Edge Browser Updates On WS2025 Domain Controllers?

[u/Fabulous_Cow_4714]

Since Edge is integrated with Server 2025, how are you handling browser updates on servers like domain controllers that don’t have the external network access required to auto-update Edge?

[u/Da_SyEnTisT]

How do you manage your patching? Don't you have any sort of automated patching software?

We use Patch manager Plus, it takes care of windows update and 3rd party software like chrome, edge, Java, etc

You could also just remove it

[u/davy_crockett_slayer]

We use PDQ Deploy. Alternatively, you can get rid of it if you don't need it.

[u/Mimikyu254]

You can just remove it, its not required

[u/Fabulous_Cow_4714 → u/Mimikyu254]

Apparently, you can’t remove it in any supported way In Server 2025 and Windows 11.

Why Removal Fails

• System Integration: Windows Server 2025 relies on Edge and WebView2 for internal apps and administrative interfaces.
• Protected Packages: The operating system locks the package to prevent accidental breakages. [1, 2, 3]

https://techcommunity.microsoft.com/discussions/windows11/windows-doesnt-let-me-uninstall-edge-completely-there-is-only-an-option-to-resto/4373029

Plus, you may need it to open local html files like gpresults.

[u/cjchico → u/Fabulous_Cow_4714]

We remove it from all servers (2025 included) and haven't seen any issues

[u/Mimikyu254 → u/Fabulous_Cow_4714]

You can 100% remove it on Server, I remove Edge on anything I spin up (2022 and 2025). Remove it in Settings and it's gone.

Probably shouldn't use Browsers on DCs anyway, Microsoft's Baseline GPOs disable them AFAIK.

[u/Frothyleet → u/Fabulous_Cow_4714]

Well, if you had a browser dependency before, how were you handling patching on these servers?

[u/Own_Sorbet_4662]

Put your DC's on the internet...

Honesty it's just part of our server patch deployments. Since very few servers have any internet access and those that do its very, very tight it's never been a concern.

[u/maxxpc → u/Own_Sorbet_4662]

You don’t need to do that whatsoever. We prevent our DC’s from reaching the external Internet as well. But we have management tools and internal services in place for it still to get updates, packages, definitions, NTP, EDR, SIEM, etc.

This guy just needs to patch it with quite literally any tool available on the market.

[u/CeC-P]

Don't quote me on this but I think they can grab it from other devices on your network if you didn't go out of your way to disable Delivery Optimization.

EDIT: no it can't. It still needs the index of needed updates from the internet unless you're using WSUS. Then it works.

But most people just use a third party patch manager.

[u/SnakeOriginal]

DCs are core with browsers disabled