Windows Server 2025 Complete Setup

Pick the Edition and Install Type Before You Boot the ISO

Windows Server 2025 mainly comes in two editions. Standard is built for lightly virtualized offices and covers two Windows Server virtual machines per licence set. Datacenter covers unlimited virtual machines on the host and adds features like Storage Spaces Direct — most single-server offices honestly do not need it. During setup you also choose the interface: Desktop Experience gives you the full Windows desktop, while Server Core has no desktop at all and is managed by commands and remote tools.

For a small office and a first server, choose Standard with Desktop Experience. Server Core is leaner and needs fewer restarts, but only pick it if you are comfortable with PowerShell — and you cannot switch between the two later without reinstalling.

Install Windows and Set a Serious Administrator Password

Boot from the ISO or USB, choose Custom: Install Windows only, and install on the drive or RAID volume you prepared for the system. The setup asks for an Administrator password before the first sign-in — this is the most powerful account the office will ever own, so make it long, unique and stored in the password vault the same day, not on a sticky note.

On Desktop Experience you land on the desktop and Server Manager opens by itself. On Server Core you land on the SConfig menu — typing sconfig in any command prompt brings it back at any time:

sconfig

Do not install a single role yet. The next two steps decide how painless the rest of your year will be.

Give the Server Its Identity — Static IP, Name and Time Zone

A server is the one machine whose address must never move, because every other computer will point at it for logins, DNS and files. Give it a fixed address inside your LAN, outside the range your router hands out — for example 192.168.1.10 when the router is 192.168.1.1 and DHCP starts at 192.168.1.100.

Set the static IP, subnet mask and gateway in the network adapter properties (or from SConfig option 8). Then rename the computer now — something short and role-based like SRV-DC01. Renaming is free today; after promotion to a domain controller it becomes a procedure you do not want to do casually. Finally, set the correct time zone and confirm the clock is right — logins and certificates quietly depend on accurate time.

Update Completely Before Installing Any Role

This is the step impatient setups skip, and it is the one that causes the strangest errors later. A brand-new install is months behind on patches, and role wizards regularly fail on a half-patched base for reasons that look like black magic.

Open Settings → Windows Update and run Check for updates. Install everything, restart when asked, then check again — new updates often appear only after the previous round. Repeat until Windows reports you are up to date twice in a row, and make sure no restart is left pending. Only now is the base stable enough to build roles on.

Install the Roles in Order — Active Directory With DNS, Then DHCP

For a typical office server the first three roles have a natural order, because each one leans on the previous one.

Active Directory Domain Services comes first — install the role from Server Manager, then run the promotion wizard to create the domain. Promotion installs and configures DNS for the domain automatically, which is exactly why AD comes first. Choose the domain name deliberately — a subdomain of the company domain such as ad.company.com is the modern pattern; a name like office.local still works in a closed office. Keep the DSRM password in the vault; it is the emergency key to the domain.

DHCP comes second — install the role, then authorize it in Active Directory and create the address scope. An unauthorized DHCP server in a domain refuses to hand out addresses on purpose — that is a security feature, not a fault. Add File and Storage Services pieces as needed for shares.

Prefer PowerShell? The same roles install with these commands — Active Directory first:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest

And DHCP after it:

Install-WindowsFeature DHCP -IncludeManagementTools

Separate the System Drive From the Data Drive

Keep Windows and the roles on C: and put everything the office creates — shared folders, user documents, redirected profiles — on a separate data volume. This one layout decision pays you back for years.

Data on its own volume can be backed up, snapshotted with shadow copies and even moved to a new server without touching the system. And if the data drive fills up, the server still boots and logs people in — if C: fills up, everything stops. The backup target should be a different physical disk again: a partition on the same disk is not protection against that disk dying.

Set Up Remote Management With Discipline

You should manage this server from your desk, not by standing in front of it — but remote access must be a door with a lock, not an open window. Enable Remote Desktop for administrators only, and keep Network Level Authentication switched on.

From your own PC, Server Manager (via RSAT) or Windows Admin Center (a free download from Microsoft) can manage this server and the next ones from one console.

Run a Basic Hardening Pass Before Users Arrive

Thirty minutes of checks now is cheaper than one incident later. Confirm Windows Defender Firewall is on for all profiles — installing roles opens only the ports those roles need. Create your own named administrator account and use it for admin work, so the logs show a person, not a shared account; keep the built-in Administrator as a break-glass login.

Check that SMB signing is enabled, and do not install legacy features like SMBv1 for luck — Server 2025 does not install it by default, and that is deliberate. Finally, set a monthly update window and write it down: servers do not patch themselves responsibly by accident.

Turn On Backup Today, and Write Down What You Built

The setup is not finished when the roles work. It is finished when the server can come back from a bad day and when somebody else could understand it.

Install the Windows Server Backup feature, point it at a separate disk, include Bare Metal Recovery, and schedule it for tonight.

Then write the handover document: server name, IP, domain, roles, backup schedule, update window, and where the licences and passwords are stored. Store a copy of that document off the server — a document that only exists on the machine it describes is missing exactly when you need it.