63

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable."

Is that true? If so, how does removing the GUI have that effect?

  • 3
    So it working for Linux and Microsoft and any other system. – R1W Aug 26 '18 at 17:04
  • 11
    It is ironic that this advice comes from Microsoft, which has always provided server OSes with GUIs. – dr01 Aug 27 '18 at 9:43
  • 5
    @dr01 Their servers since 2012 have had Core mode - no GUI out of the box. Mixed results, obviously, but they've been at least moderately pushing to remove the GUI - or at least make it optional - for years. – WernerCD Aug 27 '18 at 17:16
  • 6
  • 2
    Note that removing the desktop is not the same as removing the graphical user interface. A window with gadgets and borders is still a GUI, even if that window is displaying a Windows console used by a command interpreter. – JdeBP Aug 28 '18 at 16:45
118

Removing the GUI is useful and recommended. It will remove unused components, a lot of libraries, and makes the install size smaller.

How does this make it less vulnerable?

Fewer components equal less attack surface. A vulnerability on a GUI component will not affect you. Attacks relying on GUI components won't work either.

So, when designing a server, remove every single component not needed by the application you are serving. It will be way more secure than using the default install.

  • 8
    This is also true for Linux systems. As per hardening guidelines, you should remove X Windows System packages, unless very much required. – Krishna Pandey Aug 26 '18 at 16:24
  • 36
    It is just Windows and Linux. This is true for any system. For instance, ask any network professional if they have the GUI enabled on their Cisco switches or routers. Less services running or less services exposed/available means a more secure system. – YLearn Aug 26 '18 at 16:33
  • 12
    @R1- You can manage a Windows server with PowerShell, remotely. A GUI installed on the server is not required or even desirable. – Michael Hampton Aug 26 '18 at 22:28
  • 10
    You don't even need PowerShell just to view logs. Windows Event Viewer (the GUI part) is network-capable. You can view server logs from a workstation; it just opens the local logs by default. – MSalters Aug 27 '18 at 8:35
  • 6
    @KrishnaPandey Absolutely. At ${EMPLOYER} our standard RHEL image has no X components whatsoever. I occasionally run into software installation packages that ASS|U|ME X is running, and have to ask the vendor for documentation on how to create and use a response file (which I prefer anyway, as it makes installation reliably repeatable, which really helps when you want to be able to spin up new servers (and shut down old) to handle fluctuating demand. – Monty Harder Aug 27 '18 at 17:37
42

Removing the GUI also has the side effect of making it a bit more "human safe" because put bluntly, it makes the OS more idiot proof.

There are countless stories of small businesses having users reading mail and browsing the internet on the company DC. The user opens a bad attachment and suddenly everything is on fire. Simply removing the GUI from server prevents this sort of thing from happening.

Another useful side to this is protecting servers from sysadmins. The general consensus is that you should not be running standard user programs on a server but instead in containers/somewhere else. I've stumbled upon a few servers in my time running CCleaner. While the use of the tool is arguable, it has absolutely no place running on a DC because it simply isn't designed for servers.

Most of these aren't mistakes that any experience sysadmin would make. Security of an enterprise, however, is based on the weakest link. If all of your other sites are extraordinarily well secured but one manager decides that Bob from finance needs a faster computer to work on spreadsheets but doesn't want to purchase one and decides to let him into the server closet, you're in trouble if he manages to sign in.

  • 1
    In case of Microsoft Windows or Linux, we are talking about removing GUI from the server and it is not Client Side – R1W Aug 27 '18 at 12:40
  • 8
    @R1- I am very much aware. Removing the GUI from Windows Server (ie core) prevents a lot of bad behavior as I explained in my answer. – Sirens Aug 27 '18 at 14:18
  • 5
    "Most of these aren't mistakes that any experienced sysadmin would make." Sadly, my personal experience is contrary to this assertion. Which is why I believe this answer is actually the better of the two: saving the server from bad system administration is more of a real-world day-to-day need than reducing its attack area just slightly. – Todd Wilcox Aug 28 '18 at 20:08
  • Given that over 80% of breaches happen because of human error, I also suggest that removing browsing and HTML email reduces vulnerabilities more than removing the GUI libraries from the threat surface (although that is also a factor). – schroeder Sep 10 '18 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.