back to article Sysadmin shock as Windows Server 2025 installs itself after update labeling error

Administrators are reporting unexpected appearances of Windows Server 2025 after what was published as a security update turned out to be a complete operating system upgrade. The problem was flagged by a customer of web app security biz Heimdal. Arriving at the office on the morning of November 5, they found, to their horror, …

  1. Mentat74
    Windows

    First...

    They did it to regular consumers... (Win7 --> Win8/10)

    Now they're trying it with corporate customers ?

    Guess it's the only way to get people to upgrade and for the CEO's to get their bonusses !

    1. Lee D Silver badge

      Re: First...

      It's the perfect way to move people off Windows servers, that's what it is.

      1. Anonymous Coward
        Anonymous Coward

        Re: First...

        I said exactly that to management after I read the article.

    2. Kraft

      Re: First...

      That is the next step in the enshittification process.

  2. Neil Barnes Silver badge

    Wait...

    You provided an automatic update, and now you want your customers to pay an increased license fee for the privilege?

    1. Anonymous Coward
      Anonymous Coward

      Re: Wait...

      Of course they do.

      Which suggests to me that it might not have been entirely accidental...

      1. Number6

        Re: Wait...

        I know they've got more lawyers, but I'd start with the line that it was their error, so I shouldn't have to pay more than my existing fees until the time I would have had to upgrade anyway (if I've got proof of typical upgrade cycles for my company then I'd use that to nominate a date).

        1. Doctor Syntax Silver badge

          Re: Wait...

          Given that the existing software on the server may not work with the new server I'd start with this being an offence under the Computer Misuse Act and ask for damages.

          1. tfewster
            Facepalm

            Re: Wait...

            Wait, what? A patch supposedly for Windows 11 installed on Windows Server 2022? And was pushed out by patch management? Regardless of the patch content, doesn't that jump all guardrails?

            1. J. Cook Silver badge
              Boffin

              Re: Wait...

              It's the same code base, and that's been the case since windows XP.

              1. david 12 Silver badge

                Re: Wait...

                It's the same code base, and that's been the case since windows XP.

                Win2K.

                WinNT 3.x server was different than workstation.

                2K CDS were identical other than installation configuration, differed only in resource allocation.

            2. Doctor Syntax Silver badge

              Re: Wait...

              Guardrails?

              1. Tron Silver badge

                Re: Wait...

                - Guardrails.

                Politicians, media and nudge units believe that if you invent a stupid neologism everyone will think you know what you are talking about and must be doing something impressive. The other recent one has been 'conversations'.

        2. drankinatty

          Re: Wait...

          Even better, legally if something is provided as a gratuity without any bargained-for exchange, then it is considered a gift as there is no basis in contract to support a claim that payment is due.

      2. Anonymous Coward
        Anonymous Coward

        Re: Wait...

        Which suggests makes it quite obvious to me that it might was not have been entirely accidental ...

        There you go.*

        * you realise that you are writing about Microsoft. Right?

        .

    2. Yet Another Anonymous coward Silver badge

      Re: Wait...

      Don't give Oracle any ideas.

    3. veti Silver badge

      Re: Wait...

      To be fair, the story gives no indication that anyone has been or will be asked to pay for the "upgrade". That's sheer unsupported speculation.

      1. Grinning Bandicoot

        Re: Wait...

        O come now! We see M$ so often it isn't even funny.

        The blackmail will soon start.

        1. veti Silver badge

          Re: Wait...

          Really? MS has a long history of giving OS upgrades away for free.

          Where exactly is the history of demanding payment for upgrades installed involuntarily or by mistake?

  3. David 132 Silver badge
    Happy

    I don't see what all the fuss is about.

    Windows version updates are always quick, fuss-free, and quietly and without drama work exactly as the previous version did, only with drastically fewer errata and many new user-pleasing - nay, delighting - features. Plus, they never break older applications.

