September 11, 2026
13 min read
By Kokil Thapa | Last reviewed: September 2026
Windows Server 2022: Getting Started is the first practical checkpoint before you run Active Directory, IIS, SQL Server, or a hybrid stack beside Linux. Most teams I work with still split workloads: Ubuntu for PHP and Laravel, Windows for directory services, file shares, or legacy .NET. This guide walks through edition choice, clean installation, post-install configuration, and the hardening steps you should not skip. If you already run Linux system administration in production, treat Windows Server as another managed host with its own patch cycle and licensing rules.
Quick answer: Windows Server 2022: Getting Started means choosing Standard or Datacenter, installing Server Core or Desktop Experience, applying updates, joining or creating a domain, enabling only required roles, and hardening with firewall rules, backups, and monitoring before production traffic arrives.
What is Windows Server 2022 and when should you use it?
Windows Server 2022 is Microsoft's long-term servicing (LTS) release for on-premises and hybrid cloud infrastructure. It ships with improved security baselines, SMB compression, secured-core server support, and tighter Azure Arc integration. Support runs through October 2031, which makes it a sensible choice in 2026 when you need a stable Windows platform.
You reach for Windows Server when the workload genuinely requires it. Common cases include Active Directory Domain Services, Group Policy, Windows file and print services, IIS for ASP.NET applications, Remote Desktop Services, and SQL Server on Windows. For greenfield PHP or Laravel APIs, Linux remains the simpler path I use daily—but mixed estates are normal, especially in Nepal offices that run Windows desktops and need a local domain controller.
Windows Server 2022 is not a drop-in replacement for every Linux web stack. It excels where Windows-native tooling, AD integration, or vendor support contracts require the platform. Plan the OS choice during planning and research so licensing and hardware costs do not surprise the client later.
Server Core versus Desktop Experience
Server Core installs without the full GUI. It uses less disk space and presents a smaller patch surface. Desktop Experience includes the familiar Windows shell and is easier for teams new to PowerShell administration. For production, prefer Server Core once your runbooks and PowerShell automation for Windows servers are in place.
What are the hardware and licensing requirements for Windows Server 2022?
Microsoft publishes minimum specs, but production hosts need headroom. Plan at least two CPU cores, 4 GB RAM for lightweight roles, and 32 GB or more disk for the OS partition alone. Domain controllers, Hyper-V hosts, and SQL Server need substantially more memory and fast storage.
Licensing is per physical core, not per virtual machine. Standard Edition covers two OSEs (operating system environments) when all cores on the server are licensed. Datacenter Edition allows unlimited Windows VMs on the same licensed hardware. Essentials targets very small shops but caps users and drops several enterprise features—verify it still fits your scenario before buying.
| Edition | Typical use | Virtualization rights | Notes for 2026 |
|---|---|---|---|
| Standard | Single DC, IIS, file server | 2 OSEs per fully licensed host | Most SMB and branch-office installs |
| Datacenter | Heavy Hyper-V density | Unlimited Windows VMs | Justify cost with VM count |
| Essentials | ≤25 users, ≤50 devices | One physical instance | No CALs, limited roles |
| Azure Hybrid Benefit | Cloud or hybrid | Varies by subscription | Reuse existing licenses on Azure VMs |
Client access licenses (CALs) are required for users or devices accessing Standard or Datacenter services like file shares or Remote Desktop. Budget CALs alongside the server license—clients often forget this line item. For domain registration and hosting projects, separate Windows licensing from web hosting fees so invoices stay transparent.
Check firmware before install. Secured-core features expect TPM 2.0 and UEFI Secure Boot on supported hardware. Older lab machines may install fine but skip advanced security capabilities. Confirm CPU compatibility for nested virtualization if you plan Hyper-V inside a cloud VM.
How do you install Windows Server 2022 step by step?
Start from the official ISO published by Microsoft. Verify the SHA256 hash after download. Build bootable USB media with the Windows USB/DVD Download Tool or diskpart on an existing Windows workstation. For remote offices in Nepal with slow links, copy the ISO to local storage first—re-downloading a 5 GB image over a unstable connection wastes an afternoon.
