| Windows Server 2022 is built on the solid foundation of Windows Server 2019 and delivers many innovations in three key areas: security, hybrid integration and management with Azure, and application platform. |
-
Security
The new security capabilities in Windows Server 2022 combine other security features in Windows Server across multiple areas to provide defence in depth against sophisticated threats. The advanced multi-layered security in Windows Server 2022 delivers the comprehensive protection that servers need today.
-
Secured-core server
Certified Secured-core server hardware from an OEM partner provides additional protection against advanced attacks. This can give greater confidence when processing critical data in some of the most data-sensitive industries. A Secured-core server uses hardware, firmware and driver capabilities to enable advanced Windows Server security features. Many of these features are available in Windows Secured-core PCs and are now also available with Secured-core server hardware and Windows Server 2022.
-
Hardware root of trust
Trusted Platform Module 2.0 (TPM 2.0) chips provide a secure hardware store for sensitive cryptographic keys and data, including measurements for system integrity. TPM 2.0 can verify that the server was started with legitimate code and can trust the subsequent execution of code. This is known as a hardware root of trust and is used by features such as BitLocker disk encryption.
-
Firmware protection
Firmware runs with high privileges and is often invisible to traditional antivirus solutions, which has led to a rise in firmware-based attacks. Secured-core server processors support measurement and verification of boot processes with Dynamic Root of Trust for Measurement (DRTM) technology and isolate driver access to memory with Direct Memory Access (DMA) protection.
-
Virtualisation-based security (VBS)
Secured-core servers support virtualisation-based security (VBS) and hypervisor-protected code integrity (HVCI). VBS uses hardware virtualisation features to create and isolate a secure memory region from the normal operating system, protecting against a whole class of vulnerabilities used in cryptocurrency mining attacks. VBS also enables the use of Credential Guard, where user credentials and secrets are stored in a virtual container that the operating system cannot directly access. HVCI uses VBS to greatly strengthen enforcement of code integrity policy, including kernel-mode code integrity, which verifies all kernel-mode drivers and binaries in a virtual environment before they are started, and prevents unsigned drivers or system files from being loaded into system memory.
-
Secure connectivity
Secure connections are the foundation of today's interconnected systems. Transport Layer Security (TLS) 1.3 is the latest version of the most widely used security protocol on the internet, which encrypts data to provide a secure communication channel between two endpoints. HTTPS and TLS 1.3 are now enabled by default in Windows Server 2022, protecting data for clients that connect to the server. It removes outdated cryptographic algorithms, improves security over older versions and aims to encrypt as much of the handshake as possible. Learn more about supported TLS versions and supported cipher suites.
-
Secure DNS: encrypted DNS name resolution queries via DNS-over-HTTPS
The DNS client in Windows Server 2022 now supports DNS-over-HTTPS (DoH), which encrypts DNS queries using the HTTPS protocol. This helps keep your traffic as private as possible by preventing eavesdropping on and tampering with your DNS data. Learn more about configuring the DNS client to use DoH.
-
Server Message Block (SMB): SMB encryption with AES-256 for the most security-demanding environments
Windows Server now supports AES-256-GCM and AES-256-CCM cryptographic suites for SMB encryption. Windows automatically negotiates this more advanced cipher when connecting to another computer that also supports it, and it can also be enforced through group policies. Windows Server still supports AES-128 for compatibility with older versions. Signing with AES-128-GMAC now also speeds up signing performance.
-
SMB: East-West SMB encryption controls for intra-cluster communication
Windows Server failover clusters now support granular control over the encryption and signing of intra-node storage communication for Cluster Shared Volumes (CSV) and the storage bus layer (SBL). This means that when using Storage Spaces Direct you can choose to encrypt or sign east-west communication within the cluster for higher security.
-
SMB Direct and RDMA encryption
SMB Direct and RDMA provide a high-throughput, low-latency network fabric for workloads such as Storage Spaces Direct, Storage Replica, Hyper-V, Scale-out File Server and SQL Server. SMB Direct in Windows Server 2022 now supports encryption. Previously, enabling SMB encryption disabled direct data placement; this was intentional but significantly affected performance. Now data is encrypted before placement, which results in far less performance loss while adding packet-level privacy through AES-128 and AES-256.
-
SMB over QUIC
SMB over QUIC updates the SMB 3.1.1 protocol in Windows Server 2022 Datacenter: Azure Edition and supported Windows clients to use the QUIC protocol instead of TCP. With SMB over QUIC together with TLS 1.3, users and applications can securely and reliably access data from edge file servers running in Azure. Mobile and remote workers no longer need a VPN to reach their file servers over SMB when using Windows. More information can be found in the SMB over QUIC documentation.
-
Hybrid capabilities with Azure
You can increase your efficiency and flexibility with the built-in hybrid capabilities in Windows Server 2022, which let you extend your datacentres to Azure more easily than ever.
-
Windows Server with Azure Arc enabled
Windows Server 2022 and Azure Arc-enabled servers add on-premises and multicloud Windows servers to Azure through Azure Arc. This management experience is designed to be consistent with how you manage your own Azure virtual machines. When a hybrid machine connects to Azure, it becomes a connected machine and is treated as a resource in Azure. More information can be found in the documentation for Azure Arc-enabled servers.
-
Windows Admin Center
Improvements in Windows Admin Center for managing Windows Server 2022 include capabilities both for reporting the current status of the Secured-core features mentioned above and, where applicable, for allowing customers to enable those features. More information about these and many other improvements in Windows Admin Center can be found in the Windows Admin Center documentation.
-
Azure Automanage - Hotpatch
Hotpatch, part of Azure Automanage, is supported in Windows Server 2022 Datacenter: Azure Edition. Hotpatching is a new way to install updates on new Windows Server Azure Edition virtual machines (VMs) that does not require a restart after installation. More information can be found in the Azure Automanage documentation.
|
| Language |
English, Czech, German, Spanish, French, Italian, Dutch, Polish, Portuguese, Russian, Swedish, Korean, Japanese, Brazilian Portuguese |
Please note that quantities are limited and dynamic. At the time of ordering, the item may be out of stock. We will notify you in a timely manner in the event that we are unable to fulfill the order.