    (Note icon. It was a toss-up between that one, the trollface, and the coffee-sprayed-on-keyboard one.)

    1. Anonymous Coward
      Anonymous Coward

      Re: I don't see what all the fuss is about.

      Yes, no need to use the /s tag here..

    2. EricB123 Silver badge

      Re: I don't see what all the fuss is about.

      OMG, you British make even my New York sarcasm to shame!

      1. Huw L-D

        Re: I don't see what all the fuss is about.

        You have sarcasm in New York?

        1. CrazyOldCatMan Silver badge

          Re: I don't see what all the fuss is about.

          You have sarcasm in New York?

          Sure - lots of of British tourists..

        2. Anonymous Coward
          Anonymous Coward

          Re: I don't see what all the fuss is about.

          Americans (USAers) have plenty of sarcasm. What they lack is irony, a typically British trait.

          1. veti Silver badge

            Re: I don't see what all the fuss is about.

            This for the country that just elected Trump *again* on the basis that he'd be better for the economy?

            I'd say they have more irony than they know what to do with.

            1. 42656e4d203239 Silver badge

              Re: I don't see what all the fuss is about.

              >>he'd be better for the economy?

              He will be better for certain parts of the economy, just not for the majority of people who voted for him. Those who bankroll him (I mean aside from the USAian tax payer) are no doubt quite happy that he won.

              1. Grinning Bandicoot

                Re: I don't see what all the fuss is about.

                The USAian is the wrong case it should be WEan. It nominative as the part of participle's phrase.

                IRONY is in the man claiming to want to make America Great Again but supporting every lawyer in sight. The contradiction is so flagrant.

          2. collinsl Silver badge
            Coat

            Re: I don't see what all the fuss is about.

            I thought they had plenty of irony, otherwise they wouldn't be able to make so much stealy to steal all their elections.

  4. Pascal Monett Silver badge
    WTF?

    "paying for the required license"

    You have got to be kidding me.

    The proper procedure is Redmond sends its engineers to reinstall the original version - at its own cost - and presents its excuses to the customers that it fucked over.

    I'm pretty sure this is not going to hold up in court. No way.

    1. RAMChYLD

      Re: "paying for the required license"

      Or make Windows 2025 a free upgrade to Windows 2022 licensors, just like how Win11 is free to licensors of Win10.

    2. david 12 Silver badge

      Re: "paying for the required license"

      You have got to be kidding me.

      Yes, not sure where that came from. The server license for 2019 was good for 2022, I expect similar will be true for 2025.

      https://answers.microsoft.com/en-us/windowserver/forum/all/windows-server-free-upgrade-costs-from-windows/9c06469c-1c22-42f8-8297-806a96c34399#:~:text=According%20to%20Microsoft%27s%20policy%2C%20you%20can%20upgrade%20to,license%20you%20purchased%20without%20paying%20any%20additional%20fees.

  5. Anonymous Coward
    Anonymous Coward

    Acrobat

    Many years ago with a patching system we used, I came into a number of incidents from our German colleagues as their Acrobats were screwed.

    They were licened for full v 8 or 9, but they had all been upgraded to X, which they were not licensed for and stopped lots of reports and automation..... heads would roll.

    Lots of hoo har, finger pointing - mainly at me, and then eventually found that the upgrade to Acrobat X from anything previous had been miss labelled as Critical by a vendor some where, and our policy was to patch all Critical

    So when we patched, we pushed patches out to all devices 3 weeks AFTER patch tuesday. First week to pilot, second week to test, then everyone else. Plenty of time for issues to be found, patches to be pulled if required - and often there was at least one.

    Oh, each site was responsible for ensuring devices were in specific AD groups which we targetted for those patching runs (after all, we have no idea what a machine is or whose it is, so do not want to patch with something that gives BSD's and it is a bigwig in an important meeting?)

