Microsoft Server Administrator's Pocket Consultant User Manual
광고
광고
©
To learn more about this book, visit Microsoft Learning at
http://www.microsoft.com/MSPress/books/11449.aspx
Table of Contents
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xviii
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xix
Who Is This Book For? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx
How This Book Is Organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx
Conventions Used in This Book. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxi
Other Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii
Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxii
Part I Windows Server 2008 Administration Fundamentals
1 Windows Server 2008 Administration Overview. . . . . . . . . . . . . . . . . 3
Windows Server 2008 and Windows Vista . . . . . . . . . . . . . . . . . . . . . . 4
Getting to Know Windows Server 2008 . . . . . . . . . . . . . . . . . . . . . . . . 5
Networking Tools and Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Understanding Networking Options . . . . . . . . . . . . . . . . . . . . 7
Working with Networking Protocols . . . . . . . . . . . . . . . . . . . . 8
Domain Controllers, Member Servers, and Domain Services . . . . . . 9
Working with Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . 9
Using Read-Only Domain Controllers . . . . . . . . . . . . . . . . . . 11
Using Restartable Active Directory Domain Services . . . . . 12
Name-Resolution Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Using Domain Name System (DNS) . . . . . . . . . . . . . . . . . . . 13
Using Windows Internet Name Service (WINS). . . . . . . . . . 15
Using Link-Local Multicast Name Resolution (LLMNR) . . . 17
Frequently Used Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Using Windows PowerShell. . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2 Deploying Windows Server 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Server Roles, Role Services, and Features for
Windows Server 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Full-Server and Core-Server Installations of
Windows Server 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Installing Windows Server 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Performing a Clean Installation . . . . . . . . . . . . . . . . . . . . . . . 31
What do you think of this book? We want to hear from you!
Microsoft is interested in hearing your feedback so we can continually improve our books and learning resources for you. To participate in a brief survey, please visit: www.microsoft.com/learning/booksurvey iii
iv Table of Contents
Performing an Upgrade Installation . . . . . . . . . . . . . . . . . . . 33
Performing Additional Administration Tasks
During Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Managing Roles, Role Services, and Features . . . . . . . . . . . . . . . . . . 42
Viewing Configured Roles and Role Services . . . . . . . . . . . 42
Adding or Removing Roles on Servers . . . . . . . . . . . . . . . . . 43
Viewing and Modifying Role Services on Servers. . . . . . . . 46
Adding or Removing Features in Windows Server 2008 . . 47
3 Managing Servers Running Windows Server 2008 . . . . . . . . . . . . . 48
Performing Initial Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . 49
Managing Your Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Managing System Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
The Computer Name Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
The Hardware Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
The Advanced Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
The Remote Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Managing Dynamic-Link Libraries. . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
4 Monitoring Processes, Services, and Events . . . . . . . . . . . . . . . . . . . . 68
Managing Applications, Processes, and Performance . . . . . . . . . . . 68
Task Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Managing Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Administering Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Viewing System Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Viewing and Managing System Performance . . . . . . . . . . . 74
Viewing and Managing Networking Performance . . . . . . . 76
Viewing and Managing Remote User Sessions . . . . . . . . . . 77
Managing System Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Starting, Stopping, and Pausing Services . . . . . . . . . . . . . . . 79
Configuring Service Startup . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Configuring Service Logon. . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Configuring Service Recovery . . . . . . . . . . . . . . . . . . . . . . . . 82
Disabling Unnecessary Services . . . . . . . . . . . . . . . . . . . . . . . 84
Event Logging and Viewing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Accessing and Using the Event Logs. . . . . . . . . . . . . . . . . . . 86
Filtering Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Setting Event Log Options . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Clearing Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Archiving Event Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Monitoring Server Performance and Activity . . . . . . . . . . . . . . . . . . 94
Why Monitor Your Server? . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Table of Contents v
Getting Ready to Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Using the Reliability And Performance Console . . . . . . . . . 95
Choosing Counters to Monitor . . . . . . . . . . . . . . . . . . . . . . . 98
Performance Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Viewing Data Collector Reports . . . . . . . . . . . . . . . . . . . . . . 104
Configuring Performance Counter Alerts. . . . . . . . . . . . . . 105
Tuning System Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Monitoring and Tuning Memory Usage . . . . . . . . . . . . . . . 106
Monitoring and Tuning Processor Usage . . . . . . . . . . . . . . 108
Monitoring and Tuning Disk I/O . . . . . . . . . . . . . . . . . . . . . 109
Monitoring and Tuning Network Bandwidth and Connectivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
5 Automating Administrative Tasks, Policies, and Procedures. . . . . 111
Understanding Group Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Group Policy Essentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
In What Order Are Multiple Policies Applied? . . . . . . . . . . 115
When Are Group Policies Applied? . . . . . . . . . . . . . . . . . . . 115
Group Policy Requirements and Version Compatibility . . 116
Navigating Group Policy Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Managing Local Group Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Local Group Policy Objects . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Accessing the Top-Level Local Policy Settings . . . . . . . . . . 121
LGPO Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Accessing Administrator, Non-Administrator, and
User-Specific Local Group Policy . . . . . . . . . . . . . . . . . . . . . 122
Managing Site, Domain, and Organizational Unit Policies. . . . . . . 123
Understanding Domain and Default Policies . . . . . . . . . . . 123
Using the Group Policy Management Console . . . . . . . . . 125
Getting to Know the Policy Editor . . . . . . . . . . . . . . . . . . . . 126
Using Administrative Templates to Set Policies . . . . . . . . . 127
Creating a Central Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Creating and Linking GPOs. . . . . . . . . . . . . . . . . . . . . . . . . . 130
Creating and Using Starter GPOs. . . . . . . . . . . . . . . . . . . . . 131
Delegating Privileges for Group Policy Management . . . 132
Blocking, Overriding, and Disabling Policies . . . . . . . . . . . 133
Maintaining and Troubleshooting Group Policy . . . . . . . . . . . . . . . 136
Refreshing Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Configuring the Refresh Interval for
Domain Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Modeling Group Policy for Planning Purposes . . . . . . . . . 140
Copying, Pasting, and Importing Policy Objects . . . . . . . . 142
Backing Up and Restoring Policy Objects. . . . . . . . . . . . . . 143
vi Table of Contents
Determining Current Group Policy Settings and
Refresh Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Disabling an Unused Part of Group Policy. . . . . . . . . . . . . 145
Changing Policy Processing Preferences . . . . . . . . . . . . . . 145
Configuring Slow-Link Detection . . . . . . . . . . . . . . . . . . . . 146
Removing Links and Deleting GPOs . . . . . . . . . . . . . . . . . . 149
Troubleshooting Group Policy . . . . . . . . . . . . . . . . . . . . . . . 150
Fixing Default Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . 151
Managing Users and Computers with Group Policy. . . . . . . . . . . . 152
Centrally Managing Special Folders . . . . . . . . . . . . . . . . . . 152
User and Computer Script Management . . . . . . . . . . . . . . 156
Deploying Software Through Group Policy . . . . . . . . . . . . 159
Automatically Enrolling Computer and
User Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Managing Automatic Updates in Group Policy. . . . . . . . . 166
6 Enhancing Computer Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Using Security Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Using the Security Templates and Security
Configuration And Analysis Snap-ins . . . . . . . . . . . . . . . . . 172
Reviewing and Changing Template Settings . . . . . . . . . . . 172
Analyzing, Reviewing, and Applying
Security Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Deploying Security Templates to Multiple Computers . . 182
Using the Security Configuration Wizard . . . . . . . . . . . . . . . . . . . . . 184
Creating Security Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Edit Existing Security Policies . . . . . . . . . . . . . . . . . . . . . . . . 188
Apply Existing Security Policies . . . . . . . . . . . . . . . . . . . . . . 189
Roll Back the Last Applied Security Policy . . . . . . . . . . . . . 189
Deploying a Security Policy to Multiple Computers. . . . . 190
Part II Windows Server 2008 Directory Services
Administration
7 Using Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Introducing Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Active Directory and DNS. . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Read-Only Domain Controller Deployment . . . . . . . . . . . 194
Windows Server 2008 with Windows NT 4.0. . . . . . . . . . . 195
Working with Domain Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Understanding Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Understanding Domain Forests and Domain Trees . . . . . 198
Understanding Organizational Units . . . . . . . . . . . . . . . . . 200
Understanding Sites and Subnets . . . . . . . . . . . . . . . . . . . . 201
Table of Contents vii
Working with Active Directory Domains. . . . . . . . . . . . . . . . . . . . . . 202
Using Windows 2000 and Later Computers with Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Working with Domain Functional Levels . . . . . . . . . . . . . . 203
Raising Domain and Forest Functionality . . . . . . . . . . . . . . 206
Understanding the Directory Structure . . . . . . . . . . . . . . . . . . . . . . . 208
Exploring the Data Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Exploring Global Catalogs. . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Universal Group Membership Caching . . . . . . . . . . . . . . . . 210
Replication and Active Directory . . . . . . . . . . . . . . . . . . . . . 211
Active Directory and LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Understanding Operations Master Roles . . . . . . . . . . . . . . 213
8 Core Active Directory Administration. . . . . . . . . . . . . . . . . . . . . . . . 215
Tools for Managing Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . 215
Active Directory Administration Tools. . . . . . . . . . . . . . . . . 215
Active Directory Command-Line Tools . . . . . . . . . . . . . . . . 216
Active Directory Support Tools. . . . . . . . . . . . . . . . . . . . . . . 217
Using the Active Directory Users And Computers Tool . . . . . . . . . 218
Getting Started with Active Directory Users
And Computers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Connecting to a Domain Controller . . . . . . . . . . . . . . . . . . 220
Connecting to a Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Searching for Accounts and Shared Resources . . . . . . . . . 221
Managing Computer Accounts . . . . . . . . . . . . . . . . . . . . . . 223
Creating Computer Accounts on a Workstation or Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Creating Computer Accounts in
Active Directory Users And Computers . . . . . . . . . . . . . . . 223
Viewing and Editing Computer Account Properties. . . . . 224
Deleting, Disabling, and Enabling Computer Accounts . . 225
Resetting Locked Computer Accounts . . . . . . . . . . . . . . . . 225
Moving Computer Accounts. . . . . . . . . . . . . . . . . . . . . . . . . 226
Managing Computers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Joining a Computer to a Domain or Workgroup . . . . . . . 227
Managing Domain Controllers, Roles, and Catalogs. . . . . . . . . . . . 228
Installing and Demoting Domain Controllers . . . . . . . . . . 229
Viewing and Transferring Domain-Wide Roles . . . . . . . . . 230
Viewing and Transferring the Domain Naming
Master Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Viewing and Transferring Schema Master Roles . . . . . . . . 232
Transferring Roles Using the Command Line . . . . . . . . . . . 233
Seizing Roles Using the Command Line . . . . . . . . . . . . . . . 233
viii Table of Contents
Configuring Global Catalogs . . . . . . . . . . . . . . . . . . . . . . . . 235
Configuring Universal Group Membership Caching . . . . 236
Managing Organizational Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Creating Organizational Units . . . . . . . . . . . . . . . . . . . . . . . 237
Viewing and Editing Organizational Unit Properties . . . . 237
Renaming and Deleting Organizational Units. . . . . . . . . . 237
Moving Organizational Units . . . . . . . . . . . . . . . . . . . . . . . . 237
Managing Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Creating Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Creating Subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Associating Domain Controllers with Sites . . . . . . . . . . . . 240
Configuring Site Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Configuring Site Link Bridges. . . . . . . . . . . . . . . . . . . . . . . . 243
Maintaining Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Using ADSI Edit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Examining Inter-Site Topology. . . . . . . . . . . . . . . . . . . . . . . 246
Troubleshooting Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
9 Understanding User and Group Accounts . . . . . . . . . . . . . . . . . . . . 251
The Windows Server 2008 Security Model. . . . . . . . . . . . . . . . . . . . 251
Authentication Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Access Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Differences Between User and Group Accounts . . . . . . . . . . . . . . . 253
User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Group Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Default User Accounts and Groups . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Built-in User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Predefined User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Built-in and Predefined Groups . . . . . . . . . . . . . . . . . . . . . . 262
Implicit Groups and Special Identities . . . . . . . . . . . . . . . . 262
Account Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Logon Rights. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Built-in Capabilities for Groups in Active Directory . . . . . 266
Using Default Group Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Groups Used by Administrators. . . . . . . . . . . . . . . . . . . . . . 271
Implicit Groups and Identities . . . . . . . . . . . . . . . . . . . . . . . 272
10 Creating User and Group Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . 274
User Account Setup and Organization . . . . . . . . . . . . . . . . . . . . . . . 274
Account Naming Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Password and Account Policies . . . . . . . . . . . . . . . . . . . . . . 276
Table of Contents ix
Configuring Account Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Configuring Password Policies . . . . . . . . . . . . . . . . . . . . . . . 279
Configuring Account Lockout Policies . . . . . . . . . . . . . . . . 281
Configuring Kerberos Policies. . . . . . . . . . . . . . . . . . . . . . . . 283
Configuring User Rights Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Configuring User Rights Globally. . . . . . . . . . . . . . . . . . . . . 285
Configuring User Rights Locally . . . . . . . . . . . . . . . . . . . . . . 286
Adding a User Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Creating Domain User Accounts . . . . . . . . . . . . . . . . . . . . . 287
Creating Local User Accounts. . . . . . . . . . . . . . . . . . . . . . . . 289
Adding a Group Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Creating a Global Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Creating a Local Group and Assigning Members . . . . . . . 292
Handling Global Group Membership . . . . . . . . . . . . . . . . . . . . . . . . 293
Managing Individual Membership . . . . . . . . . . . . . . . . . . . 294
Managing Multiple Memberships in a Group . . . . . . . . . . 295
Setting the Primary Group for Users and Computers. . . . 295
11 Managing Existing User and Group Accounts . . . . . . . . . . . . . . . . . 296
Managing User Contact Information. . . . . . . . . . . . . . . . . . . . . . . . . 296
Setting Contact Information . . . . . . . . . . . . . . . . . . . . . . . . . 296
Searching for Users and Groups In Active Directory. . . . . 298
Configuring the User’s Environment Settings . . . . . . . . . . . . . . . . . 299
System Environment Variables . . . . . . . . . . . . . . . . . . . . . . . 300
Logon Scripts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
Assigning Home Directories . . . . . . . . . . . . . . . . . . . . . . . . . 302
Setting Account Options and Restrictions . . . . . . . . . . . . . . . . . . . . 303
Managing Logon Hours . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Setting Permitted Logon Workstations . . . . . . . . . . . . . . . . 305
Setting Dial-In and VPN Privileges . . . . . . . . . . . . . . . . . . . 306
Setting Account Security Options . . . . . . . . . . . . . . . . . . . . 308
Managing User Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Local, Roaming, and Mandatory Profiles . . . . . . . . . . . . . . 310
Using the System Utility to Manage Local Profiles . . . . . . 312
Updating User and Group Accounts . . . . . . . . . . . . . . . . . . . . . . . . . 316
Renaming User and Group Accounts . . . . . . . . . . . . . . . . . 317
Copying Domain User Accounts . . . . . . . . . . . . . . . . . . . . . 318
Importing and Exporting Accounts . . . . . . . . . . . . . . . . . . . 319
Changing and Resetting Passwords. . . . . . . . . . . . . . . . . . . 320
Enabling User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Managing Multiple User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . 322
Setting Profiles for Multiple Accounts. . . . . . . . . . . . . . . . . 323
x Table of Contents
Setting Logon Hours for Multiple Accounts . . . . . . . . . . . 324
Setting Permitted Logon Workstations for
Multiple Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324
Setting Logon, Password, and Expiration Properties for Multiple Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Troubleshooting Logon Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Viewing and Setting Active Directory Permissions . . . . . . . . . . . . . 327
Part III Windows Server 2008 Data Administration
12 Managing File Systems and Drives . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Managing the File Services Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Adding Hard Disk Drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Physical Drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Preparing a Physical Drive for Use . . . . . . . . . . . . . . . . . . . 338
Using Disk Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
Removable Storage Devices . . . . . . . . . . . . . . . . . . . . . . . . . 341
Installing and Checking for a New Drive . . . . . . . . . . . . . . 343
Understanding Drive Status . . . . . . . . . . . . . . . . . . . . . . . . . 344
Working with Basic and Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . 346
Using Basic and Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . 346
Special Considerations for Basic and Dynamic Disks . . . . 347
Changing Drive Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Reactivating Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . . . . 349
Rescanning Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
Moving a Dynamic Disk to a New System . . . . . . . . . . . . . 350
Using Basic Disks and Partitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Partitioning Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Creating Partitions and Simple Volumes . . . . . . . . . . . . . . 352
Formatting Partitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Managing Existing Partitions and Drives . . . . . . . . . . . . . . . . . . . . . 357
Assigning Drive Letters and Paths . . . . . . . . . . . . . . . . . . . . 357
Changing or Deleting the Volume Label . . . . . . . . . . . . . . 358
Deleting Partitions and Drives . . . . . . . . . . . . . . . . . . . . . . . 359
Converting a Volume to NTFS . . . . . . . . . . . . . . . . . . . . . . . 359
Resizing Partitions and Volumes . . . . . . . . . . . . . . . . . . . . . 361
Repairing Disk Errors and Inconsistencies . . . . . . . . . . . . . 363
Defragmenting Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366
Compressing Drives and Data . . . . . . . . . . . . . . . . . . . . . . . 368
Encrypting Drives and Data . . . . . . . . . . . . . . . . . . . . . . . . . 370
Understanding Encryption and the Encrypting
File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Table of Contents xi
Working with Encrypted Files and Folders . . . . . . . . . . . . . 373
Configuring Recovery Policy. . . . . . . . . . . . . . . . . . . . . . . . . 373
13 Administering Volume Sets and RAID Arrays . . . . . . . . . . . . . . . . . 375
Using Volumes and Volume Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
Understanding Volume Basics . . . . . . . . . . . . . . . . . . . . . . . 376
Understanding Volume Sets . . . . . . . . . . . . . . . . . . . . . . . . . 377
Creating Volumes and Volume Sets. . . . . . . . . . . . . . . . . . . 379
Deleting Volumes and Volume Sets. . . . . . . . . . . . . . . . . . . 382
Managing Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
Improving Performance and Fault Tolerance with RAIDs . . . . . . . . 382
Implementing RAID on Windows Server 2008 . . . . . . . . . . . . . . . . 384
