes. The portal's browser console gives you the server's screen directly, which is useful for first login, for fixing a broken firewall rule, or when RDP is restricted to a VPN you can't reach.

When does Windows Server 2025 support end?

Microsoft lists mainstream support until November 2029 and extended support until November 2034.