Microsoft has quietly turned Windows Update into an in-place upgrade path for Windows Server 2025, giving IT administrators a new way to move Server 2019 and 2022 machines forward without mounting an ISO. The mechanism is optional, gated behind a specific policy toggle, and demands that the March 2026 cumulative update be installed first. If you manage domain controllers, though, the official advice is to step away from the button entirely.

How the Upgrade Reaches Your Servers

The new delivery method works through the same Windows Update channel that handles monthly patches, but it never runs on autopilot. For Windows Server 2022, the machine must have the March 2026 cumulative update or a later release installed; for Server 2019, the equivalent March 2026 cumulative update is the floor. After that, an admin must explicitly flip a switch—typically by setting a registry value under the Windows Update policy path—to unlock the feature update offer. Once enabled, the upgrade surfaces inside Settings or, on Server Core, through the SConfig menu.

Microsoft’s documentation makes clear that this route is narrower than what an ISO can do. A manual media-based setup supports in-place upgrades from older releases like Server 2012 R2 and Server 2016, but through Windows Update, the lane is limited to Server 2019 and Server 2022. That distinction matters in any estate where generations of Windows Server still coexist. The Windows Update path is a convenience layer for relatively recent systems, not a bridge for every aging machine in the rack.

Who Should Consider the Windows Update Upgrade

This isn’t a universal blessing. The clearest winners are midmarket IT teams that run several hundred Windows servers, have a patching tool that mostly works, and face a backlog of OS upgrades competing with a dozen other priorities. For them, the ability to stage prerequisites through existing update processes, snapshot a VM, and perform the upgrade inside a standard maintenance window cuts real friction. It turns a once-artisanal task—someone logging in, mounting media, and praying through Setup—into something repeatable across low-criticality servers.

On the other side, organisations with deeply integrated third-party patch management products need to audit how those tools classify the new offering. In late 2024, some Server 2019 and Server 2022 environments saw unexpected upgrade triggers because patch management platforms misinterpreted feature update metadata as a recommended update. Microsoft later resolved the misclassification, but the lesson stands: any product in the update chain—from WSUS and Configuration Manager to RMM tools and vulnerability scanners—must understand that this is an optional lifecycle event, not a routine patch. A server that accidentally installs a cumulative update is a headache; a server that accidentally becomes Server 2025 can become a business incident.

The Non-Negotiable Line: Domain Controllers

The guidance here is unambiguous. Microsoft strongly discourages using in-place upgrades on servers running Active Directory Domain Services. The preferred path for domain controllers is clean installation, promotion, role transfer, and demotion of older systems. Technical feasibility does not equal architectural wisdom, especially when the authentication substrate of an entire environment is on the line. The same caution applies to other identity-adjacent workloads—certificate authorities, federation services, privileged access management components—where a botched upgrade can cascade into locked-out users and broken trusts.

How We Got Here

Windows Server 2025 hit general availability in late 2024 as Microsoft’s current Long-Term Servicing Channel release, packing security hardening, Hyper-V improvements, and hybrid management hooks. The traditional upgrade method was—and remains—media-based setup. In late 2024, however, some admins noticed the Server 2025 feature update appearing in Windows Update unexpectedly, a glitch tied to third-party tooling. Microsoft quickly clarified that the metadata should be treated as optional, not recommended. Now the company is formalizing the path with explicit guardrails: the March 2026 cumulative update prerequisite and the policy toggle.

This move also fits a broader arc. Microsoft’s server strategy increasingly treats on-premises machines as managed endpoints in a hybrid cloud pipeline. Delivering an OS upgrade through the same channel that serves monthly patches nudges server lifecycle management closer to the cadence of everyday servicing. It’s convenient, but it also shifts control toward Microsoft’s update metadata and policy surfaces. Shops already invested in Azure Arc, Defender for Servers, and Windows Admin Center will find the integration natural; organisations that draw a hard line between patching and OS migration may feel a boundary being tested.

Your Practical Upgrade Checklist

The Windows Update path compresses execution, not planning. The real work begins before anyone opens Settings. Use these steps to build a safe, controlled rollout:

  1. Inventory and classify every server. Identify which machines are eligible (Server 2019 or Server 2022, running the March 2026 CU or later) and flag any that should never touch this path: domain controllers, heavily customised legacy systems, and servers with vendor certification requirements.
  2. Lock down third-party patch tools. Verify that your WSUS, Configuration Manager, Intune, Azure Update Manager, RMM, or vulnerability scanner clearly classifies the Server 2025 feature update as optional and will not auto-approve it under existing rules. Test in a lab first.
  3. Enable the feature update policy only on chosen test servers. Use Group Policy or direct registry edits to flip the switch, and start with the least critical VMs.
  4. Take application-consistent backups. Snapshots are valuable, but workload-specific recovery plans matter more—especially for databases, queues, or distributed systems that don’t tolerate sudden rollbacks.
  5. Validate activation readiness. Confirm your Key Management Service, Active Directory-based Activation, or MAK infrastructure can handle Server 2025 clients, and ensure licensing records match the edition and core count. A post-upgrade activation failure is not when you want to learn that entitlement is missing.
  6. Perform the upgrade during a dedicated maintenance window. Microsoft’s rough two-hour estimate is a planning placeholder, not a promise. Heavily loaded servers with third-party agents, filter drivers, and custom middleware may take longer. After the upgrade, do not delete the Windows.old folder until you’ve verified every service, scheduled job, backup agent, monitoring hook, and downstream dependency.
  7. Pilot and sequence. Let the process become boring on non-critical systems before it touches anything important. Document everything, and write a rollback runbook before you need it.

The Licensing and Security Reality Check

Windows Update delivers the bits, but it cannot verify your licensing state. The upgrade is still a Software Assurance or key-owned event, entangled with cores, virtualization rights, and edition choices. Treat entitlement checks as a pre-flight requirement, not an afterthought. On the security side, Server 2025 brings real gains—stronger defaults, SMB hardening, Secured-core alignment—but it may also surface compatibility debt. Older drivers, deprecated cipher suites, and legacy authentication paths can behave differently. The servers that benefit most are the ones already well-maintained: patched, documented, and running supported workloads.

Outlook: The Servicing Model Is Shifting

Microsoft is nudging server upgrades into the same channel as monthly patching, a trend that will likely accelerate. The convenience is real, but it rewards organisations that have already done the boring work—asset inventories, application ownership mapping, backup testing, and change control. The future of Windows Server upgrades may be less about finding the right ISO and more about proving that an estate is disciplined enough for a simple button to exist safely.