Implementing RAID 0: Disk Striping . . . . . . . . . . . . . . . . . . 384
Implementing RAID 1: Disk Mirroring. . . . . . . . . . . . . . . . . 385
Implementing RAID 5: Disk Striping with Parity . . . . . . . . 387
Managing RAIDs and Recovering from Failures. . . . . . . . . . . . . . . . 388
Breaking a Mirrored Set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388
Resynchronizing and Repairing a Mirrored Set . . . . . . . . . 388
Repairing a Mirrored System Volume to Enable Boot . . . 389
Removing a Mirrored Set . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
Repairing a Striped Set Without Parity . . . . . . . . . . . . . . . . 390
Regenerating a Striped Set with Parity . . . . . . . . . . . . . . . . 390
Managing LUNs on SANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Configuring Fibre Channel SAN Connections . . . . . . . . . . 392
Configuring iSCSI SAN Connections . . . . . . . . . . . . . . . . . . 393
Adding and Removing Targets . . . . . . . . . . . . . . . . . . . . . . . 394
Creating, Extending, Assigning, and Deleting LUNs . . . . . 394
Defining a Server Cluster in Storage Manager
For SANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395
14 Managing File Screening and Storage Reporting . . . . . . . . . . . . . . 396
Understanding File Screening and Storage Reporting . . . . . . . . . . 396
Managing File Screening and Storage Reporting . . . . . . . . . . . . . . 399
Managing Global File Resource Settings . . . . . . . . . . . . . . 400
Managing the File Groups to Which Screens
Are Applied . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
Managing File Screen Templates . . . . . . . . . . . . . . . . . . . . . 404
Creating File Screens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Defining File Screening Exceptions . . . . . . . . . . . . . . . . . . . 407
Scheduling and Generating Storage Reports. . . . . . . . . . . 408
15 Data Sharing, Security, and Auditing . . . . . . . . . . . . . . . . . . . . . . . . 410
Using and Enabling File Sharing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411
Configuring Standard File Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
xii Table of Contents
Viewing Existing Shares. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
Creating Shared Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417
Creating Additional Shares on an Existing Share . . . . . . . 419
Managing Share Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420
The Different Share Permissions . . . . . . . . . . . . . . . . . . . . . 420
Viewing Share Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . 420
Configuring Share Permissions . . . . . . . . . . . . . . . . . . . . . . 421
Modifying Existing Share Permissions . . . . . . . . . . . . . . . . 422
Removing Share Permissions for Users and Groups . . . . . 423
Managing Existing Shares . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
Understanding Special Shares . . . . . . . . . . . . . . . . . . . . . . . 423
Connecting to Special Shares. . . . . . . . . . . . . . . . . . . . . . . . 424
Viewing User and Computer Sessions . . . . . . . . . . . . . . . . 425
Stopping File and Folder Sharing . . . . . . . . . . . . . . . . . . . . 427
Configuring NFS Sharing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428
Using Shadow Copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429
Understanding Shadow Copies . . . . . . . . . . . . . . . . . . . . . . 430
Creating Shadow Copies. . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
Restoring a Shadow Copy. . . . . . . . . . . . . . . . . . . . . . . . . . . 431
Reverting an Entire Volume to a Previous
Shadow Copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
Deleting Shadow Copies. . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
Disabling Shadow Copies . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
Connecting to Network Drives. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
Mapping a Network Drive . . . . . . . . . . . . . . . . . . . . . . . . . . 433
Disconnecting a Network Drive . . . . . . . . . . . . . . . . . . . . . . 433
Object Management, Ownership, and Inheritance. . . . . . . . . . . . . 434
Objects and Object Managers . . . . . . . . . . . . . . . . . . . . . . . 434
Object Ownership and Transfer . . . . . . . . . . . . . . . . . . . . . . 434
Object Inheritance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
File and Folder Permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
Understanding File and Folder Permissions. . . . . . . . . . . . 437
Setting File and Folder Permissions. . . . . . . . . . . . . . . . . . . 439
Auditing System Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
Setting Auditing Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
Auditing Files and Folders . . . . . . . . . . . . . . . . . . . . . . . . . . 443
Auditing the Registry. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
Auditing Active Directory Objects. . . . . . . . . . . . . . . . . . . . 445
Using, Configuring, and Managing NTFS Disk Quotas. . . . . . . . . . 446
Understanding NTFS Disk Quotas and How NTFS Quotas Are Used. . . . . . . . . . . . . . . . . . . . . 447
Table of Contents xiii
Setting NTFS Disk Quota Policies. . . . . . . . . . . . . . . . . . . . . 449
Enabling NTFS Disk Quotas on NTFS Volumes . . . . . . . . . 451
Viewing Disk Quota Entries. . . . . . . . . . . . . . . . . . . . . . . . . . 452
Creating Disk Quota Entries . . . . . . . . . . . . . . . . . . . . . . . . . 453
Deleting Disk Quota Entries . . . . . . . . . . . . . . . . . . . . . . . . . 454
Exporting and Importing NTFS Disk Quota Settings . . . . 455
Disabling NTFS Disk Quotas . . . . . . . . . . . . . . . . . . . . . . . . . 456
Using, Configuring, and Managing Resource Manager
Disk Quotas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
Understanding Resource Manager Disk Quotas . . . . . . . . 457
Managing Disk Quota Templates. . . . . . . . . . . . . . . . . . . . . 458
Creating Resource Manager Disk Quotas . . . . . . . . . . . . . . 460
16 Data Backup and Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
Creating a Backup and Recovery Plan. . . . . . . . . . . . . . . . . . . . . . . . 461
Figuring Out a Backup Plan . . . . . . . . . . . . . . . . . . . . . . . . . 461
The Basic Types of Backup . . . . . . . . . . . . . . . . . . . . . . . . . . 462
Differential and Incremental Backups . . . . . . . . . . . . . . . . . 463
Selecting Backup Devices and Media . . . . . . . . . . . . . . . . . 464
Common Backup Solutions. . . . . . . . . . . . . . . . . . . . . . . . . . 465
Buying and Using Backup Media . . . . . . . . . . . . . . . . . . . . . 466
Selecting a Backup Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
Backing Up Your Data: The Essentials . . . . . . . . . . . . . . . . . . . . . . . . 468
Installing the Windows Backup and Recovery Utilities. . . 468
Getting Started with Windows Server Backup . . . . . . . . . . 468
Getting Started with the Backup Command-Line
Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471
Working with Wbadmin Commands. . . . . . . . . . . . . . . . . . 473
Using General-Purpose Commands . . . . . . . . . . . . . . . . . . 473
Using Backup Management Commands . . . . . . . . . . . . . . 474
Using Recovery Management Commands . . . . . . . . . . . . . 475
Performing Server Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475
Configuring Scheduled Backups . . . . . . . . . . . . . . . . . . . . . 477
Modifying or Stopping Scheduled Backups . . . . . . . . . . . . 479
Creating and Scheduling Backups with Wbadmin . . . . . . 481
Running Manual Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
Recovering Your Server from Hardware or
Startup Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
Starting a Server in Safe Mode. . . . . . . . . . . . . . . . . . . . . . . 486
Resuming After a Failed Start . . . . . . . . . . . . . . . . . . . . . . . . 488
Backing Up and Restoring the System State . . . . . . . . . . . 488
Restoring Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . 489
Restoring the Operating System and the Full System. . . . 489
xiv Table of Contents
Restoring Applications, Non-System Volumes, and Files and Folders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
Managing Encryption Recovery Policy . . . . . . . . . . . . . . . . . . . . . . . 493
Understanding Encryption Certificates and
Recovery Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
Configuring the EFS Recovery Policy . . . . . . . . . . . . . . . . . 495
Backing Up and Restoring Encrypted Data and Certificates . . . . . 496
Backing Up Encryption Certificates. . . . . . . . . . . . . . . . . . . 496
Restoring Encryption Certificates . . . . . . . . . . . . . . . . . . . . 497
Part IV Windows Server 2008 Network Administration
17 Managing TCP/IP Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501
Navigating Networking in Windows Server 2008. . . . . . . . . . . . . . 501
Networking Enhancements in Windows Vista and
Windows Server 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Installing TCP/IP Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
Configuring TCP/IP Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
Configuring Static IP Addresses . . . . . . . . . . . . . . . . . . . . . . 508
Configuring Dynamic IP Addresses and Alternate
IP Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510
Configuring Multiple Gateways . . . . . . . . . . . . . . . . . . . . . . 511
Managing Network Connections. . . . . . . . . . . . . . . . . . . . . . . . . . . . 512
Checking the Status, Speed, and Activity for Local Area Connections . . . . . . . . . . . . . . . . . . . . . . . . . 513
Enabling and Disabling Local Area Connections . . . . . . . 513
Renaming Local Area Connections . . . . . . . . . . . . . . . . . . . 513
18 Administering Network Printers and Print Services . . . . . . . . . . . . 514
Managing the Print Services Role . . . . . . . . . . . . . . . . . . . . . . . . . . . 514
Using Print Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514
Printing Essentials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515
Configuring Print Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . 517
Enabling and Disabling Print Sharing . . . . . . . . . . . . . . . . . 518
Getting Started with Print Management . . . . . . . . . . . . . . . . . . . . . 518
Installing Printers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 520
Using the Autoinstall Feature of Print Management . . . . 520
Installing and Configuring Physically Attached
Print Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
Installing Network-Attached Print Devices . . . . . . . . . . . . 525
Connecting to Printers Created on the Network . . . . . . . 527
Deploying Printer Connections . . . . . . . . . . . . . . . . . . . . . . 528
Configuring Point and Print Restrictions . . . . . . . . . . . . . . 530
Moving Printers to a New Print Server . . . . . . . . . . . . . . . . 532
Table of Contents xv
Monitoring Printers and Printer Queues Automatically . . 534
Solving Spooling Problems . . . . . . . . . . . . . . . . . . . . . . . . . . 535
Configuring Printer Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536
Adding Comments and Location Information. . . . . . . . . . 536
Listing Printers in Active Directory. . . . . . . . . . . . . . . . . . . . 536
Managing Printer Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . 536
Setting a Separator Page and Changing Print
Device Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537
Changing the Printer Port . . . . . . . . . . . . . . . . . . . . . . . . . . . 538
Scheduling and Prioritizing Print Jobs . . . . . . . . . . . . . . . . 538
Starting and Stopping Printer Sharing . . . . . . . . . . . . . . . . 540
Setting Printer Access Permissions. . . . . . . . . . . . . . . . . . . . 540
Auditing Print Jobs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
Setting Document Defaults. . . . . . . . . . . . . . . . . . . . . . . . . . 542
Configuring Print Server Properties. . . . . . . . . . . . . . . . . . . . . . . . . . 542
Locating the Spool Folder and Enabling Printing on NTFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542
Managing High-Volume Printing . . . . . . . . . . . . . . . . . . . . 543
Logging Printer Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543
Enabling Print Job Error Notification. . . . . . . . . . . . . . . . . . 543
Managing Print Jobs on Local and Remote Printers . . . . . . . . . . . . 543
Viewing Printer Queues and Print Jobs. . . . . . . . . . . . . . . . 544
Pausing the Printer and Resuming Printing . . . . . . . . . . . . 544
Emptying the Print Queue . . . . . . . . . . . . . . . . . . . . . . . . . . 545
Pausing, Resuming, and Restarting Individual
Document Printing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545
Removing a Document and Canceling a Print Job . . . . . . 545
Checking the Properties of Documents in the Printer . . . 545
Setting the Priority of Individual Documents. . . . . . . . . . . 546
Scheduling the Printing of Individual Documents . . . . . . 546
19 Running DHCP Clients and Servers . . . . . . . . . . . . . . . . . . . . . . . . . . 547
Understanding DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547
Using Dynamic IPv4 Addressing and Configuration. . . . . 547
Using Dynamic IPv6 Addressing and Configuration. . . . . 548
Checking IP Address Assignment. . . . . . . . . . . . . . . . . . . . . 551
Understanding Scopes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
Installing a DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
Installing DHCP Components . . . . . . . . . . . . . . . . . . . . . . . . 553
Starting and Using the DHCP Console . . . . . . . . . . . . . . . . 556
Connecting to Remote DHCP Servers . . . . . . . . . . . . . . . . . 557
Starting and Stopping a DHCP Server. . . . . . . . . . . . . . . . . 557
Authorizing a DHCP Server in Active Directory. . . . . . . . . 558
xvi Table of Contents
Configuring DHCP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
Binding a DHCP Server with Multiple Network Interface
Cards to a Specific IP Address . . . . . . . . . . . . . . . . . . . . . . . 558
Updating DHCP Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
DHCP Auditing and Troubleshooting . . . . . . . . . . . . . . . . . 559
Integrating DHCP and DNS . . . . . . . . . . . . . . . . . . . . . . . . . 560
Integrating DHCP and NAP . . . . . . . . . . . . . . . . . . . . . . . . . 562
Avoiding IP Address Conflicts . . . . . . . . . . . . . . . . . . . . . . . 565
Saving and Restoring the DHCP Configuration . . . . . . . . 565
Managing DHCP Scopes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
Creating and Managing Superscopes. . . . . . . . . . . . . . . . . 566
Creating and Managing Scopes . . . . . . . . . . . . . . . . . . . . . 567
Managing the Address Pool, Leases, and Reservations . . . . . . . . . 577
Viewing Scope Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
Setting a New Exclusion Range . . . . . . . . . . . . . . . . . . . . . . 577
Deleting an Exclusion Range . . . . . . . . . . . . . . . . . . . . . . . . 578
Reserving DHCP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . 578
Modifying Reservation Properties . . . . . . . . . . . . . . . . . . . . 580
Deleting Leases and Reservations . . . . . . . . . . . . . . . . . . . . 580
Backing Up and Restoring the DHCP Database . . . . . . . . . . . . . . . 580
Backing Up the DHCP Database . . . . . . . . . . . . . . . . . . . . . 581
Restoring the DHCP Database from Backup . . . . . . . . . . . 581
Using Backup and Restore to Move the DHCP Database to a New Server . . . . . . . . . . . . . . . . . 582
Forcing the DHCP Server Service to Regenerate the DHCP Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582
Reconciling Leases and Reservations . . . . . . . . . . . . . . . . . 583
20 Optimizing DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 584
Understanding DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 584
Integrating Active Directory and DNS . . . . . . . . . . . . . . . . 585
Enabling DNS on the Network. . . . . . . . . . . . . . . . . . . . . . . 586
Configuring Name Resolution on DNS Clients . . . . . . . . . . . . . . . . 588
Installing DNS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590
Installing and Configuring the DNS Server Service . . . . . 590
Configuring a Primary DNS Server . . . . . . . . . . . . . . . . . . . 592
Configuring a Secondary DNS Server. . . . . . . . . . . . . . . . . 595
Configuring Reverse Lookups . . . . . . . . . . . . . . . . . . . . . . . 595
Configuring Global Names. . . . . . . . . . . . . . . . . . . . . . . . . . 597
Managing DNS Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
Table of Contents xvii
Adding Remote Servers to the DNS Console. . . . . . . . . . . 599
Removing a Server from the DNS Console . . . . . . . . . . . . 599
Starting and Stopping a DNS Server . . . . . . . . . . . . . . . . . . 599
Creating Child Domains Within Zones . . . . . . . . . . . . . . . . 600
Creating Child Domains in Separate Zones . . . . . . . . . . . . 600
Deleting a Domain or Subnet. . . . . . . . . . . . . . . . . . . . . . . . 601
Managing DNS Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
Adding Address and Pointer Records . . . . . . . . . . . . . . . . . 602
Adding DNS Aliases with CNAME . . . . . . . . . . . . . . . . . . . . 604
Adding Mail Exchange Servers. . . . . . . . . . . . . . . . . . . . . . . 605
Adding Name Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
Viewing and Updating DNS Records. . . . . . . . . . . . . . . . . . 607
Updating Zone Properties and the SOA Record . . . . . . . . . . . . . . . 608
Modifying the SOA Record . . . . . . . . . . . . . . . . . . . . . . . . . . 608
Allowing and Restricting Zone Transfers. . . . . . . . . . . . . . . 609
Notifying Secondaries of Changes. . . . . . . . . . . . . . . . . . . . 611
Setting the Zone Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612
Enabling and Disabling Dynamic Updates . . . . . . . . . . . . . 612
Managing DNS Server Configuration and Security. . . . . . . . . . . . . 613
Enabling and Disabling IP Addresses for a DNS Server . . 613
Controlling Access to DNS Servers Outside the Organization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613
Enabling and Disabling Event Logging . . . . . . . . . . . . . . . . 615
Using Debug Logging to Track DNS Activity . . . . . . . . . . . 615
Monitoring a DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 616
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619
What do you think of this book? We want to hear from you!
Microsoft is interested in hearing your feedback so we can continually improve our books and learning resources for you. To participate in a brief survey, please visit: www.microsoft.com/learning/booksurvey
Chapter 7
Using Active Directory
In this chapter:
Introducing Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
Working with Domain Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Working with Active Directory Domains . . . . . . . . . . . . . . . . . . . . . . . .202
Understanding the Directory Structure . . . . . . . . . . . . . . . . . . . . . . . . .208
Active Directory Domain Services is an extensible and scalable directory service that you can use to manage network resources efficiently. As an administrator, you’ll need to be very familiar with how Active Directory technology works, and that’s exactly what this chapter is about. If you haven’t worked with Active Directory technology before, one thing you’ll notice immediately is that the technology is fairly advanced and has many features. To help manage this complex technology, I’ll start with an overview of Active Directory and then explore its components.
Introducing Active Directory
Ever since the introduction of Windows 2000, Active Directory has been the heart of
Windows-based domains. Just about every administrative task you’ll perform will affect Active Directory in some way. Active Directory technology is based on standard
Internet protocols and has a design that helps you clearly define your network’s structure.
Active Directory and DNS
Active Directory uses Domain Name System (DNS). DNS is a standard Internet service that organizes groups of computers into domains. DNS domains are organized into a hierarchical structure. The DNS domain hierarchy is defined on an Internet-wide basis, and the different levels within the hierarchy identify computers, organizational domains, and top-level domains. DNS is also used to map host names, such as zeta.microsoft.com, to numeric Transmission Control Protocol/Internet Protocol
(TCP/IP) addresses, such as 192.168.19.2. Through DNS, an Active Directory domain hierarchy can also be defined on an Internet-wide basis or the domain hierarchy can be separate and private.
193
194 Part II Windows Server 2008 Directory Services Administration
When you refer to computer resources in this type of domain, you use the fully qualified domain name (FQDN), such as zeta.microsoft.com. Here, zeta represents the name of an individual computer, microsoft represents the organizational domain, and
com is the top-level domain. Top-level domains (TLDs) are at the base of the DNS hierarchy. TLDs are organized geographically, by using two-letter country codes, such as
CA for Canada; by organization type, such as com for commercial organizations; and by function, such as mil for U.S. military installations.
Normal domains, such as microsoft.com, are also referred to as parent domains. They have this name because they’re the parents of an organizational structure. You can divide parent domains into subdomains, which you can then use for different offices, divisions, or geographic locations. For example, the fully qualified domain name for a computer at Microsoft’s Seattle office could be designated as jacob.seattle.microsoft.com. Here, jacob is the computer name, seattle is the subdomain, and microsoft.com is the parent domain. Another term for a subdomain is a child domain.
As you can see, DNS is an integral part of Active Directory technology—so much so, in fact, that you must configure DNS on the network before you can install Active Directory. Working with DNS is covered in Chapter 20, “Optimizing DNS.”
With Windows Server 2008, you install Active Directory in a two-part process. First, you add the Active Directory Domain Services role to the server using the Add Role
Wizard. Then, you run the Active Directory Installation Wizard (click Start, type
dcpromo in the Search field, and then press Enter). If DNS isn’t installed already, you will be prompted to install DNS. If there isn’t an existing domain, the wizard helps you create a domain and configure Active Directory in a new domain. The wizard can also help you add child domains to existing domain structures. To verify that a domain controller is installed correctly, you can:
■
■
■
■
Check the Directory Service event log for errors.
Ensure that the Sysvol folder is accessible to clients.
Verify that name resolution is working through DNS.
Verify the replication of changes to Active Directory.
Note
In the rest of this chapter I’ll often use the terms directory and domains to refer to Active Directory and Active Directory domains, respectively, except when I need to distinguish Active Directory structures from DNS or other types of directories.
Read-Only Domain Controller Deployment
As discussed in Chapter 1, “Windows Server 2008 Administration Overview,” domain controllers running Windows Server 2008 can be configured as read-only domain controllers (RODCs). When you install the DNS Server service on an RODC, the RODC
Chapter 7 Using Active Directory 195
can act as a read-only DNS server (RODNS server). In this configuration, the following conditions are true:
■ The RODC replicates the application directory partitions that DNS uses, including the ForestDNSZones and DomainDNSZones partitions. Clients can query an
RODNS server for name resolution. However, the RODNS server does not support client updates directly because the RODNS server does not register resource records for any Active Directory–integrated zone that it hosts.
■ When a client attempts to update its DNS records, the server returns a referral.
The client can then attempt to update against the DNS server that is provided in the referral. Through replication in the background, the RODNS server will then attempt to retrieve the updated record from the DNS server that made the update. This replication request is only for the changed DNS record. The entire list of changed zone or domain data is not replicated during this special request.
The first Windows Server 2008 domain controller installed in a forest or domain cannot be an RODC. However, you can configure subsequent domain controllers as readonly. For planning purposes, keep the following in mind:
■ Prior to adding Active Directory Domain Services (AD DS) for the first time to a server that is running Windows Server 2008 in a Windows Server 2003 or Windows 2000 Server forest, you must update the schema on the schema operations master in the forest by running adprep /forestprep.
■ Prior to adding AD DS for the first time to a server that is running Windows
Server 2008 in a Windows Server 2003 or Windows 2000 Server domain, you must update the infrastructure master in the domain by running adprep
/domainprep /gpprep.
■ Prior to installing AD DS to create your first RODC in a forest, you must prepare the forest by running adprep /rodcprep.
Windows Server 2008 with Windows NT 4.0
Windows Server 2008 domain functions are not designed to interoperate with Windows NT 4.0 domain functions. Domain controllers that are running Windows NT
Server 4.0 are not supported with Windows Server 2008. Servers running Windows
NT Server 4.0 are not supported by domain controllers that are running Windows
Server 2008. Because of these interoperability issues, you should take the following actions:
■ Upgrade domain controllers running Windows NT Server 4.0 prior to deploying any computers running Windows Server 2008.
■ Upgrade all computers running Windows NT Server 4.0 prior to deploying any domain controllers running Windows Server 2008.
196 Part II Windows Server 2008 Directory Services Administration
You can upgrade Windows NT Server 4.0 to Windows 2000 Server or Windows Server
2003. It is important to remember that a Primary Domain Controller (PDC) emulator operations master is still required when you upgrade all computers running Windows
NT Server 4.0.
Working with Domain Structures
Active Directory provides both logical and physical structures for network components. Logical structures help you organize directory objects and manage network accounts and shared resources. Logical structures include the following:
Organizational units
A subgroup of domains that often mirrors the organization’s business or functional structure.
Domains
A group of computers that share a common directory database.
Domain trees
One or more domains that share a contiguous namespace.
Domain forests
One or more domain trees that share common directory information.
Physical structures serve to facilitate network communication and to set physical boundaries around network resources. Physical structures that help you map the physical network structure include the following:
Subnets
A network group with a specific Internet Protocol (IP) address range and network mask.
Sites
One or more subnets. Sites are used to configure directory access and replication.
Understanding Domains
An Active Directory domain is simply a group of computers that share a common directory database. Active Directory domain names must be unique. For example, you can’t have two microsoft.com domains, but you could have a microsoft.com parent domain with seattle.microsoft.com and ny.microsoft.com child domains. If the domain is part of a private network, the name assigned to a new domain must not conflict with any existing domain name on the private network. If the domain is part of the global Internet, the name assigned to a new domain must not conflict with any existing domain name throughout the Internet. To ensure uniqueness on the Internet, you must register the parent domain name before using it. You can register a domain through any designated registrar. You can find a current list of designated registrars at InterNIC
(http:// www.internic.net).
Each domain has its own security policies and trust relationships with other domains.
Domains can also span more than one physical location, which means that a domain can consist of multiple sites and those sites can have multiple subnets, as shown in Figure 7-1. Within a domain’s directory database, you’ll find objects defining accounts for users, groups, and computers as well as shared resources such as printers and folders.
10.1.11.0/24
10.1.12.0/24
Seattle Site
Seattle
Network
Chapter 7 Using Active Directory
10.1.1.0/24
10.1.2.0/24
197
10.1.31.0/24
10.1.32.0/24
New York Site
New York
Network
Chicago Site
Chicago
Network
LA Site
LA
Network
10.1.21.0/24
10.1.22.0/24
Miami Site
10.1.41.0/24
10.1.42.0/24
Miami
Network
Figure 7-1
This network diagram depicts a wide area network (WAN) with multiple sites and subnets.
Note
User and group accounts are discussed in Chapter 9, “Understanding User and Group Accounts.” Computer accounts and the various types of computers used
in Windows Server 2008 domains are discussed in “Working with Active Directory
Domain functions are limited and controlled by the domain functional level. Several domain functional levels are available, including the following:
Windows 2000 mixed
Supports domain controllers running Windows NT 4.0 and later releases of Windows Server. However, you cannot use Windows NT 4.0 domain controllers with Windows Server 2008 and you cannot use Windows
Server 2008 domain controllers with Windows NT 4.0 servers.
Windows 2000 native
later.
Supports domain controllers running Windows 2000 and
Windows Server 2003
Supports domain controllers running Windows Server 2003 and Windows Server 2008.
Windows Server 2008
Supports domain controllers running Windows Server 2008.
198 Part II Windows Server 2008 Directory Services Administration
Understanding Domain Forests and Domain Trees
Each Active Directory domain has a DNS domain name, such as microsoft.com. One or more domains sharing the same directory data are referred to as a forest. The domain names within this forest can be discontiguous or contiguous in the DNS naming hierarchy.
When domains have a contiguous naming structure, they’re said to be in the same
domain tree. Figure 7-2 shows an example of a domain tree. In this example the root domain msnbc.com has two child domains—seattle.msnbc.com and ny.msnbc.com.
These domains in turn have subdomains. All the domains are part of the same tree because they have the same root domain.
msnbc.com
seattle.msnbc.com
ny.msnbc.com
hr.seattle.msnbc.com
it.seattle.msnbc.com
hr.ny.msnbc.com
it.ny.msnbc.com
Figure 7-2
Domains in the same tree share a contiguous naming structure.
If the domains in a forest have discontiguous DNS names, they form separate domain trees within the forest. As shown in Figure 7-3, a domain forest can have one or more domain trees. In this example the msnbc.com and microsoft.com domains form the roots of separate domain trees in the same forest.
msnbc.com
ny.msnbc.com
seattle.msnbc.com
hr.seattle.msnbc.com
it.seattle.msnbc.com
microsoft.com
sf.microsoft.com
miami.microsoft.com
eng.sf.microsoft.com
bus.sf.microsoft.com
bus.miami.microsoft.com
Figure 7-3
Multiple trees in a forest have discontiguous naming structures.
Chapter 7 Using Active Directory 199
You access domain structures in Active Directory Domains And Trusts, which is shown in Figure 7-4. Active Directory Domains And Trusts is a snap-in for the Microsoft Management Console (MMC); you can also start it from the Administrative Tools menu.
You’ll find separate entries for each root domain. In Figure 7-4, the active domain is cpandl.com.
Figure 7-4
Use Active Directory Domains And Trusts to work with domains, domain trees, and domain forests.
Forest functions are limited and controlled by the forest functional level. Several forest functional levels are available, including:
Windows 2000
Supports domain controllers running Windows NT 4.0 and later releases of Windows Server. However, you cannot use Windows NT 4.0 domain controllers with Windows Server 2008 and you cannot use Windows Server
2008 domain controllers with Windows NT 4.0 servers.
Windows Server 2003
Supports domain controllers running Windows Server 2003 and Windows Server 2008.
Windows Server 2008
Supports domain controllers running Windows Server 2008.
The Windows Server 2003 forest functional level offers substantial improvements in
Active Directory performance and features over the Windows 2000 forest functional level. When all domains within a forest are operating in this mode, you’ll see improvements in global catalog replication and improved replication efficiency for Active Directory data. Because link values are replicated, you might see improved intersite replication as well. You’ll be able to deactivate schema class objects and attributes; use dynamic auxiliary classes; rename domains; and create one-way, two-way, and transitive forest trusts.
The Windows Server 2008 forest functional level offers incremental improvements in
Active Directory performance and features over the Windows Server 2003 forest functional level. When all domains within a forest are operating in this mode, you’ll see improvements in both intersite and intrasite replication throughout the organization.
Domain controllers will use DFS replication rather than FRS replication as well. Further, Windows Server 2008 security principals are not created until the PDC emulator operations master in the forest root domain is running Windows Server 2008. This requirement is similar to the Windows Server 2003 requirement.
200 Part II Windows Server 2008 Directory Services Administration
Understanding Organizational Units
Organizational units are subgroups within domains that often mirror an organization’s functional or business structure. You can also think of organizational units as logical containers into which you can place accounts, shared resources, and other organizational units. For example, you could create organizational units named Human-
Resources, IT, Engineering, and Marketing for the microsoft.com domain. You could later expand this scheme to include child units. Child organizational units for Marketing could include OnlineSales, ChannelSales, and PrintSales.
Objects placed in an organizational unit can only come from the parent domain. For example, organizational units associated with seattle.microsoft.com can contain objects for this domain only. You can’t add objects from ny.microsoft.com to these containers, but you could create separate organizational units to mirror the business structure of seattle.microsoft.com.
Organizational units are very helpful in organizing the objects around the organization’s business or functional structure. Still, this isn’t the only reason to use organizational units. Other reasons include:
■ Organizational units allow you to assign a group policy to a small set of resources in a domain without applying this policy to the entire domain. This helps you set and manage group policies at the appropriate level in the enterprise.
■ Organizational units create smaller, more manageable views of directory objects in a domain. This helps you manage resources more efficiently.
■
Organizational units allow you to delegate authority and to easily control administrative access to domain resources. This helps you control the scope of administrator privileges in the domain. You could grant user A administrative authority for one organizational unit and not for others. Meanwhile, you could grant user
B administrative authority for all organizational units in the domain.
Organizational units are represented as folders in Active Directory Users And Computers, as shown in Figure 7-5. This utility is a snap-in for the MMC, and you can also start it from the Administrative Tools menu.
Figure 7-5
Use Active Directory Users And Computers to manage users, groups, computers, and organizational units.
Chapter 7 Using Active Directory 201
Understanding Sites and Subnets
A site is a group of computers in one or more IP subnets. You use sites to map your network’s physical structure. Site mappings are independent from logical domain structures, so there’s no necessary relationship between a network’s physical structure and its logical domain structure. With Active Directory you can create multiple sites within a single domain or create a single site that serves multiple domains. The IP address ranges used by a site and the domain namespace also have no connection.
You can think of a subnet as a group of network addresses. Unlike sites, which can have multiple IP address ranges, subnets have a specific IP address range and network mask. Subnet names are shown in the form network/bits-masked, such as
192.168.19.0/24. Here, the network address 192.168.19.9 and network mask
255.255.255.0 are combined to create the subnet name 192.168.19.0/24.
Note
Don’t worry, you don’t need to know how to create a subnet name. In most cases you enter the network address and the network mask and then Windows
Server 2008 generates the subnet name for you.
Computers are assigned to sites based on their location in a subnet or a set of subnets.
If computers in subnets can communicate efficiently with one another over the network, they’re said to be well connected. Ideally, sites consist of subnets and computers that are all well connected. If the subnets and computers aren’t well connected, you might need to set up multiple sites. Being well connected gives sites several advantages:
■ When clients log on to a domain, the authentication process first searches for domain controllers that are in the same site as the client. This means that local domain controllers are used first, if possible, which localizes network traffic and can speed up the authentication process.
■ Directory information is replicated more frequently within sites than between sites. This reduces the network traffic load caused by replication while ensuring that local domain controllers get up-to-date information quickly. You can also use site links to customize how directory information is replicated between sites.
A domain controller designated to perform intersite replication is called a bridge-
head server. By designating a bridgehead server to handle replication between sites, you place the bulk of the intersite replication burden on a specific server rather than on any available server in a site.
You access sites and subnets through Active Directory Sites And Services, as shown in
Figure 7-6. Because this is a snap-in for the MMC, you can add it to any updateable console. You can also open Active Directory Sites And Services from the Administrative
Tools menu.
202 Part II Windows Server 2008 Directory Services Administration
Figure 7-6
Use Active Directory Sites And Services to manage sites and subnets.
Working with Active Directory Domains
Although you must configure both Active Directory and DNS on a Windows Server
2008 network, Active Directory domains and DNS domains have different purposes.
Active Directory domains help you manage accounts, resources, and security. DNS domains establish a domain hierarchy primarily used for name resolution. Windows
Server 2008 uses DNS to map host names, such as zeta.microsoft.com, to numeric
TCP/IP addresses, such as 172.16.18.8. To learn more about DNS and DNS domains, see Chapter 20.
Using Windows 2000 and Later Computers with Active Directory
User computers running professional or business editions of Windows 2000, Windows XP, and Windows Vista can make full use of Active Directory. These computers access the network as Active Directory clients and have full use of Active Directory features. As clients, these systems can use transitive trust relationships that exist within the domain tree or forest. A transitive trust is one that isn’t established explicitly.
Rather, the trust is established automatically based on the forest structure and permissions set in the forest. These relationships allow authorized users to access resources in any domain in the forest.
Server computers running Windows 2000 Server, Windows Server 2003, and Windows Server 2008 provide services to other systems and can act as domain controllers or member servers. A domain controller is distinguished from a member server because it runs Active Directory Domain Services. You promote member servers to domain controllers by installing Active Directory Domain Services. You demote domain controllers to member servers by uninstalling Active Directory Domain
Services. You use the Add Role and Remove Role Wizards to add or remove Active
Directory Domain Services. You promote or demote a server through the Active Directory Installation Wizard (dcpromo.exe).
Chapter 7 Using Active Directory 203
Domains can have one or more domain controllers. When there are multiple domain controllers, the controllers automatically replicate directory data with one another using a multimaster replication model. This model allows any domain controller to process directory changes and then replicate those changes to other domain controllers.
Because of the multimaster domain structure, all domain controllers have equal responsibility by default. You can, however, give some domain controllers precedence over others for certain tasks, such as specifying a bridgehead server that has priority in replicating directory information to other sites. In addition, some tasks are best performed by a single server. A server that handles this type of task is called an operations
master. There are five flexible single master operations (FSMO) roles, and you can
All Windows 2000, Windows XP Professional, Windows Vista, Windows Server 2003, and Windows Server 2008 computers that join a domain have computer accounts.
Like other resources, computer accounts are stored in Active Directory as objects. You use computer accounts to control access to the network and its resources. A computer accesses a domain using its account, which is authenticated before the computer can access the network.
Real World
Domain controllers use Active Directory’s global catalog to authenticate both computer and user logons. If the global catalog is unavailable, only members of the Domain Admins group can log on to the domain. This is because the universal group membership information is stored in the global catalog and this information is required for authentication. In Windows Server 2003 and Windows
Server 2008, you have the option of caching universal group membership locally,
which solves this problem. For more information, see “Understanding the Directory
Working with Domain Functional Levels
All Windows NT, Windows 2000, Windows XP, Windows Vista, Windows Server
2003, and Windows Server 2008 computers must have computer accounts before they can join a domain. To support domain structures, Active Directory includes support for several domain functional levels, including:
Windows 2000 mixed mode
This mode is not recommended for use with Windows
Server 2008. You will not be able to use domain controllers running Windows
Server 2008, and computers running Windows Server 2008 may have issues when working with domain controllers running Windows NT. Domains operating in this mode can’t use many of the latest Active Directory features, including universal groups, group nesting, group type conversion, easy domain controller renaming, update logon timestamps, and Kerberos key distribution center
(KDC) key version numbers.
204 Part II Windows Server 2008 Directory Services Administration
Windows 2000 native mode
When the domain is operating in Windows 2000 native mode, the directory supports domain controllers running Windows Server
2008, Windows Server 2003, and Windows 2000. Windows NT domain controllers are no longer supported. Domains operating in this mode aren’t able to use easy domain controller renaming, update logon timestamps, and Kerberos KDC key version numbers.
Windows Server 2003 mode
When the domain is operating in Windows Server 2003 mode, the directory supports domain controllers running Windows Server 2008 and Windows Server 2003. Windows NT and Windows 2000 domain controllers are no longer supported. A domain operating in Windows Server 2003 mode can use many Active Directory feature enhancements, including universal groups, group nesting, group type conversion, easy domain controller renaming, update logon timestamps, and Kerberos KDC key version numbers.
Windows Server 2008 mode
When the domain is operating in Windows Server 2008 mode, the directory supports only Windows Server 2008 domain controllers.
Windows NT, Windows 2000, and Windows Server 2003 domain controllers are no longer supported. The good news, however, is that a domain operating in
Windows Server 2003 mode can use all the latest Active Directory feature enhancements, including the DFS Replication service for enhanced intersite and intrasite replication.
Using Windows 2000 Native-Mode Operations
After you upgrade the PDC, BDCs, and other Windows NT systems—and if you still have Windows 2000 domain resources—you can change to the Windows 2000 nativemode operations and then use only Windows 2000, Windows Server 2003, and Windows Server 2008 resources in the domain. Once you set the Windows 2000 nativemode operations, however, you can’t go back to mixed mode. Because of this, you should use native-mode operations only when you’re certain that you don’t need the old Windows NT domain structure or Windows NT BDCs.
When you change to Windows 2000 native mode, you’ll notice the following:
■ Kerberos v5 becomes the preferred authentication mechanism and NTLM authentication is no longer used.
■ The PDC emulator can no longer synchronize data with any existing Windows
NT BDCs.
■ You can’t add any Windows NT domain controllers to the domain.
You switch from Windows 2000 mixed-mode to Windows 2000 native-mode operations by raising the domain functional level.
Using Windows Server 2003 Mode Operations
After you’ve upgraded the Windows NT structures in your organization, you can begin upgrading to Windows Server 2003 domain structures. You do this by upgrading Win-
Chapter 7 Using Active Directory 205
dows 2000 domain controllers to Windows Server 2003 or Windows Server 2008 domain controllers and then, if desired, you can change the functional level to Windows Server 2003 mode operations.
Before updating Windows 2000 domain controllers, you should prepare the domain for upgrade. To do this, you’ll need to update the forest and the domain schema so that they are compatible with Windows Server 2003 domains. A tool called Adprep.exe is provided to automatically perform the update for you. All you need to do is run the tool on the schema operations master in the forest and then on the infrastructure operations master for each domain in the forest. As always, you should test out any procedure in the lab before performing it in an operational environment. On Windows
Server 2003 installation media, you'll find Adprep in the i386 subfolder.
Note
To determine which server is the current schema operations master for the domain, open a command prompt and type dsquery server -hasfsmo schema. A directory service path string is returned containing the name of the server, such as:
“CN=CORPSERVER01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,
CN=Configuration,DC=microsoft,DC=com.” This string tells you that the schema operations master is COPRSERVER01 in the microsoft.com domain.
Note
To determine which server is the current infrastructure operations master for the domain, start a command prompt and type dsquery server -hasfsmo infr.
After upgrading your servers, you can raise the domain and forest level functionality to take advantage of the latest Active Directory features. If you do this, however, you can use only Windows Server 2003 and Windows Server 2008 resources in the domain and you can’t go back to any other mode. Therefore, you should use Windows Server
2003 mode only when you’re certain that you don’t need old Windows NT domain structures, Windows NT BDCs, or Windows 2000 domain structures.
Using Windows Server 2008 Mode Operations
After you’ve upgraded the Windows NT and Windows 2000 structures in your organization, you can begin upgrading to Windows Server 2008 domain structures. You do this by upgrading Windows Server 2003 domain controllers to Windows Server
2008 domain controllers and then, if desired, you can change the functional level to
Windows Server 2008 mode operations.
Before updating Windows Server 2003 domain controllers, you should prepare the domain for Windows Server 2008. To do this, you’ll need to use Adprep.exe to update the forest and the domain schema so that they are compatible with Windows Server
2008 domains:
1. On the schema operations master in the forest, copy the contents of the
Sources\Adprep folder from the Windows Server 20008 installation media to a local folder and then run run adprep /forestprep. If you plan to install any
206 Part II Windows Server 2008 Directory Services Administration
read-only domain controllers, you should also run adprep /rodcprep. You’ll need to use an administrator account that is a member of Enterprise Admins,
Schema Admins, or Domain Admins in the forest root domain.
2. On the infrastructure operations master for each domain in the forest, copy the contents of the Sources\Adprep folder from the Windows Server 20008 installation media to a local folder and then run run adprep /domainprep /gpprep.
You’ll need to use an account that is a member of the Domain Admins group in an applicable domain.
As always, you should test out any procedure in the lab before performing it in an operational environment.
Note
To determine which server is the current schema operations master for the domain, start a command prompt and type dsquery server -hasfsmo schema. To determine which server is the current infrastructure operations master for the domain, start a command prompt and type dsquery server -hasfsmo infr.
After upgrading all domain controllers to Windows Server 2008, you can raise the domain and forest level functionality to take advantage of the latest Active Directory features. If you do this, however, you can use only Windows Server 2008 resources in the domain and you can’t go back to any other mode. Because of this, you should use
Windows Server 2008 mode only when you’re certain that you don’t need old Windows NT domain structures, Windows NT BDCs, Windows 2000, or Windows Server
2003 domain structures.
Raising Domain and Forest Functionality
Domains operating in Windows Server 2003 or higher functional level can use many enhancements for Active Directory domains, including universal groups, group nesting, group type conversion, update logon timestamps, and Kerberos KDC key version numbers. In this mode administrators will also be able to do the following:
■
■
■
■
Rename domain controllers without having to demote them first
Rename domains running on Windows Server 2008 domain controllers
Create extended two-way trusts between two forests
Restructure domains in the domain hierarchy by renaming them and putting them at different levels
■ Take advantage of replication enhancements for individual group members and global catalogs
Forests operating in Windows Server 2003 or higher functional level can use the many enhancements for Active Directory forests, which means improved global catalog replication and intrasite and intersite replication efficiency, as well as the ability to establish one-way, two-way, and transitive forest trusts.
Chapter 7 Using Active Directory 207
Real World
The domain and forest upgrade process can generate a lot of network traffic as information is being replicated around the network. Sometimes the entire upgrade process can take 15 minutes or longer to complete. During this time you might experience delayed responsiveness when communicating with servers and higher latency on the network. You therefore might want to schedule the upgrade outside of normal business hours. It’s also a good idea to thoroughly test compatibility with existing applications (especially legacy applications) before performing this operation.
You can raise the domain level functionality by following these steps:
1. Click Start, choose Administrative Tools, and then select Active Directory
Domains And Trusts.
2. Right-click the domain you want to work with in the console tree and then select
Raise Domain Functional Level.
3. The current domain name and functional level are displayed in the Raise
Domain Functional Level dialog box.
4. To change the domain functionality, select the new domain functional level from the selection list provided and then click Raise. However, you can’t reverse this action. Consider the implications carefully before you do this.
5. When you click OK, the new domain functional level will be replicated to each domain controller in the domain. This operation can take some time in a large organization.
You can raise the forest level functionality by following these steps:
1. Click Start, choose Administrative Tools, and then select Active Directory
Domains And Trusts.
2. Right-click the Active Directory Domains And Trusts node in the console tree and then select Raise Forest Functional Level.
3. The current forest name and functional level are displayed in the Raise Forest
Functional Level dialog box.
4. To change the forest functionality, select the new forest functional level using the selection list provided and then click Raise. However, you can’t reverse this action. Consider the implications carefully before you do this.
5. When you click OK, the new forest functional level will be replicated to each domain controller in each domain in the forest. This operation can take some time in a large organization.
208 Part II Windows Server 2008 Directory Services Administration
Understanding the Directory Structure
Active Directory has many components and is built on many technologies. Directory data is made available to users and computers through data stores and global catalogs.
Although most Active Directory tasks affect the data store, global catalogs are equally important because they’re used during logon and for information searches. In fact, if the global catalog is unavailable, normal users can’t log on to the domain. The only way to change this behavior is to cache universal group membership locally. As you might expect, caching universal group membership has advantages and disadvantages, which I’ll discuss in a moment.
You access and distribute Active Directory data using directory access protocols and replication. Directory access protocols allow clients to communicate with computers running Active Directory. Replication is necessary to ensure that updates to data are distributed to domain controllers. Although multimaster replication is the primary technique that you use to distribute updates, some data changes can be handled only by individual domain controllers called operations masters. A new feature of Windows
Server 2008 called application directory partitions also changes the way multimaster replication works.
With application directory partitions, enterprise administrators (those belonging to the Enterprise Admins group) can create replication partitions in the domain forest.
These partitions are logical structures used to control replication of data within a domain forest. For example, you could create a partition to strictly control the replication of DNS information within a domain, thereby preventing other systems in the domain from replicating DNS information.
An application directory partition can appear as a child of a domain, a child of another application partition, or a new tree in the domain forest. Replicas of the application directory partition can be made available on any Active Directory domain controller running Windows Server 2008, including global catalogs. Although application directory partitions are useful in large domains and forests, they add overhead in terms of planning, administration, and maintenance.
Exploring the Data Store
The data store contains information about objects such as accounts, shared resources, organizational units, and group policies. Another name for the data store is the directory, which refers to Active Directory itself.
Domain controllers store the directory in a file called Ntds.dit. This file’s location is set when Active Directory is installed, and it must be on an NTFS file system drive formatted for use with Windows Server 2008. You can also save directory data separately from the main data store. This is true for group policies, scripts, and other types of public information stored on the shared system volume (Sysvol).
Chapter 7 Using Active Directory 209
Because the data store is a container for objects, sharing directory information is called
publishing. For example, you publish information about a printer by sharing the printer over the network. Similarly, you publish information about a folder by sharing the folder over the network.
Domain controllers replicate most changes to the data store in multimaster fashion. As an administrator for a small or medium-sized organization, you’ll rarely need to manage replication of the data store. Replication is handled automatically, but you can customize it to meet the needs of large organizations or organizations with special requirements.
Not all directory data is replicated. Instead, only public information that falls into one of the following three categories is replicated:
Domain data
Contains information about objects within a domain. This includes objects for accounts, shared resources, organizational units, and group policies.
Configuration data
Describes the directory’s topology. This includes a list of all domains, domain trees, and forests, as well as the locations of the domain controllers and global catalog servers.
Schema data
Describes all objects and data types that can be stored in the directory.
The default schema provided with Windows Server 2008 describes account objects, shared resource objects, and more. You can extend the default schema by defining new objects and attributes or by adding attributes to existing objects.
Exploring Global Catalogs
When universal group membership isn’t cached locally, global catalogs enable network logon by providing universal group membership information when a logon process is initiated. Global catalogs also enable directory searches throughout all the domains in a forest. A domain controller designated as a global catalog stores a full replica of all objects in the directory for its host domain and a partial replica for all other domains in the domain forest.
Note
Partial replicas are used because only certain object properties are needed for logon and search operations. Partial replication also means that less information needs to be circulated on the network, reducing the amount of network traffic.
By default, the first domain controller installed on a domain is designated as the global catalog. So if only one domain controller is in the domain, the domain controller and the global catalog are the same server. Otherwise, the global catalog is on the domain controller that you’ve configured as such. You can also add global catalogs to a domain to help improve response time for logon and search requests. The recommended technique is to have one global catalog per site within a domain.
210 Part II Windows Server 2008 Directory Services Administration
Domain controllers hosting the global catalog should be well connected to domain controllers acting as infrastructure masters. The role of infrastructure master is one of the five operations master roles that you can assign to a domain controller. In a domain, the infrastructure master is responsible for updating object references. The infrastructure master does this by comparing its data with that of a global catalog.
If the infrastructure master finds outdated data, it requests the updated data from a global catalog. The infrastructure master then replicates the changes to the other domain controllers in the domain. For more information on operations master roles,
see “Understanding Operations Master Roles” on page 213.
When only one domain controller is in a domain, you can assign the infrastructure master role and the global catalog to the same domain controller. When two or more domain controllers are in the domain, however, the global catalog and the infrastructure master must be on separate domain controllers. If they aren’t, the infrastructure master won’t find out-of-date data and, as a result, will never replicate changes. The only exception is when all domain controllers in the domain host the global catalog. In this case it doesn’t matter which domain controller serves as the infrastructure master.
One of the key reasons to configure additional global catalogs in a domain is to ensure that a catalog is available to service logon and directory search requests. Again, if the domain has only one global catalog and the catalog isn’t available, and there’s no local caching of universal group membership, normal users can’t log on and you can’t search the directory. In this scenario the only users who can log on to the domain when the global catalog is unavailable are members of the Domain Admins group.
Searches in the global catalog are very efficient. The catalog contains information about objects in all domains in the forest. This allows directory search requests to be resolved in a local domain rather than in a domain in another part of the network.
Resolving queries locally reduces the network load and allows for quicker responses in most cases.
Tip
If you notice slow logon or query response times, you might want to configure additional global catalogs. But more global catalogs usually mean more replication data being transferred over the network.
Universal Group Membership Caching
In a large organization it might not be practical to have global catalogs at every office location. Not having global catalogs at every office location presents a problem, however, if a remote office loses connectivity with the main office or a designated branch office where global catalog servers reside: normal users won’t be able to log on; only domain admins will be able to log on. This is because logon requests must be routed over the network to a global catalog server at a different office; with no connectivity, this isn’t possible.
Chapter 7 Using Active Directory 211
As you might expect, you can resolve this problem in many ways. You could make one of the domain controllers at the remote office a global catalog server by following the procedure discussed in “Configuring Global Catalogs” on page 235. The disadvantage is that the designated server or servers will have an additional burden placed on them and might require additional resources. You also have to more carefully manage the up time of the global catalog server.
Another way to resolve this problem is to cache universal group membership locally.
Here, any domain controller can resolve logon requests locally without having to go through the global catalog server. This allows for faster logons and makes managing server outages much easier: your domain isn’t relying on a single server or a group of servers for logons. This solution also reduces replication traffic. Instead of replicating the entire global catalog periodically over the network, only the universal group membership information in the cache is refreshed. By default, a refresh occurs every eight hours on each domain controller that’s caching membership locally.
Universal group membership is site-specific. Remember, a site is a physical directory structure consisting of one or more subnets with a specific IP address range and network mask. The domain controllers running Windows Server 2008 and the global catalog they’re contacting must be in the same site. If you have multiple sites, you’ll need to configure local caching in each site. Additionally, users in the site must be part of a
Windows Server 2008 domain running in Windows Server 2008 forest functional mode. To learn how to configure caching, see “Configuring Universal Group Membership Caching” on page 236.
Replication and Active Directory
Regardless of whether you use FRS or DFS replication, the three types of information stored in the directory are domain data, schema data, and configuration data.
Domain data is replicated to all domain controllers within a particular domain.
Schema and configuration data are replicated to all domains in the domain tree or forest. In addition, all objects in an individual domain, and a subset of object properties in the domain forest, are replicated to global catalogs.
This means that domain controllers store and replicate the following:
■
■
■
Schema information for the domain tree or forest
Configuration information for all domains in the domain tree or forest
All directory objects and properties for their respective domains
Domain controllers hosting a global catalog, however, store and replicate schema information for the forest, configuration information for all domains in the forest, a subset of the properties for all directory objects in the forest that’s replicated between servers hosting global catalogs only, and all directory objects and properties for their respective domain.
212 Part II Windows Server 2008 Directory Services Administration
To get a better understanding of replication, consider the following scenario, in which you’re installing a new network:
1. Start by installing the first domain controller in domain A. The server is the only domain controller and also hosts the global catalog. No replication occurs because other domain controllers are on the network.
2. Install a second domain controller in domain A. Because there are now two domain controllers, replication begins. To make sure that data is replicated properly, assign one domain controller as the infrastructure master and the other as the global catalog. The infrastructure master watches for updates to the global catalog and requests updates to changed objects. The two domain controllers also replicate schema and configuration data.
3. Install a third domain controller in domain A. This server isn’t a global catalog.
The infrastructure master watches for updates to the global catalog, requests updates to changed objects, and then replicates those changes to the third domain controller. The three domain controllers also replicate schema and configuration data.
4. Install a new domain, domain B, and add domain controllers to it. The global catalog hosts in domain A and domain B begin replicating all schema and configuration data, as well as a subset of the domain data in each domain. Replication within domain A continues as previously described. Replication within domain
B begins.
Active Directory and LDAP
The Lightweight Directory Access Protocol (LDAP) is a standard Internet communications protocol for TCP/IP networks. LDAP is designed specifically for accessing directory services with the least amount of overhead. LDAP also defines operations that can be used to query and modify directory information.
Active Directory clients use LDAP to communicate with computers running Active
Directory whenever they log on to the network or search for shared resources. You can also use LDAP to manage Active Directory.
LDAP is an open standard that many other directory services can use. This makes interdirectory communications easier and provides a clearer migration path from other directory services to Active Directory. You can also use Active Directory Service
Interface (ADSI) to enhance interoperability. ADSI supports the standard application programming interfaces (APIs) for LDAP that are specified in Internet standard
Request For Comments (RFC) 1823. You can use ADSI with Windows Script Host to script objects in Active Directory.
Chapter 7 Using Active Directory 213
Understanding Operations Master Roles
Operations master roles accomplish tasks that are impractical to perform in multimaster fashion. Five operations master roles are defined; you can assign them to one or more domain controllers. Although certain roles can be assigned only once in a domain forest, other roles must be defined once in each domain.
Every Active Directory forest must have the following roles:
Schema master
Controls updates and modifications to directory schema. To update directory schema, you must have access to the schema master. To determine which server is the current schema master for the domain, start a command prompt and type dsquery server -hasfsmo schema.
Domain naming master
Controls the addition or removal of domains in the forest. To add or remove domains, you must have access to the domain naming master.
To determine which server is the current domain naming master for the domain, start a command prompt and type dsquery server -hasfsmo name.
These forest-wide roles must be unique in the forest. This means you can assign only one schema master and one domain naming master in a forest.
Every Active Directory domain must have the following roles:
Relative ID master
Allocates relative IDs to domain controllers. Whenever you create a user, group, or computer object, domain controllers assign a unique security ID to the related object. The security ID consists of the domain’s security ID prefix and a unique relative ID, which was allocated by the relative ID master. To determine which server is the current relative ID master for the domain, start a command prompt and type dsquery server -hasfsmo rid.
PDC emulator
When you use mixed- or interim-mode operations, the PDC emulator acts as a Windows NT PDC. Its job is to authenticate Windows NT logons, process password changes, and replicate updates to the BDCs. To determine which server is the current PDC emulator master for the domain, start a command prompt and type dsquery server -hasfsmo pdc.
Infrastructure master
Updates object references by comparing its directory data with that of a global catalog. If the data is outdated, the infrastructure master requests the updated data from a global catalog and then replicates the changes to the other domain controllers in the domain. To determine which server is the current infrastructure operations master for the domain, start a command prompt and type dsquery server -hasfsmo infr.
These domain-wide roles must be unique in each domain. This means you can assign only one relative ID master, one PDC emulator, and one infrastructure master in each domain.
214 Part II Windows Server 2008 Directory Services Administration
Operations master roles are usually assigned automatically, but you can reassign them.
When you install a new network, the first domain controller in the first domain is assigned all the operations master roles. If you later create a new child domain or a root domain in a new tree, the first domain controller in the new domain is automatically assigned operations master roles as well. In a new domain forest, the domain controller is assigned all operations master roles. If the new domain is in the same forest, the assigned roles are relative ID master, PDC emulator, and infrastructure master. The schema master and domain naming master roles remain in the first domain in the forest.
When a domain has only one domain controller, that computer handles all the operations master roles. If you’re working with a single site, the default operations master locations should be sufficient. As you add domain controllers and domains, however, you’ll probably want to move the operations master roles to other domain controllers.
When a domain has two or more domain controllers, you should configure two domain controllers to handle operations master roles. Here, you would make one domain controller the operations master and the second the standby operations master. The standby operations master is then used if the primary fails. Be sure that the domain controllers are direct replication partners and are well connected.
As the domain structure grows, you might want to split up the operations master roles and place them on separate domain controllers. This can improve the responsiveness of the operations masters. Pay particular attention to the current responsibilities of the domain controller you plan to use.
Best Practices
Two roles that you should not separate are schema master and domain naming master. Always assign these roles to the same server. For the most efficient operations, you’ll usually want the relative ID master and PDC emulator to be on the same server as well. But you can separate these roles if necessary. For example, on a large network where peak loads are causing performance problems, you would probably want to place the relative ID master and PDC emulator on separate domain controllers. Additionally, you usually shouldn’t place the infrastructure
Chapter 12
Managing File Systems and Drives
In this chapter:
Managing the File Services Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .331
Working with Basic and Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . . . .346
Using Basic Disks and Partitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .351
Managing Existing Partitions and Drives . . . . . . . . . . . . . . . . . . . . . . . .357
A hard disk drive is the most common storage device used on network workstations and servers. Users depend on hard disk drives to store their word-processing documents, spreadsheets, and other types of data. Drives are organized into file systems that users can access either locally or remotely.
Local file systems are installed on a user’s computer and don’t require remote network connections to access. The C drive available on most workstations and servers is an example of a local file system. You access the C drive using the file path C:\.
You access remote file systems, on the other hand, through a network connection to a remote resource. You can connect to a remote file system using the Map Network Drive feature of Windows Explorer.
Wherever disk resources are located, your job as a system administrator is to manage them. The tools and techniques you use to manage file systems and drives are discussed in this chapter. Chapter 13, “Administering Volume Sets and RAID Arrays,” looks at volume sets and fault tolerance. Chapter 14, “Managing File Screening and
Storage Reporting,” tells you how to manage files and directories.
Managing the File Services Role
A file server provides a central location for storing and sharing files across the network.
When many users require access to the same files and application data, you should configure file servers in the domain. In earlier releases of the Windows Server operating system, all servers were installed with basic file services. With Windows Server
2008, you must specifically configure a server to be a file server by adding the File
Services role and configuring this role to use the appropriate role services.
331
332 Part III Windows Server 2008 Data Administration
Table 12-1 provides an overview of the role services associated with the File Services role. When you install the File Services role, you may also want to install these optional features:
Windows Server Backup
The new backup utility included with Windows Server 2008.
Storage Manager for SANs
(SANs).
Allows you to provision storage for storage area networks
Multipath IO
Provides support for using multiple data paths between a file server and a storage device. Servers use multiple IO paths for redundancy in case of failure of a path and to improve transfer performance.
Table 12-1 Role Services for File Servers
Role Service
Share and Storage
Management
Distributed File System
(DFS)
DFS Namespaces
DFS Replication
File Server Resource
Manager (FSRM)
Description
Installs the Share And Storage Management console and configures the server so that this console can be used. This console allows administrators to manage shared folders and allows users to access shared folders over the network. You can also use this console to configure logical unit numbers
(LUNs) in a storage area network (SAN).
Provides tools and services for DFS Namespaces and DFS
Replication. DFS Replication is a newer and preferred replication technology. When a domain is running in Windows
2008 Domain Functional Level, domain controllers use DFS
Replication to provide more robust and granular replication of the Sysvol directory.
Allows you to group shared folders located on different servers into one or more logically structured namespaces.
Each namespace appears as a single shared folder with a series of subfolders. However, the underlying structure of the namespace can come from shared folders on multiple servers in different sites.
Allows you to synchronize folders on multiple servers across local or wide area network connections using a multimaster replication engine. The replication engine uses the Remote
Differential Compression (RDC) protocol to synchronize only the portions of files that have changed since the last replication. You can use DFS Replication with DFS Namespaces or by itself.
Installs a suite of tools that administrators can use to better manage data stored on servers. Using FSRM, administrators can generate storage reports, configure quotas, and define file screening policies.
Chapter 12 Managing File Systems and Drives 333
Table 12-1 Role Services for File Servers
Role Service Description
Services for Network File
System
Provides a file sharing solution for enterprises with mixed
Windows and UNIX environments. When you install Services for Network File System (NFS), users can transfer files between
Windows Server 2008 and UNIX operating systems using the
NFS protocol.
Windows Search Service Allows fast file searches of resources on the server from clients that are compatible with Windows Search Service. This feature is designed primarily for desktop and small office implementations.
Windows Server 2003
File Services
Provides file services that are compatible with Windows Server
2003. This allows you to use a server running Windows Server
2008 with servers running Windows Server 2003.
File Replication Service
(FRS)
Indexing Service
Allows you to synchronize folders with file servers that use FRS instead of DFS for replication. Also allows synchronization with
Windows 2000 implementations of DFS. If your organization has computers running FRS, you may need to install this role service to ensure compatibility with Windows Server 2008.
When a domain is using Windows 2003 Domain Functional
Level, domain controllers running Windows Server 2008 use
FRS for replication automatically.
Allows indexing of files and folders for faster searching. Using the related query language, users can find files quickly. You cannot install Indexing Service and Windows Search Service on the same computer.
You can add the File Services role to a server by following these steps:
1. In Server Manager, select the Roles node in the left pane and then click Add
Roles. This starts the Add Roles Wizard. If the wizard displays the Before You
Begin page, read the Welcome text and then click Next.
Note
During the setup process, shared files are created on the server. If you encounter a problem that causes the setup process to fail, you will need to resume the setup process using the Add Role Services Wizard. After you restart Server Manager, select the File Services node under Roles. In the main pane scroll down and then click Add Role Services. You can continue with the installation, starting with step 3. If you were in the process of configuring domain-based DFS, you’ll need to provide administrator credentials.
2. On the Select Server Roles page, select File Services and then click Next twice.
3. On the Select Role Services page, select one or more role services to install. A summary of each role service is provided in Table 12-1. To allow for interoperability with UNIX, be sure to add Services For Network File System. Click Next.
334 Part III Windows Server 2008 Data Administration
4. A DFS namespace is a virtual view of shared folders located on different servers.
If you are installing DFS Namespaces, you’ll have three additional configuration pages:
❑ On the Create A DFS Namespace page, set the root name for the first namespace or elect to create a namespace later as shown in the following screen. The namespace root name should be something that is easy for users to remember, such as CorpData. In a large enterprise, you may need to create separate namespaces for each major division.
❑ On the Select Namespace Type page, specify whether you want to create a domain-based namespace or a stand-alone namespace as shown in the following screen. Domain-based namespaces can be replicated with multiple namespace servers to provide high availability but can only have up to
5,000 DFS folders. Stand-alone namespaces can have up to 50,000 DFS folders but are replicated only when you use failover server clusters and configure replication.
❑ On the Configure Namespace page, you can add shared folders to the namespace as well as namespaces that are associated with a DFS folder as shown in the following screen. Click Add. In the Add Folder To Namespace dialog box, click Browse. In the Browse For Shared Folders dialog box, select the shared folder to add and then click OK. Next, type a name for the folder to add and then click OK. Next, type a name for the folder in the namespace. This name can be the same as the original folder name or a new name that will be associated with the original folder in the namespace.
After you type a name, click OK to add the folder and complete the process.
Chapter 12 Managing File Systems and Drives 335
Note
You do not have to configure DFS Namespaces at this time. Once you’ve installed DFS Namespaces, DFS Replication, or both, you can use the
DFS Management console to manage the related features. This console is installed and available on the Administrative Tools menu. See Chapter 15,
“Data Sharing, Security, and Auditing,” for more information.
5. With File Server Resource Manager, you can monitor the amount of space used on disk volumes and create storage reports. If you are installing File Server
Resource Manager, you’ll have two additional configuration pages:
❑
On the Configure Storage Usage Monitoring page, you can select disk volumes for monitoring as shown in the following screen. When you select a volume and then click Options, you can set the volume usage threshold and choose the reports to generate when the volume reaches the threshold value. By default, the usage threshold is 85 percent.
❑ On the Set Report Options page, you can select a save location for usage reports as shown in the following screen. One usage report of each previously selected type is generated each time a volume reaches its threshold.
Old reports are not automatically deleted. The default save location is
%SystemDrive%\StorageReports. To change the default location, click
Browse and then select the new save location in the Browse For Folder
336 Part III Windows Server 2008 Data Administration
dialog box. You can also elect to receive reports by e-mail. To do this, you must specify the recipient e-mail addresses and the SMTP server to use.
Note
You do not have to configure monitoring and reporting at this time.
After you’ve installed FSRM, you can use the File Server Resource Manager console to manage the related features. This console is installed and available on the Administrative Tools menu. See Chapter 14 for more information.
6. If you are installing Windows Search Service, you’ll see an additional configuration page that allows you to select the volumes to index. Indexing a volume makes it possible for users to search a volume quickly. However, indexing entire volumes can affect service performance, especially if you index the system volume. Therefore, you may only want to index specific shared folders on volumes, which you’ll be able to do later on a per-folder basis.
Note
You do not have to configure indexing at this time. After you’ve installed Windows Search Service, you can use the Indexing Options utility in
Control Panel to manage the related features.
7. When you’ve completed all the optional pages, click Next. You’ll see the Confirm
Installation Options page. Click Install to begin the installation process. When
Setup finishes installing the server with the features you’ve selected, you’ll see the Installation Results page. Review the installation details to ensure that all phases of the installation completed successfully.
If the File Services role is installed already on a server and you want to install additional services for a file server, you can add role services to the server using a similar process.
In Server Manager, expand the Roles node and then select the File Services node. In the main pane, the window is divided into several panels. Scroll down until you see the
Role Services panel and then click Add Role Services. You can then follow the previous procedure starting with step 3 to add Role Services.
Chapter 12 Managing File Systems and Drives 337
Adding Hard Disk Drives
Before you make a hard disk drive available to users, you’ll need to configure it and consider how it’ll be used. With Microsoft Windows Server 2008, you can configure hard disk drives in a variety of ways. The technique you choose depends primarily on the type of data you’re working with and the needs of your network environment. For general user data stored on workstations, you might want to configure individual drives as stand-alone storage devices. In that case, user data is stored on a workstation’s hard disk drive, where it can be accessed and stored locally.
Although storing data on a single drive is convenient, it isn’t the most reliable way to store data. To improve reliability and performance, you might want a set of drives to work together. Windows Server 2008 supports drive sets and arrays using redundant array of independent disks (RAID) technology, which is built into the operating system.
Physical Drives
Whether you use individual drives or drive sets, you’ll need physical drives. Physical drives are the actual hardware devices that are used to store data. The amount of data a drive can store depends on its size and whether it uses compression. Typical drives have capacities of 100 gigabytes (GB) to 500 GB. Many drive types are available for use with Windows Server 2008, including Small Computer System Interface (SCSI), Parallel ATA (PATA), and Serial ATA (SATA).
The terms SCSI, PATA, and SATA designate the interface type used by the hard disk drives. This interface is used to communicate with a drive controller. SCSI drives use
SCSI controllers, PATA drives use PATA controllers, and so on. When setting up a new server, you should give considerable thought to the drive configuration. Start by choosing drives or storage systems that provide the appropriate level of performance. There really is a substantial difference in speed and performance among various drive specifications.
You should consider not only the capacity of the drive but also the following:
Rotational speed
A measurement of how fast the disk spins
Average seek time
A measurement of how long it takes to seek between disk tracks during sequential input/output (I/O) operations
Generally speaking, when comparing drives that conform to the same specification, such as Ultra320 SCSI or SATA II, the higher the rotational speed (measured in thousands of rotations per minute) and the lower the average seek time (measured in milliseconds, or msecs), the better. As an example, a drive with a rotational speed of
15,000 RPM will give you 45 percent to 50 percent more I/O per second than the average 10,000 RPM drive, all other things being equal. A drive with a seek time of 3.5 msec will give you a 25 percent to 30 percent response time improvement over a drive with a seek time of 4.7 msec.
338 Part III Windows Server 2008 Data Administration
Other factors to consider include the following:
Maximum sustained data transfer rate
can continuously transfer
A measurement of how much data the drive
Mean time to failure (MTTF)
A measurement of how many hours of operation you can expect to get from the drive before it fails
Nonoperational temperatures
drive fails
Measurements of the temperatures at which the
Most drives of comparable quality will have similar transfer rates and MTTF. For example, if you compare Ultra320 SCSI drives with a 15,000 RPM rotational speed, you will probably find similar transfer rates and MTTF. For example, the Maxtor Atlas 15K II has a maximum sustained data transfer rate of up to 98 megabytes per second (MBps).
The Seagate Cheetah 15K.4 has a maximum sustained data transfer rate of up to 96
MBps. Both have an MTTF of 1.4 million hours. Transfer rates can also be expressed in gigabits per second (Gbps). A rate of 1.5 Gbps is equivalent to a data rate of 188 MBps, and 3.0 Gbps is equivalent to 375 MBps. Sometimes you’ll see a maximum external transfer rate (per the specification to which the drive complies) and an average sustained transfer rate. The average sustained transfer rate is the most important factor.
The Seagate Barracuda 7200 SATA II drive has a rotational speed of 7,200 RPM and an average sustained transfer rate of 58 MBps. With an average seek time of 8.5 msec and an MTTF of 1 million hours, the drive performs comparably to other 7,200 RPM SATA
II drives. However, most Ultra320 SCSI drives perform better and are better at multiuser read/write operations, too.
Temperature is another important factor to consider when you’re selecting a drive—but it’s a factor few administrators take into account. Typically, the faster a drive rotates, the hotter it will run. This is not always the case, but it is certainly something you should consider when making your choice. For example, 15K drives tend to run hot, and you must be sure to carefully regulate temperature. Both the Maxtor Atlas 15K II and the Seagate Cheetah 15K.4 can become nonoperational at temperatures of 70°C or higher (as would most other drives).
Preparing a Physical Drive for Use
After you install a drive, you’ll need to configure it for use. You configure the drive by partitioning it and creating file systems in the partitions, as needed. A partition is a section of a physical drive that functions as if it were a separate unit. After you create a partition, you can create a file system in the partition.
Two partition styles are used for disks: Master Boot Record (MBR) and GUID Partition
Table (GPT). Although both 32-bit and 64-bit editions of Windows Server 2008 support both MBR and GPT, the GPT partition style is not recognized by any earlier releases of Windows Server for x86 or x64 architectures.
The MBR contains a partition table that describes where the partitions are located on the disk. With this partition style, the first sector on a hard disk contains the Master
Chapter 12 Managing File Systems and Drives 339
Boot Record and a binary code file called the master boot code that’s used to boot the system. This sector is unpartitioned and hidden from view to protect the system.
With the MBR partitioning style, disks support volumes of up to four terabytes (TB) and use one of two types of partitions—primary or extended. Each MBR drive can have up to four primary partitions or three primary partitions and one extended partition.
Primary partitions are drive sections that you can access directly for file storage. You make a primary partition accessible to users by creating a file system on it. Unlike primary partitions, you can’t access extended partitions directly. Instead, you can configure extended partitions with one or more logical drives that are used to store files.
Being able to divide extended partitions into logical drives allows you to divide a physical drive into more than four sections.
GPT was originally developed for high-performance Itanium-based computers. GPT is recommended for disks larger than 2 TB on x86 and x64 systems, or any disks used on
Itanium-based computers. The key difference between the GPT partition style and the
MBR partition style has to do with how partition data is stored. With GPT, critical partition data is stored in the individual partitions and redundant primary and backup partition tables are used for improved structure integrity. Additionally, GPT disks support volumes of up to 18 exabytes and up to 128 partitions. Although underlying differences exist between the GPT and MBR partitioning styles, most disk-related tasks are performed in the same way.
Using Disk Management
You’ll use the Disk Management snap-in for the Microsoft Management Console
(MMC) to configure drives. Disk Management makes it easy to work with the internal and external drives on a local or remote system. Disk Management is included as part of the Computer Management console and the Server Manager console. You can also add it to custom MMCs. In Computer Management and in Server Manager, you can access Disk Management by expanding the Storage node and then selecting Disk
Management.
Regardless of whether you are using Computer Management or Server Manager, Disk
Management has three views: Disk List, Graphical View, and Volume List. With remote systems you’re limited in the tasks you can perform with Disk Management. Remote management tasks you can perform include viewing drive details, changing drive letters and paths, and converting disk types. With removable media drives, you can also eject media remotely. To perform more advanced manipulation of remote drives, you can use the DISKPART command-line utility.
Note
Before you work with Disk Management, you should know several things. If you create a partition but don’t format it, the partition will be labeled as Free Space.
If you haven’t assigned a portion of the disk to a partition, this section of the disk is labeled Unallocated.
340 Part III Windows Server 2008 Data Administration
In Figure 12-1, the Volume List view is in the upper-right corner and the Graphical
View is in the lower-right corner. This is the default configuration. You can change the view for the top or bottom pane as follows:
■ To change the top view, select View, choose Top, and then select the view you want to use.
■ To change the bottom view, select View, choose Bottom, and then select the view you want to use.
■ To hide the bottom view, select View, choose Bottom, and then select Hidden.
Figure 12-1
In Disk Management the upper view provides a detailed summary of all the drives on the computer and the lower view provides an overview of the same drives by default.
Windows Server 2008 supports three types of disk configurations:
Basic
The standard fixed disk type used in previous versions of Windows. Basic disks are divided into partitions and can be used with previous versions of Windows.
Dynamic
An enhanced fixed disk type for Windows Server 2008 that you can update without having to restart the system (in most cases). Dynamic disks are divided into volumes and can be used only with Windows 2000 and later releases of
Windows.
Removable
The standard disk type associated with removable storage devices.
Removable storage devices can be formatted with exFAT, FAT16, FAT32, or
NTFS.
Chapter 12 Managing File Systems and Drives 341
Real World
Both Windows Vista with SP1 or later and Windows Server 2008 support exFAT with removable storage devices. The exFAT file system is the next generation file system in the FAT (FAT12/16, FAT32) family. While retaining the easeof-use advantages of FAT32, exFAT overcomes FAT32’s 4-GB file size limit and
FAT32’s 32-GB partition size limit on Windows systems. exFAT also supports allocation unit sizes of up to 32,768 KB.
exFAT is designed so that it can be used with any compliant operating system or device. This means you could remove an exFAT storage device from a compliant camera and insert it into a compliant phone or vice versa without having to do any reformatting. It also means that you could remove an exFAT storage device from a computer running Mac OS or Linux and insert it into a computer running Windows.
From the Disk Management window, you can get more detailed information on a drive section by right-clicking it and then selecting Properties from the shortcut menu.
When you do this, you see a dialog box. With fixed disks, the dialog box is much like the first one shown in Figure 12-2. With removable disks, the dialog box is much like the second one shown in Figure 12-2. This is the same dialog box that you can open from Windows Explorer (by selecting the top-level folder for the drive and then selecting Properties from the File menu).
Figure 12-2
The General tab of the Properties dialog box provides detailed information about a drive.
Removable Storage Devices
Removable storage devices can be formatted with NTFS, FAT, FAT32, and exFAT. You connect external storage devices to a computer rather than installing them inside the computer. This makes external storage devices easier and faster to install than most fixed disk drives. Most external storage devices have either a universal serial bus (USB)
342 Part III Windows Server 2008 Data Administration
or a FireWire interface. When working with USB and FireWire, the transfer speed and overall performance of the device from a user’s perspective depends primarily on the version supported. Currently, several versions of USB and FireWire are used, including
USB 1.0, USB 1.1, USB 2.0, FireWire 400, and FireWire 800.
USB 2.0 is the industry standard and it supports data transfers at a maximum rate of
480 Mb per second, with sustained data transfer rates usually from 10 to 30 Mb per second. The actual sustainable transfer rate depends on many factors, including the type of device, the data you are transferring, and the speed of a computer. Each USB controller on a computer has a fixed amount of bandwidth, which all devices attached to the controller must share. The data transfer rates will be significantly slower if a computer’s USB port is an earlier version than the device you are using. For example, if you connect a USB 2.0 device to a USB 1.0 port or vice versa, the device will operate at the significantly reduced USB 1.0 transfer speed.
USB 1.0, 1.1, and 2.0 ports all look alike. The best way to determine which type of USB ports a computer has is to refer to the documentation that came with a computer.
Newer LCD monitors will have USB 2.0 ports to which you can connect devices as well. When you have USB devices connected to a monitor, the monitor acts like a USB hub device. As with any USB hub device, all devices attached to the hub share the same bandwidth and the total available bandwidth is determined by the speed of the USB input to which the hub is connected on a computer.
FireWire (IEEE 1394) is a high-performance connection standard that uses a peer-topeer architecture in which peripherals negotiate bus conflicts to determine which device can best control a data transfer. Like USB, several versions of FireWire currently are used, including FireWire 400 and FireWire 800. FireWire 400 (IEEE 1394a) has maximum sustained transfer rates of up to 400 Mb per second. FireWire 800
(IEEE 1394b) has maximum sustained transfer rates of up to 800 Mb per second. Similar to USB, if you connect a FireWire 800 device to a FireWire 400 port or vice versa, the device will operate at the significantly reduced FireWire 400 transfer speed.
FireWire 400 and FireWire 800 ports and cables have different shapes, making it easier to tell the difference between them—if you know what you’re looking for. With that said, FireWire 400 ports and cables look exactly like early versions of FireWire that were implemented prior to the finalization of the IEEE 1394a and IEEE 1394b specifications. Early FireWire implementations have a different number of pins on their connector cables and a different number of connectors on their ports. Because of this, you can tell early FireWire and FireWire 400 apart by looking closely at the cables and ports. Early FireWire cables and ports have four pins and four connectors. FireWire
400 cables and ports have six pins and six connectors.
When you are purchasing an external device for a computer, you’ll also want to consider what interfaces it supports. In some cases, you may be able to get a device with a dual interface that supports USB 2.0 and FireWire 400, or a triple interface that
Chapter 12 Managing File Systems and Drives 343
supports USB 2.0, FireWire 400, and FireWire 800. A device with dual or triple interfaces will give you more options.
Working with removable disks is similar to working with fixed disks. You can
■ Right-click a removable disk and select Open or Explore to examine the disk’s contents in Windows Explorer.
■ Right-click a removable disk and select Format to format removable disks as dis-
cussed in “Formatting Partitions” on page 355. Removable disks generally are
formatted with a single partition.
■ Right-click a removable disk and select Properties to view or set properties. On the General tab of the Properties dialog box, you can set the volume label as dis-
cussed in “Changing or Deleting the Volume Label” on page 358.
When you work with removable disks, you can customize disk and folder views. To do this, right-click the disk or folder and then click the Customize tab. You can then specify the default folder type to control the default details displayed. For example, you can set the default folder types as Documents or Pictures And Videos. You can also set folder pictures and folder icons.
Removable disks support network file and folder sharing. You configure sharing on removable disks in the same way that you configure standard file sharing. You can assign share permissions, configure caching options for offline file use, and limit the number of simultaneous users. You can share an entire removable disk as well as individual folders stored on the removable disk. You can also create multiple share instances.
Removable disks differ from standard NTFS sharing in that there isn’t necessarily an underlying security architecture. With exFAT, FAT, or FAT32, folders and files stored do not have any security permissions or features other than the basic read-only or hidden attribute flags that you can set.
Installing and Checking for a New Drive
Hot swapping is a feature that allows you to remove devices without shutting off the computer. Typically, hot-swappable drives are installed and removed from the front of the computer. If your computer supports hot swapping of drives, you can install drives to the computer without having to shut down. After you do this, open Disk Management, and select Rescan Disks from the Action menu. New disks that are found are added with the appropriate disk type. If a disk that you’ve added isn’t found, reboot.
If the computer doesn’t support hot swapping of drives, you must turn the computer off and then install the new drives. Then you can scan for new disks as described previously. If you are working with new disks that have not been initialized—meaning they don’t have disk signatures—Disk Management will start the Initialize And Convert Disk
Wizard as soon it starts up and detects the new disks.
344 Part III Windows Server 2008 Data Administration
You can use the Initialize And Convert Disk Wizard to initialize the disks by following these steps:
1. Click Next to exit the Welcome page. On the Select Disks To Initialize page, the disks you added are selected for initialization automatically, but if you don’t want to initialize a particular disk, you can clear the related option.
2. Click Next to display the Select Disks To Convert page. This page lists the new disks as well as any nonsystem or boot disks that can be converted to dynamic disks. The new disks aren’t selected by default. If you want to convert the disks, select them and then click Next.
3. The final page shows you the options you’ve selected and the actions that will be performed on each disk. If the options are correct, click Finish. The wizard then performs the designated actions. If you’ve elected to initialize a disk, the wizard writes a disk signature to the disk. If you’ve elected to convert a disk, the wizard converts the disk to a dynamic disk after writing the disk signature.
If you don’t want to use the Initialize And Convert Disk Wizard, you can close it and use Disk Management instead to view and work with the disk. In the Disk List view, the disk will be marked with a red exclamation point icon, and the disk’s status will be listed as Not Initialized. You can then right-click the disk’s icon and select Initialize
Disk. Confirm the selection (or add to the selection if more than one disk is available for initializing) and then click OK to start the initialization of the disk. Conversion to a dynamic disk would then proceed as discussed in “Converting a Basic Disk to a
Dynamic Disk” on page 348.
Understanding Drive Status
Knowing the drive status is useful when you install new drives or troubleshoot drive problems. Disk Management shows the drive status in the Graphical View and Volume
List view. Table 12-2 summarizes the most common status values.
Table 12-2 Common Drive Status Values
Status
Online
Online (Errors)
Description Resolution
The normal disk status. It means the disk is accessible and doesn’t have problems.
Both dynamic disks and basic disks display this status.
The drive doesn’t have any known problems. You don’t need to take any corrective action.
I/O errors have been detected on a dynamic disk.
You can try to correct temporary errors by right-clicking the disk and choosing Reactivate Disk. If this doesn’t work, the disk might have physical damage or you might need to run a thorough check of the disk.
Chapter 12 Managing File Systems and Drives 345
Table 12-2 Common Drive Status Values
Status
Offline
Foreign
Unreadable
Unrecognized
Not Initialized
No Media
Description Resolution
The disk isn’t accessible and might be corrupted or temporarily unavailable. If the disk name changes to Missing, the disk can no longer be located or identified on the system.
Check for problems with the drive, its controller, and cables. Make sure that the drive has power and is connected properly. Use the Reactivate Disk command to bring the disk back online (if possible).
The disk has been moved to your computer but hasn’t been imported for use. A failed drive brought back online might sometimes be listed as Foreign.
Right-click the disk and choose
Import Foreign Disks to add the disk to the system.
The disk isn’t accessible currently, which can occur when disks are being rescanned. Both dynamic and basic disks display this status.
With FireWire/USB card readers, you might see this status if the card is unformatted or improperly formatted. You might also see this status after the card is removed from the reader. Otherwise, if the drives aren’t being scanned, the drive might be corrupted or have I/O errors.
Right-click the disk and choose
Rescan Disk (on the Action menu) to try to correct the problem. You might also want to reboot the system.
The disk is of an unknown type and can’t be used on the system. A drive from a non-
Windows system might display this status.
If the disk is from another operating system, don’t do anything. You can’t use the drive on the computer, so try a different drive.
The disk doesn’t have a valid signature. A drive from a non-
Windows system might display this status.
If the disk is from another operating system, don’t do anything. You can’t use the drive on the computer, so try a different drive. To prepare the disk for use on Windows Server 2008, right-click the disk and choose
Initialize Disk.
No media has been inserted into the CD-ROM or removable drive, or the media has been removed. Only CD-
ROM and removable disk types display this status.
Insert a CD-ROM, a floppy disk, or a removable disk to bring the disk online. With FireWire/USB card readers, this status is usually (but not always) displayed when the card is removed.
346 Part III Windows Server 2008 Data Administration
Working with Basic and Dynamic Disks
Windows Server 2008 supports two types of disk configurations:
Basic
The standard disk type used in previous versions of Windows. Basic disks are divided into partitions and can be used with previous versions of Windows.
Dynamic
An enhanced disk type for Windows Server 2008 that you can update without having to restart the system (in most cases). Dynamic disks are divided into volumes and can be used only with Windows 2000 and later releases of Windows.
Note
You can’t use dynamic disks on portable computers or with removable media.
Using Basic and Dynamic Disks
When you convert to Windows Server 2008, disks with partitions are initialized as basic disks. When you install Windows Server 2008 on a new system with unpartitioned drives, you have the option of initializing the drives as either basic or dynamic.
Basic drives support the standard fault-tolerant features. You can use basic drives to maintain existing spanning, mirroring, and striping configurations and to delete these configurations. However, you can’t create new fault-tolerant drive sets using the basic disk type. You’ll need to convert to dynamic disks and then create volumes that use mirroring or striping. The fault-tolerant features and the ability to modify disks without having to restart the computer are the key capabilities that distinguish basic and dynamic disks. Other features available on a disk depend on the disk formatting.
You can use both basic and dynamic disks on the same computer. The catch is that volume sets must use the same disk type. For example, if you have mirrored drives C and
D that were created under Windows NT 4.0, you can use these drives under Windows
Server 2008. If you want to convert C to the dynamic disk type, you must also convert
D. To learn how to convert a disk from basic to dynamic, see “Changing Drive Types” on page 348.
You can perform different disk configuration tasks with basic and dynamic disks. With basic disks, you can do the following:
■
■
■
■
Format partitions and mark them as active
Create and delete primary and extended partitions
Create and delete logical drives within extended partitions
Convert from a basic disk to a dynamic disk
With dynamic disks, you can do the following:
■
■
Create and delete simple, striped, spanned, mirrored, and RAID-5 volumes
Remove a mirror from a mirrored volume
Chapter 12 Managing File Systems and Drives
■
■
■
■
■
Extend simple or spanned volumes
Split a volume into two volumes
Repair mirrored or RAID-5 volumes
Reactivate a missing or offline disk
Revert to a basic disk from a dynamic disk (requires deleting volumes and reloading)
With either disk type, you can do the following:
■
■
■
View properties of disks, partitions, and volumes
Make drive letter assignments
Configure security and drive sharing
347
Special Considerations for Basic and Dynamic Disks
Whether you’re working with basic or dynamic disks, you need to keep in mind five special types of drive sections:
Active
The active partition or volume is the drive section for system cache and startup. Some devices with removable storage may be listed as having an active partition.
Boot
The boot partition or volume contains the operating system and its support files. The system and boot partition or volume can be the same.
Crash Dump
The partition to which the computer attempts to write dump files in the event of a system crash. By default, dump files are written to the %SystemRoot% folder, but can be located on any desired partition or volume.
Page File
A partition containing a paging file used by the operating system. Because a computer can page memory to multiple disks, according to the way virtual memory is configured, a computer can have multiple page file partitions or volumes.
System
The system partition or volume contains the hardware-specific files needed to load the operating system. The system partition or volume can’t be part of a striped or spanned volume.
Note
On an x86-based computer, you can mark a partition as active using Disk
Management. In Disk Management, right-click the primary partition you want to mark as active, and then select Mark Partition As Active. You can’t mark dynamic disk volumes as active. When you convert a basic disk containing the active partition to a dynamic disk, this partition becomes a simple volume that’s active automatically.
348 Part III Windows Server 2008 Data Administration
Changing Drive Types
Basic disks are designed to be used with previous versions of Windows. Dynamic disks are designed to let you take advantage of the latest Windows features. Only computers running Windows 2000 or later releases of Windows can use dynamic disks. However, you can use dynamic disks with other operating systems, such as UNIX. To do this, you need to create a separate volume for the non-Windows operating system. You can’t use dynamic disks on portable computers.
Windows Server 2008 provides the tools you need to convert a basic disk to a dynamic disk and to change a dynamic disk back to a basic disk. When you convert to a dynamic disk, partitions are changed to volumes of the appropriate type automatically.
You can’t change these volumes back to partitions. Instead, you must delete the volumes on the dynamic disk and then change the disk back to a basic disk. Deleting the volumes destroys all the information on the disk.
Converting a Basic Disk to a Dynamic Disk
Before you convert a basic disk to a dynamic disk, you should make sure that you don’t need to boot the computer to other versions of Windows. Only computers running
Windows 2000 and later releases of Windows can use dynamic disks.
With MBR disks, you should also make sure that the disk has 1 MB of free space at the end of the disk. Although Disk Management reserves this free space when creating partitions and volumes, disk management tools on other operating systems might not.
Without the free space at the end of the disk, the conversion will fail.
With GPT disks, you must have contiguous, recognized data partitions. If the GPT disk contains partitions that Windows doesn’t recognize, such as those created by another operating system, you can’t convert to a dynamic disk.
With either type of disk, the following holds true:
■ You can’t convert drives that use sector sizes larger than 512 bytes. If the drive has large sector sizes, you’ll need to reformat before converting.
■ You can’t use dynamic disks on portable computers or with removable media.
You can only configure these drives as basic drives with primary partitions.
■ You can’t convert a disk if the system or boot partition is part of a spanned, striped, mirrored, or RAID-5 volume. You’ll need to stop the spanning, mirroring, or striping before you convert.
■ You shouldn’t convert a disk if it contains multiple installations of the Windows operating system. If you do, you might be able to start the computer only using
Windows Server 2008.
■ You can convert disks with other types of partitions that are part of spanned, striped, mirrored, or RAID-5 volumes. These volumes become dynamic volumes of the same type. However, you must convert all drives in the set together.
Chapter 12 Managing File Systems and Drives 349
To convert a basic disk to a dynamic disk, follow these steps:
1. In Disk Management, right-click a basic disk that you want to convert, either in the Disk List view or in the left pane of the Graphical View. Then select Convert
To Dynamic Disk.
2. In the Convert To Dynamic Disk dialog box, select the check boxes for the disks you want to convert. If you’re converting a spanned, striped, mirrored, or RAID-5 volume, be sure to select all the basic disks in this set. You must convert the set together. Click OK to continue.
3. The Disks To Convert dialog box shows the disks you’re converting. The buttons and columns in this dialog box contain the following information:
Name
Shows the disk number.
Disk Contents
in use.
Shows the type and status of partitions, such as boot, active, or
Will Convert
Specifies whether the drive will be converted. If the drive doesn’t meet the criteria, it won’t be converted, and you might need to take corrective action, as described previously.
Details
Shows the volumes on the selected drive.
Convert
Starts the conversion.
4. To begin the conversion, click Convert. Disk Management warns you that after you finish the conversion you won’t be able to boot previous versions of Windows from volumes on the selected disks. Click Yes to continue.
5. Disk Management will restart the computer if a selected drive contains the boot partition, system partition, or a partition in use.
Changing a Dynamic Disk Back to a Basic Disk
Before you can change a dynamic disk back to a basic disk, you must delete all dynamic volumes on the disk. After you do this, right-click the disk and select Convert To Basic
Disk. This changes the dynamic disk to a basic disk; you can then create new partitions and logical drives on the disk.
Reactivating Dynamic Disks
If the status of a dynamic disk displays as Online (Errors) or Offline, you can often reactivate the disk to correct the problem. You reactivate a disk by following these steps:
1. In Disk Management, right-click the dynamic disk you want to reactivate, and then select Reactivate Disk. Confirm the action when prompted.
2. If the drive status doesn’t change, you might need to reboot the computer. If this still doesn’t resolve the problem, check for problems with the drive, its controller, and the cables. Also make sure that the drive has power and is connected properly.
350 Part III Windows Server 2008 Data Administration
Rescanning Disks
Rescanning all drives on a system updates the drive configuration information on the computer. Rescanning can sometimes resolve a problem with drives that show a status of Unreadable. You rescan disks on a computer by selecting Rescan Disks from Disk
Management’s Action menu.
Moving a Dynamic Disk to a New System
An important advantage of dynamic disks over basic disks is that you can easily move them from one computer to another. For example, if after setting up a computer, you decide that you don’t really need an additional hard disk, you can move it to another computer where it can be better used.
Windows Server 2008 greatly simplifies the task of moving drives to a new system.
Before moving disks, you should follow these steps:
1. Open Disk Management on the system where the dynamic drives are currently installed. Check the status of the drives and ensure that they’re marked as healthy. If the status isn’t healthy, you should repair partitions and volumes, as necessary, before you move the disk drives.
Note
Drives with BitLocker Drive Encryption cannot be moved using this technique. BitLocker Driver Encryption wraps drives in a protected seal so that any offline tampering is detected and results in the disk being unavailable until an administrator unlocks it.
2. Check the hard disk subsystems on the original computer and the computer to which you want to transfer the disk. Both computers should have identical hard disk subsystems. If they don’t, the Plug and Play ID on the system disk from the original computer won’t match what the destination computer is expecting. As a result, the destination computer won’t be able to load the right drivers, and boot might fail.
3. Check whether any dynamic disks that you want to move are part of a spanned, extended, or striped set. If they are, you should make a note of which disks are part of which set and plan on moving all disks in a set together. If you are moving only part of a disk set, you should be aware of the consequences. For spanned, extended, or striped volumes, moving only part of the set will make the related volumes unusable on the current computer and on the computer to which you are planning to move the disks.
When you are ready to move the disks, follow these steps:
1. On the original computer, start Computer Management. Then, in the left pane, select Device Manager. In the Device list, expand Disk Drives. This shows a list of all the physical disk drives on the computer. Right-click each disk that you want to move and then select Uninstall. If you are unsure which disks to uninstall, right-click each disk and select Properties. In the Properties dialog box, click the
Chapter 12 Managing File Systems and Drives 351
Volumes tab and then choose Populate. This shows you the volumes on the selected disk.
2. Next, select the Disk Management node in Computer Management on the original computer. Right-click each disk that you want to move and then select
Remove Disk.
3. After you perform these procedures, you can move the dynamic disks. If the disks are hot-swappable and this feature is supported on both computers, remove the disks from the original computer and then install them on the destination computer. Otherwise, turn off both computers, remove the drives from the original computer, and then install them on the destination computer. When you’re finished, restart the computers.
4. On the destination computer, access Disk Management and then select Rescan
Disks from the Action menu. When Disk Management finishes scanning the disks, right-click any disk marked Foreign and then click Import. You should now be able to access the disks and their volumes on the destination computer.
Note
In most cases, the volumes on the dynamic disks should retain the drive letters that they had on the original computer. However, if a drive letter is already used on the destination computer, a volume receives the next available drive letter. If a dynamic volume previously did not have a drive letter, it does not receive a drive letter when moved to another computer. Additionally, if automounting is disabled, the volumes aren’t automatically mounted and you must manually mount volumes and assign drive letters.
Using Basic Disks and Partitions
When you install a new computer or update an existing computer, you’ll often need to partition the drives on the computer. You partition drives using Disk Management.
Partitioning Basics
In Windows Server 2008, a physical drive using MBR partition style can have up to four primary partitions and one extended partition. This allows you to configure MBR drives in one of two ways: using one to four primary partitions, or using one to three primary partitions and one extended partition. A primary partition can fill an entire disk, or you can size it as appropriate for the workstation or server you’re configuring.
Within an extended partition, you can create one or more logical drives. A logical drive is simply a section of a partition with its own file system. Generally, you use logical drives to divide a large drive into manageable sections. With this in mind, you might want to divide a 600 GB extended partition into three logical drives of 200 GB each.
Physical disks with the GPT partition style can have up to 128 partitions.
After you partition a drive, you format the partitions to assign drive letters. This is a high-level formatting that creates the file system structure rather than a low-level formatting that sets up the drive for initial use. You’re probably very familiar with the C
352 Part III Windows Server 2008 Data Administration
drive used by Windows Server 2008. Well, the C drive is simply the designator for a disk partition. If you partition a disk into multiple sections, each section can have its own drive letter. You use the drive letters to access file systems in various partitions on a physical drive. Unlike MS-DOS, which assigns drive letters automatically starting with the letter C, Windows Server 2008 lets you specify drive letters. Generally, the drive letters C through Z are available for your use.
Note
The drive letter A is usually assigned to the system’s floppy disk drive. If the system has a second floppy disk drive, the letter B is assigned to it, so you can use only the letters C through Z. Don’t forget that CD-ROMs, Zip drives, and other types of media drives need drive letters as well. The total number of drive letters you can use at one time is 24. If you need additional volumes, you can create them using drive paths.
Using drive letters, you can have only 24 active volumes. To get around this limitation, you can mount disks to drive paths. A drive path is set as a folder location on another drive. For example, you could mount additional drives as E:\Data1, E:\Data2, and
E:\Data3. You can use drive paths with basic and dynamic disks. The only restriction for drive paths is that you mount them on empty folders that are on NTFS drives.
To help you differentiate between primary partitions and extended partitions with logical drives, Disk Management color-codes the partitions. For example, primary partitions might be color-coded with a dark-blue band and logical drives in extended partitions might be color-coded with a light-blue band. The key for the color scheme is shown at the bottom of the Disk Management window. You can change the colors in the
View Settings dialog box by choosing Settings on the Disk Management View menu.
Creating Partitions and Simple Volumes
Windows Server 2008 simplifies the Disk Management user interface by using one set of dialog boxes and wizards for both partitions and volumes. The first three volumes on a basic drive are created automatically as primary partitions. If you try to create a fourth volume on a basic drive, the remaining free space on the drive is converted automatically to an extended partition with a logical drive of the size you designate by using the new volume feature it created in the extended partition. Any subsequent volumes are created in the extended partitions and logical drives automatically.
In Disk Management, you create partitions, logical drives, and simple volumes by following these steps:
1. In Disk Management’s Graphical View, right-click an unallocated or free area and then choose New Simple Volume. This starts the New Simple Volume Wizard.
Read the Welcome page and then click Next.
2. The Specify Volume Size page, shown in Figure 12-3, specifies the minimum and maximum size for the volume in megabytes (MB) and lets you size the volume
Chapter 12 Managing File Systems and Drives 353
within these limits. Size the partition in MB in the Simple Volume Size field and then click Next.
Figure 12-3
Set the size of the volume on the Specify Volume Size page.
3. On the Assign Drive Letter Or Path page, shown in Figure 12-4, specify whether you want to assign a drive letter or path and then click Next. The following options are available:
Assign The Following Drive Letter
Choose this option to assign a drive letter.
Then select an available drive letter in the selection list provided. By default, Windows Server 2008 selects the lowest available drive letter and excludes reserved drive letters as well as those assigned to local disks or network drives.
Mount In The Following Empty NTFS Folder
Choose this option to mount the partition in an empty NTFS folder. You must then type the path to an existing folder or click Browse to search for or create a folder to use.
Do Not Assign A Drive Letter Or Drive Path
Choose this option if you want to create the partition without assigning a drive letter or path. If you later want the partition to be available for storage, you can assign a drive letter or path at that time.
Note
You don’t have to assign volumes a drive letter or a path. A volume with no designators is considered to be unmounted and is for the most part unusable. An unmounted volume can be mounted by assigning a drive letter
or a path at a later date. See “Assigning Drive Letters and Paths” on page 357.
354 Part III Windows Server 2008 Data Administration
Figure 12-4
On the Assign Drive Letter Or Path page, assign the drive designator or choose to wait until later.
4. On the Format Partition page, shown in Figure 12-5, determine whether and how the volume should be formatted. If you want to format the volume, choose
Format This Volume With The Following Settings and then configure the following options:
File System
Sets the file system type as FAT, FAT32, or NTFS. NTFS is selected by default in most cases. If you create a file system as FAT or FAT32, you can later convert it to NTFS with the Convert utility. You can’t, however, convert NTFS partitions to FAT or FAT32.
Allocation Unit Size
Sets the cluster size for the file system. This is the basic unit in which disk space is allocated. The default allocation unit size is based on the size of the volume and, by default, is set dynamically prior to formatting. To override this feature, you can set the allocation unit size to a specific value. If you use many small files, you might want to use a smaller cluster size, such as 512 or 1024 bytes. With these settings, small files use less disk space.
Volume Label
Sets a text label for the partition. This label is the partition’s volume name and by default is set to New Volume. You can change the volume label at any time by right-clicking the volume in Windows Explorer, choosing Properties, and typing a new value in the Label field provided on the
General tab.
Chapter 12 Managing File Systems and Drives 355
Perform A Quick Format
Tells Windows Server 2008 to format without checking the partition for errors. With large partitions, this option can save you a few minutes. However, it’s usually better to check for errors, which enables
Disk Management to mark bad sectors on the disk and lock them out.
Enable File And Folder Compression
Turns on compression for the disk. Builtin compression is available only for NTFS. Under NTFS, compression is transparent to users and compressed files can be accessed just like regular files. If you select this option, files and directories on this drive are compressed automatically. For more information on compressing drives, files,
and directories, see “Compressing Drives and Data” on page 368.
Figure 12-5
Set the formatting options for the partition on the Format Partition page.
5. Click Next, confirm your options, and then click Finish.
Formatting Partitions
Formatting creates a file system in a partition and permanently deletes any existing data. This is a high-level formatting that creates the file system structure rather than a low-level formatting that initializes a drive for use. To format a partition, right-click the partition and then choose Format. This opens the Format dialog box shown in
Figure 12-6.
356 Part III Windows Server 2008 Data Administration
Figure 12-6
Format a partition in the Format dialog box by specifying its file system type and volume label.
You use the formatting fields as follows:
Volume Label
Specifies a text label for the partition. This label is the partition’s volume name.
File System
Specifies the file system type as FAT, FAT32, or NTFS. FAT is the file system type supported by MS-DOS and Microsoft Windows 3.1, Windows 95, Windows 98, and Windows Me. NTFS is the native file system type for Microsoft
Windows NT and later releases of Windows.
Allocation Unit Size
Specifies the cluster size for the file system. This is the basic unit in which disk space is allocated. The default allocation unit size is based on the size of the volume and is set dynamically prior to formatting. To override this feature, you can set the allocation unit size to a specific value. If you use lots of small files, you might want to use a smaller cluster size, such as 512 or 1024 bytes.
With these settings, small files use less disk space.
Perform A Quick Format
Tells Windows Server 2008 to format without checking the partition for errors. With large partitions this option can save you a few minutes.
However, it’s more prudent to check for errors, which allows Disk Management to mark bad sectors on the disk and lock them out.
Enable File And Folder Compression
Turns on compression for the disk. Built-in compression is available only for NTFS. Under NTFS, compression is transparent to users and compressed files can be accessed just like regular files. If you select this option, files and directories on this drive are compressed automatically. For more
information on compressing drives, files, and directories, see “Compressing
When you’re ready to proceed, click OK. Because formatting a partition destroys any existing data, Disk Management gives you one last chance to abort the procedure.
Click OK to start formatting the partition. Disk Management changes the drive’s status to reflect the formatting and the percentage of completion. When formatting is complete, the drive status will change to reflect this.
Chapter 12 Managing File Systems and Drives 357
Managing Existing Partitions and Drives
Disk Management provides many ways to manage existing partitions and drives. Use these features to assign drive letters, delete partitions, set the active partition, and more. In addition, Windows Server 2008 provides other utilities to carry out common tasks such as converting a volume to NTFS, checking a drive for errors, and cleaning up unused disk space.
Note
Both Windows Vista and Windows Server 2008 support hot-pluggable media that use NTFS volumes. This new feature allows you to format USB flash devices and other similar media with NTFS. Windows Vista with SP1 has enhancements to prevent data loss when ejecting NTFS-formatted removable media.
Assigning Drive Letters and Paths
You can assign drives one drive letter and one or more drive paths, provided that the drive paths are mounted on NTFS drives. Drives don’t have to be assigned a drive letter or path. A drive with no designators is considered to be unmounted, and you can mount it by assigning a drive letter or path at a later date. You need to unmount a drive before moving it to another computer.
Windows cannot modify the drive letter of system, boot, or page file volumes. To change the drive letter of a system or boot volume, you’ll need to edit the registry as described in Microsoft Knowledge Base article 223188 (http://support.microsoft.com/
kb/223188/en-us). Before you can change the drive letter of a page file volume, you may need to move the page file to a different volume.
To manage drive letters and paths, right-click the drive you want to configure in Disk
Management, and then choose Change Drive Letter And Paths. This opens the dialog box shown in Figure 12-7. You can now do the following:
Add a drive path
Click Add, select Mount In The Following Empty NTFS Folder, and then type the path to an existing folder or click Browse to search for or create a folder.
Remove a drive path
click Yes.
Select the drive path to remove, click Remove, and then
Assign a drive letter
Click Add, select Assign The Following Drive Letter, and then choose an available letter to assign to the drive.
Change the drive letter
Select the current drive letter, and then click Change. Select
Assign The Following Drive Letter, and then choose a different letter to assign to the drive.
Remove a drive letter
Select the current drive letter, click Remove, and then click Yes.
358 Part III Windows Server 2008 Data Administration
Figure 12-7
You can change the drive letter and path assignment in the Change Drive
Letter And Paths dialog box.
Note
If you try to change the letter of a drive that’s in use, Windows Server 2008 displays a warning. You’ll need to exit programs that are using the drive and try again or allow Disk Management to force the change by clicking Yes when prompted.
Changing or Deleting the Volume Label
The volume label is a text descriptor for a drive. With FAT and FAT32, the volume label can be up to 11 characters in length and can include spaces. With NTFS, the volume label can be up to 32 characters in length. Additionally, although FAT and FAT32 don’t allow you to use some special characters, including * / \ [ ] : ; | = , . + “ ? < >, NTFS does allow you to use these special characters.
Because the volume label is displayed when the drive is accessed in various Windows
Server 2008 utilities, such as Windows Explorer, it can provide information about a drive’s contents. You can change or delete a volume label using Disk Management or
Windows Explorer.
Using Disk Management, you can change or delete a label by following these steps:
1. Right-click the partition, and then choose Properties.
2. On the General tab of the Properties dialog box, type a new label for the volume in the Label text box or delete the existing label. Click OK.
Using Windows Explorer, you can change or delete a label by following these steps:
1. Right-click the drive icon and then choose Properties.
2. On the General tab of the Properties dialog box, type a new label for the volume in the Label text box or delete the existing label. Click OK.
Chapter 12 Managing File Systems and Drives 359
Deleting Partitions and Drives
To change the configuration of an existing drive that’s fully allocated, you might need to delete existing partitions and logical drives. Deleting a partition or a drive removes the associated file system, and all data in the file system is lost. So before you delete a partition or a drive, you should back up any files and directories that the partition or drive contains.
Note
To protect the integrity of the system, you can’t delete the system or boot partition. However, Windows Server 2008 will let you delete the active partition or volume if it is not designated as boot or system. Always check to ensure that the partition or volume you are deleting doesn’t contain important data or files.
You can delete a primary partition, a volume, or a logical drive by following these steps:
1. In Disk Management, right-click the partition, volume, or drive you want to delete, and then choose Explore. Using Windows Explorer, move all the data to another volume or verify an existing backup to ensure that the data was properly saved.
2. In Disk Management, right-click the partition, volume, or drive again and select
Delete Partition, Delete Volume, or Delete Logical Drive as appropriate.
3. Confirm that you want to delete the selected item by clicking Yes.
Deleting an extended partition differs slightly from deleting a primary partition or a logical drive. To delete an extended partition, follow these steps:
1. Delete all the logical drives on the partition following the steps listed in the previous procedure.
2. Select the extended partition area itself and delete it.
Converting a Volume to NTFS
Windows Server 2008 provides a utility for converting FAT volumes to NTFS. This utility, Convert (Convert.exe), is located in the %SystemRoot% folder. When you convert a volume using this tool, the file and directory structure is preserved and no data is lost.
Keep in mind, however, that Windows Server 2008 doesn’t provide a utility for converting NTFS to FAT. The only way to go from NTFS to FAT is to delete the partition by following the steps listed in the previous section and then to re-create the partition as a FAT volume.
The Convert Utility Syntax
Convert is a command-line utility run at the command prompt. If you want to convert a drive, use the following syntax: convert volume /FS:NTFS
360 Part III Windows Server 2008 Data Administration
where volume is the drive letter followed by a colon, drive path, or volume name.
For example, if you wanted to convert the D drive to NTFS, you’d use the following command: convert D: /FS:NTFS
The complete syntax for Convert is shown here: convert volume /FS:NTFS [/V] [/X] [/CvtArea:filename] [/NoSecurity]
The options and switches for Convert are used as follows:
volume
/FS:NTFS
/V
/X
/CvtArea: filename
/NoSecurity
Sets the volume to work with
Converts to NTFS
Sets verbose mode
Forces the volume to dismount before the conversion (if necessary)
Sets name of a contiguous file in the root directory to be a placeholder for NTFS system files
Removes all security attributes and makes all files and directories accessible to the group Everyone
The following sample statement uses Convert: convert C: /FS:NTFS /V
Using the Convert Utility
Before you use the Convert utility, determine whether the partition is being used as the active boot partition or a system partition containing the operating system. With Intel
x86 systems, you can convert the active boot partition to NTFS. Doing so requires that the system gain exclusive access to this partition, which can be obtained only during startup. Thus, if you try to convert the active boot partition to NTFS, Windows Server
2008 displays a prompt asking if you want to schedule the drive to be converted the next time the system starts. If you click Yes, you can restart the system to begin the conversion process.
Tip
Often you will need to restart a system several times to completely convert the active boot partition. Don’t panic. Let the system proceed with the conversion.
Before the Convert utility actually converts a drive to NTFS, the utility checks to see whether the drive has enough free space to perform the conversion. Generally, Convert needs a block of free space that’s roughly equal to 25 percent of the total space used on the drive. For example, if the drive stores 200 GB of data, Convert needs about 50 GB of free space. If the drive doesn’t have enough free space, Convert aborts and tells you that you need to free up some space. On the other hand, if the drive has enough free space, Convert initiates the conversion. Be patient. The conversion process takes
Chapter 12 Managing File Systems and Drives 361
several minutes (longer for large drives). Don’t access files or applications on the drive while the conversion is in progress.
You can use the /CvtArea option to improve performance on the volume so that space for the master file table (MFT) is reserved. This option helps to prevent fragmentation of the MFT. How? Over time, the MFT might grow larger than the space allocated to it.
The operating system must then expand the MFT into other areas of the disk.
Although the Disk Defragmenter utility can defragment the MFT, it cannot move the first section of the MFT, and it is very unlikely there will be space after the MFT because this will be filled by file data.
To help prevent fragmentation in some cases, you might want to reserve more space than the default (12.5 percent of the partition or volume size). For example, you might want to increase the MFT size if the volume will have many small or average-sized files rather than a few large files. To specify the amount of space to reserve, you can use
FSUtil to create a placeholder file equal in size to that of the MFT you want to create.
You can then convert the volume to NTFS and specify the name of the placeholder file to use with the /CvtArea option.
In the following example, you use FSUtil to create a 1.5 GB (1,500,000,000 bytes) placeholder file named Temp.Txt: fsutil file createnew c:\temp.txt 1500000000
To use this placeholder file for the MFT when converting drive C to NTFS, you would then type the following command: convert c: /fs:ntfs /cvtarea:temp.txt
Notice that the placeholder file is created on the partition or volume that is being converted. During the conversion process, the file will be overwritten with NTFS metadata and any unused space in the file will be reserved for future use by the MFT.
Resizing Partitions and Volumes
Windows Server 2008 doesn’t user Ntldr and Boot.ini to load the operating system.
Instead, Windows Server 2008 has a pre-boot environment in which Windows Boot
Manager is used to control startup and load the boot application you’ve selected. Windows Boot Manager also finally frees the Windows operating system from its reliance on MS-DOS so that you can use drives in new ways. With Windows Server 2008, you can extend and shrink both basic and dynamic disks. You can use either Disk Management or DiskPart to extend and shrink volumes. You cannot shrink or extend striped volumes.
In extending a volume, you convert areas of unallocated space and add them to the existing volume. For spanned volumes on dynamic disks, the space can come from any available dynamic disk, not only those on which the volume was originally created.
Thus you can combine areas of free space on multiple dynamic disks and use those areas to increase the size of an existing volume.
362 Part III Windows Server 2008 Data Administration
Caution
Before you try to extend a volume, be aware of several limitations. First, you can extend simple and spanned volumes only if they are formatted and the file system is NTFS. You can’t extend striped volumes. You can’t extend volumes that aren’t formatted or that are formatted with FAT or FAT32. Additionally, you can’t extend a system or boot volume, regardless of its configuration.
You can shrink a simple volume or a spanned volume by following these steps:
1. In Disk Management, right-click the volume that you want to shrink and then select Shrink Volume. This option is available only if the volume meets the previously discussed criteria.
2. In the field provided in the Shrink dialog box shown in Figure 12-8, enter the amount of space to shrink. The Shrink dialog box provides the following information:
Total Size Before Shrink In MB
Lists the total capacity of the volume in MB. This is the formatted size of the volume.
Size Of Available Shrink Space In MB
Lists the maximum amount by which the volume can be shrunk. This doesn’t represent the total amount of free space on the volume; rather, it represents the amount of space that can be removed, not including any data reserved for the master file table, volume snapshots, page files, and temporary files.
Amount of Space To Shrink In MB
Lists the total amount of space that will be removed from the volume. The initial value defaults to the maximum amount of space that can be removed from the volume. For optimal drive performance, you’ll want to ensure that the drive has at least 10 percent of free space after the shrink operation.
Total Size After Shrink In MB
Lists what the total capacity of the volume in MB will be after the shrink. This is the new formatted size of the volume.
Figure 12-8
Specify the amount of space to shrink from the volume.
3. Click Shrink to shrink the volume.
Chapter 12 Managing File Systems and Drives 363
You can extend a simple volume or a spanned volume by following these steps:
1. In Disk Management, right-click the volume that you want to extend and then select Extend Volume. This option is available only if the volume meets the previously discussed criteria and free space is available on one or more of the system’s dynamic disks.
2. In the Extend Volume Wizard, read the introductory message and then click Next.
3. On the Select Disks page, select the disk or disks from which you want to allocate free space. Any disks currently being used by the volume will automatically be selected. By default, all remaining free space on those disks will be selected for use.
4. With dynamic disks, you can specify the additional space that you want to use on other disks by performing the following tasks:
❑
❑
Click the disk and then click Add to add the disk to the Selected list box.
Select each disk in the Selected list box and in the Select The Amount Of
Space In MB list box, specify the amount of unallocated space to use on the selected disk.
5. Click Next, confirm your options, and then click Finish.
Repairing Disk Errors and Inconsistencies
Windows Server 2008 includes feature enhancements that reduce the amount of manual maintenance you must perform on disk drives. The following enhancements have the most impact on the way you work with disks:
■
■
Transactional NTFS
Self-Healing NTFS
Transactional NTFS allows file operations on an NTFS volume to be performed transactionally. This means programs can use a transaction to group together sets of file and registry operations so that all of them succeed or none of them succeed. While a transaction is active, changes are not visible outside of the transaction. Changes are committed and written fully to disk only when a transaction is completed successfully. If a transaction fails or is incomplete, the program rolls back the transactional work to restore the file system to the state it was in prior to the transaction.
Transactions that span multiple volumes are coordinated by the Kernel Transaction
Manager (KTM). The KTM supports independent recovery of volumes if a transaction fails. The local resource manager for a volume maintains a separate transaction log and is responsible for maintaining threads for transactions separate from threads that perform the file work.
364 Part III Windows Server 2008 Data Administration
Traditionally, you have had to use the Check Disk tool to fix errors and inconsistencies in NTFS volumes on a disk. Because this process can disrupt the availability of Windows systems, Windows Server 2008 uses Self-Healing NTFS to protect file systems without having to use separate maintenance tools to fix problems. Because much of the self-healing process is enabled and performed automatically, you may only need to manually perform volume maintenance when you are notified by the operating system that a problem cannot be corrected automatically. If such an error occurs, Windows
Server 2008 will notify you about the problem and provide possible solutions.
Self-Healing NTFS has many advantages over Check Disk, including the following:
■ Check Disk must have exclusive access to volumes, which means system and boot volumes can only be checked when the operating system starts up. On the other hand, with Self-Healing NTFS, the file system is always available and does not need to be corrected offline (in most cases).
■ Self-Healing NTFS attempts to preserve as much data as possible if corruption occurs and reduces failed file system mounting that previously could occur if a volume was known to have errors or inconsistencies. During restart, Self-Healing
NTFS repairs the volume immediately so that it can be mounted.
■ Self-Healing NTFS reports changes made to the volume during repair through existing Chkdsk.exe mechanisms, directory notifications, and update sequence number (USN) journal entries. This feature also allows authorized users and administrators to monitor repair operations through Verification, Waiting For
Repair Completion, and Progress Status messages.
■ Self-Healing NTFS can recover a volume if the boot sector is readable but does not identify an NTFS volume. In this case, you must run an offline tool that repairs the boot sector and then allow Self-Healing NTFS to initiate recovery.
Although Self-Healing NTFS is a terrific enhancement, at times you may want to (or may have to) manually check the integrity of a disk. In these cases, you can use Check
Disk (Chkdsk.exe) to check for and, optionally, repair problems found on FAT, FAT32, and NTFS volumes. Although Check Disk can check for and correct many types of errors, the utility primarily looks for inconsistencies in the file system and its related metadata. One of the ways Check Disk locates errors is by comparing the volume bitmap to the disk sectors assigned to files in the file system. Beyond this, the usefulness of Check Disk is rather limited. For example, Check Disk can’t repair corrupted data within files that appear to be structurally intact.
Running Check Disk from the Command Line
You can run Check Disk from the command line or within other utilities. At a command prompt, you can test the integrity of the E drive by typing the following command: chkdsk E:
Chapter 12 Managing File Systems and Drives 365
To find and repair errors that are found in the E drive, use the following command: chkdsk /f E:
Note
Check Disk can’t repair volumes that are in use. If the volume is in use,
Check Disk displays a prompt that asks if you want to schedule the volume to be checked the next time you restart the system. Click Yes to schedule this.
The complete syntax for Check Disk is shown here: chkdsk [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/L[:size]]
The options and switches for Check Disk are used as follows:
volume filename
/F
/V
/R
/L:size
/X
/I
/C
Sets the volume to work with.
FAT/FAT32 only: Specifies files to check for fragmentation.
Fixes errors on the disk.
On FAT/FAT32: Displays the full path and name of every file on the disk. On NTFS: Displays cleanup messages, if any.
Locates bad sectors and recovers readable information (implies /F).
NTFS only: Changes the log file size.
Forces the volume to dismount first if necessary (implies /F).
NTFS only: Performs a minimum check of index entries.
NTFS only: Skips checking of cycles within the folder structure.
Running Check Disk Interactively
You can also run Check Disk interactively by using either Windows Explorer or Disk
Management. To do that, follow these steps:
1. Right-click the drive and then choose Properties.
2. On the Tools tab of the Properties dialog box, click Check Now.
3. As shown in Figure 12-9, you can now do the following:
❑ Check for errors without repairing them. Click Start without selecting either of the check boxes.
❑ Check for errors and fix them. Make the appropriate selections in the check boxes to fix file system errors or to recover bad sectors, or both. Then click Start.
366 Part III Windows Server 2008 Data Administration
Figure 12-9
Use Check Disk to check a disk for errors and repair them.
Defragmenting Disks
Any time you add files to or remove files from a drive, the data on the drive can become fragmented. When a drive is fragmented, large files can’t be written to a single continuous area on the disk. As a result, the operating system must write the file to several smaller areas on the disk, which means more time is spent reading the file from the disk. To reduce fragmentation, Windows Server 2008 can manually or automatically defragment disks periodically using Disk Defragmenter. The more frequently data is updated on drives, the more often you should run this tool.
You can manually defragment a disk by following these steps:
1. In Server Manager, select the Storage node and then the Disk Management node.
Right-click a drive and then select Properties.
2. On the Tools tab, click Defragment Now. Disk Defragementer will then analzye the server’s disks to determine whether any disks need to be defragmented. If so, it’ll recommend that you defragment now.
3. In the Disk Defragmenter dialog box, click Defragment Now. When prompted, select the disks to defragment and then click OK.
Note
Depending on the size of the disk, defragmentation can take several hours.
You can click Cancel Defragmentation at any time to stop defragmentation.
When you enable automatic defragmenation, Windows Server 2008 runs disk defragmenter automatically at 1:00 A.M. every Wednesday. As long as the computer is on at the scheduled run time, automatic defragmentation will occur. You can configure and manage automated defragmentation by following these steps:
1. In Server Manager, select the Storage node and then the Disk Management node.
Right-click a drive and then select Properties.
2. On the Tools tab, click Defragment Now. This displays the Disk Defragmenter dialog box, shown in Figure 12-10.
Chapter 12 Managing File Systems and Drives 367
Figure 12-10
Disk Defragmenter analyzes and defragments disks efficiently.
3. To cancel automated defragmentation, clear Run On A Schedule and then click
OK twice. Skip the remaining steps.
4. To enable automated defragmentation, select Run On A Schedule. The default or last set run schedule is shown.
5. If you want to modify the run schedule, click Modify Schedule. In the Modify
Schedule dialog box, shown in Figure 12-11, set the desired run schedule and then click OK. In the How Often selection list, you can choose Daily, Weekly, or
Monthly as the run schedule. If you choose a weekly or monthly run schedule, you’ll need to select the run day of the week or month from the What Day selection list. Finally, the What Time selection list lets you set the time of the day that automated defragmentation should occur.
Figure 12-11
Set the desired run schedule for automated defragmentation.
6. If you want to manage which disks are defragmented, click Select Volumes. In the
Advanced Options dialog box, select which volumes are defragmented. By default, all disks installed within or connected to the computer are defragmented and any new disks are defragmented automatically as well. In the Disks To
Defragment list, select the check boxes for disks that should be defragmented
368 Part III Windows Server 2008 Data Administration
automatically and clear the check boxes for disks that should not be defragmented automatically. Click OK.
7. Click OK twice to save your settings.
Note
Windows Vista with SP1 or later and Windows Server 2008 automatically perform cyclic pickup defragmentation. With this feature, when a scheduled defragmentation pass is stopped and rerun, the computer will automatically pick up the next unfinished volume in line to be defragmented.
Compressing Drives and Data
When you format a drive for NTFS, Windows Server 2008 allows you to turn on the built-in compression feature. With compression, all files and directories stored on a drive are automatically compressed when they’re created. Because this compression is transparent to users, compressed data can be accessed just like regular data. The difference is that you can store more information on a compressed drive than you can on an uncompressed drive.
Real World
Although compression is certainly a useful feature when you want to save disk space, you can’t encrypt compressed data. Compression and encryption are mutually exclusive alternatives for NTFS volumes, which means you have the choice of either using compression or using encryption. You can’t use both tech-
cally decrypts the data and then compresses it. Likewise, if you try to encrypt compressed data, Windows Server 2008 uncompresses the data and then encrypts it.
Compressing Drives
To compress a drive and all its contents, follow these steps:
1. In Windows Explorer or Disk Management, right-click the drive that you want to compress, and then select Properties.
2. Select Compress Drive To Save Disk Space and then click OK.
Compressing Directories and Files
If you decide not to compress a drive, Windows Server 2008 lets you selectively compress directories and files. To compress a file or directory, follow these steps:
1. In Windows Explorer, right-click the file or directory that you want to compress, and then select Properties.
2. On the General tab of the related Properties dialog box, click Advanced. In the
Advanced Attributes dialog box, select the Compress Contents To Save Disk
Space check box, as shown in Figure 12-12. Click OK twice.
Chapter 12 Managing File Systems and Drives 369
Figure 12-12
With NTFS, you can compress a file or directory by selecting the Compress
Contents To Save Disk Space check box in the Advanced Attributes dialog box.
For an individual file, Windows Server 2008 marks the file as compressed and then compresses it. For a directory, Windows Server 2008 marks the directory as compressed and then compresses all the files in it. If the directory contains subfolders,
Windows Server 2008 displays a dialog box that allows you to compress all the subfolders associated with the directory. Simply select Apply Changes To This Folder,
Subfolders, And Files and then click OK. Once you compress a directory, any new files added or copied to the directory are compressed automatically.
Note
If you move an uncompressed file from a different drive, the file is compressed. However, if you move an uncompressed file to a compressed folder on the same NTFS drive, the file isn’t compressed. Note also that you can’t encrypt compressed files.
Expanding Compressed Drives
You can remove compression from a drive by following these steps:
1. In Windows Explorer or Disk Management, right-click the drive that contains the data you want to expand, and then select Properties.
2. Clear the Compress Drive To Save Disk Space check box and then click OK.
Tip
Windows always checks the available disk space before expanding compressed data. You should, too. If less free space is available than used space, you might not be able to complete the expansion. For example, if a compressed drive uses 150 GB of space and has 70 GB of free space available, you won’t have enough free space to expand the drive.
370 Part III Windows Server 2008 Data Administration
Expanding Compressed Directories and Files
If you decide later that you want to expand a compressed file or directory, reverse the process by following these steps:
1. Right-click the file or directory in Windows Explorer.
2. On the General tab of the related Properties dialog box, click Advanced. Clear the Compress Contents To Save Disk Space check box. Click OK twice.
With files, Windows Server 2008 removes compression and expands the file. With directories, Windows Server 2008 expands all the files within the directory. If the directory contains subfolders, you’ll also have the opportunity to remove compression from the subfolders. To do this, select Apply Changes To This Folder, Subfolders, And
Files when prompted, and then click OK.
Tip
Windows Server 2008 also provides command-line utilities for compressing and uncompressing your data. The compression utility is called Compact (Compact.exe). The uncompression utility is called Expand (Expand.exe).
Encrypting Drives and Data
NTFS has many advantages over other file systems that you can use with Windows
Server 2008. One of the major advantages is the capability to automatically encrypt and decrypt data using the Encrypting File System (EFS). When you encrypt data, you add an extra layer of protection to sensitive data—and this extra layer acts as a security blanket blocking all other users from reading the contents of the encrypted files.
Indeed, one of the great benefits of encryption is that only the designated user can access the data. This benefit is also a disadvantage in that the user must remove encryption before authorized users can access the data.
Note
As discussed previously, you can’t compress encrypted files. The encryption and compression features of NTFS are mutually exclusive. You can use one feature or the other, but not both.
Understanding Encryption and the Encrypting File System
File encryption is supported on a per-folder or per-file basis. Any file placed in a folder marked for encryption is automatically encrypted. Files in encrypted format can be read only by the person who encrypted the file. Before other users can read an encrypted file, the user must decrypt the file.
Every encrypted file has a unique encryption key. This means that an encrypted file can be copied, moved, and renamed just like any other file—and in most cases these
actions don’t affect the encryption of the data. (For details, see “Working with
Encrypted Files and Folders” on page 373.) The user who encrypted the file always
Chapter 12 Managing File Systems and Drives 371
has access to the file, provided that the user’s public-key certificate is available on the computer that he or she is using. For this user, the encryption and decryption process is handled automatically and is transparent.
The process that handles encryption and decryption is called the Encrypting File System (EFS). The default setup for EFS allows users to encrypt files without needing special permission. Files are encrypted using a public/private key that EFS automatically generates on a per-user basis.
Encryption certificates are stored as part of the data in user profiles. If a user works with multiple computers and wants to use encryption, an administrator will need to configure a roaming profile for that user. A roaming profile ensures that the user’s profile data and public-key certificates are accessible from other computers. Without this, users won’t be able to access their encrypted files on another computer.
Security
An alternative to a roaming profile is to copy the user’s encryption certificate to the computers that the user uses. You can do this using the certificate backup and restore process discussed in “Backing Up and Restoring the System
State” on page 488. Simply back up the certificate on the user’s original computer and then restore the certificate on each of the other computers the user logs on to.
EFS has a built-in data recovery system to guard against data loss. This recovery system ensures that encrypted data can be recovered in the event a user’s public-key certificate is lost or deleted. The most common scenario for this is when a user leaves the company and the associated user account is deleted. A manager might have been able to log on to the user’s account, check files, and save important files to other folders, but if the user account has been deleted, encrypted files will be accessible only if the encryption is removed or if the files are moved to a FAT or FAT32 volume (where encryption isn’t supported).
To access encrypted files after the user account has been deleted, you’ll need to use a recovery agent. Recovery agents have access to the file encryption key necessary to unlock data in encrypted files. To protect sensitive data, however, recovery agents don’t have access to a user’s private key or any private key information.
Windows Server 2008 won’t encrypt files without designated EFS recovery agents.
Therefore, recovery agents are designated automatically and the necessary recovery certificates are generated automatically as well. This ensures that encrypted files can always be recovered.
EFS recovery agents are configured at two levels:
Domain
The recovery agent for a domain is configured automatically when the first
Windows Server 2008 domain controller is installed. By default, the recovery agent is the domain administrator. Through Group Policy, domain administrators can designate additional recovery agents. Domain administrators can also delegate recovery agent privileges to designated security administrators.
372 Part III Windows Server 2008 Data Administration
Local computer
When a computer is part of a workgroup or in a stand-alone configuration, the recovery agent is the administrator of the local computer by default.
Additional recovery agents can be designated. Further, if you want local recovery agents in a domain environment rather than domain-level recovery agents, you must delete the recovery policy from the group policy for the domain.
You can delete recovery agents if you don’t want them to be used. However, if you delete all recovery agents, EFS will no longer encrypt files. One or more recovery agents must be configured for EFS to function.
Encrypting Directories and Files
With NTFS volumes, Windows Server 2008 lets you select files and folders for encryption. When you encrypt files, the file data is converted to an encrypted format that can be read only by the person who encrypted the file. Users can encrypt files only if they have the proper access permissions. When you encrypt folders, the folder is marked as encrypted, but only the files within it are actually encrypted. All files that are created in or added to a folder marked as encrypted are encrypted automatically.
To encrypt a file or directory, follow these steps:
1. Right-click the file or directory that you want to encrypt, and then select
Properties.
2. On the General tab of the related Properties dialog box, click Advanced, and then select the Encrypt Contents To Secure Data check box. Click OK twice.
Note
You can’t encrypt compressed files, system files, or read-only files. If you try to encrypt compressed files, the files are automatically uncompressed and then encrypted. If you try to encrypt system files, you’ll get an error.
For an individual file, Windows Server 2008 marks the file as encrypted and then encrypts it. For a directory, Windows Server 2008 marks the directory as encrypted and then encrypts all the files in it. If the directory contains subfolders, Windows
Server 2008 displays a dialog box that allows you to encrypt all the subfolders associated with the directory. Simply select Apply Changes To This Folder, Subfolders, And
Files and then click OK.
Note
On NTFS volumes, files remain encrypted even when they’re moved, copied, and renamed. If you copy or move an encrypted file to a FAT or FAT32 drive, the file is automatically decrypted before being copied or moved. Thus, you must have proper permissions to copy or move the file.
Chapter 12 Managing File Systems and Drives 373
Working with Encrypted Files and Folders
Previously, I said that you can copy, move, and rename encrypted files and folders just like any other files. This is true, but I qualified this by saying “in most cases.” When you work with encrypted files, you’ll have few problems as long as you work with NTFS volumes on the same computer. When you work with other file systems or other computers, you might run into problems. Two of the most common scenarios are:
Copying between volumes on the same computer
When you copy or move an encrypted file or folder from one NTFS volume to another NTFS volume on the same computer, the files remain encrypted. However, if you copy or move encrypted files to a FAT or FAT32 volume, the files are decrypted before transfer and then transferred as standard files. FAT and FAT32 don’t support encryption.
Copying between volumes on a different computer
When you copy or move an encrypted file or folder from one NTFS volume to another NTFS volume on a different computer, the files remain encrypted as long as the destination computer allows you to encrypt files and the remote computer is trusted for delegation.
Otherwise, the files are decrypted and then transferred as standard files. The same is true when you copy or move encrypted files to a FAT or FAT32 volume on another computer. FAT and FAT32 don’t support encryption.
After you transfer a sensitive file that has been encrypted, you might want to confirm that the encryption is still applied. Right-click the file and then select Properties. On the General tab of the related Properties dialog box, click Advanced. The Encrypt Contents To Secure Data option should be selected.
Configuring Recovery Policy
Recovery policies are configured automatically for domain controllers and workstations. By default, domain administrators are the designated recovery agents for domains and the local administrator is the designated recovery agent for a stand-alone workstation.
Through the Group Policy console, you can view, assign, and delete recovery agents. To do that, follow these steps:
1. Open the Group Policy console for the local computer, site, domain, or organizational unit you want to work with. For details on working with Group Policy, see
“Understanding Group Policies” on page 114.
2. Open the Encrypted Data Recovery Agents node in Group Policy. To do this, expand Computer Configuration, Windows Settings, Security Settings, and Public Key Policies and then select Encrypting File System.
374 Part III Windows Server 2008 Data Administration
3. The right-hand pane lists the recovery certificates currently assigned. Recovery certificates are listed according to who issued them, to whom they are issued, expiration data, purpose, and more.
4. To designate an additional recovery agent, right-click Encrypting File System and then select Add Data Recovery Agent. This starts the Add Recovery Agent Wizard, which you can use to select a previously generated certificate that has been assigned to a user and mark it as a designated recovery certificate. Click Next.
5. On the Select Recovery Agents page, click Browse Directory and in the Find
Users, Contacts, And Groups dialog box, select the user you want to work with.
Security
Before you can designate additional recovery agents, you must set up a root Certificate Authority (CA) in the domain. Then you must use the Certificates snap-in to generate a personal certificate that uses the EFS Recovery
Agent template. The root CA must then approve the certificate request so that the certificate can be used.
6. To delete a recovery agent, select the recovery agent’s certificate in the right pane and then press Delete. When prompted to confirm the action, click Yes to permanently and irrevocably delete the certificate. If the recovery policy is empty
(meaning that it has no other designated recovery agents), EFS will be turned off so that files can no longer be encrypted.
Decrypting Files and Directories
If you decide later that you want to decrypt a file or directory, reverse the process by following these steps:
1. Right-click the file or directory in Windows Explorer.
2. On the General tab of the related Properties dialog box, click Advanced. Clear the Encrypt Contents To Secure Data check box. Click OK twice.
With files, Windows Server 2008 decrypts the file and restores it to its original format.
With directories, Windows Server 2008 decrypts all the files within the directory. If the directory contains subfolders, you’ll also have the opportunity to remove encryption from the subfolders. To do this, select Apply Changes To This Folder, Subfolders, And
Files when prompted and then click OK.
Tip
Windows Server 2008 also provides a command-line utility called Cipher
(Cipher.exe) for encrypting and decrypting your data. Typing cipher at the command prompt without additional parameters shows you the encryption status of all folders in the current directory.
다운로드
공개 링크 업데이트됨
문서 공개 링크
광고