- Boot the server from USB or virtual DVD and choose language, edition, and install type.
- Select Windows Server 2022 Standard/Datacenter (Server Core or Desktop Experience)—edition names are baked into the index; pick the correct SKU.
- Choose Custom: Install Windows only on a blank GPT partition.
- Set the Administrator password at first logon; store it in your vault, not a chat thread.
- Run Windows Update repeatedly until cumulative updates report the system is current.
- Rename the computer, set a static IP, and register DNS forward and reverse records.
- Activate with a valid product key or KMS/Active Directory-Based Activation.
On a Hyper-V or VMware guest, install integration services or VMware Tools immediately after first boot. Time sync drift breaks Kerberos authentication in Active Directory. Point the guest to a reliable NTP source and confirm timezone settings—Kathmandu is UTC+5:45, and incorrect offsets cause subtle log timestamp mismatches across systems.
Initial PowerShell configuration
After first logon, run these commands from an elevated PowerShell session. Adjust values for your network.
# Rename and reboot
Rename-Computer -NewName "SRV-DC01" -Restart
# Static IPv4 example
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.10.10 `
-PrefixLength 24 -DefaultGateway 192.168.10.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.10.10,1.1.1.1
# Verify activation
slmgr /xpr
# Enable Remote Server Administration Tools target (if managing remotely)
Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "192.168.10.0/24" -ForceDocument every change in your internal wiki or Git-managed config repo. The same discipline applies whether the host runs Windows or Ubuntu Server setup—undocumented DNS or firewall edits become midnight outages.
How do you configure essential roles after installing Windows Server 2022?
Install only the roles you need. Each role expands the attack surface and patch burden. Use Server Manager or PowerShell Install-WindowsFeature. For a first domain controller in a greenfield forest, the sequence below is the usual path.
Active Directory Domain Services
Promote the first server with AD DS and DNS together. Choose a valid internal domain name—avoid single-label names like COMPANY and prefer company.local or a subdomain of a domain you own. After promotion, verify replication health with repadmin /replsummary once you add a second DC.
Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools
Import-Module ADDSDeployment
Install-ADDSForest `
-DomainName "corp.example.com" `
-DomainMode "WinThreshold" `
-ForestMode "WinThreshold" `
-InstallDns `
-NoRebootOnCompletion:$false `
-ForceAlways maintain at least two domain controllers in production. A single DC is a single point of failure for login, Group Policy, and DNS for the whole office.
IIS for web workloads
IIS remains the standard host for ASP.NET and some reverse-proxy scenarios on Windows. Install the Web Server role with management tools, then configure application pools with dedicated service accounts. Keep .NET runtimes patched separately from the OS cumulative updates.
Install-WindowsFeature Web-Server, Web-Mgmt-Tools, Web-Asp-Net45
# Create site directory and app pool (example)
New-Item -Path "C:\inetpub\apps\myapp" -ItemType Directory
New-WebAppPool -Name "MyAppPool"
New-Website -Name "MyApp" -Port 443 -PhysicalPath "C:\inetpub\apps\myapp" `
-ApplicationPool "MyAppPool" -SslIf your public site is PHP or Laravel on Linux, IIS might still serve an internal admin tool or API gateway. Cross-platform teams should define ownership clearly in enterprise application development engagements so Windows and Linux patches do not fall through the gap.
File services and Hyper-V
File Server role with SMB shares is still common for office documents and scanned PDFs. Enable SMB signing on domain-joined clients via Group Policy. For virtualization, install Hyper-V, create an external virtual switch bound to a physical NIC, and store VM disks on a separate volume. Read Windows Storage Spaces and DFS before designing multi-node storage—DFS Namespaces help when users need one UNC path across file servers.
For containerized .NET services, evaluate Windows containers with Docker on Server 2022 rather than stuffing every app onto IIS on the DC. Separation simplifies upgrades and rollback.
How do you harden and maintain Windows Server 2022 in production?
A freshly installed server is not production-ready. Apply a baseline before exposing it to the LAN or internet. Microsoft publishes security baselines via the Security Compliance Toolkit; CIS benchmarks for server hardening offer an independent checklist that auditors recognize.
Firewall, updates, and accounts
Windows Defender Firewall should block unsolicited inbound traffic by default. Open only required ports—389/636 for LDAP, 53 for DNS, 88 for Kerberos, 445 for SMB if needed, 443 for IIS. Disable legacy protocols where possible: LLMNR, SMBv1, and weak cipher suites. Enable Windows Update for business or WSUS so patches are predictable; test cumulative updates on a staging VM before production.
- Rename or disable the built-in Administrator after creating named admin accounts.
- Require complex passwords and lockout policy via Default Domain Policy.
- Enable auditing for logon failures and privilege use on domain controllers.
- Install antivirus only if it does not break VSS backups or Hyper-V performance.
- Generate strong local passwords with a password generator and store them in a team vault.
Remote Desktop should never sit on port 3389 exposed to the public internet. Use a VPN or jump host instead. The same rule applies to Linux SSH—see how to secure your website and server in Nepal for perimeter guidance that spans both platforms.
Backup and monitoring
Windows Server Backup or a third-party agent must capture system state for domain controllers. Test restores quarterly—a backup you never restored is wishful thinking. VSS-aware agents handle open SQL and Exchange files better than naive file copies. Align your plan with automated server backups complete setup principles: 3-2-1 retention, off-site copies, and documented runbooks.
Monitoring should cover disk space, CPU, service health, AD replication, and certificate expiry. Nagios monitoring for servers works on Windows via NSClient++; native options include Windows Admin Center and Azure Monitor when you allow outbound telemetry. Alert on failed backup jobs and DC replication errors before users notice login delays.
Hybrid and migration notes
Many organizations run Azure AD Connect to sync on-premises AD with Microsoft Entra ID. Plan attribute filtering and password hash sync before the first user sign-in to cloud apps. For migrations from Server 2016 or 2019, review schema and functional level requirements—2022 supports older domain functional levels during transition.
When you also operate Linux web tiers, document which DNS zone owns public records and which internal zone AD serves. Split-brain DNS mistakes break certificate validation and internal API calls. Projects like SRP Infrastructure Development Nepal show why infrastructure documentation matters as much as the install itself.
Ongoing care belongs in a support contract or internal runbook. Patch Tuesday, backup verification, and AD health checks are recurring work—not one-time setup. Pair Windows maintenance with support and maintenance coverage if your team lacks a dedicated Windows admin.
Reference Microsoft's official documentation for authoritative syntax and deprecated features: the Windows Server getting started guide on Microsoft Learn and the Windows Server security documentation. Licensing details change; confirm current terms on Microsoft's Windows Server pricing page before purchase.
Key Takeaways
- Pick Standard for most single-host or two-VM setups; Datacenter when Hyper-V density justifies the cost.
- Prefer Server Core in production once PowerShell automation and remote management are proven.
- Never run a lone domain controller—plan two DCs, system-state backups, and tested restores.
- Install one primary role per server when budget allows; keep AD off heavy IIS or SQL boxes.
- Apply security baselines, restrict firewall ports, and monitor replication before users depend on the box.
- Document IP, DNS, licensing, and CAL counts alongside Linux hosts in the same inventory.
People Also Ask
Is Windows Server 2022 free?
No. Windows Server 2022 requires a paid license per physical core plus CALs for Standard and Datacenter editions. Evaluation ISOs allow 180-day trials for lab use. Azure VMs can use pay-as-you-go licensing or Hybrid Benefit if you already own licenses with Software Assurance.
Can I upgrade from Windows Server 2019 to 2022 in place?
Microsoft supports in-place upgrade from 2019 to 2022 on the same hardware for the same edition class. Take a full backup and snapshot first. Many admins still prefer clean install plus role migration to avoid inherited misconfiguration.
What is the difference between Server Core and Nano Server in 2026?
Nano Server is container-only and no longer serves as a general-purpose install option. Server Core is the supported minimal GUI-less install for AD, IIS, Hyper-V, and file roles. Choose Core unless your team lacks PowerShell skills today.
Do I need Windows Server for a small business website?
Usually no. Public brochure sites and Laravel or WordPress apps run well on Linux with lower licensing cost. Windows Server makes sense when you need Active Directory, Windows-authenticated file shares, or IIS-specific applications.
Ship Windows Server 2022 with a plan, not just an ISO
Windows Server 2022: Getting Started ends when the host is patched, licensed, role-scoped, backed up, and monitored—not when the installer reboots. Edition choice, CAL budgeting, and separation of domain services from application tiers prevent the expensive rework I see when a "quick DC" becomes the file, print, and web server for the whole office. Compare your broader stack against Ubuntu server hardening and database backup strategies so both platforms meet the same recovery expectations.
If you need help designing a hybrid Windows and Linux environment, auditing an existing DC, or migrating workloads without downtime, contact us to scope the work. For CI-driven deployments across mixed hosts, see TeamCity CI getting started and custom software development options that fit your team size.
Frequently Asked Questions
No. It requires a paid per-core license plus CALs for Standard and Datacenter. Evaluation ISOs give 180-day lab trials only.
Plan two CPU cores, 4 GB RAM for light roles, and 32 GB or more OS disk. Domain controllers, Hyper-V hosts, and SQL Server need much more.
Prefer Server Core in production once PowerShell automation and remote management are proven. Desktop Experience suits teams new to Windows administration.
Windows Server 2022 is Microsoft's long-term servicing release for on-premises and hybrid infrastructure, supported through October 2031. Use it when workloads genuinely require Windows: Active Directory, Group Policy, file and print services, IIS for ASP.NET, Remote Desktop Services, or SQL Server on Windows. For greenfield PHP or Laravel APIs, Linux remains simpler, but mixed estates are normal, especially offices that run Windows desktops and need a local domain controller. It excels where Windows-native tooling, AD integration, or vendor support contracts require the platform, not as a drop-in replacement for every Linux web stack.
Licensing is per physical core, not per VM. Standard Edition covers two OSEs when all cores on the server are licensed—typical for a single domain controller, IIS host, or file server in SMB and branch offices. Datacenter Edition allows unlimited Windows VMs on the same licensed hardware, which justifies its cost when Hyper-V density is high. Essentials targets very small shops with 25 users or fewer and 50 devices, one physical instance, no CALs, but drops several enterprise features. Verify it still fits your scenario before buying.
Yes for Standard and Datacenter. CALs are required for users or devices accessing services like file shares or Remote Desktop. Budget CALs alongside the server license—this line item is often forgotten on client invoices. Essentials does not require CALs but caps users and devices. Separate Windows licensing from web hosting fees so billing stays transparent. Azure Hybrid Benefit can reuse existing licenses on Azure VMs when you hold Software Assurance, but on-premises Standard and Datacenter still need CAL planning during initial setup.
Download the official ISO and verify the SHA256 hash. Build bootable USB media with the Windows USB/DVD Download Tool or diskpart. Boot from USB, choose language, edition, and install type—pick the correct Standard or Datacenter SKU with Server Core or Desktop Experience. Select Custom install on a blank GPT partition. Set the Administrator password at first logon and store it in a vault. Run Windows Update until cumulative updates report current. Rename the computer, set a static IP, register DNS records, and activate with a product key or KMS. On Hyper-V or VMware guests, install integration services immediately after first boot.
From elevated PowerShell, rename the server with Rename-Computer, reboot, then assign a static IPv4 with New-NetIPAddress and Set-DnsClientServerAddress. Verify activation with slmgr /xpr. Enable PSRemoting for remote administration and configure TrustedHosts if you manage from a subnet range. Document every change in your wiki or Git-managed config repo—the same discipline you apply to Ubuntu Server. Time sync drift breaks Kerberos in Active Directory, so point the guest to a reliable NTP source and confirm timezone settings. Incorrect offsets cause subtle log timestamp mismatches across systems.
Install AD-Domain-Services and DNS with IncludeManagementTools, then run Install-ADDSForest with a valid internal domain name—avoid single-label names like COMPANY and prefer company.local or a subdomain you own. Choose WinThreshold domain and forest modes as in Microsoft's deployment examples. After promotion, verify replication health with repadmin /replsummary once you add a second DC. Always maintain at least two domain controllers in production; a single DC is a single point of failure for login, Group Policy, and DNS for the whole office. Install only the roles you need—each expands attack surface and patch burden.
Use Install-WindowsFeature Web-Server, Web-Mgmt-Tools, Web-Asp-Net45. Create your site directory, a dedicated application pool, and bind the site—typically port 443 with SSL for production. Configure application pools with dedicated service accounts and keep .NET runtimes patched separately from OS cumulative updates. IIS remains the standard host for ASP.NET on Windows. If your public site runs PHP or Laravel on Linux, IIS might still serve an internal admin tool or API gateway—define cross-platform ownership clearly so Windows and Linux patches do not fall through gaps. For containerized .NET, evaluate Windows containers with Docker on Server 2022 instead of stacking apps on the domain controller.
A fresh install is not production-ready. Apply Microsoft security baselines via the Security Compliance Toolkit or CIS benchmarks. Windows Defender Firewall should block unsolicited inbound traffic; open only required ports. Disable legacy protocols like LLMNR, SMBv1, and weak cipher suites. Rename or disable the built-in Administrator after creating named admin accounts, enforce complex passwords via Default Domain Policy, and enable auditing on domain controllers. Enable predictable patching through Windows Update for business or WSUS—test cumulative updates on staging first. Remote Desktop should never sit on port 3389 exposed to the public internet; use a VPN or jump host instead.
Microsoft supports in-place upgrade from 2019 to 2022 on the same hardware for the same edition class. Take a full backup and snapshot before starting—many admins still prefer clean install plus role migration for critical infrastructure. For migrations from Server 2016 or 2019, review schema and functional level requirements; Windows Server 2022 supports older domain functional levels during transition. Confirm current licensing terms on Microsoft's pricing page before upgrade planning, since licensing details change. Treat upgrades like any production change: document rollback options and verify application compatibility on a staging VM first.
A lone domain controller is a single point of failure for login, Group Policy, and DNS for the entire office. If that server fails or needs maintenance, users cannot authenticate and internal name resolution stops. Production design should include at least two DCs with system-state backups and quarterly tested restores. Monitor replication with repadmin /replsummary and alert on DC replication errors before users notice login delays. Backup jobs should capture system state specifically for domain controllers—Windows Server Backup or a VSS-aware third-party agent handles this better than naive file copies.
Windows Defender Firewall should block unsolicited inbound traffic by default. Open only what each role requires: 389 and 636 for LDAP, 53 for DNS, 88 for Kerberos, 445 for SMB when file sharing is enabled, and 443 for IIS web workloads. Do not expose Remote Desktop on port 3389 to the public internet—use a VPN or jump host, the same perimeter rule you apply to SSH on Linux servers. Review open ports after installing roles with Server Manager or PowerShell, and document exceptions in your internal runbook so future admins understand why each rule exists.
Windows Server Backup or a third-party VSS-aware agent must capture system state for domain controllers—test restores quarterly. Follow 3-2-1 retention with off-site copies and documented runbooks. Monitoring should cover disk space, CPU, service health, AD replication, and certificate expiry. Nagios works on Windows via NSClient++; native options include Windows Admin Center and Azure Monitor when outbound telemetry is allowed. Alert on failed backup jobs and DC replication errors before users notice problems. Pair recurring Patch Tuesday work, backup verification, and AD health checks with a support contract if your team lacks a dedicated Windows admin.
0 Comments
Leave a comment
Your email is not published. Comments appear once they have been read. Sign in to have your details filled in.
