| Windows Server 2022 is built on the solid foundation of Windows Server 2019 and offers many innovations in three key areas: security, hybrid integration and management with Azure, and application platform. |
-
Security
The new security capabilities in Windows Server 2022 combine other security features in Windows Server across multiple areas to provide defence-in-depth protection against sophisticated threats. Multi-layered advanced security in Windows Server 2022 delivers the comprehensive protection that servers need today.
-
Secured-core server
Secured-core server certified hardware from an OEM partner provides additional protection against sophisticated attacks. This can provide increased confidence when processing critically important data in some of the most data-sensitive industries. Secured-core server uses hardware, firmware and driver capabilities to enable advanced Windows Server security features. Many of these features are available in Windows Secured-core PCs and are now also available with Secured-core server hardware and Windows Server 2022.
-
Hardware root of trust
Trusted Platform Module 2.0 (TPM 2.0) cryptographic processor chips provide a secure, hardware-based store for sensitive cryptographic keys and data, including system integrity measurements. TPM 2.0 can verify that the server was started with legitimate code and can trust the subsequent execution of code. This is known as a hardware root of trust and is used by features such as BitLocker disk encryption.
-
Firmware protection
Firmware runs with high privileges and is often invisible to traditional antivirus solutions, which has led to an increase in firmware-based attacks. Secured-core server processors support measurement and verification of boot processes with Dynamic Root of Trust for Measurement (DRTM) technology and isolate driver access to memory with Direct Memory Access (DMA) protection.
-
Virtualization-based security (VBS)
Secured-core servers support virtualization-based security (VBS) and hypervisor-protected code integrity (HVCI). VBS uses hardware virtualization features to create and isolate a secure memory region from the normal operating system, protecting against an entire class of vulnerabilities used in cryptocurrency mining attacks. VBS also enables the use of Credential Guard, where user credentials and secrets are stored in a virtual container that the operating system cannot access directly. HVCI uses VBS to greatly strengthen enforcement of code integrity policy, including kernel-mode code integrity, which verifies all kernel-mode drivers and binaries in a virtualized environment before they are started, preventing unsigned drivers or system files from being loaded into system memory.
-
Secured connectivity
Secured connections are the foundation of today's interconnected systems. Transport Layer Security (TLS) 1.3 is the latest version of the most widely used security protocol on the internet, which encrypts data to provide a secure communication channel between two endpoints. HTTPS and TLS 1.3 are now enabled by default in Windows Server 2022, protecting data from clients connecting to the server. It removes outdated cryptographic algorithms, improves security compared with older versions, and aims to encrypt as much of the handshake as possible. Learn more about supported TLS versions and supported cipher suites.
-
Secure DNS: Encrypted DNS name resolution queries with DNS-over-HTTPS
The DNS client in Windows Server 2022 now supports DNS-over-HTTPS (DoH), which encrypts DNS queries using the HTTPS protocol. This helps keep your traffic as private as possible by preventing eavesdropping on and tampering with your DNS data. Learn more about configuring the DNS client to use DoH.
-
Server Message Block (SMB): SMB encryption AES-256 for the most security-demanding
Windows Server now supports the AES-256-GCM and AES-256-CCM cipher suites for SMB encryption. Windows will automatically negotiate this more advanced encryption method when connecting to another computer that also supports it, and it can also be enforced through group policies. Windows Server still supports AES-128 for compatibility with older versions. SMB signing AES-128-GMAC now also speeds up signing performance.
-
SMB: East-West SMB encryption controls for intra-cluster communication
Windows Server failover clusters now support granular control over encryption and signing of intra-node communication for Cluster Shared Volumes (CSV) storage and the storage bus layer (SBL). This means that when using Storage Spaces Direct, you can choose to encrypt or sign east-west communication within the cluster itself for higher security.
-
SMB Direct and RDMA encryption
SMB Direct and RDMA provide a high-throughput, low-latency network fabric for workloads such as Storage Spaces Direct, Storage Replica, Hyper-V, Scale-out File Server and SQL Server. SMB Direct in Windows Server 2022 now supports encryption. Previously, enabling SMB encryption disabled direct data placement; this was intentional but significantly affected performance. Now data is encrypted before placement, which results in far less performance loss while adding secure packet privacy with AES-128 and AES-256.
-
SMB over QUIC
SMB over QUIC updates the SMB 3.1.1 protocol in Windows Server 2022 Datacenter: Azure Edition and supported Windows clients to use the QUIC protocol instead of TCP. With SMB over QUIC together with TLS 1.3, users and applications can securely and reliably access data from edge file servers running in Azure. Mobile and remote users no longer need a VPN to access their file servers over SMB in Windows. More information can be found in the SMB over QUIC documentation.
-
Hybrid capabilities with Azure
You can increase efficiency and flexibility with built-in hybrid capabilities in Windows Server 2022, which let you extend your datacenters to Azure more easily than ever.
-
Windows Server with Azure Arc enabled
Windows Server 2022 servers enabled with Azure Arc include on-premises and multi-cloud Windows servers in Azure through Azure Arc. This management experience is designed to be consistent with how you manage your own Azure virtual machines. When a hybrid machine is connected to Azure, it becomes a connected machine and is treated as a resource in Azure. More information can be found in the documentation for servers enabled with Azure Arc.
-
Windows Admin Center
Improvements in Windows Admin Center for managing Windows Server 2022 include capabilities both for reporting the current status of the Secured-core features mentioned above and, where applicable, for allowing customers to enable these features. More information about them and the many other improvements in Windows Admin Center can be found in the Windows Admin Center documentation.
-
Azure Automanage - Hotpatch
Hotpatch, part of Azure Automanage, is supported in Windows Server 2022 Datacenter: Azure Edition. Hotpatching is a new way to install updates on new Windows Server Azure Edition virtual machines (VMs) that does not require a restart after installation. More information can be found in the Azure Automanage documentation.
|
| Language |
English, Czech, German, Spanish, French, Italian, Dutch, Polish, Portuguese, Russian, Swedish, Korean, Japanese, Brazilian Portuguese |
Please note that quantities are limited and dynamic. At the time of ordering, the item may be out of stock. We will notify you in a timely manner in the event that we are unable to fulfill the order.
