Windows Server

Microsoft's server operating system.

Operating System
Microsoft

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

App
Framework
Web Server
Runtime
Containers
OSWindows Server
Hypervisor
Firmware
Hardware
Data

It Runs

Windows ServerOperating System

Runs On

See It in the Stack

About

Windows Server is Microsoft's server operating system. It runs IIS, .NET applications, SQL Server and Active Directory, and everything above it on the same machine depends on it. It is a rival to Linux on the operating system layer.

How to Spot It

These are signs that a system runs Windows Server, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Default port: 3389 (Remote Desktop)
Default port: 445 (SMB file sharing)
Default port: 135 (RPC endpoint mapper)

If It Has a Flaw

A flaw in the operating system reaches every application and service on that machine.

A flaw exposes what runs on it.

Application: SharePoint Exchange Server MOVEit Transfer
Framework and Libraries: ASP.NET Laravel Express Spring Django Ruby on Rails Log4j
Web and App Servers: IIS Tomcat
Runtime: .NET PHP Node.js Java Python Ruby
Containers: Docker
Data: SQL Server MySQL PostgreSQL MongoDB

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Windows Server sits.

CVE-2020-1472 (opens in a new tab)2020
Zerologon
A Netlogon flaw let an attacker with no credentials reset a domain controller's password.
Reach It handed over the whole Active Directory domain.
CVE-2017-0144 (opens in a new tab)2017
EternalBlue
A flaw in SMBv1 allowed remote code execution on unpatched Windows machines.
Reach It reached the whole machine and spread across networks, as WannaCry showed.

Rivals

Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Windows Server.

Linux

Stacks and Code

Windows Server is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.

In Common Stacks: SharePoint, On Premises Exchange, On Premises
Its Code Comes From: Vendor Updates

Sources

Microsoft Learn: Windows Server (opens in a new tab)