Managing Windows 2008 Server Core Local Settings

A Server Core installation provides a minimal environment for running specific server roles, which reduces the maintenance and management requirements and the attack surface for those server roles. A server running a Server Core installation supports the following server roles:

• Active Directory Domain Services (AD DS)
• Active Directory Lightweight Directory Services (AD LDS)
• DHCP Server
• DNS Server
• File Services
• Print Services
• Streaming Media Services
• Internet Information Services (IIS)
• Windows Virtualization

In Windows Server 2008, Server Core installation does not include the traditional full graphical user interface (GUI). Therefore, once you have configured the server, you can only manage it locally at a command prompt, or remotely using a Terminal Server connection. A third management option is to manage the server remotely using the Microsoft Management Console (MMC) or command-line tools that support remote use.

A Server Core installation provides these benefits in three ways:

• By reducing the software maintenance required (less updates, etc…)
• By reducing the management required
• By reducing the attack surface

To accomplish this, the Server Core installation option installs only the subset of the binary files that are required by the supported server roles. It takes about 1 GB of disk space and +/- 100 MB memory footprint (varies per server core role).

The following list is a compilation of some of the most useful commands allowing you to either locally or remotely manage a Server Core installation. You can use this as a quick reference guide, but as always, reading the full server help for a full guide.

Please make sure you also read the other articles listed in the “Related Articles” section below, for a more thorough list of Server Core tips and tricks.

To manage a server running a Server Core installation locally at a command prompt

1. Start a server running a Server Core installation.  
2. Log on using an administrator account.  
3. At the command prompt, use the appropriate command-line tool for the task you want to complete.  

To add hardware to Windows Server 2008

1. If the driver for the hardware is included in Windows Server 2008, Plug and Play will start automatically and install the driver.  
2. At a command prompt, open the folder where the driver files are located, and then run the following command:

   ​pnputil -i -a 

   Where: driverinf is the file name of the .inf file for the driver.  

3. If prompted, restart the computer.

To add a user to the local Administrators group

1. At a command prompt, type:

   ​net localgroup Administrators /add '

    

To remove a user from the local Administrators group

1. At a command prompt, type:

   ​net localgroup Administrators /delete 

    

To disable a device driver

1. At a command prompt, type:

   ​sc delete 

   Where: service_name is the name of the service that you obtain by running

To obtain a list of drivers that are installed on the server

1. At a command prompt, type:

   ​sc query type= driver

   Note: You must include the space after the equal sign for the command to complete successfully.

To manage event logs

1. To list event logs type:

   ​wevtutil el

    

2. To query events in a specified log type:

   ​wevtutil qe /f:text 

    

3. To export an event log type:

   ​wevtutil epl 

    

4. To clear an event log type:

   ​wevtutil cl 

To list the running services

1. At a command prompt, type one of the following:

   ​sc query

   or

   ​net start

1. At a command prompt, type one of the following:

   ​sc start 

   or

   ​net start 

    

To stop a service

1. At a command prompt, type one of the following:

   ​sc stop 

   or

   ​net stop 

To forcibly stop a process

1. Use the tasklist command to retrieve the process ID (PID).  
2. At a command prompt, type:

   ​taskkill /PID 

    

To configure the firewall

1. Use the netsh advfirewall command. For example, to enable remote management from any MMC snap-in, type the following:

   ​netsh advfirewall firewall set rule group="Remote Administration" new enable=yes

   Note: You can also use the Windows Firewall snap-in from a Windows Vista or Windows Server 2008 computer to remotely manage the firewall on a server running a Server Core installation. To do this, you must first enable remote management of the firewall by running the following command on the computer running a Server Core installation:

   ​netsh advfirewall set currentprofile settings remotemanagement enable

Configure the paging file

1. At a command prompt type:

   ​wmic pagefileset where name=”” set InitialSize=,MaximumSize=

   Where:

   • path/filename – is the path to and name of the paging file
   • initialsize – is the starting size of the paging file in bytes.
   • maxsize – is the maximum size of the page file in bytes.

To install an optional feature

1. At a command prompt, type:

   ​start /w ocsetup 

   Note: Using /w prevents the command prompt from returning until the installation completes. Without /w, there is no indication that the installation completed. Where featurename is the name of a feature from the following list:

   • Failover Clustering: FailoverCluster-Core
   • Network Load Balancing: NetworkLoadBalancingHeadlessServer
   • Subsystem for UNIX-based applications: SUACore
   • Multipath IO: MultipathIo
   • Removable Storage: Microsoft-Windows-RemovableStorageManagementCore
   • Bitlocker Drive Encryption: BitLocker

   Note: To install the remote administration tool for BitLocker, type the following at a command prompt:

   ​start /w ocsetup BitLocker-RemoteAdminTool

    

   • Backup: WindowsServerBackup
   • Simple Network Management Protocol (SNMP): SNMP-SC
   • Windows Internet Name Service (WINS): WINS-SC
   • Telnet client: TelnetClient

   Note: To remove an optional feature, use start /w ocsetup with the appropriate role name and the /uninstall switch.

To reboot the server

1. You can reboot the server by typing the following at a command prompt:

   ​shutdown /r /t 0

To change the name of the server

1. Determine the current name of the server with the hostname or ipconfig /all commands.  
2. At a command prompt, type:

   ​netdom renamecomputer  /NewName:

   Note: You can obtain the name of the server by running the hostname or ipconfig /all commands.  

3. Restart the computer.

To change the name of a domain-joined server

1. At a command prompt, type:

   ​netdom renamecomputer %computername% /NewName: /userd: /password:*

    

To set the administrative password

1. At a command prompt, type the following:

   ​net user administrator *

    

2. When prompted to enter the password, type the new password for the administrator user account and press ENTER.  
3. When prompted, retype the password and press ENTER.

Summary

In Windows Server 2008, Server Core installations are used to offer a slim, well-tuned and secure method of running specific roles. These servers need to be properly configured. This article, and the other articles in this series, will show you how to do that.