Chapter 9. Managing Network Shares

This chapter covers the following recipes:

• Securing your SMB file server
• Creating and securing SMB shares
• Accessing SMB shares
• Creating an iSCSI target
• Using an iSCSI target
• Creating a scale-out SMB file server
• Configuring a DFS Namespace
• Configuring DFS Replication

Introduction

Sharing data across a network has been a feature of computer operating systems from the very earliest days of networking. This chapter looks at Windows Server 2016 features that enables you to share files and folders and to use the data that you have shared.

Microsoft's LAN Manager was the company's first network offering. It enabled client computers to create, manage, and share files in a secure manner. The protocol that LAN Manager used to provide this client/server functionality was an early version of the Server Message Block (SMB) protocol.

SMB is a file-level storage protocol that enables you to share files and folders securely and reliably. To increase reliability, you can install a cluster and cluster the file server role. This is an active-passive solution.

A Scale-Out File Server (SOFS) is a clustered file service where all nodes are active. With SMB 3, an SOFS provides continuous availability to files for any file-based application. Applications can include productivity...

Securing your SMB file server

The first step in creating a file server is to harden it. A file server can contain sensitive information, and you should take reasonable steps to avoid some of the common attack mechanisms and adopt best security practice. Security is a good thing but be careful! By locking down your SMB file server too hard, you can lock some users out of the server. SMB 1.0 has a number of weaknesses and in general should be removed. But, if you disable SMB 1.0, you may find that older computers (for example running Windows XP) lose the ability to access shared data.

Getting ready

This recipe helps you to harden a single file server, FS1, which has locally attached storage. The server is domain joined and has the full GUI. FS1 has only the default services, plus the FileServer feature loaded. To add the FileServer feature to Windows, you could do this:

    Install-WindowsFeature -Name FS-FileServer `
                           -IncludeManagementTools

How to do it...

In this recipe...

Creating and securing SMB shares

For generations, administrators have used the net.exe command to set up shared folders and a lot more. These continue to work but you may find the new cmdlets easier to use, particularly if you are automating large-scale SMB server deployments.

This recipe looks at creating and securing shares on a Server 2016 platform using the PowerShell SMBServer module.

Getting ready

For this recipe, you use the file server (FS1) that you hardened in the recipe Securing your SMB server. On this server, you share out folders on the file server. Later, in the recipe Accessing SMB shares, you access the shared folders. Ensure you have created the C:\Foo folder on FS1. This recipe uses a security group, IT Management which you create in the Reskit.Org AD (or use a different group).

How to do it...

1. Discover the existing shares and access rights:

Get-SmbShare -Name * |      Get-SmbShareAccess |
            Sort-Object -Property Name |           Format-Table -GroupBy Name

2. Share a folder...

Accessing SMB shares

In the recipe Creating and securing SMB shares, you set up the shared files on the FS1 server. In this recipe, you access and use the shared folders.

Getting ready

This recipe uses two servers—on one (FS1) you previously shared a few folders. In this recipe, you also utilize those shared files from server DC1. As with all recipes in this book, feel free to change the servers and folders being shared and used. Ensure you have a C:\Foo folder on FS1 created and populated with a few test files.

This recipe also uses a file on the C:\Foo folder on FS1—Marsinstaller.exe. This executable is created using the Creating an Azure backup recipe in Chapter 5, Managing Server Backup chapter. Feel free to use a different file and update step 8 appropriately.

How to do it...

1. Examine the SMB client's configuration:

Get-SmbClientConfiguration

2. You will require SMB signing from the client. You must run this command from an elevated console on the client computer:

Set-SmbClientConfiguration `
...

Creating an iSCSI target

iSCSI is an industry standard protocol which implements block storage over a TCP/IP network. Windows sees an iSCSI Logical Unit Number (LUN) as a locally attached disk. You can manage the disk just like locally attached storage.

Windows Server 2016 includes both iSCSI target (server) and iSCSI initiator (client) features. You set up an iSCSI target on a server and then use an iSCSI initiator on a client system to access the iSCSI target. You can use both Microsoft and 3rd party initiators and targets, although if you mix and match you need to test very carefully that the combination works in your environment.

With iSCSI, a target is a single storage unit (effectively a disk) that the client computer accesses using the iSCSI protocol. An iSCSI target server hosts one or more targets where each iSCSI target is equivalent to a LUN on a Fiber Channel SAN. The iSCSI initiator is a built-in component of Windows Server 2016 (and Windows 10). The iSCSI target feature is one...

Using an iSCSI target

In the previous recipe, you created an iSCSI target. In this recipe, you will implement an iSCSI initiator that enables you to use the iSCSI target across the iSCSI network. You use the iSCSI feature included in Windows Server 2016 (and Windows 10) to access the target. Note that, by default, the iSCSI initiator does not start automatically. To use an initiator on an iSCSI client computer, you have to start the service (msiscsi) and enable the service to start on reboot automatically.

Getting ready

This recipe, which you run on server FS1, assumes you have created an iSCSI target as shown on the Creating an iSCSI target recipe.

How to do it...

1. Adjust the startup type and start the service:

Set-Service -Ma,e msiscsi -StartupType 'Automatic'Start-Service =Name msiscsi

2. Add the iSCSI portal:

New-IscsiTargetPortal `
                  -TargetPortalAddress Srv1.Reskit.Org `              -TargetPortalPortNumber 3260

3. Find the SalesTarget iSCSI target on the portal:

$Target = Get-IscsiTarget...

Creating a scale-out SMB file server

Windows clustering enables you to create a failover file server. When you cluster the file server role, one node in the cluster offers the SMB server features to the network based on shared storage. If that node fails, the cluster can fail over the file sharing service to another node and still access the shared storage. But the fail over can take some time and has some limitations.

An SOFS enables all nodes in the cluster to be active simultaneously. This provides for extra performance as well as improved fault tolerance. With an SOFS, you can hold Hyper-V virtual machine hard drives/configuration information and SQL databases. This recipe shows you how to set up an SOFS.

Getting ready

For this recipe, you need a two node cluster. The nodes are FS1 and FS2 each of which has already been set up with iSCSI targets that point to shared disks.

How to do it...

1. Add the Failover-Clustering feature to both servers:

Install-WindowsFeature -Name Failover-Clustering...

Configuring a DFS Namespace

The Distributed File System (DFS) is a set of services in Windows that enables you to create a structured replicated file store on two or more servers within your organization. Microsoft first released DFS as an add-on to Windows NT 4.0. DFS has been improved significantly since then.

In Windows Server 2016, DFS has two separate components. The first is DFS Namespace (DFSN). DFSN enables you to create a single contiguous namespace that refers to shares held on multiple servers. The second component, DFS Replication (DFSR), performs replication of data between DFS nodes in the DFS Namespace.

With DFS Namespaces, you can make use of shared folders stored on computers throughout the organization to create a single logically structured namespace. This namespace appears to the user as a continuous and well-organized set of folders and subfolders even though the actual shared data may be in a variety of independently named shares on one or more computers in the organization...

Configuring DFS Replication

DFSR is an efficient file replication engine built into Windows Server 2016. You can use DFS Replication to replicate DFSN targets in an efficient manner, especially across low-bandwidth connections.

In DFSR, a replication group is a collection of computers, knows as members. Each replication group member hosts replicated folders. Replicated folders are folders which DFSR ensures are synchronized. With DFS Replication groups, you can replicate the folders contained in your DFS Namespace.

A replicated folder is a folder that stays synchronized on each member. In the figure, there are two replicated folders: projects and proposals. As the data changes in each replicated folder, DFS replicates the changes across connections between the members of the replication group. The connections you set up between the members forms the replication topology.

Creating multiple replicated folders in a single replication group simplifies the process of deploying replicated folders...