Windows Server 2016 became commercially available on Oct. 12, 2016. The new operating system includes a bare-bones Nano Server to reduce the potential attack surface. Nano Server is a very compact version that eliminates the graphical interface and just about everything else. Microsoft has adopted the notion of least privilege with its Windows Management Framework 5.0. Device Guard will lock down your servers to only run digitally signed applications permitted by particular security policies. The idea is to protect the integrity of your servers so that any malware can be better contained.”]
Source: https://securityintelligence.com/new-security-enhancements-microsoft-windows-server-2016/