Windows Server dedicated servers

A Windows Server dedicated server is a physical, single-tenant machine that runs Windows Server directly on the hardware — no hypervisor, no shared tenancy. You get full Administrator access over RDP, every physical core, and predictable performance for licence-sensitive workloads like SQL Server, Active Directory, and IIS.

Because the box is fully dedicated to you, licensing is flexible: bring your own Windows image and licence (BYOL), or add a Windows Server licence through our SPLA and pay for it monthly, quoted during the order process. We offer Windows Server 2022 and Windows Server 2025.

Not sure which Windows Server release to run? Read our Windows Server version guide.

Windows Server licensing: BYOL and SPLA

Windows Server is licensed per physical core, not per virtual machine, with a minimum of 8 core licences per processor and 16 per server. On a Serverside dedicated server you have two routes, and you choose at order time.

Bring your own licence (BYOL): because the hardware is fully dedicated and single-tenant, you can generally deploy your own Windows Server licences on it under Microsoft’s Outsourcing Software Management Rights and Flexible Virtualization Benefit. That is the key distinction from shared or multi-tenant hosting, where those rights do not apply. Note that Windows Server itself is not covered by classic License Mobility through Software Assurance, so eligibility depends on your specific licence and its subscription or Software Assurance status — worth confirming with your reseller.

SPLA (Services Provider License Agreement): alternatively, we can license Windows Server for you through our SPLA. This is Microsoft’s monthly, per-physical-core model for hosting providers — you rent the licence for as long as you run the server, no up-front purchase and no Windows Server CALs to manage. We quote the SPLA fee during the order process; it scales with the core count of the machine you pick, which is one reason higher-clock, lower-core CPUs can be the economical choice for many Windows workloads.

• Per-core licensing: bill follows physical cores (min 8/processor, 16/server), not VM count
• BYOL is available on our dedicated single-tenant hardware — verify your licence + SA/subscription status
• SPLA is monthly, no CALs, quoted at order and scaling with core count
• You keep full Administrator access under either route

Standard vs Datacenter edition

The edition you license changes your virtualisation rights, and this matters if you intend to run Hyper-V on the box. Both editions are otherwise feature-comparable for most roles.

Standard grants two operating-system environments per fully-licensed server — in practice, the host plus two Windows Server VMs (or two VMs if the host runs only the Hyper-V role). Stacking a second set of core licences over the same cores buys another two VMs. Datacenter grants unlimited Windows Server VMs on the licensed cores, so it becomes the economical choice once you are running roughly eight to ten VMs on one host. If you are not virtualising Windows and just want a single Windows workload on the metal, Standard is usually the right call.

• Standard: 2 Windows VMs (OSEs) per fully-licensed server; re-license the cores for +2
• Datacenter: unlimited Windows VMs on the licensed cores
• Crossover to Datacenter is around 8–10 VMs per host
• Both are covered under BYOL or SPLA — edition is chosen at order

RDP hardening: the number-one Windows exposure

Remote Desktop is how you administer a Windows server, and an RDP endpoint left open on TCP 3389 to the whole internet is the single most-attacked surface on Windows. Automated password-spraying and brute-force against exposed 3389 is constant. Never leave it open to the world — front it, and lock down who can reach it.

You manage your own firewall rules at the network level from your dashboard, so filtering happens in front of the machine rather than only in Windows Firewall on the box — self-service DDoS mitigation and rule management upstream, Windows Firewall behind it, a layered defence where neither tier is your single point of failure. If you do lock yourself out — a bad rule, a firewall change, a wrong RDP setting — the KVM console gives you out-of-band access when RDP is unreachable: watch the machine boot, fix the NIC driver, firewall, or setting that broke it, and get back in without opening a support ticket.

Beyond the network layer, you should also harden the OS itself. A sensible baseline on a fresh Serverside Windows box:

• Restrict 3389 to an IP allowlist (your office/VPN egress), or don’t expose it at all
• Reach RDP through an RD Gateway or a VPN rather than the raw port
• Require Network Level Authentication (NLA) so credentials are checked before a session spins up
• Set account lockout policies to blunt brute-force attempts
• Rename/disable the default Administrator account and use strong, unique credentials
• Let our inline filtering front the endpoint — but treat it as defence in depth, not a substitute for the above

What teams run on Windows bare metal

Bare metal suits Windows workloads that are licence-sensitive or latency-sensitive, because fixed physical cores and no hypervisor tax make both licensing and performance predictable.

• SQL Server — per-core licensing rewards a known, fixed physical core count, and local NVMe keeps I/O-bound queries fast
• Active Directory and domain services as a dedicated domain controller or identity tier
• IIS and ASP.NET / .NET application hosting with the full uplink behind it
• Hyper-V virtualisation host — pair with Datacenter edition for unlimited Windows guests
• Windows-based game servers — our DDoS profiles are tuned per title across the games hosted on our network

Isolate domain controllers on the private network

Active Directory is the case where network topology matters most: a domain controller should almost never sit directly on a public address. Put your servers on a private network between them and keep the DCs on that private side, with only the members that genuinely have to face the internet — a public web front-end, an edge relay — placed in a customer-defined DMZ. Domain replication, LDAP, and Kerberos traffic then stay off the public interface entirely.

That is the classic tiered pattern: the exposed member in the DMZ, the identity tier isolated behind it, and the private network carrying everything that should never leave your own boundary. Drawn that way, a DC never has to answer a packet from the open internet.

Windows Server 2022 or 2025?

Windows Server 2025 reached general availability on 1 November 2024 as the current Long-Term Servicing Channel release, so both 2022 and 2025 are supported, current choices. 2025 brings a newer kernel, security hardening (credential and Active Directory improvements, SMB over QUIC now available in Standard and Datacenter rather than Azure Edition only), performance gains, and support for hotpatching.

Hotpatching lets you apply many security updates to running code without a reboot, cutting the number of restart months per year. It is delivered for Windows Server 2025 through Azure Arc; Microsoft’s commercial terms for it have shifted since launch, so confirm the current arrangement rather than assuming a fixed fee. If reboot-free patching is a priority, 2025 is the version to pick.

Choose 2022 for maximum compatibility with software certified against it and a longer track record; choose 2025 for the newer feature set, hotpatching, and the longest support runway. We image either in under a minute, so the choice is about your software, not our provisioning.

Patching and security posture

Windows Server ships with Microsoft Defender Antivirus enabled and receives cumulative security updates on the monthly "Patch Tuesday" cadence (the second Tuesday of each month), with out-of-band fixes for urgent CVEs. Because your Serverside server is unmanaged by default, keeping current is your responsibility — an internet-facing Windows box that misses Patch Tuesday is an easy target.

Put a patching plan in place from day one: schedule updates via Windows Update, WSUS, or your configuration-management tooling, keep Defender (or your chosen EDR) active and updated, and plan reboot windows — or run Windows Server 2025 with hotpatching to shrink how often those reboots interrupt service. Managed patching can be arranged if you’d rather we handle it.