Running a 10-50 person office where every PC manages its own local logins? You know the drill. Password resets that don’t sync. Three people editing the same “FINAL_v2” spreadsheet. No central switch to flip when someone gets let go on a Friday. Windows Server 2025 fixes that by becoming the single source of truth for logins, file shares, and network services.
This guide walks you from a blank server to a working domain controller with file sharing, patching, and backups in place. It’s sized for a small office, not a datacenter. You won’t find Storage Spaces Direct or Shielded VMs here, because you probably don’t need them.
What is Windows Server 2025?
Windows Server 2025 is Microsoft’s current Long-Term Servicing Channel (LTSC) release. It’s been generally available since November 1, 2024, and runs on OS build 26100.
For a small shop, it’s the box that hands out IP addresses (DHCP), resolves computer names (DNS), and stores every employee’s login and password policy (Active Directory Domain Services). It also hosts the shared drives everyone saves to. Instead of 30 PCs each managing their own accounts, one server becomes the authority every workstation checks in with.
Compared to Windows Server 2022, the security defaults are tighter out of the box. SMBv1 is disabled by default. Windows Defender ships built in. That matters if your last server was a 2012 R2 or 2016 box running legacy settings for a decade. You’re inheriting a much saner baseline this time around.
Before You Begin
Make sure you have:
- A physical or virtual machine meeting Windows Server 2025 minimums (2 GHz 64-bit CPU, 2 GB RAM minimum, 4+ GB realistic for a DC, 32 GB+ disk for the OS volume, separate volume recommended for data)
- The Windows Server 2025 installation ISO (Standard or Datacenter, Desktop Experience) from your Volume Licensing portal, retail purchase, or OEM
- A purchased license matching your edition decision, plus Client Access Licenses (CALs) unless you’re using Azure Arc pay-as-you-go billing
- A planned static IP address for the server (e.g., 192.168.1.10) and knowledge of your office’s private IP range
- A decided internal Active Directory domain name that you control (not a public TLD you don’t own)
- Administrative access to your router/firewall to set DHCP exclusions and reserve the server’s IP
- A destination for off-site backups (cloud storage account or a second physical location)
| Requirement | Details |
|---|---|
| Device | Physical server, or VM host (Hyper-V, VMware, Proxmox) |
| OS version | Windows Server 2025 (build 26100 or later) |
| RAM | 4 GB minimum for a DC role; 8+ GB recommended if also running File Services |
| Disk | 32 GB+ OS volume; separate data volume for shared files recommended |
| Network | Static IP reservation on your router/switch |
Domain-joined licensing rule: Windows Server 2022 CALs do not work with a Windows Server 2025 server. CALs are version-specific; budget for 2025-specific CALs even if you’re upgrading an existing environment.
Step-by-Step Guide
Step 1: Plan Your Static IP and Domain Name Before Installing Anything
Most small-business admins skip this step. It’s also the one that causes the most rework later. Active Directory, DNS, and DHCP all reference the server by IP address internally. Change that address after promoting the box to a domain controller, and you’ll spend an afternoon fixing DNS records and every workstation’s cached settings by hand.
Pick a static IP outside your router’s DHCP pool. If your router hands out 192.168.1.100–200, reserve 192.168.1.10 for the server. Also decide your internal AD domain name now. A common mistake: naming your AD forest after a domain you don’t own, like using contoso.com when contoso.com is a real, publicly registered domain someone else controls. This causes DNS conflicts later, especially once you add split-DNS or cloud services that need to talk to both namespaces. Safer patterns:
- Use a subdomain of a domain you already own publicly, like
corp.yourcompany.com - Use
.localonly if you’re certain you’ll never need to resolve it externally (Microsoft no longer recommends.localfor new deployments, since it conflicts with mDNS/Bonjour multicast DNS) - The safest modern choice for most small offices is a registered subdomain like
ad.yourcompany.com
Step 2: Decide on Edition and Licensing Model
Settle the licensing question before you boot the installer. It affects which ISO you download and how you activate later.
| Edition | Best for | Licensing model |
|---|---|---|
| Standard | Most 10-50 user shops running AD DS, DNS, DHCP, file sharing, up to 2 VMs per license | Per-core, minimum 16 core licenses per physical server, plus CALs per user/device |
| Datacenter | Shops needing unlimited VMs, Storage Spaces Direct, Shielded VMs | Per-core, same 16-core minimum, plus CALs, priced well above Standard’s list price |
| Essentials-class (OEM-only) | Very small offices under ~25 users/50 devices, single server, simplified role set | Sold only through OEM hardware, not a standalone retail SKU |
| Azure Arc pay-as-you-go | Shops wanting to avoid buying CALs upfront | Metered per-core/hour via Azure Arc; RDS CALs still required if using Remote Desktop |
For a 10-50 user office running standard file sharing and AD DS without heavy virtualization, Standard edition with per-device or per-user CALs is the practical default. Datacenter only makes sense if you’re running a lot of VMs on one host. Otherwise you’re paying for headroom you’ll never use. The Essentials-class SKU is worth considering only if you’re buying pre-built OEM hardware and your headcount is firmly under 25.
Budget check: total cost includes more than the core license. Add CALs (roughly $39/device or $50/user in typical CSP pricing) and RDS CALs if you’ll use Remote Desktop. Small shops underestimate this line item more often than you’d think.
Step 3: Boot the Installer and Choose Your Edition
Boot the server from the Windows Server 2025 ISO (USB media or virtual media if you’re on a hypervisor). At the setup screen:
- Select your language and keyboard layout, click Next
- Click Install now
- On the edition selection screen, choose Windows Server 2025 Standard (Desktop Experience) or Datacenter (Desktop Experience) based on your Step 2 decision. The Desktop Experience version gives you the full GUI, which you’ll want for Server Manager and the wizards described here
- Accept the license terms
- Choose Custom: Install Microsoft Server Operating System only (this is a clean install, not an upgrade)
- Select the target disk/volume and click Next; installation takes 15-25 minutes depending on hardware
- When prompted, set a strong local Administrator password
Step 4: Confirm the Build and Run Initial Updates
Sign in as Administrator. Server Manager opens automatically on Desktop Experience installs. Before touching roles, confirm you’re on a current build.
Go to Settings > System > About and check the OS build number; it should read 26100.x. Then run Windows Update immediately. The install media is often a few months behind the current cumulative update. You don’t want a domain controller running day-one patches.
SMBv1 note: Windows Server 2025 ships with SMBv1 disabled by default. You don’t need to manually turn it off like you did on older Server builds. Verify it’s still off after any role installs with
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocolin an elevated PowerShell session, theStateshould readDisabled.
Step 5: Assign the Static IP Address
Open Settings > Network & internet > Ethernet, click your adapter, then click Edit next to IP assignment. Switch from Automatic (DHCP) to Manual, enable IPv4, and enter the address you planned in Step 1.
# Alternative: set static IP via PowerShell (run as Administrator)
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.1.10 -PrefixLength 24 -DefaultGateway 192.168.1.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1,8.8.8.8The DNS server address points to 127.0.0.1 because once you install AD DS, this box becomes its own DNS server. The secondary 8.8.8.8 is a temporary fallback for internet name resolution until AD DS is fully configured. You’ll clean this up in Step 7.
Step 6: Install Active Directory Domain Services
In Server Manager, click Manage > Add Roles and Features.
- Click Next through the wizard intro, keep Role-based or feature-based installation selected
- Select your server from the pool, click Next
- On Server Roles, check Active Directory Domain Services. A dialog pops up asking to add required features (Group Policy Management, RSAT tools); click Add Features
- Click Next through Features, AD DS intro page, then Install
Installation takes a few minutes. When it finishes, don’t close the wizard yet. Click the notification flag icon near the top of Server Manager and select Promote this server to a domain controller.
Step 7: Promote the Server to a Domain Controller
The Active Directory Domain Services Configuration Wizard opens.
- On Deployment Configuration, select Add a new forest
- Enter your root domain name from Step 1 (e.g.,
corp.yourcompany.com), click Next
- On Domain Controller Options, keep the default Forest/Domain functional level (Windows Server 2016 or higher is fine for a small office), leave DNS Server checked, and set a Directory Services Restore Mode (DSRM) password. Store this somewhere safe; you’ll need it if AD ever needs offline repair
- Click through DNS Options (ignore the delegation warning, normal for a new forest), confirm the NetBIOS name, accept default database/log/SYSVOL paths, review the summary, and click Install
The server reboots automatically. After reboot, you’ll log in with your domain administrator account (DOMAIN\Administrator) instead of the local account.
