In a Windows environment where security is more important than flexibility, is Windows 2008 R2 Core Server installation the best option? How much more difficult is it to setup an environment with Server Core?

  • This is a tricky question.... define 'best'. Put the 'best', most expensive tools in the hand of an amateur and you will still be insecure. – Dave Drager Feb 11 '11 at 14:57

Server core isn't really (fundamentally) about security, it is more about trying to use Windows with the lowest footprint/bare essentials.

Based on the fact it has hardly anything running by default, out of the box, it probably is more secure - but - any software you install on top of it will not magically become secure because it is installed on Server Core.

For example, if you were to have a dynamic website with a SQL injection bug, it can be exploited on IIS on Server Core just as easily as if it was on the full Server 2008.

Windows Server Core is more complicated to set up for an absolute amateur, but you can use many powerful command line tools.

In addition, if this is on a domain environment, you can use a full range of MMC based tools and target the computer remotely.

There is also a tool called "Core Configurator" which I would highly recommend.

| improve this answer | |
  • Yes, appreciate it's no silver bullet, but it would reduce the attack surface area which is always helpful. Thanks for the pointer to the config tool too. – bert48 Feb 11 '11 at 15:11
  • 1
    I think it is, fundamentally, at least according to Microsoft. The Server Core blog indicated back in 2006 a Reduced attack surface is one of the main benefits. Even the Server Core 208R2 pages proper tout increased security. – jscott Feb 11 '11 at 15:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.