Executive Summary:
Windows Server 2008's Server Core edition is a stripped-down version of the OS—a kind of Windows lite that you control from the command line rather than from a GUI. Are the benefits of reduced resource utilization and improved security offset by a server that some might see as hard to set up and administer? A look at the installation process and some basic configuration commands will help you get Server Core running and connected to your network so that you can begin to answer that question for yourself. |
Windows Server 2008’s Server Core edition is a stripped-down version
of the OS—a kind of Windows lite that you control from the command
line rather than from a GUI. What are the benefits of such a
configuration? Server Core’s footprint is about 3MB, considerably less than
a full installation of Windows Server. Of course, 3MB is just to host the
OS and any server roles—it doesn’t include additional data, such
as Active Directory (AD) databases, that you might need for a
particular server role. Server Core installs only the necessary
components for any of its supported server roles. This reduces the
attack surface of the OS, improves its security, and makes it easier to
maintain and manage (albeit with a reduced armory of tools). New technologies
in Server 2008, notably BitLocker and the read-only domain controller (RODC) functionality, can be
used in combination with Server Core to provide even better security.
Are the benefits of reduced resource utilization and improved security offset by a server that some
might consider hard to set up and administer? A look at the installation process and some basic configuration
commands will help you get Server Core
running and connected to your network
so that you can begin to answer that question
for yourself.
Installation and Setup
Installing Server Core is essentially the
same as installing the full version of Server
2008; you simply need to select the Server
Core entry instead of the Server option
in the installation program (as Figure 1 shows). Not only is Server Core installation
extremely simple but, as you might expect, much faster than installing the
full edition of the server.
After installation has finished, you’re asked
to press the usual key sequence of Ctrl+Alt+Del
to open the logon dialog box. It might be a
little disconcerting to then be presented with
the option of logging on as Other User. Only
one user is enabled by default in Server
Core, and that’s the administrator. Initially,
no password is defined for the administrator
account; you must set it the first time you log
on. To do so:
- Click Other User.
- In the dialog box shown in Figure 2,
enter administrator as the username in the
upper box, and leave the lower (password)
box empty. Click the arrow to the right of the
boxes.
- Enter a password.
To log off, simply type logoff at the command
prompt.
Give Server Core an IP
Address and Host Name
You can assign a static IP address and DNS
server to a network adapter by using the netsh
command, the same way you would with the
full version of Server 2008. To assign an IP
address, use a command like
netsh interface ipv4 add address
“Local Area Connection”
192.168.1.100 255.255.255.0
192.168.1.11
where 192.168.1.100 is the IP address,
255.255.255.0 is the subnet mask, and
192.168.1.11 is the gateway address. Of course,
you should enter the full command without
line breaks on the command line.
To assign a DNS server, type
netsh interface ipv4 set dnsserver
“Local Area Connection”
static 192.168.1.101
where 192.168.1.101 is the DNS server’s IP
address.
Rename and Activate the
Server
If you want to rename the server, you first need
to determine the name that was automatically
assigned during the installation process. Type
hostname at the command prompt to return
the server’s name, then issue the following two
commands to change the name and reboot
the server:
netdom renamecomputer
%computername%
/newname:servercore1
shutdown /r
Once Server Core is connected to the Internet,
you can activate the server by running the
following command:
cscript c:\windows\system32
slmgr.vbs –ato
Enable Remote Desktop
Probably the two most crucial remote
tools that you’ll want to use with Server
Core for administration initially are
Remote Desktop and the Microsoft
Management Console (MMC) Windows
Firewall with Advanced Security
snap-in. First, I’ll show you how
to enable and use Remote Desktop,
then I’ll address accessing Server Core
remotely with MMC and the Windows
Firewall with Advanced Security
snap-in.
Although it’s possible to make a Telnet
connection to Server Core, Remote
Desktop is the preferred method
because it provides encryption, network level
authentication, and other conveniences such
as cut and paste. But don’t get too excited—
Remote Desktop won’t give you a full-fledged
Windows Desktop from which you can administer
the server. You’ll just see a command
prompt as you would from the console.
