Disks and File Systems Regardless of the partition style or disk - - PDF document

27/05/2013 1

Disks and File Systems

• Regardless of the partition style or disk type,

the basic unit of storage is a disk.

• When you format a disk with a file system, the

file system structures the disk using clusters which are logical groupings of sectors

• Both FAT and NTFS use a fixed sector size of

512bytes but allow the cluster size to be variable

• When you create a file system on a disk you

can accept the default or specify the setting.

• The cluster sizes available depend on the file

system chosen

27/05/2013 2

• Each cluster can hold one file only
• If you create a 1 kilobyte file and it is stored on

a file system using 4kilobyte clusters then 3 kilobytes of space will be wasted.

• If a single cluster is not big enough to hold the

file, the remaining data will go to the next cluster and the first cluster will have a pointer pointing to the next cluster.

Cluster Sizes

exFAT (Extended File Allocation Table) is a Microsoft file system optimized for flash

• drives. It is proprietary and patent‐pending. It is supported in Windows XP and

Windows Server 2003 with update KB955704 and all later windows OS’s

NTFS

• NTFS is a recoverable file system with many

advantages over FAT.

• Although Server 2008 is using the same

version number as that of 2003, it has a number of improvements

• Volumes formatted with NTFS can be

recovered if they contain structure errors

27/05/2013 3

• Instead of a FAT table, NTFS relies on a

database to store its information.

• The database is called the Master File Table

(MFT)

NTFS Comparison

BASIC AND DYNAMIC DISKS

27/05/2013 4

• Basic disks and dynamic disks are two types of

hard disk configurations in Windows.

Basic Disk

• A basic disk uses primary partitions, extended

partitions, and logical drives to organize data.

• A formatted partition is also called a volume (the terms

volume and partition are often used interchangeably).

• Basic disks can have either four primary partitions or

three primary and one extended partition.

– The extended partition can contain multiple logical drives (up to 128 logical drives are supported).

• The partitions on a basic disk cannot share or split data

with other partitions.

• Each partition on a basic disk is a separate entity on the

disk.

Dynamic Disks

• Dynamic disks can contain a large number of

dynamic volumes (approximately 2000) that function like the primary partitions used on basic disks.

• In some versions of Windows, you can combine

separate dynamic hard disks into a single dynamic volume (called spanning), split data among several hard disks (called striping) for increased performance, or duplicate data among several hard disks (called mirroring) for increased reliability.

27/05/2013 5

• The following operations can be performed
• nly on dynamic disks:

– Create and delete simple, spanned, striped, mirrored, and RAID‐5 volumes. – Extend a simple or spanned volume. – Remove a mirror from a mirrored volume or break the mirrored volume into two volumes. – Repair mirrored or RAID‐5 volumes. – Reactivate a missing or offline disk.

Partition Types

• The original method of partitioning disks is

referred to as MBR (Master Boot Record) which was developed during the 1980’s.

• This scheme has many shortcomings including

partitions being limited to 2TB in size.

• A new partition architecture developed in the

late 1990’s called GPT (GUID Partition Table) was created to accommodate the larger partition sizes.

• one of the biggest pitfalls of MBR‐based disks is their

potential for corruption of the partition table, a region

• n the disk that maps sectors to logical block numbers.
• MBR disks only have 1 partition table to keep track of

all the blocks in the partition.

– If the table becomes corrupt, the entire disk must be recovered from backup.

• Windows GPT‐based disks have multiple, redundant

partition tables so that if one is detected as being corrupt, it can self‐heal itself from a redundant copy of the table.

27/05/2013 6

• Another shortcoming of MBR‐based disk partitions is

the limitation of 3 primary partitions and 1 extended partition.

• The extended partition can be further divided into

multiple logical partitions.

– By limiting the number of partitions on a disk, you effectively reduce the number of partitions to organize or manage the data.

• With GPT‐based disks, Microsoft supports up to 128

partitions per disk.

