Windows Storage Server 2008 R2

Transcription

1 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Version 1.0 Published: February 2011

2 Copyright 2010 Microsoft Corporation. All rights reserved. Complying with the applicable copyright laws is your responsibility. By using or providing feedback on this documentation, you agree to the license agreement below. If you are using this documentation solely for non-commercial purposes internally within YOUR company or organization, then this documentation is licensed to you under the Creative Commons Attribution- NonCommercial License. To view a copy of this license, visit or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA. This documentation is provided to you for informational purposes only, and is provided to you entirely "AS IS". Your use of the documentation cannot be understood as substituting for customized service and information that might be developed by Microsoft Corporation for a particular user based upon that user s particular environment. To the extent permitted by law, MICROSOFT MAKES NO WARRANTY OF ANY KIND, DISCLAIMS ALL EXPRESS, IMPLIED AND STATUTORY WARRANTIES, AND ASSUMES NO LIABILITY TO YOU FOR ANY DAMAGES OF ANY TYPE IN CONNECTION WITH THESE MATERIALS OR ANY INTELLECTUAL PROPERTY IN THEM. Microsoft may have patents, patent applications, trademarks, or other intellectual property rights covering subject matter within this documentation. Except as provided in a separate agreement from Microsoft, your use of this document does not give you any license to these patents, trademarks or other intellectual property. Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e- mail addresses, logos, people, places and events depicted herein are fictitious. Microsoft, Active Directory, ActiveX, BitLocker, Excel, Forefront, Internet Explorer, PowerPoint, SharePoint Portal Server, SharePoint Services, SQL Server, Visual Basic, Windows, Windows 7, Windows PowerShell, Windows Server, Windows Storage Server 2008, Windows Server 2008, Windows Server 2003, Windows XP and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. You have no obligation to give Microsoft any suggestions, comments or other feedback ("Feedback") relating to the documentation. However, if you do provide any Feedback to Microsoft then you provide to Microsoft, without charge, the right to use, share and commercialize your Feedback in any way and for any purpose. You also give to third parties, without charge, any patent rights needed for their products, technologies and services to use or interface with any specific parts of a Microsoft software or service that includes the Feedback. You will not give Feedback that is subject to a license that requires Microsoft to license its software or documentation to third parties because we include your Feedback in them.

3 Contents Introduction... 1 Windows Storage Server 2008 R2 Overview... 3 Comparing Windows Server Operating System Storage Offerings... 3 Comparing Windows Storage Server with Windows Server... 3 Identifying Windows Storage Server Features... 4 What s New in Windows Storage Server 2008 R Comparing Windows Storage Server 2008 R2 with Windows Server 2008 R Windows Storage Server 2008 R2 Editions Identifying Storage Challenges Identify Scalability Storage Challenges Identify Availability Storage Challenges Identify Security Storage Challenges Identify Manageability Storage Challenges Identify Data Recovery Storage Challenges Identifying Windows Storage Server Solution Benefits Identifying Scalability Benefits Identifying Availability Benefits Identifying Security Benefits Identifying Manageability Benefits Identifying Data Recovery Benefits Exploring Windows Storage Server Features and Capabilities Providing Access to File Services Workloads Supporting File Services Workloads Using CIFS, SMB, or SMB Supporting File Services Workloads Using NFS Supporting File Services Workloads Using WebDAV Supporting File Services Workloads Using Windows SharePoint Services Providing Access to iscsi Block I/O Workloads Supporting iscsi Block I/O Workloads Using Microsoft iscsi Software Target Supporting iscsi Boot Providing Access to Web Services Workloads Providing Access to FTP Services Workloads Providing Access to Print Services Workloads Providing Reduction in Power Consumption Improve the Power Efficiency of Individual Servers Processor Power Management Storage Power Management Additional Power Saving Features Performing Highly Automated Installations Managing Windows Storage Server Management Tools for All Workloads Managing Power Consumption for All Workloads... 37

4 ii Windows Storage Server 2008 R2 Architecture and Deployment White Paper Remote Manageability of Power Policy In-Band Power Metering and Budgeting Managing File Services Workloads Managing File Services Using File Server Resource Manager Managing File Services Using Share and Storage Management Managing DFS Namespaces and DFS Replication Managing Single Instance Storage Managing iscsi Block I/O Workloads Managing the Microsoft iscsi Software Target for iscsi Block I/O Workloads Managing the Microsoft iscsi Software Initiator for iscsi Block I/O Workloads Managing iscsi Block I/O Workloads Using Windows PowerShell Managing Web Services Workloads Managing Print Services Workloads Protecting Windows Storage Server Workload Data Using Windows Server Backup to Protect Data Using Shadow Copies of Shared Folders to Protect Data Using the Volume Shadow Copy Service to Protect Data Using LUN Resynchronization to Protect Data Comparison of LUN Resynchronization and Traditional Volume Shadow Copy Service Comparison of LUN Resynchronization and LUN Swap Benefits of Performing Full Volume Recovery Using LUN Resynchronization Process for Performing Full Volume Recovery Using LUN Resynchronization Using DFS Replication to Protect Data Using Automated System Recovery to Protect Data Using System Center Data Protection Manager 2007 to Protect Data Using Virtual Disk Snapshots to Protect Data Using the Appcmd.exe Tool to Backup IIS Configuration Using the PrintBRM.exe Tool to Backup Printer Information Securing Windows Storage Server Workloads Securing Windows Storage Server for All Workloads Securing File Services Workloads Securing iscsi Block I/O Workloads Securing Web Services Workloads Securing Print Services Workloads Improving Availability of Windows Storage Server Workloads Improving Availability of File Services Workloads Improving Availability of iscsi Block I/O Workloads Creating Highly-Available iscsi Targets Creating Highly-Available iscsi Initiators Improving Availability of Web Services Workloads Improving Availability of Print Services Workloads... 73

5 iii Windows Storage Server 2008 R2 Architecture and Deployment White Paper Improving Performance and Scalability for Windows Storage Server Solutions Improving Performance and Scalability for All Workloads Improvements in Processor and Memory Capacity Improvements in the Next Generation TCP/IP Protocol Improvements in Network Adapter Performance Reduction in Processor Utilization for I/O Operations Improving Performance and Scalability for File Services Workloads Review Improvements in the SMB2 Protocol Review SMB-based File Services Workload Test Results Reviewing Performance Improvements in SMB Version 2.1 in Windows Server 2008 R Improving Performance for Branch Offices Using BranchCache Improving Performance for Folder Redirection and Offline Files Improving Performance and Scalability for iscsi Block I/O Workloads Identify Methods for Improving iscsi Block I/O Workload Performance and Scalability Review I/O Storage Test Results Improving Performance and Scalability for Web Services Workloads Identify Methods for Improving Web Services Workload Performance and Scalability Review Web Services Workload Test Results Improving Performance and Scalability for Print Workloads Windows Storage Server Deployment Scenarios Overview of Windows Storage Server Configurations Using Windows Storage Server in a Stand-Alone NAS Configuration Using Windows Storage Server in a Highly-Available NAS Configuration Using Windows Storage Server in a NAS Gateway Configuration Using Windows Storage Server in iscsi Block I/O Configuration Creating Branch Office Solutions Creating Highly-Available Solutions Creating Solutions for Storage Consolidation Creating Small to Medium Business Solutions Creating Solutions for Heterogeneous Environments Creating Application Consolidation Solutions Creating Unified Storage Solutions Creating Virtualization Solutions Connecting Virtual Machines to iscsi LUNs Running Virtual Machines on Windows Storage Server Creating iscsi Boot Solutions Conclusion More Information

