Windows Server 2025 must be maintained at a supported servicing level.

Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates.

The Long-Term Servicing Channel (LTSC) remains the standard support branch for Enterprise server platforms. The guidance in this rule assumes usage via this support channel.

1. Determine the system's OS version. a. Open "Command Prompt". b. Run "winver.exe". The "About Windows" dialog box will display the system’s version and OS build. For example, "Microsoft Windows Server Version 25H2 (Build 26100.33296)". This does not represent a required version. It is provided only as an example. c. Record the OS numbers for the system.

2. Determine Microsoft's support stance for Windows 2025. Mainstream support ends on 11/13/2029 and extended support ends on 11/14/2034. Visit https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2025 to determine the latest guidance regarding support dates. These dates are applicable to the following editions: Datacenter, Datacenter: Azure Edition, Essentials, Standard.

3. Determine Microsoft's latest available Windows 2025 OS version and Security Patch. a. Access Microsoft’s Lifecycle & Build History website at https://learn.microsoft.com/en-us/windows/release-health/windows-server-release-info. b. Review the Windows 2025 table (under heading of "Windows Server release history"). To view the table, expand heading of "Windows Server 2025 (OS build 26100)". c. Compare the system’s OS build and KB # with those listed to determine how many (if any) newer patches are available for the system’s OS version. It is strongly recommended that the latest security patch be installed, unless there is a valid operational reason to delay installing it.

If the end-of-support date (which includes the "Extended Support End Date") for the system’s OS version is a past date, this is a finding.

Note: Preview versions must not be used in a production environment.

Determine if the end-of-support date for the system’s OS build (e.g., build 26100.xxxx) is a past date. If the end-of-support date for the system’s OS build is in the past, perform an update to an OS build with a future end-of-support date.