When less is better Last month's column focused on reducing network services to the bare minimum for an exposed NT Web server. If all networked services are disabled, the only way to access a system is from the console or by usurping network connections originating from that system. Our focus is on servers, and you can eliminate these threats from critical servers by eliminating desktop-styled users.
Users have no business working on any server system.
Microsoft attempts to enforce this behaviour on NT domain controllers by prevent non-administrative logins. The problem with this approach is that many NT users log into the Administrator account, or one in the Administrators group, defeating this protection. For the UNIX-based server system, we can go further in eliminating possible misuse. For a start, the only accounts on the server system will be for root and other administrative accounts, for example, a webadmin. And for another, we simply will not install software on the server that makes it into an attractive and useful desktop system.