Windows Server vNext Build 29683 Adds MSHardenedPolicyEval; LSASS TLS Crash Warning

The build includes both the Desktop Experience and Server Core installation options for the Datacenter and Standard editions. Azure Edition is included for virtual machine evaluation only. The preview still says Windows Server 2025 on screen. Microsoft asks testers to call it "Windows Server vNext preview" when they report problems.

MSHardenedPolicyEval: a hardening scorecard built into Windows​

Microsoft lists the security areas Server Core can be configured for: authentication, credential protection, cryptography and TLS, auditing, event logging, exploit mitigations, networking, PowerShell, printing, remote management, SMB, UAC, firewall policy and more. Microsoft admits that confirming a machine matches the new hardened defaults in all of those areas has usually meant combining several tools and doing manual checks.

MSHardenedPolicyEval puts that work into one tool. It compares the machine's current state with a curated catalog of hardening policies covering:

• Registry settings
• Local Security Authority (LSA) rights and SID assignments
• Audit subcategories
• Security Accounts Manager (SAM) settings

It then gives a score for each policy group and an overall hardening score. Microsoft also says the tool can serve as the mechanism behind scheduled hardening tasks on the system.

The design detail that matters most is that evaluation, apply and revert all use the same policy tables. Microsoft says this means what the tool measures and what it enforces can't drift apart. Any setting that counts toward your score is exactly the setting the apply switch (-ap) will configure. If you've ever seen a compliance scanner and a remediation script disagree about what "compliant" means, you'll see why that's useful.

Results don't have to stay in a console window. Scores and policy bitmasks can be written to the Windows event log and, optionally, sent through TraceLogging. That lets monitoring and telemetry pipelines collect them.

How to use it​

Microsoft's stated requirements and switches:

• Location: %SystemRoot%\System32\MSHardenedPolicyEval.exe
• Requirements: Run it from an elevated administrator prompt. It runs only on Windows Server SKUs.
• No arguments: Performs a read-only evaluation.

If you leave out the selector list, the operation covers every supported group. You can also target specific categories or groups. Selectors aren't case-sensitive and can be separated with commas, semicolons or vertical bars. Microsoft gives three examples: -ap registry, -rp Printing and -ap Audit,LSA.

A cautious first run on a test server​

Based only on the documented switches, a sensible order looks like this:

1. Open an elevated prompt on a test Server Core VM and run the tool with no arguments to get a read-only baseline.
2. Run it again with -v to see which groups score low.
3. Add -l so you keep a log of the results before you change anything.
4. Apply hardening to a single group with a narrow selector, not the whole catalog.
5. Reboot if needed, run the evaluation again, and check that your workloads still behave.

Microsoft warns that applying or reverting policy may need a reboot before the change fully takes effect. It also says some operations touch security-sensitive configurations, so you should review your selectors before running -ap or -rp broadly in critical environments. The announcement doesn't publish the full policy catalog or explain how scores are calculated. Until it does, treat the scores as a guide rather than a compliance certificate.

Why it matters​

This is analysis based on general industry knowledge. Microsoft calls these the "new default hardened" values. That suggests the next Server release may ship with tighter defaults than Windows Server 2025, with the revert switch available for workloads that break. Tighter defaults usually break something, such as an old print workflow, a legacy authentication path or a monitoring agent that expects lax audit settings. A per-group revert option is the practical answer to that. Build a test inventory now and you won't be surprised at general availability.

Summary: MSHardenedPolicyEval scores, applies and reverts Server Core hardening from one policy catalog, and it reports results through the event log or TraceLogging. Start with read-only runs and narrow selectors.

Clean install from Build 29531 is still required​

The upgrade rules haven't changed. Build 29531 is still the preview baseline. Microsoft does not support upgrades from vNext preview builds older than 29531 and recommends a clean install of 29531 or later. BetaWiki records that build 29531 was released to Windows Insiders in the Canary Channel on 12 February 2026, so this baseline has been in place for about eight months.

What's still confusing is that upgrades from earlier Windows Server previews (Build 26525 and older) are not technically blocked by setup.exe. Setup letting you start an upgrade doesn't mean the upgrade will work. Microsoft warns that VMs upgraded from those older previews may fail to upgrade or fail to start afterward, which affects live migration and failover clustering. Build 29531 itself was never flighted, and flighting support resumed with preview build 29550 or later.

