Windows Server 2008 Server Core installation is a minimal install of the upcoming Windows Server OS that can run specific roles (like DNS, Active Directory or File Server) with a much smaller footprint and attack surface.

In a previous blog post I looked into overall image sizes for both and also discussed some of the details about the differences between these Full and the Core installs. Now I am taking it one step further to look into the executable files in both installs. I will be presenting about this next Thursday and wanted to have a better feel for what’s really the difference between the two. My findings are presented below, first with some overall counts and then looking at files by group (only in Core, in both, only in full).

I looked only at executable for the grouped file names. My goal here is not to have a very precise list, but to get a feeling for how the two installs compare. Also note that Windows Server 2008 is in pre-release format today (there is a public Beta 3 and an MSDN-and-TechNet-subscribers-only release called June CTP or IDS3). Keep in mind that this data will most likely change before final release. My counts are based on an Enterprise edition, June CTP install. I did not load any roles after my install. I also did not include the pagefile.sys or any of the driver/installation files from C:\Windows\System32\DriverStore, C:\Windows\SysMsiCache\ and C:\Windows\winsxs\.

WARNING! After reading the list below you might be tempted to start running applications just because you don’t know or don’t remember what they do. Please don’t do that. If you want to find out what an application or command does, search the Internet. If you start running these commands one by one you will end up with a hosed system. Proceed at your own risk…

Now, for the findings…

File sizes and counts

First, here’s a table with the number of files per extension on both types of install. The list is sorted by number of files per extension:

  Core Full
dll 904 1,960
mui 876 1,921
exe 274 462
inf 163 485
pnf 141 447
cat 111 410
sys 212 261
fon 189 192
mof 115 168
mum 53 202
other 836 2,707
total 3,874 9,215

Now here here’s a table with total size of files per extension on both types of install. It is sorted by total size of files per extension:

  Core Full
dll 194,222,621 1,046,602,066
ttf 66,931,536 180,406,932
ttc 71,748,756 141,006,768
imd 95,800,180 98,644,356
exe 39,484,233 77,126,097
mui 28,401,664 45,699,584
h1s 0 60,454,606
dat 26,840,852 32,105,023
dic 15,080,248 37,281,416
sys 22,717,860 26,069,852
other 195,456,877 430,138,287
total 756,684,827 2,175,534,987

As you can clearly see, core has less than half the number of executable files and saves you a lot of disk space as well. Now look at the executables files by group...


COM files, all are in both, all are under c:\windows\system32\

This is an odd group. Stored in the old .COM executable format (before we had .COM web sites), these are probably here for compatibility only. Can you believe that edit.com (that old character-mode text editor) is still shipping with Windows Server 2008? At least edlin.com is not there anymore…

chcp.com, command.com, diskcomp.com, diskcopy.com, edit.com, format.com, graftabl.com, graphics.com, kb16.com, loadfix.com, mode.com, more.com, tree.com, win.com


EXE files only in Core

This is one was a suprise to me. There’s actually one EXE file that exists on a Core install and not on a Full install. It’s the tool that lists the roles available for installation on Server Core. The equivalent tool in the Full install is the –query option in the ServerManagerCmd tool.

c:\windows\system32\oclist.exe


EXE files in both, under c:\windows\system32\

This group has most of the tools we use on a daily basis to manage our servers. Most are command-line, but some are GUI-based, like taskmgr.exe and msinfo32.exe. Some tools are in subfolders (those are listed in the end) like sysprep, oobe (the out-of-the-box-experience tools that run on a fresh install), ime (the input method editor that supports double-byte characters) and wbem (windows management tools).

append.exe, arp.exe, at.exe, attrib.exe, auditpol.exe, autochk.exe, autoconv.exe, autofmt.exe, bcdedit.exe, bootcfg.exe, cacls.exe, cbsra.exe, ceipdata.exe, ceiprole.exe, certenrollctrl.exe, certreq.exe, certutil.exe, change.exe, chglogon.exe, chgport.exe, chgusr.exe, chkdsk.exe, chkntfs.exe, choice.exe, cliconfg.exe, clip.exe, cmd.exe, cmdkey.exe, comp.exe, compact.exe, conime.exe, control.exe, convert.exe, cscript.exe, csrss.exe, csrstub.exe, ctfmon.exe, dcgpofix.exe, dcpromowmic.exe, debug.exe, defrag.exe, dfrgfat.exe, dfrgifc.exe, dfrgntfs.exe, diskpart.exe, diskperf.exe, diskraid.exe, diskshadow.exe, dllhost.exe, dllhst3g.exe, dnscacheugc.exe, doskey.exe, dosx.exe, dpapimig.exe, driverquery.exe, drvinst.exe, drwatson.exe, edlin.exe, esentutl.exe, eventcreate.exe, exe2bin.exe, expand.exe, fastopen.exe, fc.exe, find.exe, findstr.exe, finger.exe, fltmc.exe, forfiles.exe, fsutil.exe, ftp.exe, gdi.exe, gpresult.exe, gpscript.exe, gpupdate.exe, help.exe, hostname.exe, icacls.exe, ipconfig.exe, iscsicli.exe, klist.exe, krnl386.exe, ksetup.exe, ktmutil.exe, ktpass.exe, label.exe, lnkstub.exe, lodctr.exe, logman.exe, logoff.exe, logonui.exe, lpksetup.exe, lpremove.exe, lsass.exe, lsm.exe, makecab.exe, mcbuilder.exe, mem.exe, mountvol.exe, mpnotify.exe, mrinfo.exe, mscdexnt.exe, msdt.exe, msdtc.exe, msg.exe, msiexec.exe, msinfo32.exe, muiunattend.exe, napstat.exe, nbtstat.exe, net.exe, net1.exe, netbtugc.exe, netcfg.exe, netdom.exe, netiougc.exe, netsh.exe, netstat.exe, newdev.exe, nlsfunc.exe, nltest.exe, notepad.exe, nslookup.exe, ntkrnlpa.exe, ntoskrnl.exe, ntprint.exe, ntvdm.exe, ocsetup.exe, odbcad32.exe, odbcconf.exe, openfiles.exe, pathping.exe, ping.exe, pkgmgr.exe, plasrv.exe, pnpunattend.exe, pnputil.exe, poqexec.exe, powercfg.exe, print.exe, qappsrv.exe, qprocess.exe, query.exe, quser.exe, qwinsta.exe, rdpclip.exe, rdpinit.exe, rdpshell.exe, rdpsign.exe, recover.exe, redir.exe, reg.exe, regedt32.exe, regsvr32.exe, relog.exe, replace.exe, reset.exe, rmclient.exe, robocopy.exe, route.exe, rsopprov.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, sacsess.exe, sc.exe, schtasks.exe, sdbinst.exe, secedit.exe, secinit.exe, serverceipoptin.exe, serverweroptin.exe, services.exe, setspn.exe, setupcl.exe, setupugc.exe, setver.exe, setx.exe, sfc.exe, shadow.exe, share.exe, shutdown.exe, sigverif.exe, slsvc.exe, smss.exe, snmptrap.exe, sort.exe, subst.exe, svchost.exe, sxstrace.exe, sysedit.exe, syskey.exe, systeminfo.exe, takeown.exe, taskeng.exe, taskkill.exe, tasklist.exe, taskmgr.exe, tcpsvcs.exe, timeout.exe, tracerpt.exe, tracert.exe, tscon.exe, tsdiscon.exe, tskill.exe, tstheme.exe, typeperf.exe, ucsvc.exe, unattendedjoin.exe, unlodctr.exe, user.exe, userinit.exe, vds.exe, vdsldr.exe, verifier.exe, vssadmin.exe, vssvc.exe, w32tm.exe, waitfor.exe, wecutil.exe, werfault.exe, werfaultsecure.exe, wermgr.exe, wevtutil.exe, where.exe, whoami.exe, wininit.exe, winload.exe, winlogon.exe, winresume.exe, winrs.exe, winrshost.exe, winspool.exe, wlrmdr.exe, wowdeb.exe, wowexec.exe, wscript.exe, wsmanhttpconfig.exe, wsqmcons.exe, wuauclt.exe, wusa.exe, xcopy.exe, boot\winload.exe, boot\winresume.exe, com\comrepl.exe, ime\imejp10\imjpdsvr.exe, ime\imejp10\imjpmgr.exe, ime\imesc5\imscprop.exe, ime\imetc10\imtcprop.exe, ime\shared\imepadsv.exe, oobe\audit.exe, oobe\msoobe.exe, oobe\oobeldr.exe, oobe\setup.exe, oobe\windeploy.exe, sysprep\sysprep.exe, wbem\mofcomp.exe, wbem\scrcons.exe, wbem\unsecapp.exe, wbem\winmgmt.exe, wbem\wmiadap.exe, wbem\wmiapsrv.exe, wbem\wmic.exe, wbem\wmiprvse.exe


In both, all other EXE files

There are also a few other files that are not under c:\windows\system32\. There’s no EXE files under c:\program files in Core, but there is one on the boot folder and a few under the root of c:\windows. One important tool on this group is regedit.exe.

c:\boot\memtest.exe
c:\windows\bfsvc.exe
c:\windows\boot\pcat\memtest.exe
c:\windows\fveupdate.exe
c:\windows\regedit.exe
c:\windows\servicing\gc32\tzupd.exe
c:\windows\servicing\trustedinstaller.exe
c:\windows\winhelp.exe


EXE files only in Full, under c:\windows\system32\

Now we start with the files that exist only in the Full install, starting with the ones living right at c:\windows\system32. Some are very familiar like mspaint.exe, write.exe, perfmon.exe, mmc.exe or good old calc.exe (which has been there since the very beginning of Windows). Others I beleive I never really used, like the tcmsetup.exe . Oddly enough, some are actually command-line tools like cipher.exe (the tool to encrypt files in NTFS). Note that some of the ime and wbem tools appear only here in the Full install, while some of their support files appeared in both.

acw.exe, adaptertroubleshooter.exe, alg.exe, atbroker.exe, audiodg.exe, bitsadmin.exe, bridgeunattend.exe, bthudtask.exe, calc.exe, cipher.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, cofire.exe, colorcpl.exe, compmgmtlauncher.exe, computerdefaults.exe, consent.exe, cprepsrv.exe, credwiz.exe, dcomcnfg.exe, deviceeject.exe, deviceproperties.exe, dfrgui.exe, dialer.exe, diantz.exe, dispdiag.exe, dpiscaling.exe, dplaysvr.exe, dpnsvr.exe, dvdplay.exe, dvdupgrd.exe, dwm.exe, dwwin.exe, dxdiag.exe, efsui.exe, escunattend.exe, eudcedit.exe, eventvwr.exe, extrac32.exe, firewallcontrolpanel.exe, firewallsettings.exe, fixmapi.exe, fontview.exe, getmac.exe, grpconv.exe, hdwwiz.exe, iashost.exe, icsunattend.exe, ie4uinit.exe, ieunatt.exe, iexpress.exe, infdefaultinstall.exe, irftp.exe, iscsicpl.exe, locator.exe, magnify.exe, mdres.exe, mdsched.exe, mmc.exe, mrt.exe, msconfig.exe, msfeedssync.exe, mshta.exe, mspaint.exe, mstsc.exe, mtstocom.exe, narrator.exe, netplwiz.exe, nfsconfigguide.exe, oobe.exe, osk.exe, pcaelv.exe, pcalua.exe, pcaui.exe, perfmon.exe, prevhost.exe, printfilterpipelinesvc.exe, printui.exe, proquota.exe, provisionshare.exe, provisionstorage.exe, racagent.exe, rasautou.exe, rasdial.exe, rasphone.exe, regini.exe, rekeywiz.exe, relpost.exe, rmactivate.exe, rmactivate_isv.exe, rmactivate_ssp.exe, rmactivate_ssp_isv.exe, rpcping.exe, runlegacycplelevated.exe, scshost.exe, scss.exe, scw.exe, scwcmd.exe, scwviewer.exe, servermanagercmd.exe, servermanagerlauncher.exe, sethc.exe, setupnfsidmap.exe, shrpubw.exe, shvcnfg.exe, sllua.exe, slui.exe, sndvol.exe, spoolsv.exe, systempropertiesadvanced.exe, systempropertiescomputername.exe, systempropertiesdataexecutionprevention.exe, systempropertieshardware.exe, systempropertiesperformance.exe, systempropertiesprotection.exe, systempropertiesremote.exe, systray.exe, tapiunattend.exe, tcmsetup.exe, tpminit.exe, tscupgrd.exe, tsecimp.exe, tssetup.exe, ui0detect.exe, upnpcont.exe, utilman.exe, verclsid.exe, vssuirun.exe, wercon.exe, wextract.exe, winfxdocobj.exe, winver.exe, write.exe, wuapp.exe, wudfhost.exe, com\migregdb.exe, ime\imejp10\imjpdadm.exe, ime\imejp10\imjpdct.exe, ime\imejp10\imjppdmg.exe, ime\imejp10\imjpuex.exe, ime\imejp10\imjpuexc.exe, ime\shared\imccphr.exe, wbem\wbemtest.exe


