Windows Server 2025 Performance Defaults — Issues and Justification

Windows Server 2025 Performance Defaults — Issues and Justification

Table of Contents

Purpose

This document lists the performance issues in the default settings of Windows Server 2025 (WS2025). It explains what you can change on a server in a trusted private network. Each section also gives the command for that change.

Scope and Conditions

WS2025 changed 10 default settings. Each change raises a security control. Each change also adds a performance cost. On a trusted private network, you can disable the extra security control. On a public-facing server, keep the extra security control enabled.

Apply these changes only on a trusted private network. Do not apply these changes on a server exposed to an untrusted network.

Before you make any change, confirm the OS build number. Build 26100 marks WS2025. Skip every change on Windows Server 2022 or earlier. Administrator rights are necessary to make these changes.

1. SMB Server Signing

Issue: WS2025 requires SMB server signing by default. Signing adds a CPU cost to every SMB packet the server sends or receives.

Why the change is needed: This cost slows every SMB operation. On a Failover Cluster, it slows resource moves by up to 10 times. You can disable this signing overhead on a trusted private network.

Command:

Set-SmbServerConfiguration -RequireSecuritySignature $false -Force

2. SMB Client Signing

Issue: WS2025 also requires SMB client signing by default. This setting adds the same CPU cost to every outbound SMB request the server makes.

Why the change is needed: This cost adds to the SMB Server Signing cost. The added cost appears when the server also acts as an SMB client, for example during cluster operations. Change the two settings together to remove the full cost.

Command:

Set-SmbClientConfiguration -RequireSecuritySignature $false -Force

3. SMB Authentication Rate Limiter

Issue: WS2025 adds a 2000 ms delay after each failed SMB authentication attempt.

Why the change is needed: Cluster operations produce repeated authentication attempts as part of normal operation. Each delay adds latency to a process that must complete quickly. A public-facing server benefits from this delay. On a trusted network, you can disable this delay for a cluster node.

Command:

Set-SmbServerConfiguration -InvalidAuthenticationDelayTimeInMs 0 -Force

4. Virtualization Based Security (VBS / HVCI)

Issue: WS2025 enables Virtualization Based Security by default. VBS runs a secure kernel in a hardware-isolated partition alongside the primary OS. This adds 5 to 15 percent general performance overhead.

Why the change is needed: On a virtual machine, the hypervisor must manage an extra isolated partition to support VBS. This adds more overhead on top of the base cost. You can disable VBS to remove this overhead. A reboot is necessary for the change to take effect.

Command:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f

5. Network Offloads (RSS, RSC, LSO)

Issue: WS2025 does not enable RSS, RSC, and LSO on every adapter by default. These are NIC hardware features. They move network processing work off the CPU and onto the NIC.

Why the change is needed: When these offloads stay off, the CPU does the work instead. This lowers network throughput. You can turn on every offload an active physical adapter supports.

Command: run for each active physical adapter that supports the feature:

Enable-NetAdapterRss -Name "<AdapterName>"
Enable-NetAdapterRsc -Name "<AdapterName>"
Enable-NetAdapterLso -Name "<AdapterName>"

6. IPsec Keying Module

Issue: WS2025 changed the default IPsec keying module order. It now prefers IKEv2 to the legacy AuthIP / IKEv1 module.

Why the change is needed: Windows Server Failover Clustering (WSFC) uses AuthIP for machine certificate authentication between cluster nodes. The IKEv2 default can add latency to this process, or cause a cluster communication failure. You can restore the legacy AuthIP / IKEv1 module to remove this risk. A reboot is necessary for the change to take effect.

Command:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters" -Name "IpsecRestoreLegacyKeyMod" -PropertyType "DWORD" -Value 1 -Force

7. Remote Mailslots

Issue: WS2025 disables remote mailslots by default.

Why the change is needed: The DC locator process uses mailslots for Active Directory site and domain controller discovery. A disabled mailslot can slow or break AD communication on a cluster node during a failover. You can enable mailslots again to remove this risk. A reboot is necessary for the change to take effect.

Command:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "EnableMailslots" -PropertyType "DWORD" -Value 1 -Force

8. Network ATC

Issue: WS2025 installs and runs the Network ATC service by default. Network ATC manages NIC configuration automatically. Microsoft made it for on-premises bare metal servers with physical NICs.

Why the change is needed: On a virtual machine, Network ATC can configure a virtual network adapter incorrectly. If no intents are configured, you can stop and disable the service. If an intent is configured, review it manually before you remove it.

Command: when Get-NetIntent returns no intent:

Stop-Service -Name NetworkATC -Force
Set-Service -Name NetworkATC -StartupType Disabled

When an intent exists, remove it first, one command per intent:

Remove-NetIntent -Name "<IntentName>"

9. Azure Arc Setup

Issue: Some WS2025 images include Azure Arc Setup as an installed Windows capability. Azure Arc Setup connects a server to Microsoft Azure for cloud management.

Why the change is needed: If a server runs in Azure, Azure Arc Setup applies, and you can keep it enabled. If a server does not run in Azure, Azure Arc Setup does not apply. It adds outbound network traffic to Azure, and it adds a dependency that is not necessary outside Azure. You can use DISM directly to find and remove this capability. DISM is faster than the Get-WindowsCapability cmdlet, which contacts Windows Update.

Command: when not in Azure, get the exact capability name first, then remove it:

DISM /online /Get-Capabilities
DISM /online /Remove-Capability /CapabilityName:"<CapabilityName>" /NoRestart

10. Power Plan

Issue: WS2025 defaults to the Balanced power plan. This plan lets the CPU throttle its own frequency, known as a P-state, based on load.

Why the change is needed: A throttled CPU can cause a latency spike at the exact moment a cluster operation starts. A failover of an Always On availability group carries the same risk. This risk is greatest for SQL Server and WSFC.

You can set the High Performance plan to lock every processor at maximum frequency and remove this risk. On some virtual machines, the guest OS controls the P-state directly, so this setting has a real, measurable effect. A reboot is not necessary for this change.

Command:

powercfg /SetActive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c

Summary Table

# Setting WS2025 Default Change Reboot Necessary
1 SMB Server Signing Required Disabled No
2 SMB Client Signing Required Disabled No
3 SMB Authentication Rate Limiter 2000 ms delay per failed attempt Delay set to 0 ms No
4 Virtualization Based Security (VBS / HVCI) Enabled Disabled Yes
5 Network Offloads (RSS, RSC, LSO) Not enabled on every adapter Enabled on all active physical adapters No
6 IPsec Keying Module IKEv2 preferred Legacy AuthIP / IKEv1 restored Yes
7 Remote Mailslots Disabled Enabled Yes
8 Network ATC Installed and running Stopped and disabled, only when no intents are configured No
9 Azure Arc Setup Present on some WS2025 images Removed, if not in Azure No
10 Power Plan Balanced High Performance No

WS2025 adds a "User Manager Group" role to every new Failover Cluster automatically. This role supports Windows Admin Center authentication through Microsoft Entra ID. If a cluster does not use Windows Admin Center for this purpose, this role is not necessary. You can remove it once, manually, after cluster creation. This step is an operational cleanup step, not a performance fix.

Command: run once from any cluster node, after cluster creation:

Get-ClusterGroup | Where-Object { $_.Name -like "*User Manager*" } | Remove-ClusterGroup -Force -RemoveResources

Trade-off and Warning

Make these changes only on a server in a trusted private network. Every change in this document lowers a security control that WS2025 turns on by default. A trusted private network, for example a private LAN or an isolated cloud network, can accept this trade-off safely. An untrusted or public-facing network cannot accept this trade-off safely.

Conclusion

WS2025 shifts several defaults toward more security control at a real, measurable performance cost. On a trusted private network, this cost applies to eight areas. These areas are SMB traffic, VBS, network offloads, IPsec keying, mailslots, Network ATC, Azure Arc Setup, and CPU power state. Each cost falls hardest during a Failover Cluster operation, or during a failover of an Always On availability group. Latency at the wrong moment in these operations causes a visible impact. Together, these 10 changes correct every area. On Windows Server 2022 or earlier, none of these changes apply.

Comments

Post a Comment

Popular posts from this blog

Windows Server Failover Clustering/SQL Server Firewall Access Rules

This document defines the firewall rules required for a Multi-Subnet Windows Server Failover Cluster (WSFC) environment. It covers WSFC core communication, the WSFC dependency on Active Directory (AD), and SQL Server Availability Group (AG) communication. Use these rules when you request network access for a Multi-Subnet Cluster. This version corrects several rows to agree with current Microsoft documentation. See Verification Notes at the end of this document for the list of changes and sources. Table of Contents Best Practice: IP Specificity Critical Action: Review Ephemeral Port Ranges Section 1: Core WSFC and Active Directory Ports Section 2: SQL Server Database Engine and Availability Group Ports Section 3: SQL Server BI Stack Ports (Conditional) Section 4: Multi-Subnet / Cloud Deployment Ports (Conditional) Section 5: Official References Verification Notes Windows Server 2025 / SQL Server 2025 Notes Best Practice: IP Specificity Specify exact IP ad...
Read more

Windows Server Recommendations For AWS

Windows Server Recommendations for AWS.md Windows Server Recommendations for AWS Overview This document gives a high-level recommendation for building a Windows Server EC2 host in AWS. It also covers support for Windows Server Failover Clustering (WSFC). Table of Contents Table of Contents Overview EC2 Host Recommendations EC2 Network Recommendations EC2 Security Recommendations Security Group 1: Internal Region Traffic Security Group 2: Inbound Windows and SQL Server Access Security Group 3: Outbound Access Security Group 4: Cross-Region WSFC and AG Traffic EC2 O/S Recommendations Operating System Image Network Configuration Drive Configuration Patching and Drivers Backups EC2 Host Recommendations This section gives recommendations for an EC2 host in AWS. It covers instance type and storage. Use the r6idn or i3en instance type for a SQL Server host in AWS. Both instance types come with NVMe SSD storage. Use the NVMe SSD storage for te...
Read more

Requirements for SQL Server AlwaysOn Feature on a Windows Server Failover Cluster

Requirements for SQL Server AlwaysOn Feature on a Windows Server Failover Cluster.md This document targets Windows Server 2022 and SQL Server 2022. See Update Notes at the end of this document. That section lists what changed from the original 2012 version, and the reason for each change. Table of Contents Overview Terminology Windows Server Failover Clustering (WSFC) Cluster Name Object (CNO) Virtual Computer Object (VCO) Symmetric / Asymmetric Storage SQL Server Failover Clustered Instance (FCI) SQL Server Failover Clustered Instance CNAME (FCI CNAME) SQL Server Availability Group (AG) SQL Server Availability Group Listener (AGL) SQL Server Availability Group Listener CNAME (AGL CNAME) WSFC Requirements SQL Server FCI Requirements SQL Server Availability Group Requirements Update Notes Windows Server 2025 / SQL Server 2025 Notes Overview This document covers the SQL Server AlwaysOn feature. This includes the Failover Clustered Instance, the A...
Read more