containers
45 TopicsAnnouncing Windows Server 2025 Security Baseline Preview
Announcing Windows Server 2025 Security Baseline Preview Hello Windows Server Insiders! Today we are pleased to announce the Windows Server 2025 Security Baseline Preview. You can enable security right from the start by applying the recommended security posture for your device or VM role through application of a tailored security baseline, with over 350 preconfigured Windows security settings that help you apply and enforce granular security settings that support best practices recommended by Microsoft and Industry standards. We have organized the Windows Server 2025 Security Baseline content into three categories based on your server role: Domain Controller (DC) Member Server Workgroup Member In addition, you can apply baselines with dedicated security settings specific to: Windows Defender Antivirus (48) Secured-Core (6) Main Highlights of the security baseline are the following enforcements: Secured-Core – UEFI MAT, Secure Boot, Signed Boot Chain Account and password policies Security Policies and Security Options Protocols: TLS Enforced >1.2+, SMB 3.0+, Kerberos AES, etc. Credentials Protections (LSASS/PPL) And many more. Please review the GitHub repository for what settings comprise of each definition: https://github.com/microsoft/osconfig/blob/main/security/SecurityBaseline_WindowsServer_2025-2409.csv Customer Experience: The customer experience to apply baselines for individual machines, including image customizations are: PowerShell cmdlets Windows Admin Center (WAC) For at-scale operations, you can apply baseline and monitor using Azure Policy and Azure Automanage Machine Configuration and see your compliance score. The baseline experience is powered by ‘OSConfig - our newly introduced security configuration platform’. Once applied, your baseline settings are protected from any drift automatically, which is one of the key features of the security platform. The WAC, Azure Policy and Azure Automanage Machine Configuration experiences will be released soon to the Windows Insider Program. This mechanism will not work for any earlier version of Windows Server. 1. Download prerelease modules from the PowerShell Gallery If you have not previously configured your system to pull modules from the PowerShell Gallery, please do so using the following steps: a. Open an elevated PowerShell window (not the x86 version) b. Run Install-PackageProvider NuGet, PowerShellGet -Force c. Open a new elevated PowerShell window d. Run Set-PSRepository -Name PSGallery -InstallationPolicy Trusted 2. Install the OSConfig PowerShell module Run Install-Module -Name Microsoft.OSConfig -AllowPrerelease -Scope AllUsers -Repository PSGallery -Force To verify if the OSConfig module is installed, run Get-Module -ListAvailable -Name Microsoft.OSConfig 3. Apply the Security Baseline via PowerShell cmdlets For domain-joined device, run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Default For workgroup device, run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\WorkgroupMember -Default For domain controller device, run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WS2025/DomainController -Default For Secured-core, Run Set-OSConfigDesiredConfiguration -Scenario SecuredCore -Default For Defender Antivirus, Run Set-OSConfigDesiredConfiguration -Scenario Defender\Antivirus -Default Restart machine 4. Customize the Security Baseline via PowerShell cmdlets Example using AuditDetailedFileShare for Member Server device (where the default value is 2) Run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name AuditDetailedFileShare -Value 3 Run Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name AuditDetailedFileShare Check that the value is now 3. 5. View compliance of the Security Baseline via PowerShell cmdlets Run Get-OSConfigDesiredConfiguration -Scenario SecuredCoreState Run Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer | ft Name, @{ Name = "Status"; Expression={$_.Compliance.Status} }, @{ Name = "Reason"; Expression={$_.Compliance.Reason} } -AutoSize -Wrap 6. Most Common tasks impacted/Known Issues after applying baseline Note: (Please read before exercising the scenario! Also, these scripts are for preview only and should not be used in production.) Password requirements are Complexity and Minimum of 14-character length. This only applies to local user accounts; when signing in with a domain account, domain requirements prevail for domain accounts. TLS connections are subject to a minimum of TLS/DTLS 1.2 or higher. May prevent connections to older systems. Copy/Paste of files from RDP sessions is disabled. If you need to use this function, run: Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\[role being applied] -Name RemoteDesktopServicesDoNotAllowDriveRedirection -Value 0 and then reboot. SMB connections are subject to a minimum of 3.0 or higher (available as of WS2012). Connecting to non-windows systems (like Linux SAMBA) must support SMB 3.0, or adjustments to the baseline are needed. You may run into a few user