I have a number of 2016 servers. It seems like 99% of them fail when doing automatic updates. I am able to install them manually by going through sconfig and selecting option 6 but it takes FOREVER. During installation, the CPU or Memory isn't maxed out at 100% so I have no idea what is causing it to take forever. All other previous versions of Windows run and install updates just fine in the same VMware environment.

Enough said.

With the latest .Net updates the dashboard is not useable anymore: Warnings can't be ignored or deleted, computers can't be removed...
Only the progressbar appears, cpu usage rises to 100% and dashboard gets stuck or crashes.

The Windows Admin Center page keeps requesting credentials for the Windows Admin Center when adding computers or installing extensions, and it often does so twice in a row.

Show file extension by default on Windows Server. I can understand why the extension is hidden by default on the Desktop OS but for server it should be visible.

TS users keep hitting the powerbutton. can we change the behaviour of the power button or hide it entirely

they intend to log off but they keep powering the server down.

related to ADFS 2016:

it would be great if we can force a specific authentication method at ADFS for a relying party. in general forms and certificate authtentication is possible for our users, but for specific apps only certificate should be possible for security reasons. adding certificate as MFA is not a good solution from the users point of view because they will be forced to enter first their credentials before they have to use a certificate (which is more secure than forms and because of this sufficient).

The scenario is installation of CEP/CES (both are part of Windows AD Certificate Services role) and the problem is that this installation requires membership in either Enterprise Admins or root Domain Admins groups.
Would like to suggest to remove this hard coded requirement and provide normal delegation options where we can exactly provide to the installation user account minimum rights for performing CEP/CES installation.

I end up declining 80% of all WSUS updates, because my products all use x64 architecture, hence I don't need ARM64, Itanium or IA-32 updates. As for Windows 10, I don't need updates for versions 1507, 1511, 1607, 1703 and 1709. There should be an easy way to tell WSUS not get any of these updates during synchronization.

We still need a Windows Version for small customers getting easy connection to Azure and Office 365. So do NOT remove the Essential Role out of Version 2019.

I just had SQL server restart at 9:36 am for me because of a microsoft update. I appreciate the importance of updating product, but I should never have to apologize to my customers for 10 minutes of down time while SQL is restarting. Active hours shouldn't be only 8 hours long. All in all the most frustrating part of running Windows 2016.

Default IIS HTTPS settings should get a good grade on https://www.ssllabs.com/
If legacy operating system support is needed, that should have to be enabled on a per-site basis.

It is very important to include in the "Scope" tab, within a Windows Firewall rule, to release DNS names and not just IP addresses.

Add native ACME Client v2 to Windows Server and IIS include auto renewal feature.

Request for Wake-on-LAN (WoL) to be initiated from the Secondary Site Servers and DPs. Currently only the Primary Servers are able to initiate WoL but due to certain security concerns and geographical challenges, multicast and unicast broadcasts is either not permitted or limited. These limitations prevents the Primary Server to wake up clients at remote locations. If WoL traffic is initiated on the Site Servers and DPs, the WoL traffic will remain within their respective local networks while maintaining a security posture by blocking external unicast and multicast traffic.

my idea is to take out the google search from Microsoft and we create new search like google for Microsoft and it only used my Microsoft windows and I named it has micro search means even micro issue also will not escape means better then google search and lastly my hamble request sir please think about if we use this idea no company will beat the microsoft and have a nice day

Default VPN/WiFi settings shouldn't allow insecure connections, nor allow users to override acceptable CAs for a connection without the user acknowledging that what they're doing is very risky.

Hyper-V Servers or VM's that are not able to get to the internet Microsoft Windows Update Server are not able to get the Integration Services updates. We need a PowerShell way to be able to check to see what Integration Services version is installed like we had (Get-vm -ComputerName $Env:computername | ft ComputerName,Name,State,IntegrationServicesVersion,IntegrationServicesState
) and a way to update them with a KB update.

Robocopy.exe is great tool, but it have one really stupid thing. In command line I can add list of excluded files (param /XF file1 file2 ...filex) and directories param /XD dir1 ...dirx). Great! BUT when I have lot of files (or dirs) for exclude its really not comfortable to write lot of filenames to command line (or into batch file). And command line has limit 2048 characters. its so big problem add param for example /XDFILE:list.txt for read excluded directories from file list.txt? (and for files something similar)