Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What actions should be taken to 'lock-down'/harden/secure a windows server 2008 R2 machine, when used as a web server (with remote desktop access)?

Are there any elements that are enabled as standard that can be dissabled/removed?

Thank you.

share|improve this question
possible duplicate of What is the best way to harden Windows Server 2008 R2? – GregD Jan 14 '11 at 15:01
While there's going to be some overlap, the role of the server can have a major impact on how/what to harden, so I think this is ok. – gravyface Jan 14 '11 at 15:17
I would also try this question at – Josh Brower Jan 16 '11 at 13:09

If this server's sole purpose is to run IIS, I'd recommend installing Core and adding the IIS role (and the Remote Desktop Services role, although you may find that Remote IIS Manager suits your needs); this process is described here.

This will significantly reduce the attack footprint compared with a Standard installation of Windows 2008 R2 (and may improve performance or at least free up some resources with the reduced number of services/roles/features enabled/running).

If the box is built and you can't redo it, I'd suggest you run the Microsoft Baseline Security Analyzer after your Web application has been installed, tested to be working properly, etc. to find any potential vulnerabilities that may exist.

Following up with a general purpose security scanner such as Nessus or GFI LanGuard (and performing regular scans) would be a good idea as well.

A note on making changes... not to patronize, but I'd change one thing at a time and retest your Web site/application to make sure it's all working.

Last but not least, look at the Web application itself: you can use third-party Web vulnerability scanners to find obvious holes, but make sure that your developers or Web designers are following best practices for vigorous input validation for all your GET and POST actions on your site -- your Web application/site could be dishing up malware to unsuspecting visitors at the application-level without even compromising the OS or even IIS.

share|improve this answer
Good advice, thanks. – UpTheCreek Jan 14 '11 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.