The first time you RDP into a Server Core box and get a single command prompt on a black screen, the instinct is to panic and reinstall with the Desktop Experience. Don't. Core is the better default for anything that isn't a Remote Desktop host — smaller attack surface, fewer patches, less RAM sitting idle drawing a desktop nobody looks at. You just administer it differently: a little locally, mostly remotely. Here's the workflow I actually use.

TL;DR:

sconfig                      # menu for the basics: IP, hostname, domain, updates
# then do real work in PowerShell:
Rename-Computer -NewName FS01 -Restart
Install-WindowsFeature -Name Web-Server -IncludeManagementTools
Enable-PSRemoting -Force     # so you can drive it from your workstation

Details below. If this box is brand new, pair this with /windows-server-initial-setup-checklist/.

sconfig for the boring basics

Type sconfig at the prompt and you get a numbered menu that covers exactly the things that are annoying to do by hand on a fresh box: set the computer name, join a domain or workgroup, configure the network adapter, enable remote management, set the update policy, and reboot. On Server 2025 and 2022 it launches by default at logon.

Use it for the first five minutes of a box's life, then leave it. It's a bootstrap tool, not an administration tool — everything past initial config is faster in PowerShell.

Network and rename from PowerShell

sconfig's network menu is fiddly. I usually just do it directly:

# find the interface
Get-NetIPInterface -AddressFamily IPv4

# static IP + gateway on interface index 5
New-NetIPAddress -InterfaceIndex 5 -IPAddress 10.0.0.20 `
  -PrefixLength 24 -DefaultGateway 10.0.0.1
Set-DnsClientServerAddress -InterfaceIndex 5 -ServerAddresses 10.0.0.10

Rename-Computer -NewName FS01 -Restart

Turn on remote management — this is the point

The whole idea of Core is that you don't sit on it. Enable PowerShell remoting and, if you want the graphical MMC tools from your workstation, allow them through the firewall:

Enable-PSRemoting -Force

# allow the classic Remote Management MMC snap-ins (Event Viewer, Services, etc.)
Set-NetFirewallRule -DisplayGroup "Windows Remote Management" -Enabled True
Set-NetFirewallRule -DisplayGroup "Remote Event Log Management" -Enabled True

From your workstation you now have three ways in, in ascending order of how often I use them:

# 1. one-off command
Invoke-Command -ComputerName FS01 -ScriptBlock { Get-Service W3SVC }

# 2. an interactive session — feels like being on the box
Enter-PSSession -ComputerName FS01

# 3. point graphical tools (Server Manager, Event Viewer, Computer Management)
#    at FS01 from a Windows box with the RSAT tools installed

In a workgroup (no domain) you'll need to add the target to your TrustedHosts first: Set-Item WSMan:\localhost\Client\TrustedHosts -Value FS01. In a domain it just works.

Windows Admin Center: the browser dashboard

If you miss a GUI, don't put one back on the server — put it in your browser. Windows Admin Center is a free web console you install on a management box (or a gateway server) that manages every server from one page: roles, services, files, registry, PowerShell, performance, updates. It's genuinely the nicest way to run a fleet of Core boxes and it never touches the servers themselves beyond WinRM.

Install it once on your admin workstation, add your servers, and you've replaced ten MMC windows with one tab.

Adding roles and features

Everything the GUI's "Add Roles and Features" wizard does is one cmdlet. -IncludeManagementTools pulls in the admin bits you'd want on a management box:

Get-WindowsFeature | Where-Object Installed          # what's on
Install-WindowsFeature Web-Server -IncludeManagementTools
Install-WindowsFeature DHCP -IncludeManagementTools
Uninstall-WindowsFeature Web-Ftp-Server

Roles I've stood up this way on Core map straight to guides here: IIS in /iis-host-website-windows-server/, Hyper-V in /hyper-v-create-first-vm-windows-server/, and a domain controller in /active-directory-promote-first-domain-controller/ — all fine headless.

Gotchas

  • You cannot add the desktop later. Unlike 2012, you can't convert Core to Desktop Experience after install. Pick at install time. If you truly need the full shell, reinstall — so decide up front.
  • Some apps refuse to run on Core. Anything expecting Explorer, a full .NET desktop stack, or an interactive installer may fail. Server software is usually fine; third-party agents with GUI installers sometimes aren't. Check before you commit a role to a Core box.
  • Lost the command prompt window. Close the only cmd on the console and you're staring at a blank screen. Ctrl+Shift+Esc opens Task Manager → File → Run → cmd or powershell to get it back. Or just reconnect.
  • Default shell is cmd, not PowerShell. Type powershell (or set it as the default shell via registry) — you don't want to admin a 2020s server from cmd.exe.
  • Firewall blocks your remote tools by default. "Can't connect Event Viewer" is nearly always a disabled firewall rule group, not a real network problem. Enable the group as above.

Why bother

A Core box patches less often, reboots less, and gives an attacker less to work with — no browser, no shell add-ons, no desktop. Once remoting is on you rarely log in directly again; you drive it from PowerShell and Windows Admin Center like every other server. For the ground-floor hardening every Windows box should get, see /windows-server-disable-smbv1-llmnr-ntlmv1/ and lock down RDP with /rdp-hardening-windows-server-nla-firewall/. Automating the repetitive parts pairs well with /windows-task-scheduler-powershell-automation/.

Related posts