rights errors depending on your domain configuration. It does not impact the rest of the security baseline and can be ignored. We are working on fixing it. See MSLearn doc for details. If you are configuring the same settings with two different tools (one being OSConfig in this case), there will be conflicts, especially with drift control involved. See MSLearn doc for details. In case you are blocked or experiencing a work disruption after applying the security baseline: File a bug in feedback hub under Category Windows Server-> Security Configuration Management You should preview the security baseline only on test systems. While there is a ‘Remove’ command, not all configurations can be reversed. Open an elevated PowerShell window, run Remove-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer and then reboot. We value your feedback! Please provide feedback as to what is working and what needs to be improved as your feedback is extremely valued to make the product experience better. Please use Feedback Hub app for Windows Server 2025. Category: Windows Server->Security Configuration Management You can also reach us via email at heseccon@microsoft.com Edge Security Connect. What’s coming? We will also share a Windows Admin Center, Azure Policy and Azure Automanage Machine Configuration experience, to try out for getting full E2E experience & Application control for Windows Insider Program!!16KViews8likes0CommentsDocker image mcr.microsoft.com/windows-insider:10.0.17713.1000 is missing
To have a non-hyperv experience with Windows containers it would be good to have Docker images that fully align with the ISO version. Otherwise people have to run containers in hyperv isolation mode which is slower and also during a docker build it gets much slower. Currently the mcr.microsoft.com/windows-insider is only at 10.0.17711.1000, but no 10.0.17713.1000 is available.1.5KViews4likes0CommentsHow to Install WSL 2 on Windows Server
A couple of months ago Microsoft announced the Windows Subsystem for Linux 2 (WSL 2), which is a successor of the Windows Subsytem for Linux shipped a couple of years ago. WSL 2 is currently available for Windows Insiders running Windows 10 Insider Preview Build 18917 or higher and with the Docker Tech Preview, you can now even run Docker Linux Container directly on WSL 2. With the latest Windows Server Insider Preview build 18945, you are also able to run WSL 2 on Windows Server. In this blog post, I am going to show you how you can install the Windows Subsystem for Linux 2 (WSL 2) on Windows Server. The Windows Subsystem for Linux was already available in earlier versions of Windows Server; however, WSL 2 brings a lot of new advantages. Read more here: https://www.thomasmaurer.ch/2019/08/how-to-install-wsl-2-on-windows-server/43KViews3likes1CommentSAVE THE DATE: Windows Server 2025 Bug Bash (2/28-3/12)
Join Us and Help Shape the Future of Server Computing Save the dates: Wednesday, February 28th – Tuesday, March 12th, 2024. TL; DR Windows Server 2025 is the latest version of Microsoft's server operating system, designed to power the hybrid cloud and edge computing scenarios. It introduces new features such as Hotpatching for Azure Arc-enabled servers, Next Generation Active Directory & SMB, Mission Critical Data & Storage, Hyper-V & AI, Container Flexibility, Upgrade via Windows Update and Modern Desktop Experience. You can help us test and improve these features by joining the Windows Server 2025 Bug Bash, starting from February 28th to March 12th. What is a Bug Bash? A bug bash is a collaborative event where users, developers, and enthusiasts come together to identify and report bugs in the product. It’s an opportunity to explore new features, test functionalities and contribute to improving the software's quality. Timeline for the Bug Bash The Windows Server 2025 Bug Bash will run from February 28th to March 12th. During this period, you can try out new features and functionalities of Windows Server 2025 and provide your feedback. How to Participate To participate in the Windows Server 2025 Bug Bash, you need to do the following: Update your system to the latest preview build of Windows Server 2025. See: Announcing Windows Server Preview Build 26063 - Microsoft Community Hub If you are opted into Server Flighting, accept the latest flight from the Server Preview Canary channel. Learn more: Welcome to Windows Insider flighting on Windows Server - Microsoft Community Hub Download the latest Server Insider build from Download Windows Server Insider Preview (microsoft.com) Access the latest preview of Windows Server Azure Edition from the Microsoft Server Operating Systems Preview offer in Azure. Sign in to the Feedback Hub app on your Windows Server 2025 machine. You can find the app in the Start menu. Please update the app to latest available version by clicking on Settings > Updates > Check for Updates button in the app. Navigate to the Quests section in the Feedback Hub app. You will see a list of quests that cover various features and scenarios for Windows Server 2025. Pick a quest of your choice and follow the instructions. You will be asked to perform certain tasks and check for expected outcomes. Send us your feedback using the Feedback Hub app. You can report any bugs, issues or suggestions that you encounter. You can also attach screenshots, videos or logs to your feedback. In addition to the quests, we welcome your feedback on your experience. Feature Highlights We’re excited to introduce several new and enhanced features in Windows Server 2025: Hotpatching for Azure Arc-enabled servers This feature allows seamless updates and patches for servers running Azure Arc, ensuring minimal downtime and improved reliability. Next Generation Active Directory & SMB Windows Server 2025 introduces enhancements to Active Directory, including support for larger page sizes, NUMA optimizations, LDAP TLS 1.3 and improved security for confidential attributes. Additionally, SMB (Server Message Block) benefits from performance improvements. Mission Critical Data & Storage Windows Server 2025 prioritizes robust data management and storage solutions. It ensures high availability, scalability and reliability for critical workloads and applications. Hyper-V & AI Hyper-V, Microsoft’s virtualization platform, has been updated to enhance performance, security and scalability. Additionally, Windows Server 2025 integrates AI capabilities for intelligent workload management and resource optimization. Container Flexibility Windows Server 2025 continues to support containers, allowing developers to build, deploy, and manage applications efficiently. Whether you are using Docker or Kubernetes, the platform provides flexibility and compatibility. Upgrade via Windows Update Simplified upgrade paths make transitioning to Windows Server 2025 smoother. You can now update directly via Windows Update, reducing complexity and downtime. Modern Desktop Experience Windows Server 2025 offers an improved desktop experience making it easier for administrators and users to navigate and manage server environments. Check out Modern Desktop Experience in: Privacy settings at first login (when installing from ISO) Start, Taskbar, and Settings Settings > Accounts (there are several new experiences) Terminal and Winget (Winget will install apps from the Store and GitHub) Task Manager WiFi and Bluetooth (if running on equipped hardware) Battery features and sleep We hope you enjoy participating in the Windows Server 2025 Bug Bash and look forward to hearing your feedback. Thank you for helping us shape the future of server computing. Diagnostic and Usage Information Microsoft collects this information over the internet to help keep Windows secure and up to date, troubleshoot problems, and make product improvements. Microsoft server operating systems can be configured to turn diagnostic data off, send Required diagnostic data, or send Optional diagnostic data. During previews, Microsoft asks that you change the default setting to Optional to provide the best automatic feedback and help us improve the final product. Administrators can change the level of information collection through Settings. For details, see http://aka.ms/winserverdata. Also see the Microsoft Privacy Statement. Terms of Use This is pre-release software - it is provided for use "as-is" and is not supported in production environments. Users are responsible for installing any updates that may be made available from Windows Update. All pre-release software made available to you via the Windows Server Insider program is governed by the Insider Terms of Use.3KViews3likes0Commentsnanoserver-insider image has non-admin user as default?
I just want to mention that the microsoft/nanoserver-insider image has the non-admin "ContainerUser" account as default. Is this intented? Running containers as non-admin is a good thing, but this default sometimes result in some difficulties while building Docker images based on nanoserver-insider. In a golang+git nanoserver image I had to use a workaround to switch to ContainerAdministrator, setting the machine PATH variable, and switch back: https://github.com/StefanScherer/dockerfiles-windows/blob/c3a6dce28d325e25d3ed993e7d2b4fabd99c3b81/golang/Dockerfile#L45-L47 Otherwise we can only set the users's PATH (setx without /M option): https://github.com/StefanScherer/dockerfiles-windows/blob/b9c944fdcf8ceb936d41a48837afaba8fd92b372/node/6.11/nano/Dockerfile#L41 While creating a Docker image for the Docker swarm visualizer I once again had problems while "npm run dist" os I also had to prepend a "USER ContainerAdministrator" to have write access to C:/app - see the Dockerfile example in https://github.com/dockersamples/docker-swarm-visualizer/pull/87#issue-260104486 So the question is if the nanoserver-insider image shouldn't have a value for the user just as the windowsservercore-insider image. If someone wants to change the user, it is possible by adding a line USER ContainerUser in the Dockerfile for any Windows image.5.3KViews3likes0CommentsHow are you expected to adminster nanoserver inside container if powershell is removed?
As per release notes nano server was optimized by removing powershell from it. How are you expected to administer it (or build using dockerfile) for that matter if no powershell is available?Solved2.9KViews2likes8CommentsAnnouncing Windows Server Annual Channel for Containers Preview Build 25951
Announcing Windows Server Annual Channel for Containers Preview Build 25951 Hello Windows Server Container Insiders! Today we are pleased to release a new build of the next Windows Server Annual Channel for Containers Preview that contains Server Datacenter Core edition. Branding has not yet been updated and remains as Windows Server 2022 in this preview - when reporting issues please refer to "Windows Server Container VNext" rather than Windows Server 2022 which is currently in market. What's New To learn about this new offering for container host and Kubernetes development, please review this post: Windows Server Containers (microsoft.com) Known Issues Upgrades from existing Windows Server installations are not supported with Annual Channel for Containers previews. You must perform a clean install. This build has an issue where archiving eventlogs with "wevetutil al" command causes the Windows Event Log service to crash, and the archive operation to fail. The service must be restarted by executing "Start-Service EventLog" from an administrative command line prompt. Available Downloads Downloads to certain countries may not be available. See Microsoft suspends new sales in Russia - Microsoft On the Issues Windows Server VNext Annual Channel for Containers Preview in ISO format and English only. Keys: Keys are valid for preview builds only Datacenter: 2KNJJ-33Y9H-2GXGX-KMQWH-G6H67 Symbols: available on the public symbol server – see Using the Microsoft Symbol Server. Expiration: This Windows Server Preview will expire September 15, 2023. How to Download Registered Insiders may navigate directly to the Windows Server Insider Preview download page. If you have not yet registered as an Insider, see GETTING STARTED WITH SERVER on the Windows Insiders for Business portal. We value your feedback! The most important part of the release cycle is to hear what's working and what needs to be improved, so your feedback is extremely valued. For Windows Server, use your registered Windows 10 or Windows 11 Insider device and use the Feedback Hub application. In the app, choose the Windows Server category and then the appropriate subcategory for your feedback. In the title of the Feedback, please indicate the build number you are providing feedback on as shown below to ensure that your issue is attributed to the right version: [Server Containers #####] Title of my feedback See Give Feedback on Windows Server via Feedback Hub for specifics. The Windows Server Insiders space on the Microsoft Tech Communities supports preview builds of the next version of Windows Server. Use the forum to collaborate, share and learn from experts. For versions that have been released to general availability in market, try the Windows Server for IT Pro forum or contact Support for Business. Diagnostic and Usage Information Microsoft collects this information over the internet to help keep Windows secure and up to date, troubleshoot problems, and make product improvements. Microsoft server operating systems can be configured to turn diagnostic data off, send Required diagnostic data, or send Optional diagnostic data. During previews, Microsoft asks that you change the default setting to Optional to provide the best automatic feedback and help us improve the final product. Administrators can change the level of information collection through Settings. For details, see http://aka.ms/winserverdata. Also see the Microsoft Privacy Statement. Terms of Use This is pre-release software - it is provided for use "as-is" and is not supported in production environments. Users are responsible for installing any updates that may be made available from Windows Update. All pre-release software made available to you via the Windows Server Insider program is governed by the Insider Terms of Use.1.3KViews2likes0CommentsAnnouncing Windows Server Annual Channel for Containers Preview Build 25941
