I have a number of 2016 servers. It seems like 99% of them fail when doing automatic updates. I am able to install them manually by going through sconfig and selecting option 6 but it takes FOREVER. During installation, the CPU or Memory isn't maxed out at 100% so I have no idea what is causing it to take forever. All other previous versions of Windows run and install updates just fine in the same VMware environment.

There's a pretty big problem on some servers (at least two Dell PET Servers I've tried so far) that stops Server 2019 from booting/goes into a boot loop once the Hyper-V role is installed.

Enough said.

ADFS 2019 allows for 300 IPs to be added to the "Banned IP list"

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-banned-ip#adding-banned-ips

As there are nearly four billion public IPs on the internet, 300 is woefully inadequate.

Small customers that are only trying to block a few users aren't likely using ADFS anyway. Large organizations that rely on ADFS will hit the 300 limit almost immediately.

I'd like to see this number raised to 65538 (/16) or something similar.

Continue support and updates for Advanced Group Policy Management. Our company uses AGPM extensively and would like to see future enhancements and support continued. If there is a replacement Microsoft product, it doesn't seem to be found.

We still need a Windows Version for small customers getting easy connection to Azure and Office 365. So do NOT remove the Essential Role out of Version 2019.

Dear Microsoft Windows Server team. We would like _complete control_ over when we would like our our WS2016 to install windows updates! No more slow / timeconsuming server restarts because of "Getting Windows ready. Do not turn off your computer" messages when we just would like a quick restart of a production server.. No more TiWorker.exe using 100% of a CPU core during "*********" and so on.. And please fix the issues with '2017-08 Update for Windows Server 2016 for x64-based Systems (KB4035631)' asap. Thank you.

It would be great if it could be displayed directly in the console to which users and computers a new or changed policy could already be applied.

With the latest .Net updates the dashboard is not useable anymore: Warnings can't be ignored or deleted, computers can't be removed...
Only the progressbar appears, cpu usage rises to 100% and dashboard gets stuck or crashes.

Show file extension by default on Windows Server. I can understand why the extension is hidden by default on the Desktop OS but for server it should be visible.

While never fully supported, the support WinPE had for WPF was enough to allow folks to build flexible, customized tools. Most of us who have done it are SCCM admins building custom front-ends for the OSD process.

The excellent community has found a workaround to keep WPF going, but it would be nice to have support officially back to at least the level it was.

Thanks!

AD FS publishes two different issuer values in the public https://<domain>/adfs/.well-known/openid-configuration : One is called 'issuer' the other is 'access_token_issuer' - the access_token_issuer is optional in the standard. The value that is issued in the access token iss claim is always the 'access_token_issuer' some clients (.Net ones) validate the access token against the 'access_token_issuer' others (using open source libraries) will only validate against the 'issuer'
It would be great if I could select per relying party which value is returned in the access token iss claim.

related to ADFS 2016:

it would be great if we can force a specific authentication method at ADFS for a relying party. in general forms and certificate authtentication is possible for our users, but for specific apps only certificate should be possible for security reasons. adding certificate as MFA is not a good solution from the users point of view because they will be forced to enter first their credentials before they have to use a certificate (which is more secure than forms and because of this sufficient).

Issue relating to robocopy is detailed here:
https://social.technet.microsoft.com/Forums/exchange/en-US/cd9b83c1-bd01-41ee-8f56-ea9db4e598bb/robocopy-with-mt-switch-seems-to-show-different-summary-info-why?forum=winserverfiles&prof=required

When using the /MT to a directory that already exists the files are not skipped. This is the opposite behavior to what happens without the /MT flag. This issue is picked up reviewing the summary.

Add native ACME Client v2 to Windows Server and IIS include auto renewal feature.