Comparing executable files in Windows Server 2008 in Full and Core installs

Windows Server 2008 Server Core installation is a minimal install of the upcoming Windows Server OS that can run specific roles (like DNS, Active Directory or File Server) with a much smaller footprint and attack surface.

In a previous blog post I looked into overall image sizes for both and also discussed some of the details about the differences between these Full and the Core installs. Now I am taking it one step further to look into the executable files in both installs. I will be presenting about this next Thursday and wanted to have a better feel for what’s really the difference between the two. My findings are presented below, first with some overall counts and then looking at files by group (only in Core, in both, only in full).

I looked only at executable for the grouped file names. My goal here is not to have a very precise list, but to get a feeling for how the two installs compare. Also note that Windows Server 2008 is in pre-release format today (there is a public Beta 3 and an MSDN-and-TechNet-subscribers-only release called June CTP or IDS3). Keep in mind that this data will most likely change before final release. My counts are based on an Enterprise edition, June CTP install. I did not load any roles after my install. I also did not include the pagefile.sys or any of the driver/installation files from C:WindowsSystem32DriverStore, C:WindowsSysMsiCache and C:Windowswinsxs.

WARNING! After reading the list below you might be tempted to start running applications just because you don’t know or don’t remember what they do. Please don’t do that. If you want to find out what an application or command does, search the Internet. If you start running these commands one by one you will end up with a hosed system. Proceed at your own risk…

Now, for the findings…

File sizes and counts

First, here’s a table with the number of files per extension on both types of install. The list is sorted by number of files per extension:

Now here here’s a table with total size of files per extension on both types of install. It is sorted by total size of files per extension:

As you can clearly see, core has less than half the number of executable files and saves you a lot of disk space as well. Now look at the executables files by group...

COM files, all are in both, all are under c:windowssystem32

This is an odd group. Stored in the old .COM executable format (before we had .COM web sites), these are probably here for compatibility only. Can you believe that edit.com (that old character-mode text editor) is still shipping with Windows Server 2008? At least edlin.com is not there anymore…

chcp.com, command.com, diskcomp.com, diskcopy.com, edit.com, format.com, graftabl.com, graphics.com, kb16.com, loadfix.com, mode.com, more.com, tree.com, win.com

EXE files only in Core

This is one was a suprise to me. There’s actually one EXE file that exists on a Core install and not on a Full install. It’s the tool that lists the roles available for installation on Server Core. The equivalent tool in the Full install is the –query option in the ServerManagerCmd tool.

c:windowssystem32oclist.exe

EXE files in both, under c:windowssystem32

This group has most of the tools we use on a daily basis to manage our servers. Most are command-line, but some are GUI-based, like taskmgr.exe and msinfo32.exe. Some tools are in subfolders (those are listed in the end) like sysprep, oobe (the out-of-the-box-experience tools that run on a fresh install), ime (the input method editor that supports double-byte characters) and wbem (windows management tools).

append.exe, arp.exe, at.exe, attrib.exe, auditpol.exe, autochk.exe, autoconv.exe, autofmt.exe, bcdedit.exe, bootcfg.exe, cacls.exe, cbsra.exe, ceipdata.exe, ceiprole.exe, certenrollctrl.exe, certreq.exe, certutil.exe, change.exe, chglogon.exe, chgport.exe, chgusr.exe, chkdsk.exe, chkntfs.exe, choice.exe, cliconfg.exe, clip.exe, cmd.exe, cmdkey.exe, comp.exe, compact.exe, conime.exe, control.exe, convert.exe, cscript.exe, csrss.exe, csrstub.exe, ctfmon.exe, dcgpofix.exe, dcpromowmic.exe, debug.exe, defrag.exe, dfrgfat.exe, dfrgifc.exe, dfrgntfs.exe, diskpart.exe, diskperf.exe, diskraid.exe, diskshadow.exe, dllhost.exe, dllhst3g.exe, dnscacheugc.exe, doskey.exe, dosx.exe, dpapimig.exe, driverquery.exe, drvinst.exe, drwatson.exe, edlin.exe, esentutl.exe, eventcreate.exe, exe2bin.exe, expand.exe, fastopen.exe, fc.exe, find.exe, findstr.exe, finger.exe, fltmc.exe, forfiles.exe, fsutil.exe, ftp.exe, gdi.exe, gpresult.exe, gpscript.exe, gpupdate.exe, help.exe, hostname.exe, icacls.exe, ipconfig.exe, iscsicli.exe, klist.exe, krnl386.exe, ksetup.exe, ktmutil.exe, ktpass.exe, label.exe, lnkstub.exe, lodctr.exe, logman.exe, logoff.exe, logonui.exe, lpksetup.exe, lpremove.exe, lsass.exe, lsm.exe, makecab.exe, mcbuilder.exe, mem.exe, mountvol.exe, mpnotify.exe, mrinfo.exe, mscdexnt.exe, msdt.exe, msdtc.exe, msg.exe, msiexec.exe, msinfo32.exe, muiunattend.exe, napstat.exe, nbtstat.exe, net.exe, net1.exe, netbtugc.exe, netcfg.exe, netdom.exe, netiougc.exe, netsh.exe, netstat.exe, newdev.exe, nlsfunc.exe, nltest.exe, notepad.exe, nslookup.exe, ntkrnlpa.exe, ntoskrnl.exe, ntprint.exe, ntvdm.exe, ocsetup.exe, odbcad32.exe, odbcconf.exe, openfiles.exe, pathping.exe, ping.exe, pkgmgr.exe, plasrv.exe, pnpunattend.exe, pnputil.exe, poqexec.exe, powercfg.exe, print.exe, qappsrv.exe, qprocess.exe, query.exe, quser.exe, qwinsta.exe, rdpclip.exe, rdpinit.exe, rdpshell.exe, rdpsign.exe, recover.exe, redir.exe, reg.exe, regedt32.exe, regsvr32.exe, relog.exe, replace.exe, reset.exe, rmclient.exe, robocopy.exe, route.exe, rsopprov.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, sacsess.exe, sc.exe, schtasks.exe, sdbinst.exe, secedit.exe, secinit.exe, serverceipoptin.exe, serverweroptin.exe, services.exe, setspn.exe, setupcl.exe, setupugc.exe, setver.exe, setx.exe, sfc.exe, shadow.exe, share.exe, shutdown.exe, sigverif.exe, slsvc.exe, smss.exe, snmptrap.exe, sort.exe, subst.exe, svchost.exe, sxstrace.exe, sysedit.exe, syskey.exe, systeminfo.exe, takeown.exe, taskeng.exe, taskkill.exe, tasklist.exe, taskmgr.exe, tcpsvcs.exe, timeout.exe, tracerpt.exe, tracert.exe, tscon.exe, tsdiscon.exe, tskill.exe, tstheme.exe, typeperf.exe, ucsvc.exe, unattendedjoin.exe, unlodctr.exe, user.exe, userinit.exe, vds.exe, vdsldr.exe, verifier.exe, vssadmin.exe, vssvc.exe, w32tm.exe, waitfor.exe, wecutil.exe, werfault.exe, werfaultsecure.exe, wermgr.exe, wevtutil.exe, where.exe, whoami.exe, wininit.exe, winload.exe, winlogon.exe, winresume.exe, winrs.exe, winrshost.exe, winspool.exe, wlrmdr.exe, wowdeb.exe, wowexec.exe, wscript.exe, wsmanhttpconfig.exe, wsqmcons.exe, wuauclt.exe, wusa.exe, xcopy.exe, bootwinload.exe, bootwinresume.exe, comcomrepl.exe, imeimejp10imjpdsvr.exe, imeimejp10imjpmgr.exe, imeimesc5imscprop.exe, imeimetc10imtcprop.exe, imesharedimepadsv.exe, oobeaudit.exe, oobemsoobe.exe, oobeoobeldr.exe, oobesetup.exe, oobewindeploy.exe, sysprepsysprep.exe, wbemmofcomp.exe, wbemscrcons.exe, wbemunsecapp.exe, wbemwinmgmt.exe, wbemwmiadap.exe, wbemwmiapsrv.exe, wbemwmic.exe, wbemwmiprvse.exe

In both, all other EXE files

There are also a few other files that are not under c:windowssystem32. There’s no EXE files under c:program files in Core, but there is one on the boot folder and a few under the root of c:windows. One important tool on this group is regedit.exe.

c:bootmemtest.exe
c:windowsbfsvc.exe
c:windowsbootpcatmemtest.exe
c:windowsfveupdate.exe
c:windowsregedit.exe
c:windowsservicinggc32tzupd.exe
c:windowsservicingtrustedinstaller.exe
c:windowswinhelp.exe

EXE files only in Full, under c:windowssystem32

Now we start with the files that exist only in the Full install, starting with the ones living right at c:windowssystem32. Some are very familiar like mspaint.exe, write.exe, perfmon.exe, mmc.exe or good old calc.exe (which has been there since the very beginning of Windows). Others I beleive I never really used, like the tcmsetup.exe . Oddly enough, some are actually command-line tools like cipher.exe (the tool to encrypt files in NTFS). Note that some of the ime and wbem tools appear only here in the Full install, while some of their support files appeared in both.

acw.exe, adaptertroubleshooter.exe, alg.exe, atbroker.exe, audiodg.exe, bitsadmin.exe, bridgeunattend.exe, bthudtask.exe, calc.exe, cipher.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, cofire.exe, colorcpl.exe, compmgmtlauncher.exe, computerdefaults.exe, consent.exe, cprepsrv.exe, credwiz.exe, dcomcnfg.exe, deviceeject.exe, deviceproperties.exe, dfrgui.exe, dialer.exe, diantz.exe, dispdiag.exe, dpiscaling.exe, dplaysvr.exe, dpnsvr.exe, dvdplay.exe, dvdupgrd.exe, dwm.exe, dwwin.exe, dxdiag.exe, efsui.exe, escunattend.exe, eudcedit.exe, eventvwr.exe, extrac32.exe, firewallcontrolpanel.exe, firewallsettings.exe, fixmapi.exe, fontview.exe, getmac.exe, grpconv.exe, hdwwiz.exe, iashost.exe, icsunattend.exe, ie4uinit.exe, ieunatt.exe, iexpress.exe, infdefaultinstall.exe, irftp.exe, iscsicpl.exe, locator.exe, magnify.exe, mdres.exe, mdsched.exe, mmc.exe, mrt.exe, msconfig.exe, msfeedssync.exe, mshta.exe, mspaint.exe, mstsc.exe, mtstocom.exe, narrator.exe, netplwiz.exe, nfsconfigguide.exe, oobe.exe, osk.exe, pcaelv.exe, pcalua.exe, pcaui.exe, perfmon.exe, prevhost.exe, printfilterpipelinesvc.exe, printui.exe, proquota.exe, provisionshare.exe, provisionstorage.exe, racagent.exe, rasautou.exe, rasdial.exe, rasphone.exe, regini.exe, rekeywiz.exe, relpost.exe, rmactivate.exe, rmactivate_isv.exe, rmactivate_ssp.exe, rmactivate_ssp_isv.exe, rpcping.exe, runlegacycplelevated.exe, scshost.exe, scss.exe, scw.exe, scwcmd.exe, scwviewer.exe, servermanagercmd.exe, servermanagerlauncher.exe, sethc.exe, setupnfsidmap.exe, shrpubw.exe, shvcnfg.exe, sllua.exe, slui.exe, sndvol.exe, spoolsv.exe, systempropertiesadvanced.exe, systempropertiescomputername.exe, systempropertiesdataexecutionprevention.exe, systempropertieshardware.exe, systempropertiesperformance.exe, systempropertiesprotection.exe, systempropertiesremote.exe, systray.exe, tapiunattend.exe, tcmsetup.exe, tpminit.exe, tscupgrd.exe, tsecimp.exe, tssetup.exe, ui0detect.exe, upnpcont.exe, utilman.exe, verclsid.exe, vssuirun.exe, wercon.exe, wextract.exe, winfxdocobj.exe, winver.exe, write.exe, wuapp.exe, wudfhost.exe, commigregdb.exe, imeimejp10imjpdadm.exe, imeimejp10imjpdct.exe, imeimejp10imjppdmg.exe, imeimejp10imjpuex.exe, imeimejp10imjpuexc.exe, imesharedimccphr.exe, wbemwbemtest.exe

EXE files only in Full, .NET Framework tools mostly under c:windowsmicrosoft.netframeworkv2.0.50727

The .NET Framework is included only in the Full install and that’s been widely publicized. Most of the tools are under the c:windowsmicrosoft.net but there are some EXE files for assemblies and installation files.  

applaunch.exe, aspnet_compiler.exe, aspnet_regbrowsers.exe, aspnet_regiis.exe, aspnet_regsql.exe, aspnet_state.exe, aspnet_wp.exe, caspol.exe, csc.exe, cvtres.exe, dfsvc.exe, dw20.exe, ieexec.exe, ilasm.exe, installutil.exe, jsc.exe, msbuild.exe, mscorsvw.exe, ngen.exe, regasm.exe, regsvcs.exe, vbc.exe

c:windowsassemblygac_msildfsvc2.0.0.0__b03f5f7f11d50a3adfsvc.exe
c:windowsassemblygac_msilnarrator6.0.0.0__31bf3856ad364e35narrator.exe
c:windowsassemblygac_msilnfsconfigguide1.0.0.0__31bf3856ad364e35nfsconfigguide.exe
c:windowsassemblygac_msilsetupnfsidmap1.0.0.0__31bf3856ad364e35setupnfsidmap.exe
c:windowsassemblynativeimages_v2.0.50727_32dfsvc119ad414ba010730b5c177024233ed9ddfsvc.ni.exe
c:windowsassemblynativeimages_v2.0.50727_32narrator48b6c857c4d42818737a51a69de7de01narrator.ni.exe
c:windowsassemblynativeimages_v2.0.50727_32nfsconfigguide5b1ea604ddbd5f631ec688532d881edanfsconfigguide.ni.exe
c:windowsassemblynativeimages_v2.0.50727_32setupnfsidmapf0283b408646b8c58be5f0dcf84cc56fsetupnfsidmap.ni.exe
c:windowsmicrosoft.netframeworknetfxsbs10.exe

EXE files only in Full, all other folders

This last group is actually an interesting one. It includes all EXE files that are directly under the c:windows folder or somewhere under c:program files. Included here are the previously-hard-to-remove-from-the-OS files iexplore.exe and explorer.exe. There’s also the unusual fact that msinfo32.exe appears twice in a Full install (under c:windowssystem32 and under c:program files as listed below), but only once in Core. Wordpad.exe and the Windows address book (wab.exe) are here, but winmail.exe (which replaces Outlook Express) is an optional component, part of the “Desktop Experience” role (which could be useful in a terminal server environment).

c:program filescommon filesmicrosoft sharedinkpipanel.exe
c:program filescommon filesmicrosoft sharedmsinfomsinfo32.exe
c:program filesinternet exploreriedw.exe
c:program filesinternet explorerieinstal.exe
c:program filesinternet explorerieuser.exe
c:program filesinternet exploreriexplore.exe
c:program fileswindows mailwab.exe
c:program fileswindows mailwabmig.exe
c:program fileswindows ntaccessorieswordpad.exe
c:windowsexplorer.exe
c:windowshelppane.exe
c:windowshh.exe
c:windowswinhlp32.exe
c:windowsmsagentagentsvr.exe
c:windowsspeechcommonsapisvr.exe