– There are several partitions reserved for dynamic disks and EFI‐boot support so only 124 partitions are available for data.

Files, Folders, and Shares

• One of the core functions of any server is to

serve resources such as files and folders.

• In Windows Server 2008 R2, File Services is
• ne of the key roles you can add.

27/05/2013 7

• If you plan on sharing files and folders, it’s

important that you understand not only how to share the data but also how to protect it with permissions including both New Technology File System (NTFS) and share permissions.

• Although both sets of permissions work

independently, they also interact with each

• ther.

UNDERSTANDING THE FILE SERVICES ROLE

• The core component of any server is its ability

to share files.

• Sharing resources means that you allow your

users to access those resources from the network.

– No real processing goes into it as far as the server is concerned; it just hands out files and folders as they are.

27/05/2013 8 ADDING ROLE SERVICES

• Server Manager includes several consoles that

can be used to manage the different server roles including the File Services role.

The File Services role includes several additional role services:

• File Server This is the primary role service

required to support the File Services role. It is automatically added when a folder is shared.

• Distributed File System (DFS) DFS includes both

DFS Replication and DFS Namespaces and is covered later.

• File Server Resource Manager (FSRM) The FSRM

provides a rich set of additional tools that can be used to manage the storage of data on the server including configuring quotas, and generating storage reports.

27/05/2013 9 The File Services role includes several additional role services:

• Services for Network File System (NFS) This

service enables you to grant access to files from Unix client computers.

• Windows Search Service The Windows Search

Service uses indexing to perform quicker file searches.

• Windows Server 2003 File Services This includes

the Indexing Service for backward compatibility with Windows Server 2003 File Services.

The File Services role includes several additional role services:

• BranchCache for Network Files BranchCache

can be used in a multiple‐site environment to allow computers in branch offices to cache commonly downloaded files.

• BranchCache needs to be enabled on the

shared folder.

ADDING THE FILE SERVICES ROLE

27/05/2013 10

• For this lab, take a linked clone of Server 2008,

add in an extra hard drive (to be used for file shares)

• Set up a partition on the Drive using disk

manager

• You can add the File Services role by following

these steps:

• Launch Server Manager by selecting Start ‐

Administrative Tools ‐ Server Manager.

• Select Roles, and click the Add Roles link.

• Review the information on the Before You

Begin page, and click Next.

27/05/2013 11

• Select the File Services role, and click Next.
• Review the information on the Introduction to

File Services page, and click Next.

• On the Select Role Services page, select the

following role services

• File Server, File Server Resource Manager, and

BranchCache for network files. Click Next.

27/05/2013 12

• The Configure Storage Usage Monitoring page

is used to identify which volumes you want to monitor.

• The File Server Resource Manager can

monitor and generate storage reports on any volumes you choose to monitor.

• Select the volume that you plan on using to

share data.

• Select the second volume and Click Next.
• The Set Report Options page allows you to

specify a location for storage reports.

27/05/2013 13

• You can either accept the default location or

browse to another location.

• You can also configure the reports to be

emailed if you have an SMTP server available to send the reports.

• For now, accept the default location, and click

Next.

• Review the information on the Confirmation

page, and click Install.

• After a moment, the file services will be
• installed. Click Close.

27/05/2013 14

• At this point, Server Manager includes the File

Services role.

• Open Server Manager if it is not already open,
• It includes the Share and Storage

Management node and several selections under the File Server Resource Manager

• If you expand down to Share and Storage

Management, the shared resources will be displayed

Inter‐Process Communication (IPC) share A network share on computers running Microsoft Windows. This share is used to facilitate communication between processes and computers, often to exchange authentication data between computers. Admin$ ‐ Windows Dir

CREATING SHARES

27/05/2013 15

• There are several methods of creating shares
• First we will examine creating shares via

server manager

• Once a share is created, it can be published to

Active Directory to make it easy for users to locate the share.

CREATING SHARES WITH SERVER MANAGER

• The Share and Storage Management node

includes a Provision a Shared Folder Wizard that you can use by following these steps:

27/05/2013 16

• Launch Server Manager by selecting Start ‐

Administrative Tools – Server Manager.

• Browse to the Roles ‐ File Services ‐ Share and

Storage Management node,

• right‐click Share and Storage Management,

and select Provision Share.

• On the Shared Folder Location page, click

Browse.

• Browse to a folder you want to share.

– You can create folders also in here – Create a folder called Sales – Click OK after browsing to and selecting a folder.

27/05/2013 17

• Click Next.

The provision storage button allows you to set up available free unallocated drive space.

• The NTFS Permissions page gives you an
• pportunity to change the NTFS permissions if

desired.

• Next to accept the NTFS permissions.
• On the Share Protocols page, you identify the

protocols used to access the share and can also give the share a different share name.

– SMB is the primary protocol used by Windows clients to connect, and when this is selected, it allows both SMB version 1 and SMB version 2 depending on the client’s capabilities. – If you added NFS support for Unix clients, you could select NFS here.

• Accept the default of SMB, and click Next.

27/05/2013 18

• The SMB Settings page allows you to

manipulate some of the advanced settings by clicking the Advanced button.

– The User Limit option is set to Maximum Allowed by default, but you can limit it to a specific number of connections if desired. – The Access‐based – Enumeration setting is related to DFS and is disabled if the DFS role service isn’t added. – Offline Settings affects Offline Folders – Click Next.

• On the SMB Permissions page, you have the
• pportunity to change the default share

permissions.

– By default, the Everyone group is granted Read access to the share.

• The Quota Policy page allows you to apply

quotas to the share.

– If you wanted to ensure users were limited to no more than 100MB of storage space, you could create a quota policy to enforce the limit.

27/05/2013 19

• The File Screen Policy page allows you to apply

a file screen that can be used to monitor or block specific types of files from being saved

• n the share.
• You may want to ensure that users didn’t store

any audio and video files on the server, you could select the Block Audio and Video Files file screen.

• Click Next
• If you’re using DFS, you can publish an SMB

share to a DFS namespace.

• Review the settings you’ve selected, and click

Create.

27/05/2013 20

• After a moment, the wizard will complete the

creation of the share and indicate success.

• Click Close.

PUBLISHING SHARES IN ACTIVE DIRECTORY

• The primary reason to publish a share to

Active Directory is to allow users to easily find it.

• To publish a share, you need to be in the

Active Directory Users and Computers Management Console.

• The share needs to have been created

previously – prior to publishing

27/05/2013 21

• Right‐click the
• rganizational unit
• f choice, and select

New ‐ Shared Folder.

• From there, you’ll be asked to provide a name

for this publication of the share and, of course, the actual share name.

• The share will then appear in ADUC

27/05/2013 22

• Searching Active Directory
• If a client is a member of a domain, the Search

Active Directory command appears on the Network console. You can launch Network by selecting Start ‐ Network on Windows Server 2008 R2.

MANAGING PERMISSIONS

• One of the great strengths of both NTFS

formatted drives and shares is the ability to assign permissions and control who can access different files and folders.

• There are many similarities between NTFS and

share permissions

27/05/2013 23 NTFS PERMISSIONS NTFS permissions apply to any file or folder on a disk that has been formatted with NTFS.

• Read

– When a user is assigned Read permission, the user is allowed to view the contents, permissions, and attributes associated with a file or folder.

• Read and Execute

– The Read and Execute permission is used to grant permission for a user to execute files. If a user has only Read permission, and not Read and Execute, the files can’t be executed.

• List Folder Contents

– The List Folder Contents permission allows a user to view the contents of a folder. It will allow a user to see that files exist in a folder, but will not apply Read permissions to those files.

• Write

– If a user is assigned Write permission to a file or folder, the user can modify the file or folder. This includes adding new files or folders to a folder or making changes to existing files or

• folders. However, it does not include deleting files from a folder.
• Modify

– Modify includes all of the permissions from Read, Read & Execute, and Change, and adds the ability to delete files and folders.

• Full Control

– Full Control is a combination of all the available permissions. It adds the ability to change permissions and take ownership of files or folders.

SHARE PERMISSIONS

27/05/2013 24

• Share permissions only apply to shares when they are

accessed over the network.

• There are only three share permissions.
• Read

– Users granted Read permission can read files and folders within the share.

• Change

– Users granted Change permission can read, execute, modify, and delete files and folders within the share.

• Full Control

– Users granted Full Control permission have all the permissions from Change, and can also modify permissions on the share.

ASSIGNING ALLOW OR DENY

• If the permission is set to Allow for a user or

group, the user or group has this permission.

• If the permission is set to Deny for a user or

group, the user or group will not have the permission.

• Permissions are cumulative. If a user has multiple

Allow permissions assigned (such as allow Read and Allow Change), the user has a combination of the assigned permissions.

• If both Allow and Deny permissions are assigned

for a user, deny takes precedence.

27/05/2013 25

• If there aren’t any permissions assigned to a user, then

the user does not have access to the object.

– This is referred to as an implicit deny.

• Both share permissions and NTFS permissions use the

discretionary access control (DAC) model to control access.

– Each object has a discretionary access control list (DACL; pronounced as “dackel”). – The DACL is a list of access control entries (ACEs). – Each ACE identifies a user or a group with their associated security identifier (SID) and Allow or Deny permission.

• If multiple permissions apply to a user, the

user has the combination of all the permissions.

Deny Takes Precedence

• If both Allow and Deny for any permission are

assigned to a user, Deny takes precedence.

27/05/2013 26

Implicit Deny

• If permissions aren’t explicitly granted, they

are implicitly denied.

– Anyone who is not given access, but also is not restricted access – does not get any access by default, this is implicit deny

MODIFYING SHARE AND NTFS PERMISSIONS

• You can modify both the share and NTFS

permissions using Server Manager, Computer Management, or Windows Explorer.

27/05/2013 27

• Launch Server Manager, and browse to Roles ‐

File Services ‐ Share and Storage Management.

• Right‐click the share, and select Properties.
• Click the Permissions tab, and then click the

Share Permissions Tab.

27/05/2013 28

• Choose either Share or NTFS permissions
• Clicking on one of the buttons will open the

relevant permissions (share or NTFS) accordingly

Combining Share and NTFS Permissions

• Identifying permissions can be hard, keep it

simple with these three steps:

– Determine the cumulative NTFS permissions. – Determine the cumulative share permissions. – Determine which of the two provides the least access (commonly called the most restrictive permission).

27/05/2013 29

Connecting to Shares

• Primarily, you connect to a share using the

universal naming convention (UNC) of which follows the following syntax:

– \\ServerName\ShareName.

• You can also click Start and in the search box

enter

– \\ServerName (using the server name of any server

• n your network) followed by a backslash,
• Once the operating system connects, it retrieves a list of

shares available.

Mapping a drive

• You can map a drive letter to a share on your

network.

• You can right‐click either Computer or

Network from the Start menu and select Map Network Drive

• You can also right click on the share if you
• pen up the server via its UNC and right click

it and choose Map network drive

COMMON SHARES

27/05/2013 30

• C$, D$, and so on All drives, including CD‐

ROM drives, are given a hidden share to the root of the drive.

• This share is what is called an administrative

share.

• You cannot change the permissions or

properties of these shares

• Only the Administrators and Backup Operators

groups can connect to administrative shares

• ADMIN$ The ADMIN$ share is another

administrative share and it maps to the location of the operating system.

• PRINT$ Whenever you create a shared printer,

the system places the drivers in this share.

• This allows the drivers to be easily

downloaded when clients connect to the shared printer.

27/05/2013 31

• IPC$ The IPC$ share is probably one of the most

widely used shares in interserver communications though you will rarely interact with it directly.

• When you try to access shared resources on
• ther computers (to read event logs, for

example), the system uses named pipes.

• A named pipe is a piece of memory that handles

a communication channel between two processes, whether local or remote,

• IPC$ is used by the named pipes.
• NETLOGON The NETLOGON share is used in

conjunction with processing logon requests from users.

• Once users successfully log in, they are given

any profile and script information that they are required to run.

• SYSVOL The SYSVOL share is used to house

Group Policy information and scripts that are accessed by clients on the network.

• You will always see SYSVOL shares on domain

controllers, but they can be replicated to member servers.

27/05/2013 32 QUOTAS

• Quotas allow you to monitor and limit the space

users can consume on a volume or folder.

• When creating quotas, you have the ability to set

warning limits, set enforcement limits, provide notification of reached limits via email or event log entries, and even execute commands in response to any limit.

• You can use the quota policy to just monitor the

usage.

• To manage Disk

Quotas, you use File Services Resource Manager (FSRM), this is available via server manager – roles, if you did not install it you can install it from Server manager

27/05/2013 33

• Microsoft have included several quota

templates in File Services Resource Manager (FSRM) that you can easily be applied as is, or you can modify them to fit your needs.

• You can even create your own templates.

Quota Types

• There are two types of quota hard or soft.

– A hard quota limit will enforce the limit and prevent users from exceeding the limit. – A soft quota limit is just used for monitoring; it will provide notification but does not enforce the limit.

• To view Existing Quotas click Quotas under

Quota Management

• Any existing quotas will be shown

27/05/2013 34

Creating a Quota from a template

• Launch Server Manager, and browse to the

Roles ‐ File Services ‐ Share and Storage Management – File Services Resource Manager ‐ Quota Management – Quota Templates node.

• Right‐click the 200 MB Limit Reports to User

quota template, and select Create Quota from Template.

• Enter the path or click browse and browse to

the folder you want to monitor in the Quota Path text box.

27/05/2013 35

• View the properties
• Click Create.
• The Quota will be created
• Modifying the Quota
• Select Quotas.
• Right‐click your new quota, and select Edit

Quota Properties.

27/05/2013 36

• The edit quota properties page appears
• Select Quotas (right above Quota Templates in

the Server Manager navigation tree).

• Right‐click your new quota, and select Edit

Quota Properties.

• Change the Space Limit from 200MB to

500MB.

27/05/2013 37

• Select the Warning (100%) notification

threshold, and select Edit.

• Review the information on the E‐mail

Message, Event Log, and Command tabs.

– You may get a warning message indicating that an SMTP server is not configured

• Notice that you can modify
• the data on any of these tabs.
• The Email Tab
• The E‐mail Message tab

allows you to configure an email response if the threshold is reached.

• If you want an email sent

to an administrator, simply add the administrator’s email address on this page in the format of account@domain,

• admins@tombrett.local

You can also configure it to send an email to the user who exceeded the threshold simply by selecting a box.

27/05/2013 38

• The templates

include a preconfigured subject line and message body, and both can include variables (Source I/O Owner, Quota Path, Server etc.)

– When you can select any of these variables you can see a short explanation

• f what it is.
• Event Log Tab
• You can configure the

events to be logged in the Application log if desired.

• Selecting the Event Log tab

and selecting the box to send the warning to the event log.

• Any events sent from here

are logged into the Application log.

• Command Tab
• The command tab allows

you to run a command or script when the limit is exceeded

27/05/2013 39

• Report Tab
• You can configure reports

to be generated in response to a threshold and automatically be sent via email to administrators and/or the user.

• Reports can also be

created on demand.

• The reports are already

configured.

• The Generate Reports check

box is checked, and three reports are configured to be generated:

– Duplicate Files, Large Files, and Least Recently Accessed Files.

• Additionally, it’s configured to

send the report to the user exceeding the threshold.

CREATING FILE SCREEN POLICIES

27/05/2013 40

• File screens are used to filter or screen files to

ensure certain types of files aren’t stored on a server.

• You can create a file screen that will block users

from saving specific types of files and generate notifications when anyone attempts to save these blocked files on the server.

• File screens can be created on entire volumes or

specific folders,

• File screens also have templates.
• Launch Server Manager, and browse to the

File Screen Templates node.

• Right‐click the Block E‐mail Files template, and

select Create File Screen from Template.

27/05/2013 41

• Enter the volume

name that you want to screen (such as C:\sales) in the File Screen Path text

• box. Click Create.
• Select File Screens (right above File Screen

Templates).

• Right‐click the new file screen you just

created, and select Edit File Screen Properties.

• you can select either

Active Screening or Passive Screening.

• Since you want to

specifically block users from storing the files on the server, leave it as Active Screening.

27/05/2013 42

• Click through the Email Message, Event Log,

Command, and Report tabs.

• If a warning appears indicating that an SMTP

server is not configured, review the information, and click Yes to continue.

– These are very similar to the tabs used with quotes.

• Only the notification content is changed.
• Click OK once you’ve reviewed the tabs.

GENERATING REPORTS

• Several different reports are available. You can

generate reports as part of any quota policy or file screen policy. You can also configure reports to be generated on a schedule or generate them on demand.

27/05/2013 43

• The different reports available are Duplicate

Files, File Screening Audit, Files by File Group, Files by Owner, Files by Property, Large Files, Least Recently Accessed Files, Most Recently Accessed Files, and Quota Usage.

• You can also save the reports in several

different formats such as DHTML, HTML, XML, CSV, and text.

ACCESSING REPORTS

• Launch Server Manager.
• Right‐click the Storage Reports Management

node within the File Server Resource Manager, and select Generate Reports Now.

27/05/2013 44

• Click the Add button.
• Browse to a drive or a folder, and click OK.
• You can add multiple drives and folders.
• You can select as many reports as you’d like to

view,

– if you select them all, be patient; they take some time to generate.

• Some of the reports have additional

parameters that you can modify.

– if you select the Quota Usage report, you can click the Edit Parameters button and modify the minimum quota usage that will be included in the report.

27/05/2013 45

• Click the Delivery tab. Notice you can add an

email address and send the reports via

• email. Click OK.
• Depending on the amount of data in the

reports, this could take several minutes to complete.

• The relevant reports are created

27/05/2013 46

• You can also schedule reports to run
• The schedule tab appears
• Click Create schedule

27/05/2013 47

• The Task Scheduler opens where you can

schedule a new task by clicking new

BITLOCKER

• BitLocker Drive Encryption is a technology

designed to provide protection for entire disk drives.

• BitLocker To Go is a newer technology that

came out with Windows 7 and 2008 server and is designed to allow you to encrypt USB flash drives.

27/05/2013 48

Requirements

• A TPM 1.2 compatible chip
• Computers which don’t have TPM 1.2. There

are alternatives that can be used to encrypt drives with BitLocker:

– Password BitLocker can encrypt the drive, and a password can be used to unlock it. – Smart Card BitLocker can encrypt the drive, and a smart card with a PIN can be used to unlock the drive.

Recovery Key

• Once TPM detects that it has been moved (or

the hardware has been changed), it will lock the drive until the recovery key is used to unlock it.

Enabling BitLocker

• Launch Server Manager. Select Features, and

click Add Features.

• Select the BitLocker Drive Encryption check

box

• Click Install. When prompted, restart your

computer to complete the installation.

• After the reboot, log on. When the installation

completes, click Close.

27/05/2013 49

• Launch the Control Panel, and click System

and Security.