    To make things even better for me, I checked the AD groups for the German sites and found that they were all empty, not a single machine in any of the groups. It was then pointed out to their IT management by a rather pissed regional IT manager that this was their responibility to maintain those groups, and if they had done so they would have seen the Acrobat update and we would have stopped it before mass patching

    1. IvyKing Bronze badge

      Re: Acrobat

      Ahem - BSD is Berkeley Software Distribution, Blue Screen of Death is BSoD.

      1. Anonymous Coward
        Anonymous Coward

        Re: Acrobat

        > Ahem - BSD is Berkeley Software Distribution, Blue Screen of Death is BSoD.

        In layman's terms

        BSD, means it works

        BSoD, means it just stopped working

        1. Doctor Syntax Silver badge

          Re: Acrobat

          Just?

          1. dr.k

            Re: Acrobat

            Just? Sure you jest.

  6. cookieMonster Silver badge
    Facepalm

    Ha ha ha ha ha

    Jesus Christ, they get worse by the week.

    Sincerest condolences to all you who have to deal with this shit, but look on the bright side….

    As long as these IDIOTS continue to create “software”, you’ll have a job for sure.

    1. EricB123 Silver badge

      Re: Ha ha ha ha ha

      You are definitely a glass half full kind of guy.

      1. Anonymous Coward
        Anonymous Coward

        Re: Ha ha ha ha ha

        Half full of gin, perchance?

  7. Cheshire Cat
    Big Brother

    "Microsoft had mistakenly labeled the Windows Server 2025 upgrade "

    Yeah... "mistakenly".

    1. EricB123 Silver badge

      Well, Citibank once accidently sent the L'Oréal corporation almost a billion dollars.

      Just to put things in perspective.

      1. AndrewB57
        Facepalm

        Pesetas

        ...and I once instructed payment of £3 million in pesetas to a Spanish (wine) supplier when intending it to be £30k owing to miscounting the number of zeros in the currency transaction

        Clue: we barely had the £30k. Fortunately (for me) the bank had a sense of humour

        1. Neil Barnes Silver badge

          Re: Pesetas

          The insistence of my German bank to require commas to separate Euros and cents, and full stops to separate thousands, makes the transfer of my UK pension every month an delightfully exciting time... paying bills can be quite fraught, too, same reason.

          1. thedogandduck

            Re: Pesetas

            Entering my 4-digit PIN instead of the tip amount when paying the bill in a restaurant once gives me the same shivers of fear. I blame the rather nice bottle of wine and poor lighting that all restaurants seem to have these days

          2. Anonymous Coward
            Anonymous Coward

            Re: Pesetas

            "The insistence of my German bank to require commas to separate Euros and cents, and full stops to separate thousands"

            Well that is the German way of designating numbers (and that's why Excel in German locale actually creates CSV files with semicolon-separated values, not comma-separated).

            I assume you're expecting the bank to use English separators as you're using their online banking in English language mode? In which case you haven't considered the scenario of a someone living in Germany who speaks better English than German using a German bank website in English language but who is from somewhere other than UK/USA/etc (e.g. French or Spanish) who naturally uses the *same* numerical separators as they do in Germany.

            In a similar vein you can sometimes (often?) find online commerce sites that cannot handle scenarios like someone selecting UK as the country they're in but wanting to select French/German/Spanish etc as the language to use.

            1. old-iron

              Re: Pesetas

              Back in the past (I was buying a suit!!), I paid with my credit card and left with my new "whistle"

              Weeks later i noticed an unusual amount of £1.99 on my credit card statement.

              Yup the sales assistant typed the 199 but not the 00 into the CC machine

              #pileon (yeh yeh but i had no money in them days)

            2. Neil Barnes Silver badge

              Re: Pesetas

              I'm a guest here. I expect to conform to the customs of the country... including different comma placements. Oddly enough the bank offers an English option but does not change the numeric style. It just comes as a surprise every now and then...

