'Server Core': Small Footprint, Big Security

IT admins are justifiably excited by the idea of a "server core" in Windows Server 2008, formerly code-named Longhorn Server. The technology, which strips out extraneous functionality to allow just the services needed to run a server in a specific role, promises easier installation and a smaller footprint once set up. It even has implications for security.

Jeff Jones, a Strategy Director in the Microsoft Security Technology Unit, recently matched hard data to the small footprint theory, and came up with some interesting observations and conclusions.

On his TechNet security blog, Jones detailed his experiences installing a server core and a regular, non-server core installation of Windows 2008 on two different partitions on his machine (using the latest beta 3 release). He came up with some startling numbers. The server core installation was less than 1.8GB total, while the full, default Windows 2008 installation was 10.8GB. Jones noted that a server core install is about 16 percent of a full, default install.

So, how does this relate to security? Jones explained: "Can you say 'reduced attack surface area'? The disk space measurement is really just a proxy for the amount of code installed that the IT manager has to worry about in terms of managing security risk. I'm not claiming this was a Microsoft innovation, but it is chock full of security goodness."

Linux servers have had this ability since the beginning, hence the "I'm not claiming this was a Microsoft innovation" comment. Still, it is a big step forward for Microsoft in the security arena.

Server core supports the following roles:

  • Active Directory Domain Services
  • Active Directory Lightweight Directory Services (AD LDS)
  • Dynamic Host Configuration Protocol (DHCP) Server
  • DNS Server
  • File Services
  • Print Server
  • Streaming Media Services

A number of Windows Server attack vectors are eliminated with a server core installation, Jones points out, including Internet Explorer, File Explorer, Media Player, Internet Information Server and the Windows GUI.

For his next experiment, Jones stated he'll go back through vulnerabilities from Windows Server 2003 for the last few years and see how many would have been stopped if a server core-type of installation had been available and used. That should provide some interesting reading.

About the Author

Keith Ward is the editor in chief of Virtualization & Cloud Review. Follow him on Twitter @VirtReviewKeith.


  • Microsoft Releases Windows 10 Version 1909

    Microsoft on Tuesday announced the release of Windows 10 version 1909, a new operating system product that's also known as the "Windows 10 November 2019 Update."

  • November Microsoft Security Bundle Addresses 75 Vulnerabilities

    Of that number, 13 vulnerabilities are rated "Critical" to patch, while 62 vulnerabilities are deemed "Important."

  • The Future of Office 365 Pricing

    With a raft of new Office 365 features in the pipeline, Microsoft also seems ready to change the way it bills its subscribers. Will it replicate Azure's pay-per-use model, or will it look like something else entirely?

  • Microsoft Offers 1 Year of Free Windows 7 Extended Security Updates to E5 Licensees

    Microsoft is offering one year of free support under its Extended Security Updates program to Windows 7 users if their organizations have E5 licensing.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.