Because there’s no command-line tool
or MMC snap-in from which you can enable
Remote Desktop on Server Core, you’ll need to
run the scregedit.wsf script that’s provided as
part of Server Core. Scregedit contains various
functions that are the only means of performing
some tasks such as setting the size of the
page file, enabling Terminal Services, and
product activation. To run scregedit on Server
Core, use the command
cscript c:\windows\system32
scregedit.wsf /AR 0
If you want to access Server Core by using
Remote Desktop from a Windows OS other
than Vista, replace the /AR 0 switch with /CS
0. To see the full list of scregedit’s possibilities,
type the command
cscript c:\windows\system32\
scregedit.wsf /cli
Authenticate to Server
Core with MMC
During the initial configuration, or if Server
Core will be a standalone server, you might
need to authenticate to it from a remote
machine by using pass-through authentication.
Some, but not all, MMC snap-ins let you
specify a username and password when you’re
connecting to a remote computer.
The easiest way to get access remotely with
MMC is to create a local user on Server Core
that has the same username and password as
the remote account that you’re using to run
MMC. This way, authentication will happen
transparently. The new user also needs to be
an administrator on Server Core to gain unrestricted
access. You can create a user and add
the username to the administrators group by
entering the following commands:
net user /add <username>
<password>
net localgroup administrators
/add <username>
If you join Server Core to a domain, you
should delete this account and use a domainbased
user for authentication. Whether Server
Core is a member of a domain or a standalone
server, you should consider configuring
Windows Firewall with Advanced Security to
restrict which machines can connect remotely
to Server Core.
Configure Windows
Firewall
To enable the Windows Firewall with Advanced
Security snap-in on any machine used for
administration to access a given Server Core
box, log on to Server Core as an administrator
and type the command
netsh advfirewall set publicprofile
settings remotemanagement
enable
To access other remote administration tools,
such as the MMC Event Viewer snap-in, run
the following command on Server Core to permit
access through Windows Firewall:
netsh firewall set service
remoteadmin enable
After you’ve made these basic changes to
Windows Firewall on Server Core, you can use
the Windows Firewall with Advanced Security
snap-in from a remote computer for all further configuration
of Server
Core’s firewall.
You could additionally
modify
the firewall rules
to allow access to
Server Core from
specific administration
workstations
only, if
desired. To do
so, you change
the scope of the
predefined inbound rules for Windows Firewall
Remote Management, Remote Desktop,
and Remote Administration by setting a list
of remote IP addresses that are permitted to
access Server Core. Figure 3 shows setting the
scope of a Windows Firewall Remote Management
rule.
Firewall rules are associated with one of
three network profiles: Domain, Private, or
Public. (Server Core uses the Public network
profile out of the box.) To determine which
profile is currently active, click the Windows
Firewall with Advanced Security node directly
below Console Root in the MMC window.
You’ll see an overview of the firewall’s settings
in the central pane, including information
about the active profile. If you change the
scope for a rule that’s associated with a profile
that’s not currently active, the changes won’t
be effective.
For more information about
configuring Windows Firewall with
Advanced Security, see the Security
Pro VIP article “Windows Firewall
Shows New Maturity in Vista,” April
5, 2007 (InstantDoc ID 95099). The
configuration process is similar in
Server 2008 and Vista.
Access the File
System
The easiest way to get access to
Server Core’s file system is to use
Windows Explorer on an administration
workstation and map drives to
the root administrative shares that
are enabled by default on Server Core
(e.g., c$ and d$). You can connect to
these shares only with an account
that has administrator privileges on
Server Core, and you must enable remoteadmin by using netsh, as shown earlier.
The File Server role is installed by default to
provide access to these administrative shares,
but you can also install features such as File
Replication Service (FRS).
To map a network drive to an administrative
share on Server Core from a remote
machine, use a command similar to the following:
net use z: \\192.168.1.100\c$
Join Server Core to an AD
Domain
You can use the netdom command to join
Server Core to an existing AD domain, as follows:
netdom add
/domain:
/userd:
/passwordd:
Install Server Roles and
Optional Features
Server Core supports the server roles Active
Directory Domain Services, Active Directory
Lightweight Directory Services (AD
LDS), DHCP Server, DNS Server, File Services,
Print Server, Streaming Media Services,
and Web Server (IIS), among others. For a
full list of server roles and other supported
features, go to www.microsoft.com/windowsserver2008/servercore.mspx.
With the exception of the Active Directory
Domain Services role, you install server roles
and features by using the ocsetup command.
To list the server roles and features currently
installed, run the oclist command. The syntax for ocsetup is the same for both roles and features.
The ocsetup command-line tool is case sensitive,
but you can get the correct capitalization
for a server role or feature from the output of the
oclist command (which Figure 4 shows). The
following command installs Windows Backup:
start /w ocsetup
WindowsServerBackup
Using the /w switch with the start command
gives the user an indication of when ocsetup
has finished installing the new role or feature
by preventing further input at the command
prompt until installation is complete. It also
stops the user from running another command
while ocsetup in running.
To promote Server Core to a DC, you need
to generate an unattended .txt file on a full version
of Server 2008 and then run dcpromo as
shown below on Server Core:
dcpromo
/unattend:
Other Ways to Administer
Server Core
As if these weren’t enough ways to administer
Server Core remotely, you can make use of
Windows Remote Shell (WinRS) in Vista. The
WinRS client passes commands to a WinRS
listener on Server Core, which in turn passes
the commands to a prompt, captures the
output, and passes it back to the WinRS client. To configure WinRS on Server Core, run the
following command:
winrm quickconfig
This command will prompt you to perform a
couple WinRS configuration steps.
Below is an example of a command being
run against Server Core remotely by using
WinRS. You should note that this command
line is for a machine that’s a DC or domain
member:
winrs -r:http://<servername>
ipconfig
The one big disadvantage of WinRS is that it
can’t run commands interactively.
You can also use administration tools such
as the Windows Management Instrumentation
command line (WMIC) and PowerShell
by means of WMI calls to manage Server Core.
Unfortunately, Server Core doesn’t support
PowerShell directly at the time of writing (as
of Server Core RC0) because PowerShell relies
on the .NET Framework. Hopefully, both will
be supported in a future release.
Activate Automatic
Updating
You can activate automatic updating on Server
Core by using scregedit to modify the registry
and then restarting the Windows Update service,
as follows:
cscript c:\windows\system32\
scregedit.wsf /au 4
net stop wuauserv
net start wuauserv
As of Server Core RC0, scregedit with the /au 4
switch sets the time for checking updates to the
default of 3 a.m. In Server 2008, /au 4 also reboots
the server automatically if the updates require it.
You can disable automatic updating by using the
/au 1 switch and then restarting the Windows
Update service. To check the value set for /au,
use the /au and /v switches in sequence.
To force an immediate check for updates, you can use the wuauclt command as follows:
wuauclt /detectnow
Run Antivirus and Other
Applications
Windows Installer is supported on Server Core,
so you can use the msiexec command to install
antivirus and other third-party applications if
required. (And who wants to run a server without
proper antivirus and backup software these
days?) Before you deploy any such solution,
though, you should check that it’s officially
supported on Server Core by contacting the
vendor.
You can run at least two Windows-based
applications from the console: notepad and
regedit. These are useful tools, but I found it
a little odd to be able to run regedit but not
dcpromo, with its simple GUI.
Potential Not Yet Fully
Realized
One of the biggest potential uses for Server
Core—as a Web server—is unlikely to be
realized with the current incarnation of the
product due to its lack of support for the .NET
Framework. Other uses, although limited,
could be practical in situations that don’t
require frequent changes to server configuration,
such as an RODC. Given the trend
towards virtualization, Server Core and the
hypervisor feature in Server 2008 (a software
virtualization layer that sits between the hardware
and the OS) together could prove to be
one of the “must have” features of the next
generation Windows Server.
The lack of a GUI in Server Core needn’t be
a disadvantage. Once the basic configuration
has been completed, most other settings can
be either pushed out automatically by using
Group Policy if the server is part of a domain or
by using MMC snap-ins on a remote machine.
PowerShell is noticeable by its absence, considering
it’s Microsoft’s latest solution for managing
Windows from the command line. It’s slated for
inclusion in future versions of the product.
Despite some of the shortcomings of
Server Core, the ability to run Windows
with a significantly reduced footprint has the
potential to give substantial improvements
in security, capacity for virtualization, and
performance.
Register
