How-To: Windows Server 2025 Installation and Best Practices

INTRODUCTION

Hi everyone, and welcome to Techaptic.

Today, we are going to install Windows Server 2025. However, instead of performing only a basic installation, we will focus on preparing the server for a real-world production environment.

We will first review several important Windows Server 2025 features and hardware requirements. We will then create and configure a VMware Workstation virtual machine, install Windows Server 2025 with the Desktop Experience, install VMware Tools, and complete the essential post-installation settings.

These configurations include assigning a meaningful server name, selecting the correct time zone, configuring a static IP address, securing Remote Desktop access, controlling Windows Update behavior, and disabling unnecessary Windows services according to the server’s intended role.

The goal is not simply to make the operating system run. The goal is to create a clean, secure, manageable, and production-ready starting point.

Let’s head over to the lab and get started.

𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱 𝗛𝗢𝗧𝗣𝗔𝗧𝗖𝗛𝗜𝗡𝗚

Before beginning the installation, I want to mention several important features introduced or expanded in Windows Server 2025.

The first feature is hotpatching.

When traditional operating system updates replace core files that are in use, Windows usually requires a restart to complete the installation. These restarts can create planned downtime for application servers, database servers, file servers, and other critical workloads.

Hotpatching is designed to reduce the number of required reboots by applying eligible security updates to code that is already running in memory.

Instead of replacing every protected operating system file on disk during each monthly update cycle, an eligible hotpatch can update the relevant in-memory code while the server remains online.

This does not mean that Windows Server will never require a restart again.

Microsoft still provides periodic baseline updates. A baseline update installs the complete cumulative update package and requires a reboot. Later hotpatch updates can then be applied on top of that baseline without requiring a restart, provided that the server, edition, licensing, update channel, and workload meet the hotpatch requirements.

The exact hotpatch support and servicing model should always be confirmed for the Windows Server 2025 edition and deployment model you are using.

The main benefit is fewer required restarts and reduced planned downtime for eligible security updates.

𝗦𝗠𝗕 𝗢𝗩𝗘𝗥 𝗤𝗨𝗜𝗖 𝗜𝗡 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱

The second feature is SMB over QUIC.

Traditional SMB file sharing is normally designed for trusted internal networks. Publishing TCP port 445 directly to the internet is not a secure or recommended approach.

Remote employees therefore usually connect through a VPN before accessing an internal SMB file share.

SMB over QUIC provides another option for supported environments.

It transports SMB traffic through the QUIC protocol over UDP port 443 and protects the connection with TLS 1.3.

A properly configured client can access an SMB share through a secure encrypted connection without first creating a traditional VPN tunnel.

From the user’s perspective, the file share can still be accessed by using a standard UNC path, such as two backslashes followed by the file server name and share name.

The QUIC protocol is designed to establish secure connections efficiently and can perform well on internet connections where latency, packet loss, or network changes would negatively affect a traditional TCP-based session.

SMB over QUIC still requires careful certificate configuration, client compatibility, firewall rules, name resolution, identity security, access control, logging, and hardening.

It should not be treated as a reason to expose an ordinary SMB service directly to the internet.

When correctly deployed, it can provide secure remote file access with less dependence on a full VPN connection.

𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱 𝗡𝗩𝗠𝗘 𝗦𝗧𝗢𝗥𝗔𝗚𝗘 𝗜𝗠𝗣𝗥𝗢𝗩𝗘𝗠𝗘𝗡𝗧𝗦

The third feature is the improved NVMe storage architecture.

Windows Server 2025 includes storage stack optimizations intended to make better use of modern NVMe devices.

Older storage designs were built around technologies such as SCSI and AHCI. NVMe was designed specifically for low-latency, highly parallel solid-state storage.

By improving the way Windows Server communicates with NVMe devices, the operating system can process more storage operations with less overhead.

The actual performance improvement depends on the storage device, controller, firmware, processor, queue depth, workload, virtualization platform, and application.

