7

On a Windows Server 2008, can you even telnet into the server? (not remote desktop, but via the command line)

If yes, is there much control really?

How do people automate if you can't telnet? (assuming you can't)

6 Answers 6

4

There is basically nothing you cannot configure using the command line in Windows these days. There's netsh to manage network interfaces and the firewall for instance, and appcmd to handle an IIS instance.

Using Powershell (which currently excludes Server Core) even more options are available like an Add-Computer cmdlet for joining a machine to the domain with additional options over the old netdom.

If you stumble upon something that cannot be done from the command line, there's bound to be a 3rd party tool to do it - or you could roll your own given the knowledge of what to actually poke at on the system (generally application-specific files or registry settings).

WinRM

Since Server 2008/Vista you have Windows Remote Management which is Microsofts implementation of the open web service standard WS-Management which uses SOAP and thus can be protected with TLS/SSL and a number of authentication options.

CMD and Powershell can invoke WinRM to execute stuff on remote machines so it's easily scriptable. As far as I recall, WinRM can be installed on XP and 2003 machines as well - and it can be used to manage other platforms which implements WS-Management, like Linux running OpenWSMan.

Telnet

Not enabled by default (not even the client, thankfully!) but can be if you want to.

3rd party tools

Seems one of the more popular options - tools like psexec or 3rd party SSH servers are all available if that floats your boat.

Management suits

Any decent management solution will let you handle thousands of Windows hosts with a few clicks in a comfortable client tool. Microsoft System Center series is probably the most well-known but the other big ones I hope someone can edit in here.

UI Tools for adhoc administration

Most if not all administrative tools you find on a Windows machine can connect remotely to another Windows host for ad-hoc management. If you install the RSAT features on a Vista or Windows 7 desktop you will get most of the standard UI tools to manage AD, infrastructure, replication, Hyper-V and so on with no need whatsoever to open an interactive session with the servers in question.

Interactive desktop

Using Remote Desktop you get an interactive session to the server which can be configured to be as secure as any SSH solution or whatnot. In my opinion, using Remote Desktop to a Windows Server is out-of-the-ordinary. If you must do that, then there's something wrong (and yes, things sometimes wrong so nothing wrong with that, pun not intended) that you're fixing while doing it.

UI tools and interactive desktop could be crudely automated using AutoIT or something similar - if you really want to push it into the absurd ^^

2

The fallacy in this question lies in assuming that some form of remote command-line is required to manage or automate tasks on a Windows server (possibly as a result of coming from a Unix background?)

Even in the old days of 2000 Server and Server 2003 virtually every admin tool or scripting interface provided by Microsoft was capable of connecting to a remote machine as well as to the local machine. You going literally almost manage an entire network without ever once actually "being on" a server. This has always been building up and improving over the years - and aside from a brief disconnect where the XP client was available before the server admin tools that worked with it were - serves to demonstrate the real power and flexibility of a true native Windows setup.

1

I'll start be saying that Telnet should not be enabled. I can't understand why it's even installed, as it was designed for a closed environment where security was not an issue and has no reason to exist in today's world.

There are many ways to remotely manage a Windows server from the command line. There is WMI for starters. There are also tools such as the pstools suite, most notably psexec.

Perhaps the simplest way to get a secure command line on a remote server is to install and use one of the SSH servers. This will give you a command line exactly like opening a "DOS" prompt on the machine itself. You may however need to fiddle with the terminal emulation mode of the client (e.g. putty) to get it to look right, as they are generally intended to connect to a *nix host.

1

Windows has an entire suite of tools to remotely administer Windows machines. In addition to the remote administration tools in the admin toolpack, you can use something like psexec or even powershell to issue remote commands.

As for automation, I'd recommend powershell. All of my Windows-admin buddies swear by it.

0

Yes, you can enable telnet server. See:

http://www.windowsnetworking.com/articles_tutorials/configure-telnet-Server-Windows-Server-2008.html

Windows Server 2008 added support for the "Core" server installations -- which essentially give you little or no GUI for configuring the server, aside from very basic things like setting the IP and adding it to a domain. To allow those servers to be managed (and also the Full Server 2008 installations), Microsoft provides the Remote Server Administration Tools for Windows 7 which essentially gives you a GUI on your desktop to control most aspects of the server:

http://www.microsoft.com/downloads/details.aspx?FamilyID=7D2F6AD7-656B-4313-A005-4E344E43997D&displaylang=en

As a side note, I am aware of several reputable hosting providers (including Rackspace) that by default support remote administration via a wide-open RDP port. In my opinion, RDP is no less secure than a wide-open SSH port into a server -- in either case, the traffic is encrypted, but if you have the login/password (assuming you're not using certificates) you can pwn the server.

3
  • ... if you have a username/password to the system, any system, then you can reak havoc, regardless of which interface you use to get into the system Mar 14, 2010 at 3:53
  • My only purpose to including the side note is that I've bumped into several network admins who gasp at the thought of leaving an RDP port open, but don't think twice about it on the SSH side. Ideally, there would be a VPN between you and the remote network, and no ports that allow administration would be open. Off topic, I suppose.
    – AdamSwann
    Mar 14, 2010 at 4:00
  • 1
    What does "pwn the server" even mean? English please. Mar 14, 2010 at 10:31
0

powershell and sysinternals tools are your friends. mh01 makes a valid point that many of the MMC based tools allow for the attachment of remote machines so they can be administered from the local GUI. As an old-timer (literally) Im accustomed to the command line, and think that powershell is one of the best tools MSFT has ever built.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .