Windows Server · Lesson 02
Learn what the server is actually responsible for before hardening it. Inventory roles, features, services, and dependencies so required functions are protected.
Server Manager is one of the best starting points because it connects the server's responsibilities with health, services, management tools, and role-specific configuration.
Lesson Snapshot
Learning objectives
Use Server Manager to identify installed roles, features, services, and basic server health.
Distinguish a server role from a Windows feature, service, management tool, and application.
Classify installed components as required, unnecessary, or investigate based on scenario evidence.
Recognize why removing a role is a higher-impact action than stopping a single service.
Use PowerShell to inventory installed roles and features without changing them.
Verify that required roles are healthy before and after hardening.
Core vocabulary
A major server responsibility such as Active Directory Domain Services, DNS Server, DHCP Server, or File and Storage Services.
A smaller component inside a role that provides a specific capability.
A Windows capability that supports the operating system, administration, applications, or server roles.
A background process that may support a role, feature, application, or Windows itself.
An administrative console or module used to configure a role or feature.
Software installed on the server that may depend on Windows roles, services, accounts, networking, or storage.
Main principle
Installed does not mean required, but unfamiliar does not mean unnecessary. Classification comes from scenario evidence and dependency review.
High-impact warning
Roles such as AD DS, DNS, DHCP, file services, and IIS can support many users or systems at once.
Tool map
Start → Server ManagerDashboard health, Local Server, All Servers, installed roles, alerts, and role-specific management links.
Server Manager → Manage → Add Roles and FeaturesUse the wizard to understand which roles and features are installed. Do not install or remove items just to explore.
Server Manager → Manage → Remove Roles and FeaturesUse only when the scenario and dependency review clearly justify removing a role or feature.
Win + R → services.mscService name, status, startup type, dependencies, and whether the service supports a required role.
Win + R → compmgmt.mscShared folders, Task Scheduler, Event Viewer, storage, devices, and local administration context.
Start → search PowerShell → Run as administrator when requiredFast read-only inventory using Get-WindowsFeature, Get-Service, Get-CimInstance, and role-specific cmdlets.
Server Manager orientation
Shows a high-level summary of server health, role groups, events, services, performance, and manageability.
Shows computer name, domain/workgroup status, firewall state, remote management, update status, NIC information, time zone, and related configuration.
Provides a broader view when Server Manager is managing multiple systems.
Installed roles may appear as dedicated navigation items with role-specific health and management information.
Inventory questions
What server roles are installed?
Which roles are explicitly required by the scenario?
Which role services are installed under each role?
Which features support those roles?
Which services are running because of those roles?
Which role-specific firewall rules are enabled?
Which administrators or service accounts are tied to the role?
Which clients depend on the role?
What would stop working if the role were removed?
How will the role be tested after a hardening change?
Common server roles
Provides directory services, domain authentication, users, groups, computers, and domain administration.
Dependencies
Often depends heavily on DNS, domain-controller services, time consistency, networking, and directory-related services.
Verify
Confirm domain authentication and directory operations still work.
Provides name resolution for clients and may be critical to Active Directory.
Dependencies
DNS Server service, zones, records, forwarding, firewall rules, and network connectivity.
Verify
Resolve required names from an authorized client.
Provides IP configuration to clients through scopes, options, exclusions, and reservations.
Dependencies
DHCP Server service, authorization when applicable, network reachability, scopes, and firewall rules.
Verify
Confirm a client can obtain or renew an address.
Provides SMB shares, file access, storage management, and related file-server capabilities.
Dependencies
SMB, Server service, share and NTFS permissions, storage availability, user/group identity, and firewall rules.
Verify
Confirm an authorized user can access required shares.
Hosts websites or web applications when required by the scenario.
Dependencies
IIS role services, application pools, certificates, networking, firewall rules, files, and application dependencies.
Verify
Confirm the required site or application responds as expected.
May support remote administration or routing depending on scenario and installed components.
Dependencies
Users, rights, services, firewall rules, network reachability, and authentication.
Verify
Test only the required remote-management path.
Classification model
The scenario explicitly requires the role, or another required function clearly depends on it.
Protect it, harden around it, and verify it after every related change.
The role or feature is clearly not required and evidence shows no required dependency.
Consider removal only after documenting the dependency review and verification plan.
The purpose is unclear, the scenario is silent, or dependencies are not yet understood.
Inspect services, applications, events, firewall rules, and client usage before deciding.
PowerShell inventory
Get-WindowsFeature | Where-Object {$_.Installed -eq $true} | Select-Object DisplayName, Name, InstallStateCreates a readable list of currently installed Windows Server roles and features.
Get-WindowsFeature | Select-Object DisplayName, Name, InstallStateShows installed and available components for comparison.