In suitable workloads, the optimized NVMe path can provide substantially higher input/output performance than older storage stacks.

This is especially valuable for systems that perform heavy data processing, virtualization, database operations, analytics, large file transfers, or other storage-intensive workloads.

Better storage efficiency can help organizations obtain more performance from the same hardware and may reduce the amount of infrastructure required for a given workload.

𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱 𝗛𝗔𝗥𝗗𝗪𝗔𝗥𝗘 𝗥𝗘𝗤𝗨𝗜𝗥𝗘𝗠𝗘𝗡𝗧𝗦

We can now review the basic Windows Server 2025 hardware requirements.

The minimum processor requirement is a 1.4 GHz 64-bit processor.

The minimum storage requirement for the operating system is approximately 32 GB.

The minimum memory requirement depends on the selected installation option. A Server Core installation requires fewer resources than a Desktop Experience installation.

For practical use, especially when installing the graphical interface or additional server roles, you should allocate more memory and storage than the minimum values.

A network adapter with at least 1 Gbps connectivity is a reasonable starting point for many environments.

The minimum values only indicate what is required to install or start the operating system. They are not production sizing recommendations.

The correct CPU, memory, storage, and network resources depend on the server role, application workload, number of users, virtualization overhead, backup software, antivirus or EDR agents, monitoring tools, update activity, and future growth.

For a production system, always size the hardware according to the workload rather than relying only on the minimum requirements.

𝗧𝗣𝗠 𝗔𝗡𝗗 𝗠𝗢𝗗𝗘𝗥𝗡 𝗦𝗘𝗖𝗨𝗥𝗜𝗧𝗬 𝗙𝗘𝗔𝗧𝗨𝗥𝗘𝗦

The final hardware-related item is the Trusted Platform Module, or TPM.

Windows Server 2025 can be installed in certain scenarios without a TPM. However, many modern security technologies work best or require supported TPM hardware.

These technologies can include BitLocker key protection, measured boot, Secure Boot integration, virtualization-based security, Credential Guard, and other platform integrity features.

TPM helps protect cryptographic secrets and supports verification that the system booted through a trusted process.

Because this video follows a security-focused design, we will add a virtual TPM to the VMware virtual machine.

In a physical production server, TPM support should be enabled in the system firmware and validated before the operating system is deployed.

𝗖𝗥𝗘𝗔𝗧𝗜𝗡𝗚 𝗔 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱 𝗩𝗜𝗥𝗧𝗨𝗔𝗟 𝗠𝗔𝗖𝗛𝗜𝗡𝗘

Open VMware Workstation Pro.

Click Create a New Virtual Machine.

Select the Typical configuration and click Next.

I want to control the installation process manually, so I will select I will install the operating system later.

Click Next.

For the guest operating system, select Microsoft Windows.

For the version, select Windows Server 2025.

Click Next.

Enter a meaningful name for the virtual machine.

You can also change the location where VMware stores the virtual machine configuration, virtual disk, snapshots, and related files.

Choose a location with enough free space and appropriate storage performance.

Click Next.

𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗩𝗜𝗥𝗧𝗨𝗔𝗟 𝗗𝗜𝗦𝗞

For this demonstration, a 60 GB virtual disk is sufficient.

A production server may require significantly more capacity depending on the installed roles, Windows Update retention, log files, application data, paging requirements, backup agents, and expected growth.

I will select Store virtual disk as a single file.

A single virtual disk file can provide better performance in some environments, while splitting the disk into multiple files may make it easier to move through certain file systems or storage platforms.

Keep the selected disk capacity and click Next.

Review the virtual machine summary and click Finish.

Before powering on the virtual machine, we will customize its hardware.

𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗠𝗘𝗠𝗢𝗥𝗬 𝗔𝗡𝗗 𝗣𝗥𝗢𝗖𝗘𝗦𝗦𝗢𝗥𝗦

Click Edit virtual machine settings.

For memory, allocate at least 4 GB for this lab.

If the host has enough available memory, 8 GB will provide a more comfortable experience for Windows Server 2025 with the Desktop Experience.

For processors, I will assign four processor cores.

Do not allocate all host resources to a single virtual machine.

The VMware host still requires enough CPU and memory for its own operating system and any other virtual machines.

In a production virtualization environment, resource allocation should be based on measured workload requirements, reservation policies, overcommitment ratios, NUMA design, and the capabilities of the hypervisor platform.

𝗠𝗢𝗨𝗡𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱 𝗜𝗦𝗢

Select the CD/DVD device.

Choose Use ISO image file.

Click Browse and locate the Windows Server 2025 ISO file.

Select the ISO and confirm the selection.

Make sure Connect at power on is enabled so that the virtual machine can boot from the ISO during startup.

The Network Adapter is currently configured to use NAT.

NAT is sufficient for this lab because the virtual machine can access the external network through the VMware host without being directly bridged onto the physical LAN.

A production or enterprise lab may use bridged networking, VLANs, isolated port groups, distributed switches, or other designs according to the required network architecture.

I do not need a virtual sound card on this server, so I will remove it.

Removing unused virtual hardware reduces unnecessary devices and keeps the server configuration cleaner.

𝗘𝗡𝗖𝗥𝗬𝗣𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗩𝗜𝗥𝗧𝗨𝗔𝗟 𝗠𝗔𝗖𝗛𝗜𝗡𝗘

Before adding a virtual TPM, VMware Workstation requires the virtual machine to be encrypted.

Open the Options tab and select Access Control.

Click Encrypt.

VMware allows us to encrypt only the files required to support the virtual TPM or encrypt all files belonging to the virtual machine.

For a production-like environment, encrypting all virtual machine files provides stronger protection.

Enter a strong encryption password.

Store this password securely because it may be required when opening, moving, modifying, or recovering the virtual machine.

Do not lose the password. Losing it may make the encrypted virtual machine inaccessible.

Click Encrypt and wait for the process to finish.

Virtual machine encryption helps protect the virtual disk and configuration files if someone copies them directly from the datastore or host file system.

Encryption is not a replacement for hypervisor security, access control, storage encryption, backup protection, and monitoring, but it adds another important layer.

𝗔𝗗𝗗𝗜𝗡𝗚 𝗔 𝗩𝗜𝗥𝗧𝗨𝗔𝗟 𝗧𝗣𝗠

Return to the Hardware tab.

Click Add.

Select Trusted Platform Module and complete the wizard.

The virtual machine now has a virtual TPM.

Review the remaining settings and close the hardware configuration window.

We are ready to start the Windows Server 2025 installation.

𝗕𝗢𝗢𝗧𝗜𝗡𝗚 𝗙𝗥𝗢𝗠 𝗧𝗛𝗘 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱 𝗜𝗦𝗢

Click Power on this virtual machine.

Click inside the virtual machine console.

When the message asks you to press any key to boot from the CD or DVD, press a keyboard key before the message disappears.

Windows Setup now starts from the mounted ISO file.

𝗦𝗘𝗟𝗘𝗖𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗟𝗔𝗡𝗚𝗨𝗔𝗚𝗘 𝗔𝗡𝗗 𝗞𝗘𝗬𝗕𝗢𝗔𝗥𝗗

For the installation language, we will use English.

Select the time and currency format that matches your location.

In this demonstration, I will select Turkish for the regional format.

For the keyboard layout, I will select Turkish Q.

You should select the language, regional format, and keyboard layout required by your administrators and applications.

Click Next.

Select Install Windows Server.

Confirm that you understand the installation will remove files, applications, and settings from the selected disk.

Click Next.

𝗦𝗘𝗟𝗘𝗖𝗧𝗜𝗡𝗚 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱 𝗪𝗜𝗧𝗛 𝗗𝗘𝗦𝗞𝗧𝗢𝗣 𝗘𝗫𝗣𝗘𝗥𝗜𝗘𝗡𝗖𝗘

Windows Setup displays the editions available in the ISO file.

For this demonstration, we need the graphical user interface.

Select Windows Server 2025 Standard with Desktop Experience.

A Server Core installation has a smaller attack surface, uses fewer resources, and requires fewer updates. It is often the preferred choice for supported server roles when administrators are comfortable managing the system remotely or through command-line tools.

The Desktop Experience provides the full graphical interface and is easier for demonstrations, learning environments, and workloads that require a GUI.

Choose the edition and installation type that match your license and server role.

Click Next.

Review and accept the Microsoft license terms if you agree.

𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗜𝗡𝗚 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗘𝗥 𝟮𝟬𝟮𝟱

Windows Setup displays the available disks.

This virtual machine has only one virtual disk, and it is already selected.

In a production environment, confirm the storage design, boot mode, RAID configuration, partition structure, recovery requirements, and target disk before continuing.

Click Next.

Setup displays a summary of the selected edition and installation destination.

Review the information and click Install.

Windows Setup copies the operating system files, installs features, and prepares the server.

The virtual machine restarts several times during this process.

I will fast-forward the video so that you do not have to wait through the complete installation.

𝗖𝗥𝗘𝗔𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗟𝗢𝗖𝗔𝗟 𝗔𝗗𝗠𝗜𝗡𝗜𝗦𝗧𝗥𝗔𝗧𝗢𝗥 𝗣𝗔𝗦𝗦𝗪𝗢𝗥𝗗

After the installation is complete, Windows asks us to create a password for the built-in Administrator account.

Enter a strong and unique password.

The password should meet the organization’s length, complexity, rotation, storage, and privileged access requirements.

Do not use the same local Administrator password on multiple servers.

In a domain environment, consider using Windows Local Administrator Password Solution, or Windows LAPS, for supported local administrator accounts.

Complete the password configuration.

Send the Ctrl+Alt+Delete combination through the VMware console and sign in with the Administrator account.

𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗗𝗜𝗔𝗚𝗡𝗢𝗦𝗧𝗜𝗖 𝗗𝗔𝗧𝗔

Windows Server asks us to choose the diagnostic data level.

For this demonstration, I will select Required diagnostic data only.

The appropriate setting depends on the organization’s privacy, security, compliance, and support requirements.

Click Accept.

The Windows Server desktop is now displayed.

𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗜𝗡𝗚 𝗩𝗠𝗪𝗔𝗥𝗘 𝗧𝗢𝗢𝗟𝗦

The console resolution is currently small because VMware Tools has not been installed.

VMware Tools provides optimized virtual hardware drivers and integration features.

These can include improved display drivers, better mouse integration, time synchronization options, network drivers, storage drivers, guest shutdown operations, and more accurate virtual machine status reporting.

From the VMware Workstation menu, select the option to install VMware Tools.

VMware mounts the VMware Tools installation media in the virtual CD/DVD drive.

Open File Explorer and launch the VMware Tools installer from the mounted drive.

If AutoPlay appears, select Run setup.exe.

Click Next.

Select the Complete installation type.

Click Next and then Install.

When the installation finishes, click Finish.

VMware Tools asks us to restart the server so that the new drivers and components can become active.

Click Yes.

After the restart, send Ctrl+Alt+Delete through the VMware console and sign in again.

The display resolution and console integration should now work correctly.

I will slightly increase the display scaling to make the configuration easier to follow.

𝗔𝗦𝗦𝗜𝗚𝗡𝗜𝗡𝗚 𝗔 𝗠𝗘𝗔𝗡𝗜𝗡𝗚𝗙𝗨𝗟 𝗦𝗘𝗥𝗩𝗘𝗥 𝗡𝗔𝗠𝗘

We can now begin the production-oriented post-installation configuration.

The first step is assigning a proper server name.

Open Server Manager and select Local Server.

Click the current computer name.

