Add or remove Windows roles and features

Windows ships with many optional components, from IIS and Hyper-V tools to the old SMB1 protocol and Telnet client. Installing only what you need keeps the server lean and gives attackers fewer things to target.

Windows Server: roles and features

List what is installed:

Get-WindowsFeature | Where-Object Installed

Search for a feature by name:

Get-WindowsFeature *backup*

Install or remove one (the Name column is what you pass):

Install-WindowsFeature -Name Windows-Server-Backup -IncludeManagementTools
Uninstall-WindowsFeature -Name Web-Ftp-Server

With a desktop, you can also use Server Manager → Manage → Add Roles and Features.

Windows 10/11: optional features

Press Windows + R, type optionalfeatures and tick or untick items. Or use PowerShell:

Get-WindowsOptionalFeature -Online | Where-Object State -eq "Enabled"
Enable-WindowsOptionalFeature -Online -FeatureName TelnetClient
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Newer add-ons such as OpenSSH are capabilities instead:

Get-WindowsCapability -Online | Where-Object State -eq "Installed"

Check a restart is needed

The output of Install-WindowsFeature has a Restart Needed column. If it says Yes, restart in your next maintenance window.

Good candidates to remove

• SMB1 (FS-SMB1 on Server): an old file-sharing protocol you almost certainly do not need.
• Roles you added to test something and no longer use, such as FTP Server.

Troubleshooting

• "The source files could not be found": the feature's files were removed from the image. Run Windows Update first, then try again.
• Feature install hangs: check that no Windows Update install is in progress, then restart and retry.

Next steps

• Install IIS and host a website
• Install OpenSSH Server on Windows