              One thing that does rankle is that even having set everything on the laptop that I can find to use a UK locale, as soon as I set the time to Berlin it insists on using commas and full-stops in the German way - to the extent of automatically replacing the decimal point in the calculator application with a comma.

              1. logicalextreme

                Re: Pesetas

                Assuming this is Windows, I find that changing quite a few pseudo-related settings can arbitrarily reconfigure some of the individual locale options for you (how "helpful"). When connected to a domain controller I can also get some of these options overwritten automatically from time to time.

                I've resorted to having a PowerHell script thst changes all of these options to the ones that I like at an individual level and running that from time to time — it's all done in the Registry, which means learning some of the weird ways the options are encoded in there, but using such a script (a .reg script would do too) might help with your issue. You could have a script that changes your time to Berlin and then changes all the locale options for you, and another script that changes your time to local and does the same. Or you might find that just changing the timezone at the registry level rather than the GUI leaves all your locale options the way you like them.

                Certainly helps me out because my eye starts to twitch when my dates aren't ISO 8601 :D

                1. Neil Barnes Silver badge
                  Headmaster

                  Re: Pesetas

                  One of those odd Linux (Mint) things, I suppose. Thunderbird has finally realised I want my dates in dd:mm:yy, but Firefox seems immune to suggestions that I prefer UK to US spelling (and German is destroying my English 'ie' and 'ei' spelling, but that's just a side effect of living here!).

                  I don't worry about it, except when transferring money.

        2. Pixel Green
          Facepalm

          Re: Pesetas

          Funny story that.

          I had the inverse and had to point out to my bank that they were trying to send my solicitors £3m instead of £30k for the house deposit... Only didn't happen because the screen was facing both of us and I could see them typing it out.

          You'd think that would be the end of it, but then they do it A SECOND time a few seconds later, which I duly pointed out.

          While I'm hopeful this would have triggered some internal anti-fraud measure, at this point I'm honestly not convinced

      2. stiine Silver badge

        Ok, but Citibank reviewed the transaction after it was created, before it was submitted.

      3. ChrisC Silver badge
        Coat

        So they *were* worth it then...

      4. RobDog

        Credit card slipped

        Yearsnyears ago when I got my first credit card, and had just moved out of home, I splurged on the essentials…in Debenhams a new duvet set, and in the local in-car entertainment shop a brand new Pioneer tape/FM head unit and 4 speakers for my battered Triumph Spitfire. The assistant and Ingor on well, plenty of chatting, he broke out the card slip machine (not electronic) and took the card imprint…remembered he hadn’t given me some accessory or other, and promptly never got me to sign the card slip. Never got charged a penny or heard any more about it.

        1. logicalextreme

          Re: Credit card slipped

          Ah, I used to love using those machines. We only needed to use them if there was a problem using the electronic machines (network, bank, card, or $other including running the shop for most of a day during a power cut) but they made such a satisfying ker-CHUNK! as they rolled over the card and back.

          Also put the fear of god into some customers as they bawled about us "cloning" their card…

    2. hoola Silver badge

      Despite all general feeling that this was deliberate I believe it is far more likely to be human error.

      If the upgrade is mistakenly given a patch ID then once it is in the system the assumption is that it has been approved. It requires someone to read all the associated notes to understand that it was not a patch.

      This is exactly the same as the Crowdstrike fiasco however it appears to have been caught sooner and with (as far as we know) less catastrophic outcomes.

      I am in no way excusing the cock up and this is one of the huge issues we have now. Everything is online, Developer teams appear to be getting more and more incompetent when it comes to testing, quality assurance and release checks. This is not just Microsoft but a general issue throughout IT.

      There appears to be no responsibility, something is released that breaks stuff, "listen" to customer's grips and ignore, send out professional apologisers to smooth things over, rinse and repeat.

