Previous versions of Windows
Server required a great deal of configuration after installation to
“harden” the security of the server and ensure that viruses and exploits
would not overwhelm or disable the server. The good news with Windows
Server 2008 R2 is that, by default,
many less commonly used services are turned off. In fact, a fresh
installation of Windows Server 2008 R2 only has those services enabled
that are vital for the OS to run properly, and everything else must be
enabled by running Server Manager. In addition, by default an
intelligent firewall is enabled, and only those services that absolutely
need to run are allowed through the firewall.
Subsequently, in Windows Server
2008 R2, it is important to first define which roles a server will
utilize and then to turn on only those services that are necessary, with
the use of Server Manager, which automates the deployment of server
roles.
Defining Server Roles
Depending on the size of an
organization, a server might be designated for one or multiple network
roles. In an ideal world, a separate server or servers would be
designated to handle a single role, such as DHCP server or DNS server.
Even smaller organizations can take advantage of virtualization
technology such as Windows Server 2008 R2’s Hyper-V server
virtualization platform to provision multiple dedicated guests on a
smaller number of physical hosts.
Because any service that
is activated increases the overall risk, it is important to fully define
which roles a server will take on so that those services can be
properly configured. Although these components can be set up manually,
the process of turning on these services is streamlined through the use
of the Configure Your Server Wizard.
Securing a Server Using
Server Manager
With the list of roles
that a server will perform in hand, the ideal utility for turning on
these roles and securing them is the newly renovated Server Manager. By
default, if a server is a DNS server but does not do file and print
services, Server Manager not only opens the ports required for DNS, but
also blocks any file and print access to the server.
Windows Server 2008 R2 Server Manager, shown in Figure 1, allows for individual roles to be enabled on a
server. After being enabled, those roles are turned on and the proper
ports to run those roles are opened on the server.
