1

In regards to Windows Server 2012 how much less risk is there for a system to become compromised if the admin is done trough the command line and not Server Core / MSI or the full GUI?

So in essence how many exploits of WS 2012 has something to do with the GUI?

1
  • 1
    Well, if you look at something like Metasploit, virtually all the exploits use command line functions, rather than GUI ones...
    – Matthew
    Jan 30, 2017 at 9:22

1 Answer 1

3

The purpose behind the "Server Core" was to bring it in line with Linux/Unix.

Linux servers do not have a GUI, unless one is installed. Because this has been the default, one isn't expected, and administrators have worked that way for decades.

Windows Server has had a GUI, since it's birth. This has been an attractive feature for those who have previously administrated/worked on Windows Systems. You click buttons, and things happen. There isn't a whole lot of thinking involved. Even when installing "server roles", you get a tutorial along with it.

Some have said (including Microsoft) that "server core" is more secure. This seems to be exaggerated. Sure an attacker has less opportunities because of the lack of GUI (double extension files and the likes), and the processes required to run it, but on the remote side of things, nothing has really changed. The command line is the same as in previous versions, and critical processes still run.

The things removed include:

  • The Windows Explorer desktop shell (Explorer.exe) and any supporting features such as Themes
  • All MMC consoles
  • All Control Panel utilities, with the exception of Regional And Language Options (Intl.cpl) and Date And Time (Timedate.cpl)
  • All Hypertext Markup Language (HTML) rendering engines, including Internet Explorer and HTML Help
  • Windows Mail
  • Windows Media Player
  • Most accessories such as Paint, Calculator, and Wordpad

Funny enough, you are still running GUI programs, it's just a case of invoking them from the command prompt, rather then the start menu or other such cases. Notepad is stripped down but still retains it's functionality, and you can still remotely connect to the machine and get all the MMC console functionality back.

To claim "70% of the vulnerabilities in the last 5 years" being resolved either shows how sloppy the GUI was done, or how many unneeded features are included in Windows Server and inadvertently allows generic Windows malware to infect the server OS branch.

The major benefit of Server Core is that because of the limited GUI, it has a lighter memory footprint as well as on other resources. Do not expect a huge increase in security as many would like to claim.

https://channel9.msdn.com/blogs/duncanma/iain-mcdonald-and-andrew-mason-show-off-the-new-windows-server-os

https://www.petri.com/understanding-windows-server-2008-server-core

https://msdn.microsoft.com/en-us/library/dd184075.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .