Working with Server Core machine

Before I talk about the Server Core, I would, first of all, list the editions of Windows Server 2012 R2.

There are 4 editions in Windows Server 2012 R2.

• Data Center
• Standard
• Essentials
• Foundation

They can be installed with two states - either GUI or without GUI i.e. Server Core. Actually, there's also a third state here and it's kind of the middle ground between Server Core and Server with the GUI and that is the Minimal Server Interface.

Server Core is being installed mostly for Domain Controllers, DHCP, Hyper-V and DNS. Server Core only has Command Line and PowerShell. All of those user interface elements that you're used to in Server with GUI like the Microsoft Management Console, Server Manager, Explorer, all of those things are gone. The whole idea here is that it contains a much smaller footprint. It's actually four gigabytes smaller than server with a GUI. This is going to reduce the potential attack surface too. So, it's smaller and more secure.

The Minimal Server Interface is essentially Server with the GUI without Internet Explorer, Windows Explorer, the Desktop, and the Start screen. In Minimal Server Interface, you still have access to Server Manager, the Microsoft Management Console and then a little bit of the control panel. This installation option is actually about 300 megabytes less than Server with a GUI.

Sconfig command:
This is your command line version of Server Manager that you can use when you are working on Server Core machine. We can change domain and workgroup membership, change the computer name, configure remote management, configure our network settings and then, log off, restart and shutdown server using this command line utility.

Configure Server Core:
One of the first things, you'll do post installation of any operating system is to configure the server, things like getting it on the network by assigning it an IP address, joining a domain, configuring the firewall and remote management, and many more. We're going to look at all of those common configuration tasks, only from the perspective of Server Core.

Common Post-Installation Tasks on Server Core:
- Change Time Zone
- Set static IP
- Activate the server
- Rename the server
- Join a domain
- Configure the firewall
- Enable Remote Management
- Sconfig.cmd

Changing the time zone is a nice simple start. And we can do this on Server Core by launching the Control Panel app timedate.cpl.

In order to set a static IP using PowerShell, we first need to get the index or the name of the adapter. We can use a Get-NetIPInterface to do that. Then, we can do a New-NetIPAddress, passing in either the index or the alias, the name of the network adapter. Then, we can assign a static IP to that adapter.

Type in “Start PowerShell” to start PowerShell in its own window.
Get-NetIPInterface

New-NetIPAddress -InterfaceIndex 12 -IPAddress 192.168.1.110 -DefaultGateway 192.168.1.1 -PrefixLength 24

Now, we also need to configure DNS. Now, assume that our DNS server is our domain controller, and its ip address is, for example,  192.168.1.100. So we're going to use the PowerShell Cmdlet here Set-DnsClientServerAddress. So again, we need to pass in our interface. And I'm going to go ahead and pass in our index of 12. And then our DNS servers. The parament for this one is ServerAddresses. We could pass in a comma-delimited list, if we have multiple DNS servers. But I'm going to pass one in here and that's going to be our domain controller, 192.168.1.100.

Set-DnsClientServerAddress -InterfaceIndex 12 -ServerAddresses 192.168.1.100

Another common task to perform is to activate the server with a valid product key and for this, we would use the Server Licensing Manager dot VBS script, so slmgr.vbs. Generally, what you'll do here is you'll use the whack ipk initially to install the product key and then, to activate it, you'll run another slmgr.vbs, pass in the ato flag, and that will activate it with your key. 

Next important thing to do when you get your server spun up is to rename it. It comes with a randomly generated computer name, so you'll want to give it a name that makes sense, so you can easily identify it on the network. You can use PowerShell, the Rename-Computer commandlet, or you can also use the old command line utility netdom with the subcommand renamecomputer.

Next, join a computer with domain using a command line utility called "netdom join" or PowerShell Cmdlet called "Add-Computer".

Netdom join <computer name> /d:<domain name>

Add-Computer -DomainName <domain name> -Restart

Before we join a computer to a domain, if we want to see how many computers have already joined the domain, we can log into Domain Controller, launch PowerShell command prompt window and use “Get-ADComputer -filter *” commandlet.

The next step is to configure the firewall. There is a command line-- legacy command line utility that we should be familiar with here called netsh. Lets disable the firewall entirely across all the profiles, like you would do in the GUI through the Control Panel there. We do this using the PowerShell Cmdlet Set-NetFirewallProfile. You can also do a Get-NetFirewallProfile to see the current state of all those profiles.

Netsh command to turn firewall off for all profiles i.e. Domain, Public and Private:

Netsh advfirewall set allprofiles state off

PowerShell Command to achieve the same result:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

Get-NetFirewallProfile

Now, assume that we have firewall on our server, and we just want to setup some firewall rules to allow or block some traffic, we can use the PowerShell command similar to below:

New-NetFirewallRule -DisplayName “BLOCK ICMP IN” -Direction Inbound -Action Block -Protocol ICMPV4

You can also do a Get-NetFirewallRule, to see all of the firewall rules on the system. 

So, these are the common post-installation tasks that we complete on Server Core machine.

Thank you,

Nirav Soni

Links for Further Reading:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj592692(v=ws.11)

https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/hh846322(v=vs.85)?redirectedfrom=MSDN