Windows Server 2022

Standard targets physical or lightly virtualised servers, granting two OSE / Hyper-V container rights per fully licensed host. Datacenter unlocks unlimited OSEs on the licensed hardware plus Storage Replica without size caps, Storage Spaces Direct, Software Defined Networking, shielded VMs, and host-side encrypted networks. Datacenter Azure Edition is Azure-only or Azure Stack HCI-only and was the original home of hotpatching, SMB over QUIC and other cloud-forward features (some of which back-ported to Server 2025 for on-prem via Azure Arc). Essentials targets very small businesses (up to 25 users, 50 devices) and is sold per server with no CALs but cannot host certain roles without giving up its simplified licensing.

Both Standard and Datacenter are licensed per physical core, sold in 2-core packs, with a minimum of 8 cores per processor and 16 cores per server. Every physical core on the host must be licensed even if you only use part of the hardware for Windows workloads. Hyperthreaded logical cores do not change the count. Adding a second processor later requires a true-up. SPLA covers per-core compliance for VMs hosted on a service provider's hardware.

Every user or device that authenticates against a Windows Server 2022 instance needs a Windows Server CAL. User CALs are economical when staff use multiple devices; Device CALs win when many users share the same workstation. The most common audit finding remains missing RDS CALs — Remote Desktop sessions require both a base Windows Server CAL and a separate RDS CAL per user or device. Service-to-service authentication (machine accounts, application pool identities) does not require a CAL.

Secured-core server is a hardware-plus-software stack: a certified server (look for the explicit Microsoft secured-core badge on Dell, HPE, Lenovo, Cisco and Supermicro SKUs) ships with TPM 2.0, DMA protection, System Guard root-of-trust attestation, virtualisation-based security on by default, hypervisor-protected code integrity, and Credential Guard enabled out of the box. The feature lights up on Server 2022 Standard, Datacenter and Datacenter Azure Edition. Most production server refresh cycles since 2022 default to secured-core hardware; existing non-secured-core hardware can run 2022 without it.

SMB over QUIC, introduced in Server 2022 Datacenter Azure Edition and later broadened across the family, tunnels SMB traffic over QUIC (HTTP/3's transport) with TLS 1.3 — meaning remote SMB clients can reach an internal file server over the public internet without a VPN, with end-to-end encryption and certificate-based authentication. It is a real convenience for hybrid work scenarios where roaming Windows 11 clients need to mount internal shares without the friction of a corporate VPN. The certificate management overhead is real (issue cert, bind to KDC proxy, publish through the firewall), but the user experience after that is just \\server\share.

Server 2022 attaches to Azure Arc to expose Windows Admin Center, Azure Policy, Azure Monitor, Defender for Servers, Azure Backup and Update Manager against on-prem, edge and multi-cloud hosts from a single Azure pane. Active Software Assurance grants Azure Hybrid Benefit: an on-prem Server 2022 licence can run the same workload on Azure VMs without paying the Windows licence a second time, saving roughly 40% versus pay-as-you-go. For long-running production VMs migrated to Azure, AHB pays for the SA premium many times over.

Server 2022 remains supported through 2026 mainstream / 2031 extended — there is no compliance reason to migrate sooner. Move to 2025 when its specific deltas apply: broader hotpatching for non-Azure servers via Azure Arc subscription, ReFS block cloning improvements, the AD schema bump that allows much larger directories, BitLocker for Cluster Shared Volumes, and SMB over QUIC on by default. Greenfield 2025 deployments are the default; 2022 in-place upgrades are reasonable when the new features apply and the application owners have signed off on the underlying OS change.