EXE files only in Full, .NET Framework tools mostly under c:\windows\microsoft.net\framework\v2.0.50727\

The .NET Framework is included only in the Full install and that’s been widely publicized. Most of the tools are under the c:\windows\microsoft.net but there are some EXE files for assemblies and installation files. 

applaunch.exe, aspnet_compiler.exe, aspnet_regbrowsers.exe, aspnet_regiis.exe, aspnet_regsql.exe, aspnet_state.exe, aspnet_wp.exe, caspol.exe, csc.exe, cvtres.exe, dfsvc.exe, dw20.exe, ieexec.exe, ilasm.exe, installutil.exe, jsc.exe, msbuild.exe, mscorsvw.exe, ngen.exe, regasm.exe, regsvcs.exe, vbc.exe

c:\windows\assembly\gac_msil\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
c:\windows\assembly\gac_msil\narrator\6.0.0.0__31bf3856ad364e35\narrator.exe
c:\windows\assembly\gac_msil\nfsconfigguide\1.0.0.0__31bf3856ad364e35\nfsconfigguide.exe
c:\windows\assembly\gac_msil\setupnfsidmap\1.0.0.0__31bf3856ad364e35\setupnfsidmap.exe
c:\windows\assembly\nativeimages_v2.0.50727_32\dfsvc\119ad414ba010730b5c177024233ed9d\dfsvc.ni.exe
c:\windows\assembly\nativeimages_v2.0.50727_32\narrator\48b6c857c4d42818737a51a69de7de01\narrator.ni.exe
c:\windows\assembly\nativeimages_v2.0.50727_32\nfsconfigguide\5b1ea604ddbd5f631ec688532d881eda\nfsconfigguide.ni.exe
c:\windows\assembly\nativeimages_v2.0.50727_32\setupnfsidmap\f0283b408646b8c58be5f0dcf84cc56f\setupnfsidmap.ni.exe
c:\windows\microsoft.net\framework\netfxsbs10.exe


EXE files only in Full, all other folders

This last group is actually an interesting one. It includes all EXE files that are directly under the c:\windows folder or somewhere under c:\program files. Included here are the previously-hard-to-remove-from-the-OS files iexplore.exe and explorer.exe. There’s also the unusual fact that msinfo32.exe appears twice in a Full install (under c:\windows\system32 and under c:\program files as listed below), but only once in Core. Wordpad.exe and the Windows address book (wab.exe) are here, but winmail.exe (which replaces Outlook Express) is an optional component, part of the “Desktop Experience” role (which could be useful in a terminal server environment).

c:\program files\common files\microsoft shared\ink\pipanel.exe
c:\program files\common files\microsoft shared\msinfo\msinfo32.exe
c:\program files\internet explorer\iedw.exe
c:\program files\internet explorer\ieinstal.exe
c:\program files\internet explorer\ieuser.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\windows mail\wab.exe
c:\program files\windows mail\wabmig.exe
c:\program files\windows nt\accessories\wordpad.exe
c:\windows\explorer.exe
c:\windows\helppane.exe
c:\windows\hh.exe
c:\windows\winhlp32.exe
c:\windows\msagent\agentsvr.exe
c:\windows\speech\common\sapisvr.exe