      1. usbac

        It's not so much "Developer teams appear to be getting more and more incompetent when it comes to testing", but the bean counters in management getting rid of all of the software testers to save money. After all, customers will report all of the problems, why pay for testing?

        In most cases, it's not like we have a choice not to use their crap software, and they know it!

        1. Doctor Syntax Silver badge

          It's not so much QA as release process but the bean counters strike there as well.

          Not that anyone over there cares any more.

    3. DCdave

      Well, it appears it is a mistake to call it an upgrade.

    4. Sudosu Bronze badge

      Yeah... "server".

  8. ecarlseen

    Wonder what the legal obligations really are

    If Microsoft pushes the install and the end user doesn't accept even a click-through EULA, I wonder how Microsoft expects to collect on this.

    If Microsoft blocks functionality based on an action they unilaterally initiated, can the end-user sue?

    An interesting legal problem.

  9. AlanSh

    Wot? No testing?

    Who in their right minds puts windows patches straight onto their production servers? Didn't they have a test plan for these things?

    Alan

    1. UnknownUnknown

      Re: Wot? No testing?

      Agreed, complete madness.

      1. cmdrklarg

        Re: Wot? No testing?

        Oh, you can't help that. We're all mad here.

    2. Jon 37 Silver badge

      Re: Wot? No testing?

      Lots of small and medium sized businesses don't have the hardware and staff to test every small Microsoft security patch. And delaying the rollout is a security risk.

      So rolling out security patches automatically can be the least bad option.

      1. Doctor Syntax Silver badge

        Re: Wot? No testing?

        OTOH this doesn't seem to be a small business. I wonder if these were test servers.

  10. Paul S. Gazo

    Flawless code is hard. Humans are humans.

    And that's why the Recall feature should never be permitted to exist.

  11. Anonymous Anti-ANC South African Coward Silver badge

    To err is human.

    To really foul things up, requires a computer.

  12. 10111101101
    Facepalm

    What is all the fuss about? You got a free upgrade

    1. Lord Elpuss Silver badge

      If the article is to be believed, those affected are/may be on the hook for relicensing.

      "...paying for the required license and dealing with all the changes that come with Windows Server 2025"

      1. Dr Sendy

        Under Australian consumer law, free upgrade baby - or - Microsoft gets to make good (ie: pay for the rollback).

      2. jdiebdhidbsusbvwbsidnsoskebid Silver badge

        In the UK there is something in law called "unsolicited goods". Basically if a company sends you something you didn't ask for, it's yours to keep and they can't demand payment for it. But, that doesn't apply if it's a genuine mistake, such as sending the wrong item by mistake against a genuine order you had made for something else. You still aren't obliged to pay for it but quite how you request the supplier to collect the mistaken goods at their expense in this situation would be interesting.

        It's designed to prevent unscrupulous companies sending out stuff and demanding payment. Might apply in this case.

  13. Stumpy

    I'm sorry. You had automatic updates switched on. On a server? Are you mad?

    1. Andy A
      FAIL

      NOT on a server, but on Win11 PCs. The little patch supposedly for a bugfix for Win11 turned out to be a multi-gigabyte install file for Svr2025.

  14. Sceptic Tank Silver badge
    Windows

    WSL is sloooooow

    Windows security update. Otherwise known as a pointless exercise.

    1. Anonymous Coward
      Anonymous Coward

      Re: WSL is sloooooow

      "program" A pointless exercise program.

  15. GBE

    Otter from Animal House

    Administrators are reporting unexpected appearances of Windows Server 2025 after what was published as a security update turned out to be a complete operating system upgrade.

    To quote Otter from Animal House:

    ... you can't spend your whole life worrying about your mistakes! You f***ed up. You trusted us! Hey, make the best of it!
  16. Awbee
    WTF?

    Thanks for the unexpected upgrade that is causing veeam not not perform application aware backups. Veeam doesn't have a full support until later this year in ver 12.3.

    le sigh

  17. eric79xxl

    So many SNAFUs recently

    it seems like they are significantly worse this year than ever. SO many update and upgrade SNAFUs. It's like they have completely abandoned all Q/A testing to match the level that everyone has been talking smack about them for so long. It's getting a bit disturbing.

    But also, yeah, if you deploy patches straight to prod... I mean you really should know better by now. :/

    1. David Hicklin Silver badge

      Re: So many SNAFUs recently

      > they have completely abandoned all Q/A testing

      they abandoned Q/A testing a long time ago

      1. ecofeco Silver badge

        Re: So many SNAFUs recently

        ...in a galaxy far, far away.

    2. ecofeco Silver badge
      Pint

      Re: So many SNAFUs recently

      Recently? You're new around here, aintcha.

      Have pint on me and pull up seat. Have we got stories for you... ------------------------------------------>>>

  18. Bebu sa Ware
    Facepalm

    Oh Magoo you've done it again!

    Oh Magoo you've done it again!

    Old, blind and stupid - that's my excuse.... what's Microsoft's?

  19. Ball boy Silver badge

    In six months....

    This incident will largely have been forgotten by mid-'25 and, in an act of staggering brass neck, Redmond will release a PR puff about the number of server-users who have already migrated to their latest. You watch!

    1. ecofeco Silver badge

      Re: In six months....

      Watch? You can set your watch by it!

  20. DCdave
    Joke

    Who knew?

    That General Availability now means it will be rolled out everywhere, like it or not.

  21. Mule -D

    Does it seem a little strange that the only company reporting this is Heimdal ? If it was a simple update labeling error then why aren't there millions of server admins up in arms. Something does not smell right here. Mule -D

    1. Anonymous Coward
      Anonymous Coward

      Yes, plus on both my WSUS and if I search online, KB5044284 is marked as being for Server 2025 (well, Server Operating System 24H2, same thing), whereas Heimdal seem to be saying it's for Windows 11 (I realise the underlying code base is the same).

    2. Awbee

      We had a few client that use NinjaRMM for patching and they were hit by it too. The morning of this there was a banner across Ninja's portal giving steps on how to exclude that patch from getting processed. I know of 7 servers that got hit that morning.

  22. Paul Hovnanian Silver badge
    Facepalm

    Move fast ...

    and bork things.

  23. Mike Friedman

    It's not a bug! It's a FEATURE!

    AND YOU WILL LIKE IT.

    Or else.

  24. Lord Elpuss Silver badge

    "paying for the required license and dealing with all the changes that come with Windows Server 2025"

    No no, no pay. Didn't ask for it, don't want it, installed due to MSFU and can't roll it back without significant expense and complexity.

    Sounds like a you problem, MS.

  25. Dr Sendy

    Incompetent C-Suite: "Do more with less, move fast and break stuff, be more like a start up".

    Seasoned IT Staff: "This is what a startup looks like, you sure?"

  26. Medixstiff

    I have to wonder if M$ does any QA testing at all anymore.

    Both new Outlook and New Teams were cluster f*cks. If Microsoft staff were using their own products, they would have been treated to the same time wasting the rest of the world did, having to revert back to previous editions of each product.

    Spelling and Grammar are still screwed, words we have been using for years are not recognized anymore, type Visio in and it only gives you vision, so they don't even recognize their own product names the dingleberries.

    I bet Satya Nadella would have kicked some serious butt when his autocomplete email addresses disappeared from Outlook.

    1. Piro

      Re: I have to wonder if M$ does any QA testing at all anymore.

      I thought it was pretty well known that they don't, they fired that group back in 2014.

      They rely on basic testing in VMs, and then largely feedback from people testing early builds.

      Absolute amateurs.

  27. Arty Effem

    So they're allowing refreshments in IT zones now?

  28. Uncle William

    It has just occured to me that there may well be some crossover in the quality assurance departments between Microsoft and Boeing..

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like