Get-Service | Where-Object {$_.Status -eq 'Running'} | Sort-Object DisplayNameShows currently running services that may support Windows or installed roles.
Get-CimInstance Win32_Service | Select-Object Name, DisplayName, State, StartMode, StartName, PathNameAdds service account and executable-path context.
Get-WinEvent -LogName System -MaxEvents 50 | Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, MessageProvides recent system evidence that may reveal service or role failures.
Dependency review
Which Windows services start, stop, or fail when this role changes?
Which clients, ports, firewall rules, or protocols are required?
Which users, groups, service accounts, or domain identities depend on the role?
Does an installed application need the role, feature, database, or service?
Does Group Policy, domain configuration, or local policy affect the role?
Does the role depend on a specific volume, folder, share, permission set, or database?
High-risk changes
Can fundamentally change or destroy domain-controller functionality and should never be treated as routine cleanup.
Can break domain name resolution and Active Directory functionality if clients depend on that DNS service.
Can stop clients from receiving IP configuration when no replacement DHCP service exists.
Can break required SMB shares, storage management, or application dependencies.
A stopped service may cause authentication, networking, application, or management failures immediately.
Required roles may become unreachable even while the role itself remains installed and healthy locally.
Role verification matrix
Server check
Review domain-controller services, directory-related events, and role health.
Client check
Confirm an authorized domain user can authenticate.
Server check
Confirm DNS Server service and zone health.
Client check
Resolve required internal or external names from a client.
Server check
Confirm DHCP Server service and scope state.
Client check
Renew a lease from an authorized client.
Server check
Confirm SMB share and Server service state.
Client check
Open the required share with an authorized user.
Server check
Confirm site, application pool, bindings, and relevant services.
Client check
Open the required website or application from a client.
Server check
Confirm service, user authorization, policy, and firewall state.
Client check
Connect through the scenario-required management path.
Decision cases
The server is also a domain controller.
Active Directory commonly depends on DNS, so scenario silence does not automatically make DNS unnecessary.
Response
Classify DNS as Protect/Investigate, confirm its relationship to AD DS and client name resolution, and do not remove it blindly.
The scenario says this server should only provide file services.
DHCP may be unnecessary, but confirm there are no clients using it and that another required DHCP source exists.
Response
Inspect active scopes, leases, authorization, and client dependency before considering removal.
No scenario requirement references web hosting.
The role may be leftover, application-dependent, or unnecessary.
Response
Inspect sites, application pools, listening ports, installed applications, and logs before classifying it.
The feature name is not recognized by the student.
Features often support roles and applications indirectly.
Response
Look up what role or application depends on it inside the authorized training environment before changing it.
Fictional defensive lab
Step 01
In the fictional environment, start at Server Manager and record the server name, domain status, installed roles, and role-specific navigation items.
Step 02
The scenario requires domain authentication, DNS, and the TeamDocs share. Mark AD DS, DNS, and file services as protected dependencies.
Step 03
Use Get-WindowsFeature to confirm installed components and compare them with Server Manager.
Step 04
A DHCP role and one additional feature are not mentioned in the scenario. Mark both Investigate instead of removing them.
Step 05
Check relevant services, firewall rules, users, logs, and client usage before deciding whether anything is unnecessary.
Step 06
Confirm domain authentication, DNS resolution, and TeamDocs access before moving to deeper hardening.
Common mistakes
Unfamiliarity is not evidence that a role is unnecessary.
Installed state does not explain whether a component is required, active, healthy, or depended on.
A role can rely on multiple services, and one service can support more than one system function.
A role may appear healthy in Server Manager while clients cannot use it.
You lose the original baseline and make troubleshooting harder.
Server roles often write useful operational events outside the basic System log.
Reflection
Question 1
What is the difference between a server role, feature, and service?
Question 2
Why is Server Manager a better starting point than randomly opening administrative tools?
Question 3
Why does a domain controller make DNS especially important to investigate carefully?
Question 4
What evidence should exist before a role is classified as unnecessary?
Question 5
Why should role verification include a client-side test?
Question 6
What makes removing a role higher risk than disabling an ordinary startup application?
Competition checklist
Open Server Manager and identify installed roles.
Identify whether the server is a domain controller.
Compare Server Manager with Get-WindowsFeature.
Record role services and supporting features.
Classify each major role as Required, Unnecessary, or Investigate.
Review related services before changing a role.
Review firewall rules and network exposure.
Identify users or service accounts tied to the role.
Check relevant Event Viewer logs.
Document what clients depend on the role.
Do not remove a role without a verification plan.
Test required roles from the client perspective.
Next Windows Server lesson
Next, review local accounts, Administrators, service identities, built-in accounts, and least privilege without breaking required server functions.