Warning: Promoting a domain controller is disruptive if you do it on a production box with existing local users. Plan for a maintenance window. Don’t run this step on a server you can’t afford to reboot immediately.
Step 8: Verify DNS and Clean Up the DNS Client Settings
AD DS installs the DNS Server role automatically. Open DNS Manager from Server Manager’s Tools menu and confirm your forward lookup zone matches your domain name.
Now go back and update the network adapter’s DNS setting so it points only to itself: Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1. Add a forwarder inside DNS Manager instead (right-click the server node > Properties > Forwarders > Edit, add 8.8.8.8 or your ISP’s resolver). This lets internal clients resolve external websites through your DC without hardcoding a second DNS server on every machine.
Step 9: Install DHCP and Create a Scope
Back in Server Manager, Add Roles and Features again, this time checking DHCP Server. Accept the feature prompt, install, then click the notification flag and run Complete DHCP configuration to create the default security groups.
Open the DHCP console from Tools, expand your server, right-click IPv4, and choose New Scope.
- Name it something recognizable, like “Office LAN”
- Enter the IP range, e.g., start
192.168.1.50, end192.168.1.199 - Set exclusions to cover your server’s static IP and any other reserved addresses (printers, switches); exclude
192.168.1.1-192.168.1.49 - Set lease duration (8 days is a reasonable default for an office)
- Configure the default gateway (your router’s IP) and DNS server (your new server’s static IP)
- Activate the scope when prompted
Disable DHCP on your router if it was previously handing out addresses. Running two DHCP servers on the same LAN causes IP conflicts. Chasing duplicate leases across an office is a miserable way to spend an afternoon.
Step 10: Configure Group Policy for Password Rules and Mapped Drives
Open Group Policy Management from Server Manager’s Tools menu. Expand your domain, right-click Default Domain Policy, and select Edit.
Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy. Set:
- Minimum password length: 12 characters (up from the Windows default of 7)
- Password must meet complexity requirements: Enabled
- Maximum password age: 90 days (or longer if you’re pairing this with MFA elsewhere)
For mapped drives, create a separate GPO. Don’t overload the Default Domain Policy with unrelated settings. Right-click your domain OU and choose Create a GPO in this domain, and Link it here. Name it “Office Drive Mappings.” Edit it, then go to User Configuration > Preferences > Windows Settings > Drive Maps. Right-click and choose New > Mapped Drive, then set the path (e.g., \\SERVERNAME\Shared), drive letter, and reconnect option. Link the GPO to the OU containing your user accounts.
Step 11: Set Up the File Server and Shared Drives
If File and Storage Services isn’t already installed (it’s included by default on most Server Manager setups), add it via Add Roles and Features. Then in Server Manager, go to File and Storage Services > Shares, click Tasks > New Share.
- Choose SMB Share – Quick as the profile
- Select the server and a volume, or type a custom path
- Name the share (e.g., “Shared” or “Accounting”)
- On the permissions page, click Customize permissions and assign access to AD security groups you’ve created (e.g.,
Sales-RW,Accounting-RW) rather than individual users. This makes onboarding and offboarding much simpler later - Click Create
Step 12: Choose Your Patch Management Approach
You have two supported paths for Windows Server 2025 updates:
Windows Update for Business is the simplest option for a single server or small shop without dedicated IT staff. Configure via Settings > Windows Update > Advanced options, set deferral periods for feature and quality updates, and let it patch on its own schedule.
WSUS (Windows Server Update Services) gives you centralized control over which updates get approved and pushed to which machines before they roll out office-wide. Microsoft has marked WSUS as deprecated in favor of Windows Update for Business, but it remains supported through the Windows Server 2025 lifecycle. It’s not going anywhere overnight. Plenty of small shops still rely on it for test-then-deploy patch discipline.
For a 10-50 user shop with one server and a handful of workstations, Windows Update for Business with sane deferral settings is usually enough. You avoid standing up and maintaining a separate WSUS role for a fleet this small. Reach for WSUS if you specifically need to test patches on a staging machine before they hit production, or if compliance requirements demand documented patch approval workflows.
