Skip to content
Register

Windows Server 2022 on 1GB RAM — it runs somehow

VPS Hosting by salavi 15 replies 1.4K views
salavi

Member OP

Threat Modeler

12 #1

Screenshot attached: 847MB at idle, 23 processes I don't recognize, fresh install. This is not a brag.

Assume compromise: this is my RDP gateway to internal lab. Threat model this setup for me. Blast radius is one VLAN but attack surface includes every forwarded port. Zero trust means I don't trust this box either.

What hardening would you actually do when the OS itself is the resource hog? I've stripped roles, disabled search indexing, running Server Core was not an option (legacy app requirement).

Is "it runs" the same as "it is usable" or am I rationalizing?

SamAlvi

Member

Self-Host Everything

#2
salavi said:
What hardening would you actually do when the OS itself is the resource hog?

Why pay for windows licensing when you can self-host a linux rdp gateway with xrdp and freerdp and docker compose it all up with a reverse proxy in front and then you get actual performance on 1GB instead of whatever this is but I get it legacy apps are legacy apps and sometimes you have no choice so if youre stuck with it then at least strip it further and disable windows update because that will eat your ram alive and use a reverse proxy on a separate linux box to terminate tls so your rdp isnt directly exposed and actually run it in a container if you can but windows containers are a mess so probably not and why pay for the windows tax on vps pricing when you could just get a bigger linux box for the same money and self-host the whole stack — https://traefik.io works well for this

my cloud. my rules. my 3AM alerts.
RAJ

Member

4 #3

Guys what panel you using for client mgmt on these tiny windows boxes? Any leads? Recieved a request for shared RDP hosting and their budget is tight. Wondering if I can squeeze 2022 like this or go older version. 🙏

your margin is my opportunity
marcus_qc

Member

11 #4

Hey folks gonna be real with you

847MB at idle is cooked

But if its just rdp gateway who cares

Super stoked you admitted what its for tho most ppl pretend theyre gonna run sql server on this

  • Strip superfetch
  • Disable defender real-time
  • Scheduled tasks gone

Youre probably at 600MB then

I ran 2019 on 768MB once, was trash, admitted it, moved to linux gateway, never looked back

42U and still growing
AN

Member

#5

Disabling defender on a gateway box feels wrong tho

marcus_qc

Member

#6
andrewpollos59 said:
Disabling defender on a gateway box feels wrong tho

It is wrong. It's also the only way to get under 700MB without going Server Core.

Wrong stack for the job, wrong budget for the stack. Pick one.

42U and still growing
salavi

Member OP

Threat Modeler

#7
marcus_qc said:
Strip superfetch

Done before post.

marcus_qc said:
Disable defender real-time

Not done. 120MB for real-time vs blast radius of one VLAN... I'll eat the RAM.

What I did do: GPO to block all outbound except NTP and RDP to specific lab IPs. Windows Firewall with connection security rules, require auth on both sides. No DNS resolution from the box itself, hosts file only.

Still paranoid about the 23 mystery processes. Anyone got a clean 2022 baseline list?

thaoasad

Member

Ho Chi Minh City

7 #8

1GB Windows 2022 RDP gateway in the wild, I have seen this movie. Ping from HCMC to Tel Aviv is 180ms stable, your users feel that.

My take: if legacy app needs full desktop, run the app on the 1GB box and RDP from thin clients. Don't make the 1GB box the gateway *and* the session host. Double penalty.

Helga51

Member

#sysadminlife

4 #9
salavi said:
GPO to block all outbound

Not in config management, doesn't exist. Next month you rebuild and forget the GPO exists.

I use Ansible with winrm for my two Windows boxes. Chocolatey for packages, dsc for the firewall rules. The playbook is 40 lines and idempotent.

You said "legacy app requirement" -- what app? Some things run fine on Windows 10 IoT or even Win11 Pro with RDSH hack. Licensing is cheaper, RAM footprint smaller.

SamAlvi

Member

Self-Host Everything

#10
Helga51 said:
Win11 Pro with RDSH hack

Please don't. Microsoft audits that specifically and the fines are not a joke. I've seen it.

Back to the actual problem: salavi, what hypervisor? If it's Proxmox (https://www.proxmox.com) or KVM you can balloon memory and the guest will page less aggressively than Windows thinks it should. Give it 1.5GB balloon down to 1GB, let it breathe during updates.

my cloud. my rules. my 3AM alerts.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft