Windows Server 2025 Complete Setup From Bare Install to Production Ready Server

Windows Server 2025 mainly comes in two editions. Standard is built for lightly virtualized offices and covers two Windows Server virtual machines per licence set. Datacenter covers unlimited virtual machines on the host and adds features like Storage Spaces Direct — most single-server offices honestly do not need it. During setup you also choose the interface: Desktop Experience gives you the full Windows desktop, while Server Core has no desktop at all and is managed by commands and remote tools.

1. Small office, first server, staff who manage with a mouse — choose Standard with Desktop Experience
2. Server Core is leaner and needs fewer restarts, but only pick it if you are comfortable with PowerShell
3. Downloading the evaluation ISO is fine for learning — it runs for 180 days; plan the licence before you build production on it

Boot from the ISO or USB, choose Custom: Install Windows only, and install on the drive or RAID volume you prepared for the system. The setup asks for an Administrator password before the first sign-in — this is the most powerful account the office will ever own, so make it long, unique and stored in the password vault the same day, not on a sticky note.

1. On Desktop Experience you land on the desktop and Server Manager opens by itself
2. On Server Core you land on the SConfig menu — typing sconfig in any command prompt brings it back at any time
3. Do not install a single role yet. The next two steps decide how painless the rest of your year will be

A server is the one machine whose address must never move, because every other computer will point at it for logins, DNS and files. Give it a fixed address inside your LAN, outside the range your router hands out — for example 192.168.1.10 when the router is 192.168.1.1 and DHCP starts at 192.168.1.100.

1. Set the static IP, subnet mask and gateway in the network adapter properties (or from SConfig option 8)
2. Rename the computer now — something short and role-based like SRV-DC01. Renaming is free today; after promotion to a domain controller it becomes a procedure you do not want to do casually
3. Set the correct time zone and confirm the clock is right — logins and certificates quietly depend on accurate time

This is the step impatient setups skip, and it is the one that causes the strangest errors later. A brand-new install is months behind on patches, and role wizards regularly fail on a half-patched base for reasons that look like black magic.

1. Open Settings → Windows Update and run Check for updates
2. Install everything, restart when asked, then check again — new updates often appear only after the previous round
3. Repeat until Windows reports you are up to date twice in a row, and make sure no restart is left pending

Only now is the base stable enough to build roles on. The companion guide on this step explains the pending-restart trap and grades the new hotpatching option honestly.

For a typical office server the first three roles have a natural order, because each one leans on the previous one.

1. Active Directory Domain Services — install the role from Server Manager, then run the promotion wizard to create the domain. Promotion installs and configures DNS for the domain automatically, which is exactly why AD comes first
2. Choose the domain name deliberately — a subdomain of the company domain such as ad.company.com is the modern pattern; a name like office.local still works in a closed office. Keep the DSRM password in the vault; it is the emergency key to the domain
3. DHCP — install the role second, then authorize it in Active Directory and create the address scope. An unauthorized DHCP server in a domain refuses to hand out addresses on purpose — that is a security feature, not a fault
4. Add File and Storage Services pieces as needed for shares

Prefer PowerShell? The same roles install with Install-WindowsFeature AD-Domain-Services -IncludeManagementTools followed by Install-ADDSForest, and DHCP with Install-WindowsFeature DHCP -IncludeManagementTools.

Keep Windows and the roles on C: and put everything the office creates — shared folders, user documents, redirected profiles — on a separate data volume. This one layout decision pays you back for years.

1. Data on its own volume can be backed up, snapshotted with shadow copies and even moved to a new server without touching the system
2. If the data drive fills up, the server still boots and logs people in. If C: fills up, everything stops
3. The backup target should be a different physical disk again — a partition on the same disk is not protection against that disk dying

You should manage this server from your desk, not by standing in front of it — but remote access must be a door with a lock, not an open window.

1. Enable Remote Desktop for administrators only, and keep Network Level Authentication switched on
2. Never forward port 3389 from the internet to the server. If you need access from outside, come in through a VPN first — scanners find exposed RDP within hours
3. From your own PC, Server Manager (via RSAT) or Windows Admin Center (a free download from Microsoft) can manage this server and the next ones from one console

Thirty minutes of checks now is cheaper than one incident later.

1. Confirm Windows Defender Firewall is on for all profiles — installing roles opens only the ports those roles need
2. Create your own named administrator account and use it for admin work, so the logs show a person, not a shared account. Keep the built-in Administrator as a break-glass login
3. Check that SMB signing is enabled, and do not install legacy features like SMBv1 for luck — Server 2025 does not install it by default, and that is deliberate
4. Set a monthly update window and write it down. Servers do not patch themselves responsibly by accident