Windows Server 2022 Storage Servers

Windows Server 2022 Benefits

Security - The latest security features integrated into Windows Server 2022 consolidate various security capabilities from different aspects of the operating system. This comprehensive, multi-layered security approach delivers robust protection against advanced threats, meeting the stringent security requirements of modern servers.

Secured-core server - OEM partner-certified Secured-core server hardware offers enhanced security safeguards against sophisticated attacks. This certified hardware provides heightened assurance for handling mission-critical data, especially in highly sensitive industries. Secured-core servers leverage hardware, firmware, and driver capabilities to enable advanced security features specific to Windows Server. Many of these features, previously available in Windows Secured-core PCs, are now also accessible through Secured-core server hardware in conjunction with Windows Server 2022.

Hardware root-of-trust - Employed in functions like BitLocker drive encryption, the Trusted Platform Module 2.0 (TPM 2.0) secure crypto-processor chips offer a safe, hardware-backed repository for safeguarding sensitive cryptographic keys and data, including measurements of system integrity. TPM 2.0 can validate the server's boot process with authentic code, establishing trust for subsequent code execution, an essential foundation referred to as a hardware root-of-trust.

Firmware protection - Firmware operates with elevated privileges and is frequently undetectable by conventional antivirus solutions, resulting in an increase in firmware-based attacks. Secured-core servers employ Dynamic Root of Trust for Measurement (DRTM) technology to assess and validate the boot processes. Additionally, they can isolate driver access to memory through Direct Memory Access (DMA) protection.

UEFI secure boot - UEFI secure boot stands as a security protocol designed to shield your servers against malicious rootkits. This feature guarantees that the server exclusively starts firmware and software that have been verified by the hardware manufacturer as trustworthy. Upon server startup, the firmware conducts a thorough examination of the signature of each boot component, encompassing firmware drivers and the operating system. If the signatures are confirmed as valid, the server proceeds to boot, and the firmware transfers control to the operating system.

Virtualisation-based security (VBS) - Secured-core servers offer advanced security features like virtualisation-based security (VBS) and hypervisor-based code integrity (HVCI). VBS leverages hardware virtualisation to create a secure memory area separate from the main operating system. This shields against certain vulnerabilities commonly exploited in cryptocurrency mining attacks. VBS also enables Credential Guard, securing user credentials within a virtual container that the OS can't directly access.

HVCI builds upon VBS to enhance code integrity. It enforces strict policies to prevent unsigned kernel mode drivers or system files from loading into system memory. Furthermore, Kernel Data Protection (KDP) safeguards kernel memory containing non-executable data by making it read-only and protecting it through the Hypervisor. KDP helps protect critical Windows Defender System Guard runtime structures from tampering.

Secure connectivity

Transport: HTTPS and TLS 1.3 enabled by default on Windows Server 2022 - Secure connections are essential in today's interconnected systems. TLS 1.3, the latest version of a widely used internet security protocol, encrypts data to ensure a safe communication link between two points. On Windows Server 2022, HTTPS and TLS 1.3 are now enabled by default, safeguarding client data when connecting to the server. TLS 1.3 removes outdated encryption methods, boosts security compared to older versions, and strives to encrypt as much of the connection setup as possible. You can find more information about supported TLS versions and cipher suites.

Server Message Block (SMB): SMB AES-256 encryption for the most security conscious - The DNS Client in Windows Server 2022 now includes support for DNS-over-HTTPS (DoH). This means that DNS queries are encrypted using the secure HTTPS protocol. DoH enhances privacy by protecting your traffic from eavesdropping and preventing manipulation of your DNS data. Discover how to configure the DNS client to utilize DoH for added security.

Secure DNS: Encrypted DNS name resolution requests with DNS-over-HTTPS - Windows Server now offers enhanced security for SMB encryption with AES-256-GCM and AES-256-CCM cryptographic suites. When connecting to a compatible computer, Windows will automatically choose a more advanced cipher method for encryption. You can also enforce this through Group Policy. For compatibility with older systems, Windows Server still supports AES-128 encryption. Additionally, signing performance has been accelerated with AES-128-GMAC signing.

SMB: East-West SMB encryption controls for internal cluster communications - Windows Server failover clusters now offer precise control over encrypting and signing storage communications within the cluster. This includes Cluster Shared Volumes (CSV) and the storage bus layer (SBL). If you're using Storage Spaces Direct, you have the flexibility to choose whether to encrypt or sign communications within the cluster, enhancing security for east-west communications.

SMB Direct and RDMA encryption - "SMB Direct and RDMA offer fast and low-latency networking for various workloads such as Storage Spaces Direct, Storage Replica, Hyper-V, Scale-out File Server, and SQL Server. In Windows Server 2022, SMB Direct now supports encryption. In the past, enabling SMB encryption disabled direct data placement, which had a significant impact on performance. Now, data is encrypted before placement, resulting in much less performance impact, all while ensuring AES-128 and AES-256 packet privacy protection.