In System Properties, click Change.

Enter a meaningful name that follows your organization’s naming standard.

The name may indicate the location, environment, server role, or sequence number.

For example, a naming convention might use values such as IST-FS01, PRD-APP01, LAB-SRV01, or another approved format.

Avoid temporary or generic names such as WIN-SERVER or TEST unless the system is genuinely temporary.

Click OK.

Windows confirms that a restart is required.

Click Close and choose Restart Later because we will complete several other settings first.

𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗧𝗜𝗠𝗘 𝗭𝗢𝗡𝗘

While we are in Server Manager, configure the correct time zone.

The server currently uses Pacific Time.

Click the Time zone setting.

Select Change time zone.

Choose the time zone that matches the server’s actual location or the organization’s standard.

In this environment, I will select the appropriate time zone for Turkey.

Save the setting.

Refresh Server Manager and confirm that the new time zone is displayed.

Correct time configuration is critical for logs, scheduled tasks, certificates, authentication, monitoring, backups, database operations, and troubleshooting.

When the server later joins an Active Directory domain, time synchronization should follow the domain hierarchy.

𝗖𝗢𝗡𝗙𝗜𝗚𝗨𝗥𝗜𝗡𝗚 𝗔 𝗦𝗧𝗔𝗧𝗜𝗖 𝗜𝗣 𝗔𝗗𝗗𝗥𝗘𝗦𝗦

The next configuration is the network address.

Production servers should normally use a stable IP configuration.

A changing IP address can cause problems with DNS records, firewall rules, monitoring tools, application connections, certificates, backup jobs, management systems, and other infrastructure dependencies.

Open Network and Internet settings.

Select Ethernet.

Under IP assignment, click Edit.

Change the configuration from Automatic, or DHCP, to Manual.

Enable IPv4.

Enter the static IP address, subnet prefix length, and default gateway assigned to this server.

Enter the required DNS server addresses.

For this isolated lab, I will temporarily use a public DNS resolver.

In a production Active Directory environment, member servers should use the organization’s internal Active Directory DNS servers rather than a public DNS service.

Public DNS addresses should not be configured directly on domain members as their primary DNS servers because they cannot resolve the internal Active Directory service records.

Save the configuration.

Verify that the server can reach the required network resources and resolve names correctly.

We can now restart the server so that the computer name and other pending changes take effect.

𝗘𝗡𝗔𝗕𝗟𝗜𝗡𝗚 𝗥𝗘𝗠𝗢𝗧𝗘 𝗗𝗘𝗦𝗞𝗧𝗢𝗣 𝗦𝗘𝗖𝗨𝗥𝗘𝗟𝗬

The next best practice concerns Remote Desktop.

Administrators frequently use Remote Desktop Protocol, or RDP, to connect to Windows Servers and perform management tasks.

Remote Desktop should not simply be enabled without access restrictions and security controls.

Open Server Manager and select Local Server.

Click the Remote Desktop setting, which is currently Disabled.

Select Allow remote connections to this computer.

Windows explains that the required Remote Desktop exception will be enabled in Windows Firewall.

Confirm the message.

Make sure Allow connections only from computers running Remote Desktop with Network Level Authentication is enabled.

Network Level Authentication, or NLA, requires the user to authenticate before Windows creates a complete graphical session.

This reduces resource usage and provides better protection than allowing an unauthenticated client to reach the full sign-in interface.

𝗥𝗘𝗦𝗧𝗥𝗜𝗖𝗧𝗜𝗡𝗚 𝗥𝗘𝗠𝗢𝗧𝗘 𝗗𝗘𝗦𝗞𝗧𝗢𝗣 𝗨𝗦𝗘𝗥𝗦

Click Select Users to define which additional accounts can connect through Remote Desktop.

The built-in Administrator account already has access.

This lab does not contain any other accounts, so I do not need to add another user.

In a domain environment, grant Remote Desktop access only to a dedicated administrative group or the specific users who require it.

Do not add broad groups such as Domain Users.

Use the principle of least privilege.

Remote Desktop should also be protected through network segmentation, firewall source restrictions, VPN or secure access gateways, multifactor authentication where available, privileged access workstations, account lockout policies, logging, and monitoring.

Avoid publishing TCP port 3389 directly to the public internet.

Click OK to save the user selection.

Click OK again to apply the Remote Desktop configuration.

𝗖𝗢𝗡𝗧𝗥𝗢𝗟𝗟𝗜𝗡𝗚 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗨𝗣𝗗𝗔𝗧𝗘 𝗕𝗘𝗛𝗔𝗩𝗜𝗢𝗥

The next best practice is related to Windows Update.

Servers must receive security and reliability updates.

However, uncontrolled installation and automatic reboot behavior can create unexpected downtime for production workloads.

Administrators should be able to define maintenance windows, test updates, coordinate application dependencies, create backups or snapshots where supported, and monitor the result of each deployment.

In an enterprise environment, updates may be managed through Windows Server Update Services, Microsoft Configuration Manager, ManageEngine Endpoint Central, Azure Update Manager, another patch management platform, or an approved manual process.

For this lab, we will review the local Windows Server update behavior through SConfig.

Right-click the Start menu and select Run.

Enter sconfig and press Enter.

SConfig opens a text-based server configuration menu.

It provides quick access to settings such as the computer name, domain or workgroup membership, remote management, update behavior, network settings, activation, and restart operations.

𝗖𝗛𝗔𝗡𝗚𝗜𝗡𝗚 𝗧𝗛𝗘 𝗦𝗘𝗥𝗩𝗘𝗥 𝗨𝗣𝗗𝗔𝗧𝗘 𝗠𝗢𝗗𝗘

Locate the Windows Update setting in SConfig.

In this environment, the update mode is set to Download only.

Download only allows Windows to download available updates without automatically installing them and restarting the server.

This gives administrators more control over when the final installation occurs.

If the system is configured for automatic updates and you want to change the behavior, enter the menu number shown for Update settings.

SConfig presents the available options, which can include automatic installation, download only, or manual behavior depending on the Windows Server version and configuration.

Select the required option.

For this demonstration, we will use Download only.

After the change is applied, SConfig displays the updated value.

An update mode should not be selected in isolation.

The organization must still define who approves updates, when they are installed, how reboots are coordinated, how failures are handled, and how compliance is reported.

To exit SConfig, select the Exit to command line option or close the terminal after completing the configuration.

𝗥𝗘𝗩𝗜𝗘𝗪𝗜𝗡𝗚 𝗨𝗡𝗡𝗘𝗖𝗘𝗦𝗦𝗔𝗥𝗬 𝗪𝗜𝗡𝗗𝗢𝗪𝗦 𝗦𝗘𝗥𝗩𝗜𝗖𝗘𝗦

Another hardening step is reviewing unnecessary Windows services.

Windows Server installs services that support many different roles and features.

A specific server may not require every service.

Disabling an unnecessary service can reduce resource usage and, in some cases, reduce the attack surface.

However, disabling services without understanding their dependencies can break Windows features, applications, backup software, monitoring tools, update processes, remote management, authentication, or future server roles.

There is no single universal list of services that should be disabled on every Windows Server.

The correct configuration depends on the server’s role.

Open the Start menu, select Run, enter services.msc, and press Enter.

The Services console displays the installed Windows services, their status, and startup types.

A service can be opened individually and configured as Automatic, Automatic Delayed Start, Manual, or Disabled.

For a large number of servers, making each change manually is inefficient and inconsistent.

For this demonstration, we will use a PowerShell script.

𝗣𝗥𝗘𝗣𝗔𝗥𝗜𝗡𝗚 𝗧𝗛𝗘 𝗦𝗘𝗥𝗩𝗜𝗖𝗘 𝗛𝗔𝗥𝗗𝗘𝗡𝗜𝗡𝗚 𝗦𝗖𝗥𝗜𝗣𝗧

Open the C drive and create a folder named Temp.

Create a new text document in the folder.

Name the file Disable-Services.ps1.

Make sure Windows displays file extensions so that the script is not accidentally saved as Disable-Services.ps1.txt.

Open the file and paste the PowerShell script.

Before running the script, review every service in the list.

For example, the script disables the Print Spooler service.

Disabling the Print Spooler is a sensible hardening measure on many servers that never print and do not act as print servers.

However, if the system will be used as a print server or an application depends on printing, the Print Spooler must not be disabled.

The same rule applies to every other service.

Remove any service that is required by the server role, application, monitoring platform, backup system, security agent, or operational workflow.

Test the script in a lab before using it in production.

Save the file and close the editor.

𝗥𝗨𝗡𝗡𝗜𝗡𝗚 𝗧𝗛𝗘 𝗣𝗢𝗪𝗘𝗥𝗦𝗛𝗘𝗟𝗟 𝗦𝗖𝗥𝗜𝗣𝗧

Open PowerShell as an administrator.

Change the directory to C:\Temp.

Run the Disable-Services.ps1 script.

The green output lines show the services that were processed successfully.

Other messages may explain that a service is not installed, is already stopped, is already disabled, or does not exist in this Windows Server edition.

Review the complete output rather than assuming every operation succeeded.

After the script finishes, return to the Services console.

Locate the Print Spooler service.

Before the script, the service was running and its startup type was Automatic.

Refresh the Services console.

The Print Spooler is now stopped and disabled.

This confirms that the PowerShell script applied the intended change.

𝗩𝗔𝗟𝗜𝗗𝗔𝗧𝗜𝗡𝗚 𝗧𝗛𝗘 𝗦𝗘𝗥𝗩𝗘𝗥 𝗔𝗙𝗧𝗘𝗥 𝗛𝗔𝗥𝗗𝗘𝗡𝗜𝗡𝗚

After changing services or security settings, validate the server.

Confirm that Windows starts without errors.

Review Event Viewer.

Verify network connectivity and DNS resolution.

Test Remote Desktop through the approved management path.

Confirm that Windows Update can detect or download updates according to the selected policy.

Check that monitoring, backup, antivirus, EDR, and management agents are operating correctly.

Test the application or server role that will run on the system.

Document every disabled service and the reason for the change.

A hardening change should always be reversible.

Keep a copy of the original service startup configuration or provide an approved rollback script.

In a production environment, apply these changes through change control and test them before deploying to multiple servers.

𝗖𝗢𝗡𝗖𝗟𝗨𝗦𝗜𝗢𝗡

We have now completed the Windows Server 2025 installation and initial best-practice configuration.

We reviewed Windows Server 2025 hotpatching, SMB over QUIC, NVMe storage improvements, hardware requirements, TPM, and modern security features.

We created a VMware Workstation virtual machine, assigned memory and processor resources, configured the virtual disk, mounted the Windows Server 2025 ISO, encrypted the virtual machine, and added a virtual TPM.

We installed Windows Server 2025 Standard with Desktop Experience, created a strong local Administrator password, selected the diagnostic data level, and installed VMware Tools.

After installation, we assigned a meaningful server name, configured the correct time zone, and applied a static IPv4 address.

We enabled Remote Desktop with Network Level Authentication and reviewed how to restrict access to authorized administrators.

We used SConfig to control Windows Update behavior so that update installation and restarts can be managed through planned maintenance windows.

Finally, we reviewed unnecessary Windows services, created a PowerShell hardening script, disabled the Print Spooler as an example, and verified that the configuration was applied successfully.

These settings provide a cleaner and more secure starting point, but every production server must be configured according to its actual role, application requirements, security policies, network architecture, backup design, monitoring platform, update process, and recovery plan.

I hope you found this video helpful.

Thank you for watching.

I will see you in the next video.

Goodbye.