Image: Jesus Vigo/TechRepublic
Several years ago, Microsoft promised to shore up the security of its Windows OS line, particularly doubling down on Windows Server. The focus on security has brought about many changes, and one of the most interesting is the Server Core installation and how enabling it limits the attack surface of a server greatly.
At the heart of the Server Core installation is the lack of GUI or GUI management tools. Since enabling it means the Windows Explorer shell is not loaded, a Windows Server with Server Core installed is manageable only via the Command Line, PowerShell locally. Additionally, it may be managed by connecting to the server remotely through the Microsoft Management Console (MMC) or Remote Server Administration Tools (RSAT).Let's review the commands to enable or disable Server Core using PowerShell.
Enable Server Core from Server GUI
1. Log on to your server with an account that has administrative rights on that server.
2. Run PowerShell as an Administrator and elevate User Account Control permissions, if prompted.
3. Uninstalling the two Windows features that are associated with Server GUI (Server-Gui-Shell and Server-Gui-Mgmt-Infra) will enable Server Core. The features may be uninstalled individually by replacing *gui* after the -Name switch below or uninstalled together by entering the following command and pressing Enter to process the command.
Get-WindowsFeature -Name *gui* | Remove-WindowsFeature -Restart
Figure A
Figure B
4. Once the uninstallation has completed, the server will need to reboot; the -Restart argument will carry out that operation automatically. After reboot, the server will display the logon screen as usual, except in Server Core after authenticating, only the command prompt will be displayed.
Enable Server GUI from Server Core
1. Log on to your server with an account that has administrative rights on that server.
2. Run PowerShell as an Administrator and elevate User Account Control permissions, if prompted. It may be necessary to call PowerShell using the runas command in order to specify administrative access elevation; this will depend on the configuration of your server. Enter the following command, and enter your admin password when prompted.
runas /user:administrator powershell.exe
3. Once PowerShell is loaded with administrative privilege, you will need to reinstall the Windows features associated with Server GUI. Enter the following command, and press Enter to process the command.
Get-WindowsFeature -Name *gui* | Install-WindowsFeature -Restart
Figure C
Figure D
4. Upon completing the installation, the server will be rebooted, and the logon screen will be displayed. After authenticating, the server OS will load like normal, with access to the Windows Explorer shell restored.
As a security measure, Server Core may be enabled or disabled as needed simply by entering the commands above and restarting the server. This reduces the attack surface of the OS by not loading the Windows Explorer shell, which will help to minimize security vulnerabilities.
Also see
Source: http://techrepublic.com.feedsportal.com/c/35463/f/670841/s/4e665965/sc/28/l/0L0Stechrepublic0N0Carticle0Chow0Eto0Eswitch0Ebetween0Egui0Eand0Ecore0Ein0Ewindows0Eserver0E20A120Eusing0Epowershell0C0Tftag0FRSS56d97e7/story01.htm