Security Watch

The Genesis of Multi-Role Windows NT Servers

The evolution of Windows NT threatens its survival.

• By Russ Cooper
• 03/30/2005

The answer requires a knowledge of Windows server history. In 1992, when Windows NT 3.1 was first released, there was no cost difference between servers and desktops. Licensing was simply per seat, and based solely on the fact that you were running a licensed Windows box, so it didn't matter whether you implemented a server or workstation. You could economically separate the various roles a server might have onto multiple machines, including desktops. (Netware users might remember the days when it was possible to have a Novell server also running a desktop console; Microsoft was simply following suit.) You could have a desktop serve as a file/print server, BDC or whatever server role you might want.

When Windows NT 3.5 was introduced, the cost of servers increased, and Microsoft also unveiled Client Access Licenses (CALs) in addition to the operating system license the client already had. Given Microsoft's huge marketing push about NT's multi-tasking capabilities, economics made it imperative that NT servers take on multiple roles. At the same time, hardware requirements increased, adding considerably to server cost.

Contributing to the push of getting servers off of non-server hardware was the Bob Denny debacle. Denny had developed the first Web server for NT. It didn't discriminate, working on both workstations and servers. Microsoft, however, hadn't planned on NT Workstation being used as a server. It had hard-coded performance metrics in Workstation to limit its functionality as a server; one example was limiting the number of simultaneous connections. Denny had implemented numerous workarounds so that his Web server, whether run on a workstation or server, worked equally well.

As a result of the Denny Web server, Microsoft decided to end server-on-desktop usage. With the release of NT 3.5 came license agreement changes which stated that workstations couldn't be used as servers, and new technology that broke many of Denny's workarounds. Windows NT 3.51 also increased the server license costs even more.

By the time of NT 4.0, the use of servers for as many roles as possible had become part of the NT culture. Cost concerns aside, people implementing NT servers simply thought of them as multi-role, as if that had been the plan all along.

At about the same time, the Internet started coming to prominence. Although earlier versions of NT had been used frequently on the Internet, few had been used in fully-exposed roles subject to hack attacks from the Internet.

But Internet-exposed NT 4.0 servers became commonplace and the security pitfalls of multi-role servers became obvious. Combining so many uses on a single server makes it extremely difficult to properly secure, and compromise of one component can lead to the compromise of other components. As networks full of multi-role NT servers were connected to the Internet, the importance of role separation grew.

Role separation has always been important. Connecting to the Internet doesn't make role separation any more important, but Windows networks had been seen as proprietary until that point, and the thinking was they were less susceptible to attack. After all, who was going to be sending non-routable NetBEUI packets across the Internet?

Today, role separation is far better understood in Windows environments. But cost considerations still dominate management, leading to the present-day situation in which far too many Windows servers are still multi-role.