'Server Core': Small Footprint, Big Security

IT admins are justifiably excited by the idea of a "server core" in Windows Server 2008, formerly code-named Longhorn Server. The technology, which strips out extraneous functionality to allow just the services needed to run a server in a specific role, promises easier installation and a smaller footprint once set up. It even has implications for security.

Jeff Jones, a Strategy Director in the Microsoft Security Technology Unit, recently matched hard data to the small footprint theory, and came up with some interesting observations and conclusions.

On his TechNet security blog, Jones detailed his experiences installing a server core and a regular, non-server core installation of Windows 2008 on two different partitions on his machine (using the latest beta 3 release). He came up with some startling numbers. The server core installation was less than 1.8GB total, while the full, default Windows 2008 installation was 10.8GB. Jones noted that a server core install is about 16 percent of a full, default install.

So, how does this relate to security? Jones explained: "Can you say 'reduced attack surface area'? The disk space measurement is really just a proxy for the amount of code installed that the IT manager has to worry about in terms of managing security risk. I'm not claiming this was a Microsoft innovation, but it is chock full of security goodness."

Linux servers have had this ability since the beginning, hence the "I'm not claiming this was a Microsoft innovation" comment. Still, it is a big step forward for Microsoft in the security arena.

Server core supports the following roles:

  • Active Directory Domain Services
  • Active Directory Lightweight Directory Services (AD LDS)
  • Dynamic Host Configuration Protocol (DHCP) Server
  • DNS Server
  • File Services
  • Print Server
  • Streaming Media Services

A number of Windows Server attack vectors are eliminated with a server core installation, Jones points out, including Internet Explorer, File Explorer, Media Player, Internet Information Server and the Windows GUI.

For his next experiment, Jones stated he'll go back through vulnerabilities from Windows Server 2003 for the last few years and see how many would have been stopped if a server core-type of installation had been available and used. That should provide some interesting reading.

About the Author

Keith Ward is the editor in chief of Virtualization & Cloud Review. Follow him on Twitter @VirtReviewKeith.


  • Microsoft Adding Google G Suite Migration in Exchange Admin Center

    Microsoft's Exchange Admin Center will be getting the ability to move Google G Suite calendar, contacts and e-mail data over to the Office 365 service "in the coming weeks."

  • Qualcomm Back in Datacenter Fray with AI Chip

    The chip maker joins a crowded field of vendors that are designing silicon for processing AI inference workloads in the datacenter.

  • Microsoft To Ship Surface Hub 2S Conference Device in June

    Microsoft on Wednesday announced a June U.S. ship date for one of its Surface Hub 2S conferencing room products, plus a couple of other product milestones.

  • Kaspersky Lab Nabs Another Windows Zero-Day

    Kaspersky Lab this week described more about a zero-day Windows vulnerability (CVE-2019-0859) that its researchers recently discovered, and how PowerShell was used by the exploit.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.