Microsoft Windows server 2016 is released in this September at the Ignite Conference in Atlanta. It’s now generally available to customers, Volume licensing customer can download from licensing portal. As like the previous releases Microsoft has bundled many new exciting innovations with the release. From this post let’s discuss on what are these major changes and improvements.

Why windows server 2016?

With the cloud first mobile first journey, Microsoft always encourage their customers to move their workloads to Azure. Then why release server 2016? Not all environments can benefit from public cloud. There are scenarios which still need to depend on the On-premise infrastructure and private cloud environments. For these environments Server 2016 will provide cloud inspired technologies while building new security trends.

New features of Windows server 2016 

Shielded Virtual machines

Virtualization is in top of the peak, whole datacenters are getting virtualized and put into service providers or public clouds. No more servers, no more wires hanging out in work places. But how about the security of VM’s, the administrator who manage the Hypervisor have the control over the virtual machines. In example someone can copy the Virtual machine and mount in some other place.

Shielded VM concept address these issues. It can only run on a fabric that designed as owners of that virtual machine. Shielded VM use Virtual TPM technology, we can add virtual Trusted Platform Module to a VM. And we can encrypt the VM using bit locker or any other protection. Shielded VM’s comes in top of that. Hyper-V host does not have access to the shielded VM. So it is protected from the host management activities. Also there an external service called Host Guarding service. It will monitor the health of the Hyper-V host. When some sort of a malicious activity running in the host, host guardian service will pick it up and prevent shielded VM’s start. 

Containers

In simple words we can define container is Operating system Virtualization. In fact it’s not completely OS sharing, each container share the OS kernel. In example each container have their own view of the file system, and the registry. You can deploy application in containers to improve process isolation, performance, security, and scalability.

Windows containers having two deferent types 

• Windows Server Containers – provide application isolation through process and namespace isolation technology. A Windows Server container shares a kernel with the container host and all containers running on the host
• Hyper-V Containers – expand on the isolation provided by Windows Server Containers by running each container in a highly optimized virtual machine. In this configuration the kernel of the container host is not shared with the Hyper-V Containers.

With server 2016 Microsoft introduce Docker technology with containers, Docker is an Open source engine that automates the deployment of any application as a portable. With Docker integration, containers can be created, packaged and managed using their toolset. Also containers can be managed using PowerShell.

Security for credentials

Windows server 2016 introduce new security features to protect administration credentials, Helping guard administrator credentials from Pass-the-Hash attacks by using Credential Guard and Remote Credential Guard. Limiting administrator privileges with Just-In-Time Administration and Just Enough Administration.

• Credential Guard
  When user login to a computer, some hash value of that credential is stored in the memory of the OS. Attacker can use this hash to gain the privileges of that logon credentials. And if this a domain admin, attacker have all the rights needed. But with Credential Guard service, these hash values are being encrypted and protected from unauthorized use. Credential guard can be easily enabled or deployed by group policy in server 2016 either on-prem or cloud. 
  
  
• Remote Credential Guard
  With remote credential guard, when you login to a remote desktop session the credentials are not send to the remote server. So there is no hash in the memory to explorer. It also provides single sign on experiences for Remote Desktop sessions. If the target device is compromised, your credentials are not exposed because both credential and credential derivatives are never sent to the target device

• Just-Enough and Just-In-Time Administration
  This is a role base security feature in PowerShell which will help reduce how many administrators in your environment and what they can do with those privileges. With JEA, a non-administrator is able to run specific commands, scripts, and executables as if they were an administrator on the machine and all their actions are fully logged.

  
  

• Device Guard 
  Device guard use virtualization based security to isolate the code integrity service from the windows kernel. It can block any unwanted software running in the system. It protect software running in Kernel mode and User mode. In kernel mode Device Guard ensures the drivers are, at the very least, signed by a known signature or you can further restrict the drivers by whitelisting them in the policy. Under the user mode you can create Code Integrity (CI) policies which defines what’s trusted and authorized to run on individual servers