Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

This question is my inspiration

i have windows server 2008R2 in my network as DC.
also i use this server for hosting our organization website.
I want to make it as secure as possible.
What I need to Do for securing my windows server??


our Website is run locally and we are Use Forms Authentication with Active Directory for our now what how can i Get the web site off of your Domain Controller???

share|improve this question

marked as duplicate by sysadmin1138 Jun 7 '13 at 15:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Step 1: Get the web site off of your Domain Controller. – joeqwerty Jun 7 '13 at 14:50
The "duplicate" question has weak answers. – longneck Jun 7 '13 at 15:12
@joeqwerty:why?? – AminM Jun 7 '13 at 15:27
@longneck: I Read BeStRaFe answer but it is too Summarized and i need more description also picflight server dont have DC – AminM Jun 7 '13 at 15:58
If you need help with moving your web site from one server to another, you should probably ask a new question. – Michael Hampton Jun 26 '13 at 13:36

1 Answer 1

up vote 1 down vote accepted


  • Run a current, supported version of Windows. Currently this is Windows 2008R2 and Windows 2012.
  • Never install anything on a domain controller except:
    • DNS, DHCP, WINS, and Certificate Services (and only if needed)
    • Anti-virus, backup agents, monitoring agents


  • Use a core installation if you can
  • Rename the local administrator account
  • Do not disable the firewall
  • Run the Best Practices Analyzer
  • Run the Security Configuration Wizard
  • Use the Microsoft Security Compliance Manager to developy and apply consistent security policies to all your servers
  • Do not disable UAC
  • Do not install and Roles or Features you aren't actively using.
    • Pay particular attention to un-needed sub-features of roles like IIS
  • Keep up to date with OS and application updates

    For the paranoid

  • Change the RDP port

share|improve this answer
tnx for answer but why never install DNS, DHCP, WINS, and Certificate Services Together??( i install it Together for paying Lower cost) – AminM Jun 26 '13 at 8:33
That is not what I said. You can install dns, dhcp, wins and certificate services on a DC. Those roles are appropriate for a domain controller and have minimalsecurity impact. everything else, like a website, should not be running on a domain controller. – longneck Jun 26 '13 at 12:55
meh changing the RDP port will just give you a bit less internet background noise. – Lucas Kauffman Jun 26 '13 at 13:34
Don't forget MS BPA 2012, 2008R2 (other versions available for older versions of Windows, but if you're really concerned about security you probably aren't running ancient software). – Chris S Jun 26 '13 at 13:40
@JesonPark LOL WUT? – longneck Feb 17 '14 at 13:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.