Windows Server 2008 has introduced a ton of new security features to lock down the server operating system through a number of enhancements and a dramatic change in philosophy. Where previous versions of the operating system have tried to limit the number of components installed, Server 2008 takes this to a whole new level. A base install of the operating system will have very few server-like services and functionalities running until the appropriate roles are installed and configured on the server.
Even with this change, some situations require that even additional measures be taken to limit the services running and reduce the footprint of attack. In these circumstances, even the GUI and "normal" Windows operating system services could be point of ingress for a malicious user. Windows 2008 Server Core answers this need by installing a limited version of the operating system that supports a reduced number of server roles, but only installs needed components and can fully dedicate server resources to serving those resources.
Windows 2008 Server Core is included in the licensing of Standard, Enterprise, and Datacenter editions of Windows Server 2008 as an optional configuration and does not require any additional licensing. This configuration can provide enterprise-class services, but only certain server roles are supported:
- Active Directory Services (AD)
- Active Directory Lightweight Directory Services (AS LDS)
- DHCP Server
- DNS Server
- File Server
- Media Services
- Print Server
- Web Server (With no ASP.Net support)
Unlike other high security options, using the Server Core does not require that network Administrators learn new management and configuration tools. While no GUI is available on the server itself, many of the common management consoles can be used remotely to manage the server. Of course, all of the command-line tools have been greatly expanded and are available to manage nearly every aspect of the server.
In the Real World
The decision to use the Server Core configuration is not one that should be made lightly. Rather this decision should be made in the context of a broader security plan that takes into account both the risks that the organization is willing to accept as well as the impact that Server Core will make on flexibility and the overhead in maintaining an additional server configuration. In situations where a server will be providing services to public users, branch offices, or locations where the physical security of the server might not be as diligently maintained, Server Core can provide an additional measure of security as it can stop unskilled tampering and reduce the ways that the server could be compromised. Server Core should be a component of your Risk Management plan, not the only component.
Installing Server Core
If you have not installed Windows Server 2008 before, you will find it much simpler than its predecessors. Server core is no exception to this and can be installed and ready for configuration in minutes.
- Once you have a server that is capable of running Windows Server 2008 and meets the minimum hardware requirements of the operating system, place the operating system disk into your DVD drive and boot from the DVD.
- From the list, choose the Server Core installation rather than the Full Installation and Click Next.
- Select Custom Installation and specify the drive to which you want the operating system installed. Click Next.
- Wait as the installation files are copied and installed on your hardware. In practice this takes 10-15 minutes on modern hardware – much less than in previous operating systems.
- Once the installation is complete, the server will reboot bringing you to the logon screen. As this is a new installation, you will be forced to set the Administrator password during this firs login. Once that is completed and the initial account is set up, you will be presented with the Server Core desktop… a command prompt.
Tools & Resources
Server Core Documentation – Microsoft's documentation of the Server Core
Server Core Installation Options – Documentation of the different Server Core options by edition of Windows Server 2008
Server Core Installation Guide – Full step-by-step documentation on the installation and configuration of Server Core