Hello Windows Server Container Insiders! Today we are pleased to release a new build of the next Windows Server Annual Channel for Containers Preview that contains Server Datacenter Core edition. Branding has not yet been updated and remains as Windows Server 2022 in this preview - when reporting issues please refer to "Windows Server Container VNext" rather than Windows Server 2022 which is currently in market. What's New This is the first preview of Windows Server Annual Channel for Containers. To learn about this new offering for container host and Kubernetes development, please review this post: Windows Server Containers (microsoft.com) Known Issues Upgrades from existing Windows Server installations are not supported with Annual Channel for Containers previews. You must perform a clean install. This build has an issue where archiving eventlogs with "wevetutil al" command causes the Windows Event Log service to crash, and the archive operation to fail. The service must be restarted by executing "Start-Service EventLog" from an administrative command line prompt. Available Downloads Downloads to certain countries may not be available. See Microsoft suspends new sales in Russia - Microsoft On the Issues Windows Server VNext Annual Channel for Containers Preview in ISO format and English only. Keys: Keys are valid for preview builds only Datacenter: 2KNJJ-33Y9H-2GXGX-KMQWH-G6H67 Symbols: available on the public symbol server – see Using the Microsoft Symbol Server. Expiration: This Windows Server Preview will expire September 15, 2023. How to Download Registered Insiders may navigate directly to the Windows Server Insider Preview download page. If you have not yet registered as an Insider, see GETTING STARTED WITH SERVER on the Windows Insiders for Business portal. We value your feedback! The most important part of the release cycle is to hear what's working and what needs to be improved, so your feedback is extremely valued. For Windows Server, use your registered Windows 10 or Windows 11 Insider device and use the Feedback Hub application. In the app, choose the Windows Server category and then the appropriate subcategory for your feedback. In the title of the Feedback, please indicate the build number you are providing feedback on as shown below to ensure that your issue is attributed to the right version: [Server Containers #####] Title of my feedback See Give Feedback on Windows Server via Feedback Hub for specifics. The Windows Server Insiders space on the Microsoft Tech Communities supports preview builds of the next version of Windows Server. Use the forum to collaborate, share and learn from experts. For versions that have been released to general availability in market, try the Windows Server for IT Pro forum or contact Support for Business. Diagnostic and Usage Information Microsoft collects this information over the internet to help keep Windows secure and up to date, troubleshoot problems, and make product improvements. Microsoft server operating systems can be configured to turn diagnostic data off, send Required diagnostic data, or send Optional diagnostic data. During previews, Microsoft asks that you change the default setting to Optional to provide the best automatic feedback and help us improve the final product. Administrators can change the level of information collection through Settings. For details, see http://aka.ms/winserverdata. Also see the Microsoft Privacy Statement. Terms of Use This is pre-release software - it is provided for use "as-is" and is not supported in production environments. Users are responsible for installing any updates that may be made available from Windows Update. All pre-release software made available to you via the Windows Server Insider program is governed by the Insider Terms of Use.1.5KViews2likes0CommentsWindows Server 2022 container base images?
With the removal of the Windows Server 2022 Insider Preview (build 20344), we have lost the only currently possible to validate process-isolated containers for Windows Server 2022. Is there a plan to address this? There are no container base images matching the Windows Server 2022 Preview (build 20348), and the feedback issue I raised (as instructed here) doesn't seem to have attracted any interest. Currently, projects like Moby (Docker Engine) depend on the Insider Preview builds to validate against and prepare for upcoming Windows Server releases , as there are no other mechanisms available, as the Windows Server SAC was tracking the Windows Client builds up until 2020, went silent for 2021, and is now dead.Solved2.9KViews2likes6Commentsmcr.microsoft.com/windows-insider image is missing Get-WindowsFeature cmdlet
Hello, I have a problem with the new windows-insider Docker image. The PowerShell command Get-WindowsFeature does not work at all. $ docker run mcr.microsoft.com/windows-insider:10.0.17709.1000 powershell -Command Get-WindowsFeature Get-WindowsFeature : The term 'Get-WindowsFeature' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At line:1 char:1 + Get-WindowsFeature + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Get-WindowsFeature:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException But with the smaller windowsservercore-insider it works: $ docker run mcr.microsoft.com/windowsservercore-insider:10.0.17709.1000 powershell -Command Get-WindowsFeature Display Name Name ------------ ---- [ ] Active Directory Certificate Services AD-Certificate [ ] Certification Authority ADCS-Cert-Authority [ ] Certificate Enrollment Policy Web Service ADCS-Enroll-Web-Pol Is there a plan to add these PowerShell commands to add other Windows features?1.4KViews1like0Comments