There's also a cosmetic flighting bug: the update label may say Windows 11. Microsoft says selecting it installs the Windows Server vNext update and that the label will be fixed in a future release.

Summary: If you're on 29550 or later, flighting should bring you to 29683. If your lab started from anything older than 29531, wipe it and reinstall.

Known issues: an LSASS crash and a Server Core FOD problem​

TLS hybrid key exchange can crash LSASS​

A race condition in the TLS hybrid key exchange code may crash the LSASS service when a TLS server negotiates hybrid groups. LSASS handles authentication, so a crash there is serious. The affected groups are X25519_MLKEM768, SecP256r1_MLKEM768 and SecP384r1_MLKEM1024. Until a fix ships, Microsoft says to disable them using the TLS cmdlets or Group Policy.

This isn't new to this build. NTCompatible's coverage of Build 29659 last month already noted that a TLS hybrid key exchange race condition can crash LSASS on certain negotiated groups, so the bug has lasted through at least two server flights.

Microsoft Learn's TLS supported-groups documentation adds context. It describes these post-quantum ML-KEM groups as TLS 1.3–only and not enabled by default, and lists 29550 as the minimum Windows Server build for them. So the servers most at risk are ones where someone deliberately turned on post-quantum hybrid key exchange for testing.

To check or change your configuration, Learn points to two routes:

• Group Policy: Computer Configuration > Administrative Templates > Network > SSL Configuration Settings > Configure ECC Curve Order. Make sure the hybrid ML-KEM groups are not in the priority list.
• PowerShell: Use the TLS cmdlets to view and adjust which groups are enabled.

If you're testing post-quantum TLS, this preview isn't the place to do it until Microsoft ships the fix.

AppCompat FOD on Server Core​

After a reinstall, enabling the AppCompat Feature on Demand may fail because of legacy third-party license compatibility problems. Microsoft says Server Core users may be unable to install the latest AppCompat FOD after upgrading to build 29574. The problem seems limited to Server Core installs with third-party application licenses that fail compatibility checks after the upgrade. A fix is promised for a future build.

Summary: Keep the ML-KEM hybrid groups disabled, and expect AppCompat FOD trouble on Server Core installs that carry older third-party licenses.

Where 29683 fits in the Insider timeline​

Build 29683 follows Build 29659, which NTCompatible reported as the latest snapshot for its upcoming LTSC release, though it continues to carry the Windows Server 2025 branding. That build added Trusted Launch, Quick Machine Recovery and NVMe-over-Fabrics.

Client and server builds are again sharing a build number. BetaWiki lists Windows 11 build 29683 as released to Windows Insiders in the Experimental (Future Platforms) channel on 7 October 2026, five days before the server build. That shared codebase probably explains the "Windows 11" flight label confusion.

Downloads, keys and expiration​

• LTSC Preview: ISO in 18 languages; VHDX in English only
• Datacenter Azure Edition Preview: ISO and VHDX, English only
• Microsoft Server Languages and Optional Features Preview is also available
• Preview-only keys: Standard MFY9F-XBN2F-TYFMP-CCV49-RMYVH; Datacenter 2KNJJ-33Y9H-2GXGX-KMQWH-G6H67. Azure Edition doesn't accept a key.
• Symbols: Available on Microsoft's public symbol server
• Expiration: October 15, 2027

Registered Insiders can get the media from the Windows Server Insider Preview download page. Newcomers start at the Windows Insiders for Business portal. Microsoft notes that downloads may not be available in some countries. Like every Insider build, this is prerelease software provided "as-is" and not supported in production.

Feedback and diagnostics​

Server Desktop users can use the Feedback Hub app. It should update itself, and if it doesn't, use Check for updates in the app's settings. Server Core users, or anyone who can't run the app on Server, can file feedback from a registered Windows 10 or Windows 11 Insider device under the Windows Server category. Put the build number at the start of the title in the format [Server 29683] Title of my feedback.

Microsoft also asks preview testers to change diagnostic data from the default to Optional in Settings to give more automatic feedback. Whether you do that on a lab box is your call.

Bottom line​

This build has one new feature, but it matters. MSHardenedPolicyEval is the clearest sign yet that the next Windows Server LTSC will push stronger security defaults, and Microsoft is giving admins a way to measure them, apply them and back them out before they arrive. Run it read-only first, keep the ML-KEM hybrid groups off until the LSASS fix ships, and remember that anything older than build 29531 needs a clean install.