Step 13: Set Up Backups Following the 3-2-1 Rule
The 3-2-1 rule means: 3 copies of your data, on 2 different media types, with 1 copy off-site. For a small-business file server, that typically looks like:
- Copy 1: The live data on the server’s data volume
- Copy 2: An on-prem backup using Windows Server Backup (built-in, free) to a separate internal or external disk. Schedule it via
wbadminor the Windows Server Backup GUI for nightly runs - Copy 3: An off-site cloud backup, which is a cloud backup agent pointed at Azure Blob Storage, Backblaze B2, or a similar service, running on a schedule independent of your on-prem job
# Example: register a daily Windows Server Backup job to an external disk (run as Administrator)
wbadmin enable backup -addtarget:{backup-disk-guid} -schedule:22:00 -include:D:The on-prem copy gives you fast recovery for the common case: someone deleted a file, or a drive failed. The off-site cloud copy protects against the scenario the on-prem copy can’t cover: fire, theft, ransomware that encrypts both your live data and a locally-attached backup disk. Test your restore process at least quarterly. A backup you’ve never restored from is a guess, not a plan.
Step 14: Activate the Server
Go to Settings > System > Activation. Click Change product key, enter your 25-character key, and confirm activation status shows Windows is activated.
If you’re using the Azure Arc pay-as-you-go model instead of a traditional key, activation happens through the Azure Arc onboarding script rather than a product key. Connect the server to your Azure subscription via Azure Arc > Servers > Add in the Azure portal and follow the agent installation prompts.
Configuration Reference
| Setting | Where | Small-office recommendation |
|---|---|---|
| Static IP | Network adapter settings | Outside your DHCP pool, e.g., .10-.20 range |
| Domain name | AD DS forest root | Subdomain of a domain you own, e.g., corp.yourcompany.com |
| DHCP scope | DHCP console | Exclude the static IP range; 8-day lease is typical |
| Password policy | Default Domain Policy | 12+ characters, complexity enabled, 90-day max age |
| Share permissions | New Share Wizard | Assign to AD security groups, not individual users |
| Patch method | Windows Update / WSUS | Windows Update for Business unless you need staged approval |
| Backup cadence | Windows Server Backup | Nightly on-prem + daily/weekly off-site cloud sync |
Tips and Troubleshooting
“Windows Server 2022 CALs don’t work after I upgraded”. CALs are version-specific. A CAL purchased for 2022 does not authorize access to a 2025 server. Purchase 2025-specific User or Device CALs, and separate RDS CALs if you’re using Remote Desktop Services.
“I’m under-licensed even though my server has fewer cores”. Core-based licensing under Standard/Datacenter requires a minimum of 16 core licenses per physical server (minimum 8 per processor). That’s regardless of your actual hardware core count. A 4-core box still needs 16 core licenses purchased in 2-packs or 16-packs.
“I expected an Essentials-style setup wizard and don’t see one”. Windows Server Essentials is now a legacy, OEM-only SKU. New Standard/Datacenter deployments use Server Manager and the standard wizards described above, not a simplified small-business wizard. If you bought OEM hardware specifically with Essentials, follow that vendor’s documentation and respect the ~25 user/50 device ceiling.
“WSUS shows a deprecation warning, is it about to stop working?”. No. Deprecated means Microsoft is steering new deployments toward Windows Update for Business, not that WSUS is being removed. It remains supported through the Windows Server 2025 OS lifecycle. Plan a longer-term migration, but you’re not on a countdown clock.
“DNS resolution is flaky after promoting the DC”. Usually caused by a workstation or the server itself still pointing at your ISP router or a public DNS server as primary DNS, instead of the domain controller. Every domain-joined machine’s primary DNS should be the DC’s static IP. Verify with nslookup yourdomain.com from a client and confirm it returns the DC’s IP.
Wrapping Up
You’ve now got a working small-office setup: centralized logins, automatic IP assignment, internal name resolution, enforced password rules, mapped drives, a shared file server with group-based permissions, a patching strategy, and backups that follow the 3-2-1 rule instead of “we have one external hard drive.” That’s a real upgrade from ad-hoc peer-to-peer sharing; it’s the same foundation enterprise environments run, just scoped down to what a 10-50 person shop actually needs.
If your budget is tight, keep the Azure Arc pay-as-you-go model in your back pocket; it can lower the initial outlay if you don’t want to buy CALs upfront, though you’re trading a predictable perpetual cost for a metered monthly one. Either way, don’t skip the off-site backup leg. It’s the cheapest insurance policy you’ll buy this year.