6

7 Introduction Windows Storage Server 2008 R2 is the latest in the Windows Storage Server family of products and is based on the technologies and features found in Windows Server 2008 R2. Windows Storage Server is only available through Microsoft Partners. This white paper describes the features and technologies in Windows Storage Server, and how to create secure, extensible, scalable, and highly-available storage solutions, including file services, iscsi block input/output (I/O), Web services, and print services workloads. This white paper is intended for IT professionals who design, deploy, and operate storage solutions. Note This white paper focuses on all Windows Storage Server editions except for Windows Storage Server 2008 R2 Essentials. Windows Storage Server 2008 R2 Essentials provides entrylevel solutions intended for use in organizations with 24 or less computers. For more information about Windows Storage Server 2008 R2 Essentials, see Windows Storage Server 2008 R2. Windows Storage Server 2008 R2 is built on Windows Server 2008 to create efficient and effective storage solutions. Microsoft OEM partners offer specialized hardware and additional software components to create network attached storage appliances. Windows Storage Server provides solutions that complement the file services provided by Windows Server. Windows Storage Server extends the file services in Windows Server by providing addition storage features not found in Windows Server. In addition to providing extended features, purchasing Windows Storage Server bundled with partner appliances can be more cost effective than purchasing Windows Server and a server computer separately. Note In this white paper, Windows Storage Server refers to Windows Storage Server 2008 R2, unless otherwise specified. Windows Storage Server provides a unified solution for the following workloads: Files services. Provides access to files managed by the appliance for computers using file access protocols, such as Common Internet File System (CIFS) or Network File System (NFS). Provides access to files using the Server Message Block (SMB) version 2.0, NFS version 3.0, Web-based Distributed Authoring and Versioning (WebDAV), File Transfer Protocol (FTP) and Hypertext Transfer Protocol (HTTP) protocols. SMB2 provides a superset of the features found in CIFS and provides improved performance and reliability over previous versions of SMB. iscsi Block storage services. Provides remote network attached storage that appears as a disk logical unit number (LUN) to other computers, which are connected using the Internet Small Computer System Interface (iscsi) standard. These services also provide high-performance access to remote disk LUNs using the iscsi industry standard and can act as an iscsi initiator or an iscsi target. Web services. Provides access to Web-based content and services, which can be accessed using HTTP, Hypertext Transfer Protocol Secure (HTTPS), WebDAV, or FTP. Windows SharePoint Services. Provides the ability to share documents, track tasks, use efficiently and effectively, and share ideas and information. The most common feature is to store files in document libraries, which supports check-in and check-out features, version control, and file history. Print services. Provides access to printers using Microsoft print services, Line Printer Daemon (LPD) services, or Internet printing services. Virtualization services. Provides the ability to run up to two virtual machines on an appliance, depending on the Windows Storage Server edition. The following table lists some of the problems and pain points that organizations have with network attached storage appliances, and how Windows Storage Server appliances address them.

8 2 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Table 1. Network Attached Storage Appliance Problems and Pain Points Problem or pain point Dedicated or limited function appliance. Limited breadth of vendor support. Management of workloads. Minimal or no integration with existing authentication and authorization system. Loosely integrated with clients that consume the services. Limited provisions for failover or fault tolerant configurations. Implements nonstandard or proprietary protocols or services. Limited protection of information stored on the appliance. Lack of comprehensive software update management. Ongoing operations and maintenance is labor intensive. Limited customization and extensibility. Limited disaster recovery. Windows Storage Server solution Provides servicing of multiple workloads on highly extensible Microsoft OEM vendor hardware platforms. Takes advantage of the breadth and depth of the software and hardware products provided by other vendors that are provided for Windows Server Uses familiar Windows Server management consoles. Integrates with Active Directory Doman Services (AD DS) and Active Directory Lightweight Directory Services. Designed to work "better together" with Windows operating systems, including Windows Vista and Windows 7, to provide optimal security, performance, scalability, availability, and manageability. Supports Windows Server Failover Clusters, Distributed File System (DFS), and Network Load Balancing for improved availability and fault tolerance in addition to the hardware fault tolerance features provided by Microsoft OEM partners. Supports industry standard protocols and services that provide interoperability in heterogeneous environments. Supports a wide variety of security products and technologies, including BitLocker Drive Encryption, NTFS permissions, Share permissions, and Microsoft Forefront. Provides a set of software update management technologies and products for any sized organization, including Windows Update, Windows Software Update Services (WSUS), and Microsoft System Center Configuration Manager. Many on-going operations and management tasks can also be automated using System Center Configuration Manager or System Center Operations Manager. Many of the management consoles can be customized to include Microsoft OEM partner branding, and the server software supports extensibility using any application programming interfaces (APIs) supported by Windows Server Provides Windows Server Backup as part of Windows Storage Server, and supports other disaster recovery products from Microsoft, such as System Center Data Protection Manager, and from Microsoft partners.

9 3 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Windows Storage Server 2008 R2 Overview Windows Storage Server is optimized for file workloads and includes additional technologies, such as deduplication of files using the Single Instance Storage (SIS) feature, full screen remote desktop control of storage server administration using Web RDP, and the Microsoft iscsi Software Target, to provide a unified storage solution. Deduplication of files is a specific form of compression provided by the SIS feature that combines redundant files into a single instance of the file, and then replaces the files with reparse points (links) to the single instance. This overview of Windows Storage Server includes the following topics: Comparing Windows Server operating system storage offerings. Comparing Windows Storage Server 2008 R2 with Windows Server 2008 R2. Windows Storage Server 2008 R2 editions. Identifying Storage challenges. Identifying Windows Storage Server solution benefits. Comparing Windows Server Operating System Storage Offerings Each current Windows operating system provides some level of storage services. However, each of these Windows operating systems has different storage capabilities and features. Windows Server operating systems have been providing storage solutions since their introduction. This comparison of Windows Server operating system storage offerings includes: Comparing Windows Storage Server with Window Server. Identifying the features that are unique to Windows Storage Server. Identifying the features that are new to Windows Storage Server 2008 R2. Comparing Windows Storage Server with Windows Server Windows Server operating systems are a family of general purpose operating systems that provide a platform for running IT services and applications that are highly-available, scalable, secure, and easy to manage. As a general purpose operating system, Windows Server includes Microsoft file and print services, and support for web applications running Internet Information Services (IIS). Windows Storage Server is a member of the Windows Sever operating system family that is built on Windows Server, but is optimized for storage solutions. These optimizations provide enhanced features and performance not found in the general purpose Windows Server operating systems. However, because Windows Storage Server is based on Windows Server, it shares all the benefits of Window Server, including: A common application programming interface. Efficient management of shared resources using familiar Windows management consoles and command-line utilities. Automation of administration tasks using Windows PowerShell. Tightly integrated with Windows infrastructure services, such as Active Directory Domain Services, DFS-N, DFS-R, DHCP Server, Network Access Protection, or Direct Access. For a more detailed description of the differences between these operating systems, see the Comparing Windows Storage Server 2008 R2 with Windows Server 2008 R2 section in this white paper.

10 4 Windows Storage Server 2008 R2 Architecture and Deployment White Paper There are many instances in which Windows Storage Server provides a more costeffective and efficient storage solution than Windows Server. In other instances, Windows Server many have distinct advantages over Windows Storage Server. Table 2 lists the reasons for selecting Windows Storage Server or Windows Server as your storage solution. Table 2. Reasons to Select Windows Storage Server or Windows Server Solution Windows Storage Server Why select this solution Provides iscsi block I/O storage for application storage scenarios. Provides file deduplicaton using SIS. Consolidate file services and iscsi block I/O on one appliance Provides file services for an existing SAN solution by acting as a SAN gateway. Potentially lowers deployment cost than Windows Server when new hardware is required. Windows Server Provides multiple roles on the same computer, such as file services and domain controller on the same computer. Runs applications on the same computer, such as database services or messaging services. Installs on existing computers. Provides additional installation and configuration options. Runs more than two virtual machines in a Microsoft Hyper-V environment. Identifying Windows Storage Server Features Windows Storage Server includes the following features that are not included in Windows Server: Deduplication of files using Single Instance Storage (SIS) v2 as described in the section Managing Single Instance Storage in this white paper. The ability to function as an iscsi target using Microsoft iscsi Software Target 3.3 as described in the section Supporting iscsi Block I/O Workloads using Microsoft iscsi Software Target in this white paper. Full-screen remote desktop management using Windows Internet Explorer or any web browser that supports Java using the WebRDP feature as described in the Management Tools for All Workloads section in this white paper. The ability to extend the Windows user experience for commonly used management tools, such as Initial Configuration Tasks window, as described in the Step 2: Customize the end user installation experience for the usage scenario section in Windows Storage Server 2008 R2 OEM Deployment Guide.

11 5 Windows Storage Server 2008 R2 Architecture and Deployment White Paper What s New in Windows Storage Server 2008 R2 Table 3 lists the new or improved features in Windows Storage Server 2008 R2 that did not exist in previous versions of Windows Storage Server. Table 3. New or Improved Features in Windows Storage Server 2008 R2 Feature DFS replication (DFS-R) DFS namespace (DFS-N) improvements Branch cache hosted cache mode SMB2 file access improvements Unmapped UNIX User Access (UUUA) for NFS file services. iscsi Software Target 3.3 Description Supports up to 16 simultaneous replication streams. Supports replication to and from failover clusters. Provides read-only access to replica copies of data. For more information, see the following sections in this white paper: Managing DFS Namespaces and DFS Replication Using DFS Replication to Protect Data Creating Branch Office Solutions Scales to support up to 60,000 domain-based namespaces and improvements in fault tolerances. For more information, see the following sections in this white paper: Managing DFS Namespaces and DFS Replication Creating Branch Office Solutions Provides locally cached copies of files to reduce network utilization between locations. For more information, see the following sections in this white paper: Improving Performance for Branch Offices Using Branch Cache Creating Branch Office Solutions Dramatic reduction in network utilization for accessing files. For more information, see the following sections in this whitepaper: Review Improvements in the SMB Protocol Creating Branch Office Solutions Reduced administrative effort for providing and monitoring access to NFS shares. NFS client user identities use automatically generated Windows SIDs to access NFS shares, which minimizes administrative effort. For more information, see the following sections in this whitepaper: Supporting Files Services Workloads Using NFS Securing Files Services Workloads Improved performance for iscsi block I/O workloads and support for differencing VHDs used in iscsi boot solutions. For more information, see the following sections in this whitepaper: Supporting iscsi Block I/O Workloads using Microsoft iscsi Software Target Creating iscsi Boot Solutions

12 6 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Feature Simplified deployment for two node clusters Automation of repetitive administrative tasks using Windows PowerShell Remote management using WebRDP Client. Power consumption and power management Performance and memory capacity I/O performance FTP services Description Reduced administrative effort for installing and configuring a failover cluster using two appliances using the Initial Configuration Tasks window, the Cluster Name and Domain Join Wizard and the Cluster Validation and Setup Wizard. For more information, see the following sections in this whitepaper: Improving Availability of File Services Workloads Improving Availability of iscsi Block I/O Workloads Windows PowerShell providers are included for Single Instance Storage and iscsi block I/O workloads. For more information, see the following sections in this whitepaper: Managing Single Instance Storage Using Windows PowerShell Managing iscsi Block I/O Workloads Using Windows PowerShell IT pros can remotely perform full-screen remote desktop management using Internet Explorer or any web browser that supports Java, see the Management Tools for All Workloads section in this white paper. Dramatic reduction in power consumption due to improvements in system resource power management, such as processor power consumption. In addition, the power management features can be configured using Group Policy settings. For more information, see the following sections in this whitepaper: Providing Reduction in Power Consumption Management Tools for All Workloads Overall performance enhancements due to operating system optimization, 64-bit processor support, and increased memory capacity. For more information, see the following sections in this white paper: Improvements in Processor and Memory Capacity Improving Performance for Branch Offices Using Branch Cache Performance for I/O operations has been dramatically improved. For more information, see the Reduction in Processor Utilization for I/O Operations section in this white paper. Performance and manageability for FTP services have been improved. For more information, see Providing Access to FTP Services Workloads section in this white paper.

13 7 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Feature Windows File Classification infrastructure Windows PowerShell Unattended installation and configuration of storage settings Windows Server Backup LUN resynchronization Volume Shadow Copy Service improvements Description Management of files has been improved though the Windows File Classification Infrastructure, which allows files to be managed based on their classification. The classification of files is defined by IT administrators. For more information, see Managing File Services Workloads Using File Classification Infrastructure in this white paper. Windows PowerShell support has been improved for helping to automate storage management tasks. For more information, see the following sections in this white paper: Managing Single Instance Storage Using Windows PowerShell Managing iscsi Block I/O Workloads Using Windows PowerShell Storage settings can be configured at installation time using the unattended installation, which facilitates fully automated installations. For more information, see Performing Highly Automated Installations in this white paper. Windows Server Backup provides improved features for performing backup and recovery scenarios. For more information, see Using Windows Server Backup to Protect Data section in this white paper. LUN resynchronization can be used to provide faster recovery in some disaster recovery scenarios. For more information, see the Using LUN Resynchronization to Protect Data section in this white paper. Provides snapshots of volumes virtual hard disks (VHDs), supports concurrent restores, and reduced effort for developing a backup extension. For more information, see the Using the Volume Shadow Copy Service to Protect Data section in this white paper.

14 8 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Comparing Windows Storage Server 2008 R2 with Windows Server 2008 R2 The following lists features and technologies common to both Windows Storage Server 2008 R2 and Windows Server 2008 R2: Administration Tools Microsoft.NET 3.0 BitLocker Drive Encryption Note BitLocker Drive Encryption does not work with failover clusters. BITS Server Extensions Desktop Experience DFS Namespace DFS Replication DHCP Server Failover Clustering Note Failover clustering is available only in the Enterprise edition of Windows Storage Server 2008 R2. File Server Resource Manager (FSRM) Full Text Search Group Policy Management Console Integration with Windows Server ecosystems (including backup software, and antivirus software.) Internet Printing Client LPR Port Monitor Microsoft file services based on SMB2 Microsoft Message Queuing (MSMQ) Multipath I/O Network File System (NFS) Peer Name Resolution Protocol Remote Assistance Remove Desktop Connection Remote Differential Compression Remote Server Admin Tools RPC Over HTTP Proxy Simple TCP/IP Services SNMP Subsystem for UNIX-Based Applications (SUA) Telnet Server TFTP Client Windows Biometric Framework Windows Firewall with Advanced Security Windows Network Load Balancing Windows PowerShell Integrated Scripting Environment (ISE) Windows PowerShell Windows Process Activation Server

15 9 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Windows Server Backup Note Windows Server Backup does not work with failover clusters and does not support volumes larger than 2 terabytes. Windows Server Migration Tools WS-Management Windows Management Instrumentation (WMI) Although Windows Storage Server 2008 R2 is based on the features and technologies in Windows Server 2008 R2, there are some differences between the two products. Table 4 lists the feature and technology differences between the two products. Table 4. Windows Storage Server 2008 R2 and Windows Server 2008 R2 Differences Feature or technology Windows Server 2008 R2 Windows Storage Server 2008 R2 Availability to organizations. Retail channels Microsoft OEM partners Supports deduplication of files using Single Instance Storage (SIS). Supports acting as an iscsi target using Microsoft iscsi Software Target 3.3. Supports customized branding of user interface. Supports full screen remote desktop management using Web RDP. Optimized for file services workloads. Optionally performed by Microsoft OEM partners

16 10 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Windows Storage Server 2008 R2 Editions Windows Storage Server 2008 R2, which provides key functionality to support any sized business and IT storage challenge, is available in the following editions: Windows Storage Server 2008 R2 Workgroup. Workgroup is an entry-level technology foundation also targeted at small business owners and IT generalists supporting small businesses. Workgroup provides support for less than 25 users who require access to file services using Microsoft file services or NFS, iscsi block I/O services, print services, and Web services workloads. Windows Storage Server 2008 R2 Standard. Standard provides support for an unlimited number of users who require access to file services using Microsoft file services or NFS, deduplication of files using Single Instance Storage, iscsi block I/O services, print services, and Web services workloads. Windows Storage Server 2008 R2 Enterprise. Enterprise is an advanced platform that provides more cost-effective and reliable support for mission-critical workloads. Enterprise provides support for an unlimited number of users with maximum faulttolerance and scalability provided in a Windows Storage Server product. Table 5 lists the capabilities of Windows Storage Server, and the support level for the capabilities in each edition of the product. Use the information in Table 5 to identify which Windows Storage Server 2008 R2 edition is best suited for your organization. Table 5. Comparison of Windows Storage Editions Maximum system resources support Capabilities Workgroup Standard Enterprise Supported processor architecture. 64-bit 64-bit 64-bit Maximum number of processor sockets Maximum amount of memory. 32 GB 32 GB 2 terabyte Maximum number of network adapters. 2 Unlimited Unlimited Number of disks supported. 6 Any Any Type of disk adapters supported. Any Any Any Hardware RAID supported. Capabilities Workgroup Standard Enterprise Maximum number of simultaneous users supported. 25 Unlimited Unlimited NFS. DFS replication. File Services Resource Manager. File Classification Infrastructure. BranchCache in hosted cache mode. Deduplication of files using SIS. BitLocker Drive Encryption

17 11 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Capabilities Workgroup Standard Enterprise Microsoft iscsi Target Software. Note Some Microsoft partners include the Microsoft iscsi Software Target by default. Failover clusters. Optional Optional Optional Multipath I/O. Hyper-V guest support. 1 2 Number of printers supported for Print Services workloads. Any Any Any Domain membership. Fax services. Domain name system (DNS). AD DS read-only domain controller. DHCP Server services. Windows Search services. Windows Management Instrumentation. Windows Server Backup. OEM customization of user interface and experience. Active Directory Lightweight Directory Services. For more information about the Microsoft iscsi Software Target specifications, see the section, "Identifying Microsoft iscsi Software Target Specifications" later in this white paper.

18 12 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Identifying Storage Challenges IT pros face most of the same storage challenges, regardless of the size of their organization. Business requirements determine the challenges that an organization must solve to provide a comprehensive storage solution. Table 6 lists the categories of storage challenges that most organizations experience. Table 6. Storage Challenge Categories Category Scalability Availability Security Manageability Data recovery Description Data must be accessible in a timely manner based on the response times defined in your Service Level Agreements (SLAs). Data must be accessible by users on an on-demand basis for a high percentage of the time, and it should be protected from any single point of failure. Data must remain free from corruption, compromise, unauthorized access, and inadvertent user error. Data must be easy to manage and maintain for local users, remote users, or branch offices using highly-automated, policy-driven processes and procedures. Data must be recoverable in the event of a disaster. Identify storage solution challenges by performing the following steps: Identify scalability challenges in storage solutions. Identify availability challenges in storage solutions. Identify security challenges in storage solutions. Identify manageability challenges in storage solutions. Identify data recovery challenges in storage solutions. Identify Scalability Storage Challenges Internal or external hard disks are the most common way to store data on desktops, workstations, and servers. When an administrator finds that these hard disk drives are getting too full, the simplest solutions to increase storage capacity are: add more hard drives, upgrade to higher capacity disks, or purchase additional computers that each have more hard disks. Finding the appropriate solution requires careful optimization of an enterprise-wide storage plan. Scalability storage challenges include: Decentralized of data. Underutilization of storage resources. Compatibility with storage networking solutions. Decentralization of Data As the number of systems increase, data is increasingly dispersed throughout a company, making it difficult for users to know what resources exist, and where to find them. This is an especially troublesome problem with data stored on desktops without file sharing enabled on these computers, it can be difficult to make the data accessible to others. Even when sharing is enabled, there is no effective mechanism to determine exactly where information is stored or which version of a document is the most up-todate. Many organizations must adhere to data retention regulatory requirements to not keep data older than a defined age. However, in a decentralized structure an administrator can

19 13 Windows Storage Server 2008 R2 Architecture and Deployment White Paper face many hurdles when building and applying a consistent policy to the type and age of data that is stored, and ensuring that the data is protected well enough to meet requirements. Migrating a company s critical data to a centralized server can help the situation, because the data can be readily shared across the network. But, as more servers are added to increase storage capacity (and to provide redundancy in the event of hardware failure), users still have the problem of not being able to find the data that they need or in some cases even knowing that it exists. As data is centralized, organizations can experience bandwidth bottlenecks as users in remote locations attempt to access data in a central location via potentially slow, high latency WAN links. In this case, mechanisms need to be put in place to ensure data availability so that user productivity is not negatively affected. Underutilization of Storage Resources Storage that is directly attached to a server is made available to other computers on the network through the operating system s sharing capabilities. Effective storage planning requires accurate predictions of which users and applications will require more storage capacity, and those resources must be provisioned before disk capacity is exceeded. Unfortunately, directly attached storage tends to scale poorly over the long term. Some computers inevitably exceed their storage capacity, while others have excess capacity but no means to effectively share those resources. Adding more servers does not eliminate the problem of inefficient utilization of storage space between servers. Storage remains local to each server; thus space may be available on one server, but capacity exceeded on another. Anticipating growth and implementing storage solutions that scale with growth remains a problem. Compatibility with Storage Networking Solutions The best storage solutions not only meet today s storage needs, they also scale well with more advanced storage solutions, such as network attached storage (NAS) and storage area networks (SANs). Storage solutions must be able to integrate with, and offer services for, other storage mediums with the end result being consolidated management flow for administrators and a consistent experience for users. Identify Availability Storage Challenges Businesses rely on making their services and information available for access, 24x7, year-round. Failure in any of a number of hardware components storage devices, storage interconnects, cabling, network interconnects, processors, motherboards and power supplies can result in a temporary or permanent loss of data. Fault tolerance can be achieved through redundancy of hardware components, and is one way to ensure highly available data. The availability storage challenges include: Hard disk redundancy. Server redundancy. Hard Disk Redundancy Hard disk redundancy can be achieved using RAID types such as RAID 10, RAID 5, or RAID 6. You can also create more sophisticated, parity-based configurations that spread multiple data over multiple drives. These parity-based approaches can provide protection from a disk failure through the maintenance of checksum information. Hard disks using the same RAID controller can be combined to provide a fault tolerance disk configuration using RAID subsystems.

20 14 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Server Redundancy Failover clustering allows two or more computer systems to perform and be managed as a single system. With Failover Clustering, applications remain online, even if a server goes down. Users are redirected to another computer without any loss of services. Identify Security Storage Challenges Preventing unauthorized access to confidential data requires tight integration between file services and identity management systems. Security in depth is required in terms of multi-level and multi-factor security in instances where the data is highly confidential. IT pros have to help ensure the strongest possible security while allowing users the access they require to data. Access to the data must be secured for users on the organization s intranet, extranets, or the Internet. In addition, remote users must be able to access the data through remote access connections. Identify Manageability Storage Challenges System administration can become enormously complex, especially in midsize and large organizations. Administrators are responsible for managing file, web, application, and database servers, and for clustering those servers to ensure effective performance and high availability. Finally, although many organizations require multiple platforms to support various applications, demand is increasing to share data among users whether they are running Windows, UNIX, or another operating system. Identify Data Recovery Storage Challenges System administrators must protect data not only from hardware failure, but also from data corruption, user error, and disasters. The most common means of protecting data from these problems is through tape backups and restores. Unfortunately, these solutions provide only partial protection. Hard disks must be backed up by the individual user. However, users are rarely effective in performing regular backups, and for that reason, system administrators strongly advocate storing critical documents and data on a server, where it can be properly backed up. Technologies such as folder redirection combined with Offline Files can help users store data on servers by redirecting key folders, such as My Documents to a network location while keeping a cached version of the data on the user s local machine. This redirection can also ensure data availability even when the computer is not connected to the network. Identifying Windows Storage Server Solution Benefits Network attached storage appliances running Windows Storage Server have a number of advantages compared to other network attached storage appliances. Most of these advantages are available because Windows Storage Server is based on Windows Server 2008 R2. The benefits to creating storage solutions using Windows Storage Server include: Scalability Availability Security Manageability Data recovery

21 15 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Identifying Scalability Benefits The following are the scalability benefits provided by Windows Storage Server: Increasing the Effectiveness of File Sharing. Distributed File System (DFS) simplifies the user s process of locating and accessing files distributed across an organization. With the release of Windows Server 2008 R2, DFS has been enhanced to remove the 5,000-link target limit that previously existed, and to provide support for Access Based Enumeration (ABE) on DFS Namespaces. Once enabled, DFS only displays items in the namespace and folders that the user has access to. Windows Server 2003 introduced the ability to accommodate multiple DFS root directories on each server, and this capability has been maintained in Windows Server 2008 R2. It is no longer necessary to add an additional server for each additional DFS root directory. DFS also offers closest site selection, ensuring access to the nearest available copy of the data at the lowest cost. The Distributed File System Replication (DFSR) service controls replication and synchronization of data using Remote Differential Compression (RDC) that only replicates modifications to a file. Those modifications are compressed during transmission, resulting in less bandwidth used for replication and, therefore, faster synchronization. This data can be made highly available in a transparent manner using the Distributed File System Namespace. Reduces storage requirements. The Single Instance Storage feature in Windows Storage Server helps optimize storage capacity using built-in file deduplication. Single Instance Storage actively compares and eliminates identical files on selected volumes. Duplicate files are transparently replaced with file system links to the single copy retained in the SIS Common Store saving significant capacity. In addition, protection and recovery by Single Instance Store-aware backup solutions can significantly reduce backup windows and recovery times. Processor scaling. Windows Storage Server can scale up to 256 logical processors to meet the demands of business-critical servers supporting large databases, line of business, and custom applications that sometimes require highly reliable, scalable servers. Identifying Availability Benefits The following are the availability benefits provided by Windows Storage Server: Failover clustering. Failover clustering can help you build redundancy into your network and eliminate single points of failure. Windows Hardware Error Architecture (WHEA). WHEA has been enhanced to support Machine Check Architecture (MCA) error recovery, offering the ability to contain and recover from several types of multi-bit ECC errors in memory and cache without operating system or application interruption. Dynamic hardware partitioning. On a dynamically partitionable server, partition units can be added or replaced without restarting the operating system. Windows Storage Server supports hot-add of processors, memory, and I/O host bridges, and hot-replace of processors and memory on x64-based and Itanium-based systems which support DHP. Fault tolerant hardware. Windows Storage Server includes support for fault tolerate memory synchronization. Fault-tolerant servers contain redundant hardware, including fans and power supplies and processors and RAM that runs in lockstep together. If a primary component fails, the secondary component takes over in a process that is seamless to the application running on the server. Improved fault tolerance between servers and storage. When multiple paths exist between servers and storage, Windows Storage Server can failover to an alternate path if the primary path fails. You can select the failover priority by configuring the load-balancing policies for your storage solution.

22 16 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Improved recovery from configuration errors. An error in the configuration of the storage subsystem can negatively affect storage availability. Windows Storage Server allows you to take configuration snapshots of the storage subsystem (for example, the iscsi configuration). In the event of a subsequent configuration failure, you can quickly restore the configuration to a previous version. Identifying Security Benefits The following are the security benefits provided by Windows Storage Server: Secures digital assets. You can use the same extensive security products and technologies found in Windows Server 2008 to secure Windows Storage Server, such as BitLocker Drive Encryption, NTFS permissions, Windows Firewall with Advanced Security, and IPsec. You can also use Microsoft and partner products to further strengthen the security of your storage solutions, such as Microsoft Forefront. Integrates with existing identity management systems. Identities from AD DS, Active Directory Lightweight Directory Services (AD LDS), and federated domains using Active Directory Federation Services (AD FS), can be used to access resources shared by Windows Storage Server. In addition, Forefront Identity Manager (FIM) 2010 also can be used to synchronize identities from other identity systems. Identifying Manageability Benefits The following are the manageability benefits provided by Windows Storage Server: Reduces time to realize efficient management. Because Windows Storage Server is based on Windows Server 2008 R2, you can take advantage of your expertise with Windows Server. This familiarity dramatically can help reduce your learning curve so that you can quickly and efficiently plan, build, deploy, and operate storage solutions. Manages and operates your storage solution using your existing processes and procedures. You can manage and operate Windows Storage Server using the same IT processes and procedures that are currently used to manage Windows Server 2008 R2. This helps protect your existing investment while developing custom processes and procedures. In addition, you can manage and operate Windows Storage Server using other products, such as System Center Configuration Manager or System Center Operations Manager Resolves support issues faster, more precisely, and with less effort. Comprehensive Microsoft support for Windows Server products and the extensive community of partners and peers help you resolve storage-related issues with less effort. Much of this existing knowledge is integrated in the product or available online. In addition, many of the Microsoft management products, such as System Center Operations Manager, include knowledge from the product groups at Microsoft to help provide you with accurate and relevant information to resolve support issues. Manages multi-vendor storage more effectively. In past versions of Windows Server, multi-vendor storage device management required a system administrator to manage each device independently and to use a different vendor-supplied interface to do so all of which adds another layer of complexity to the system administrator s job. Windows Server 2008 R2 contains a number of management interfaces for SAN hardware. For example, the Storage Manager for SANs. Seamlessly integrates with your existing Windows IT infrastructure. Windows Storage Server integrates easily with existing Windows IT infrastructure services, such as AD DS. This level of integration also helps minimize any infrastructure remediation that may be required to deploy and operate your storage solution. Easily extends storage solutions. You can easily extend the features and services provided by Windows Storage Server using the large number of products and services provided by Microsoft partners or by developing your own solution. The broad range of well documented APIs and scripting languages can help you customize Windows Storage Server to meet your organization's requirements.

23 17 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Migrates from other storage solutions to Windows Storage Server. You can migrate workloads from existing Windows Server operating systems to Windows Storage Server using highly-automated migration tools, such as the File Server Migration Tools. These tools help protect the integrity of your existing data while ensuring the current user permissions and security configuration is transferred to Windows Storage Server. In addition, many Microsoft partners produce products to help in migrating workloads to Windows Server products. Provides unified solution to storage management and operations. You can use the same set of tools and process to manage all the workloads supported by Windows Storage Server. You can manage file services, iscsi block I/O services, Web services, and print services workloads using the well-known management consoles and utilities in Windows Storage Server, instead of using a different set of management tools for each workload. Provides centralized storage for applications. The Microsoft iscsi Software Target component in Windows Storage Server allows you to create iscsi disk LUNs. Disk LUNs can be remotely mounted by application servers, such as Microsoft Exchange Server 2010 running on a Windows Server operating system, using the Microsoft iscsi Software Initiator or application servers running other operating systems, such as Linux, using available iscsi initiators. Reduces administration effort for storage solutions. You can automate repetitive administrative tasks using Windows PowerShell scripts in Windows Storage Server. For example, you can draw on the large number of existing scripts developed by the partner and peer communities to further reduce the time required to achieve automation. You can also centrally manage many of the Windows Storage Server configuration settings using Group Policy. In addition, you can use other Microsoft products to further automate the administration of Windows Storage Server, such as System Center Configuration Manager or System Center Operations Manager. Robust storage solutions. The Windows Storage Server 2008 operating system is a multi-purpose server designed to handle a diverse set of server roles, including file and print, web, remote desktop, storing Exchange Server and virtual server data and directory services. Windows Storage Server 2008 is a network-attached storage (NAS) operating system, built on Windows Server 2008 R2 operating system technologies. The integrated storage services available in Windows Server and Windows Storage Server 2008 have been enhanced in Windows Storage Server 2008 R2, and new features have been added aimed at helping businesses control storage management costs and increase availability of data. For example, Windows Server 2008 R2 and Windows Storage Server 2008 R2 make it easier to manage and maintain disks, which in turn helps lower total cost of ownership (TCO) especially in complex multivendor storage environments. Takes advantage of existing network infrastructure for SAN storage. Windows support for iscsi technology allows users to connect computers to consolidated storage devices using existing Ethernet technologies, rather than having to install a separate Fibre Channel network. iscsi technology helps bring the advantages of storage area networking (SAN) to midsize and small businesses that otherwise could not afford the extra cost and management of running a separate Fibre Channel network. SAN technology based on IP also removes the physical limitations of moving data associated with Fibre Channel. The Windows Storage Server 2008 platform now provides better support for SANs. Enhancements include: Administrators can now control volume mounting to protect volumes from unintentional access. Fibre Channel and iscsi SANs handling has been improved. SAN Host Bus Adapter (HBA) interoperability has been simplified with the SAN MMC management snap-in.

24 18 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Minimizes storage solution adoption risk. Because Windows Storage Server is based on Windows Server, you can minimize the risk of adoption for your new storage solution. Your IT organization and users are less likely to experience difficulties in using and operating Windows Storage Server because they are already familiar with Windows Server. You can use many of the existing tools, Microsoft Solution Accelerators, and best practice guidance to help make certain that the planning, deployment, and ongoing operations of Windows Storage Server succeed. Identifying Data Recovery Benefits The following are the data recovery benefits provided by Windows Storage Server: Easier data recovery. The accidental deletion or overwriting of files has long been the bane of system administrators charged with the time-intensive and costly task of locating and restoring single files from tape. The Shadow Copy for Shared Folders feature of the new Volume Shadow Copy Service (VSS) enables users to easily restore their own deleted files without IT intervention. This capability can be extended with technologies like System Center Data Protection Manager (DPM), which can centrally store the snapshot information, thus adding availability to the data, separate from the originating server. Manages backups and restores more effectively. As organizations produce more information, backing up data becomes an increasingly time intensive and potentially disruptive operation. With VSS, open file backups are enabled, thus making unnecessary the disruptive practice of shutting down applications during backup to prevent data consistency issues. The VSS process ensures data integrity though the utilization of VSS writers. These can be responsible for flushing buffers and getting data on a disk in a consistent state that is suitable to back up. In the case of catastrophic system failures cases in which all operating system information is lost and the server is effectively stripped down to bare metal Automated System Recovery makes possible rapid restore of the system s original state. Making data highly available throughout an organization requires data redundancy. VSS allows administrators to schedule regular copies of data stored on disk. Moreover, because only the changes to the data are saved, shadow copies take up little disk space, enabling companies to make copies of necessary data. Windows Server backup tools. When multiple paths exist between servers and storage, Windows Storage Server can failover to an alternate path if the primary path fails. You can select the failover priority by configuring the load-balancing policies for your storage solution Windows Recovery Environment. The Windows Recovery Environment in Windows Storage Server is a partial version of the operating system and a set of tools that you can use to perform operating system or full server recoveries.

25 19 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Exploring Windows Storage Server Features and Capabilities Windows Storage Server includes a rich set of features and capabilities to help service multiple workloads, unlike dedicated or single function network attached storage appliances. These features and capabilities allow Windows Storage Server to act as a unified platform to manage various workloads, as illustrated in Figure 1. Figure 1. Workloads supported by Window Storage Server

26 20 Windows Storage Server 2008 R2 Architecture and Deployment White Paper These features and capabilities help you provide access to: File services workloads. iscsi block I/O workloads. Web services workloads. Print services workloads This section includes the following topics: Providing access to file services workloads. Providing access to iscsi block I/O workloads in development, test, or production environments, including the following workloads: Hyper-V Microsoft SQL Server Microsoft Exchange Server iscsi boot Providing access to Web services workloads. Providing access to FTP services workloads. Providing access to print services workloads. Providing Access to File Services Workloads File services workloads allow computers to access files and folders stored on network access storage appliances. Windows Storage Server can support file services workloads in homogeneous Windows network environments or heterogeneous network environments with a variety of operating systems, as illustrated in Figure 1. Windows Storage Server provides support for homogeneous or heterogeneous file services workloads using the following protocols or features: CIFS, SMB, or SMB2 NFS WebDAV Windows SharePoint Services Supporting File Services Workloads Using CIFS, SMB, or SMB2 The SMB2 protocol in Windows Storage Server provides access to files and folders for client computers using the SMB or CIFS protocols. Windows-based client computers use the SMB protocol while other operating systems typically use the CIFS protocol. The File Services server role in Windows Storage Server supports both SMB2, which is highly-optimized for use with Windows 7, and the prior versions of SMB for previous Windows operating systems. Some network access storage appliances that are not running Windows Storage Server implement generic CIFS-based file services that implement only older versions of SMB and lack the performance advantages and improved reliability of SMB2. For more information about the improvements available in SMB2, see the "Review Improvements in File Services" section later in this white paper. Select this protocol to support homogeneous or heterogeneous environments that contain: Windows-based computers that use Client for Microsoft Networks to access file services workloads using the SMB protocol. Computers running other operating systems that access file services workloads using the CIFS protocol.

27 21 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Supporting File Services Workloads Using NFS Windows Storage Server supports access to file services workloads using the NFS protocol version 3.0 with the Services for Network File System role service. The NFS protocol allows any NFS client computer to access files and folders managed by Windows Storage Server using version 2 and version 3 of the NFS protocol. The Services for Network File System role service includes the following components: Server for NFS. This component allows a computer running Windows Storage Server and Server for NFS to service NFS client computer requests. Client for NFS. This component allows a computer running Windows Storage Server and Client for NFS to access NFS mount points on NFS servers. The Server for NFS component is required to support file services workloads using NFS. This component includes the Services for NFS snap-in, and a number of command-line tools for managing it. Note The Server for NFS component supports NFS version 2.0 and version 3.0. For more information about installing and configuring the Services for Network File System role service, see Services for NFS Step-by-Step Guide for Windows Server UNIX Version Support The Services for NFS supports the following versions of UNIX: Sun Microsystems Solaris version 9 Red Hat Linux version 9 IBM AIX version 5L 5.2 Hewlett Packard HP-UX version 11i The Server for NFS component allows you to share a folder as a NFS exported folder (also known as a NFS shared folder). A computer running an NFS client can mount the NFS exported folder into the local file system of the operating system running on the computer. For computers running Windows, the NFS client allows access to the NFS exported folder using a universal naming convention (UNC) path or by mapping the NFS exported folder to a drive letter. NFS Authentication The Server for NFS component can use Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS) for mapped identity management. In Windows Storage Server, Windows Server 2008, and later Windows Server operating systems, the Identity Management for UNIX Active Directory schema extension includes the UNIX user identifier (UID) and group identifier (GID) fields. This enables Server for NFS and Client for NFS to look up Windows-to-UNIX user account mappings directly from AD DS or AD LDS. In addition, Server for NFS can support unmapped user access using: Unmapped UNIX User Access. This method allows users to access shared resources using automatically generated Windows Security Identifiers (SIDs) based on the UNIX UID and GID. Anonymous access. This method allows all unmapped users to access shared resources using a common anonymous account is configurable. Select this protocol to support heterogeneous environments that contain computers running an NFS client that access file services workloads using the NFS protocol. For more information about enabling identity (account) mapping for Services for NFS, download NFS Account Mapping in Windows Server 2008 R2.

28 22 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Non-Windows and Windows File Names Many of the conventions used for naming files and directories on non-windows systems differ from those used by Windows. Depending on the operating system, file names can be case sensitive, contain special characters, or be hidden from users. The differences between Windows and non-windows filenames include the following: Case sensitivity. Most UNIX-like non-windows file systems are case-sensitive when handling directory and file names. In contrast, Windows computers preserve the case, but are not case sensitive. By default, Server for NFS is case-sensitive when matching directory- and file-access requests to directories and files in its shared directories; it preserves the case of the names of directories and files when creating files on behalf of NFS client computers. Administrators can configure Server for NFS to ignore case sensitivity when returning directory and file names. For more information, see Configure Case Sensitivity for File and Folder Names. Special characters. Every file system reserves characters for use in path and command syntax. For example, a file stored on NTFS cannot contain the colon (:) character because that character separates the drive letter from the rest of the path in a fully qualified path name. Non-Windows file systems do not use letters to identify drives, so colon characters are valid in non-windows file names. Administrators can specify how characters in directory and file names will be converted when files are shared between Server for NFS and client computers. To accomplish this, the administrator creates a file that defines how these characters are to be mapped, and then specifies where Server for NFS can find the file containing the character map. For more information, see Nfsadmin. Hidden files. Files can be hidden on both non-windows and Windows computers. In the case of Windows computers, files are hidden by setting a special attribute for the file. Non-Windows file systems simply do not list files whose names begin with a period (.) character. By default, Server for NFS does not create files with names beginning with a period as hidden files in the Windows file system. This setting can be turned off by administrators to ensure that files whose names begin with a period (.) character are hidden. Supporting File Services Workloads Using WebDAV The WebDAV protocol is a set of extensions to the HTTP protocol that enables file management over any IP network. Client computers running a WebDAV redirector can access file services workloads using the WebDAV protocol. All current Windows operating systems include a WebDAV redirector. Other operating systems also include a WebDAV redirector, which provides support for homogeneous and heterogeneous environments. Windows Storage Server includes version 7.5 of the WebDAV extension module for Internet Information Services (IIS) 7.0. The WebDAV extension module is available as a separate download at WebDAV 7.5 for IIS 7.0 (x64). WebDAV 7.5 is the latest version of WebDAV for Windows Storage Server, and includes the following improvements: Integration with IIS 7.0. IIS 7.0 has a new administration interface and configuration store. The new WebDAV extension module is tightly integrated with this new design. Also, the new WebDAV extension module integrates with the Internet Information Services Manager console to provide ease of administration. Per-site Configuration. WebDAV 7.5 can be enabled at the site level. Previous versions of WebDAV only allowed you to enable WebDAV at the server level. Per-URL Security Settings. WebDAV 7.5 supports per-url authoring rules, allowing you to specify custom WebDAV security settings on a per-url basis. These authoring rules are separate from the IIS 7.0 per-url authorization rules, thereby

29 23 Windows Storage Server 2008 R2 Architecture and Deployment White Paper allowing one set of security settings for normal HTTP requests, and a separate set of security settings for WebDAV requests. Select this protocol to support heterogeneous environments that contain computers running WebDAV redirectors that need to access the file services workloads using the HTTP or HTTPS protocol. For more information about providing WebDAV support on Windows Storage Server, see WebDAV for IIS 7.0. Supporting File Services Workloads Using Windows SharePoint Services Microsoft Windows SharePoint Services 3.0 allows users to collaborate with each other using either HTTP or HTTPS. Windows SharePoint Services include a number of collaboration features, but the feature specific to file services is the document library feature. Client computers can access the document libraries using either protocol. Computers running Windows can also access the document libraries through Windows Explorer. Also, Microsoft Office System client applications, such as Microsoft Word 2007 or Excel 2007, support opening and saving files to document libraries directly within the application. Document libraries include the ability to check in and check out files to help maintain version control. In addition, you can configure document libraries to retain a specified number of versions for each file in the document library, which allows you to easily restore a previous version of a file and track version history. For more information about providing Windows SharePoint Services 3.0 support on Windows Storage Server, see Microsoft Windows SharePoint Services 3.0. Providing Access to iscsi Block I/O Workloads iscsi block I/O workloads are another type of workload provided by most network access storage appliances. iscsi block I/O workloads include both a server component (iscsi target) and a client component (iscsi initiator), as illustrated in Figure 2. As an iscsi initiator, Windows Storage Server is used to connect to external iscsi targets, such as a SAN. As an iscsi target, Windows Storage Server is used to support iscsi block IO workloads for applications, such as SQL Server 2008 or Exchange Server Note When Windows Storage Server is deployed in a NAS gateway scenario, Windows Storage Server can be an iscsi, Serial Attached SCSI (SAS), or Fibre Channel initiator based on the type of storage being accessed. For more information, see the section "Using Windows Storage Server as a NAS Gateway in Solutions," later in this white paper.

30 24 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 2. iscsi block I/O workloads supported by Windows Storage Server Windows Storage Server supports iscsi block I/O workloads using the iscsi standard. Windows Storage Server can function as an iscsi target (the server component) or an iscsi initiator (the client component). This allows a large number of configuration options for iscsi block I/O workload solutions. Supporting iscsi Block I/O Workloads Using Microsoft iscsi Software Target The Microsoft iscsi Software Target version 3.3 available for Windows Storage Server provides iscsi target functionality. The Microsoft iscsi Software Target version 3.3 is the latest version of the iscsi target software and is an optional component in Window Storage Server Workgroup, Standard, and Enterprise editions. Note Some Microsoft partners include the Microsoft iscsi Software Target by default. For more information about the Microsoft iscsi Software Target version 3.3 in Windows Storage Server, see Microsoft iscsi Software Target 3.3. Identifying Microsoft iscsi Software Target Specifications Table 7 lists the specifications for the Microsoft iscsi Software Target version 3.3. These specifications are applicable to all Windows Storage Server editions that include Microsoft iscsi Software Target version 3.3.

31 25 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Table 7. Microsoft iscsi Software Target Version 3.3 Specifications Specification Value Maximum number of iscsi target instances per appliance. 64 Maximum number of virtual disk per iscsi target instance. 128 Maximum number of snapshots per virtual disk. 128 Maximum number of virtual disks per appliance. 512 Maximum number of virtual disks or snapshots that can be locally mounted by the appliance. 32 (or 4 per cluster node) Maximum number of iscsi initiators per appliance. 64 Maximum number of iscsi initiators that can connect to the same iscsi target instance. Maximum number of iscsi initiator sessions that can connect to the same iscsi target instance. IPv4. IPv6. TCP offload. iscsi offload. Jumbo frames. IPsec Yes Yes Yes No Yes Yes Windows Storage Server includes support for single path and multipath I/O connections to nonclustered and clustered configurations. Multipath I/O connections allow for improved fault-tolerance and performance for iscsi block I/O workloads. The Microsoft iscsi Software Initiator includes a multipath I/O Device Specific Module (DSM) for the Microsoft Multipath I/O (MPIO) in Windows Server. Table 8 lists the support for the Microsoft iscsi Software Initiator and the Microsoft iscsi Software Target with single or multipath I/O connections when connecting to nonclustered or clustered configurations. For more information about multipath I/O, see the section "Improving Availability of iscsi Block I/O Workloads," later in this white paper. Table 8. Support for Single or Multipath IO Connections for Non-Clustered or Clustered Configurations Specification Nonclustered Clustered Windows Server 2008 (multipath I/O connection) Supported Supported Windows Server 2008 (single path I/O connection) Supported Limited * Windows Server 2008 (multipath I/O connection) Supported Limited * Windows Server 2003 (single path I/O connection) Supported Limited* * There is limited support for iscsi initiators or iscsi targets in clustered configurations of Windows Server 2003 when connected to the Microsoft iscsi Software Target. Failures on the iscsi network path may result in delayed failover and recovery times. Failures for non-network related issues have been tested with acceptable recovery times. For these reasons, we recommend to use Windows Server 2008 or Windows Server 2008 R2 in clustered configurations when connecting to the Microsoft iscsi Software Target.

32 26 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Note The limitation for iscsi initiators or iscsi targets in clustered configurations of Windows Server 2003 is specific to Microsoft iscsi Software Target usage. Customers using a different iscsi target should refer to the storage array vendor for supported configurations. Identifying Microsoft iscsi Software Target Support for iscsi Initiators Microsoft iscsi Software Target version 3.3 supports the following iscsi initiators: Microsoft iscsi Software Initiator 2.07 and 2.08 in Windows Server Microsoft iscsi Software Initiator in Windows Server 2008 SP1 and SP2. Microsoft iscsi Software Initiator in Windows Server 2008 R2. Microsoft iscsi Software Initiator in Windows Vista. Microsoft iscsi Software Initiator in Windows 7. Qlogic initiator QLE4062C-SP, firmware Red Hat Enterprise Linux iscsi Initiator version 5.x. SUSE Enterprise Linux iscsi Initiator version 10.x. Identifying Microsoft iscsi Software Target Support for VSS and VDS Providers Microsoft iscsi Software Target version 3.3 includes a hardware provider for: Volume Shadow Copy Service (VSS). VSS is a set of APIs that implement a framework to allow volume backups to be performed while applications on a system continue to write to the volumes. iscsi snapshots are created using VSS and a storage array with a hardware provider designed for use with VSS. The Microsoft iscsi Software Target VSS Hardware Provider is required to create transportable snapshots of iscsi virtual disks and application-consistent snapshots from iscsi initiators. Install this hardware provider on the computer running the iscsi initiator and the computer that is to perform backups. The backup software must support transporting snapshots. Virtual Disk Service (VDS). VDS is a set of APIs that provides a single interface for managing disks. VDS provides an end-to-end solution for managing storage hardware and disks, and for creating volumes on those disks. The Microsoft iscsi Software Target VDS Hardware Provider is required to manage virtual disks on a storage subsystem. Install the Microsoft iscsi Software Target VDS Hardware Provider on each iscsi initiator computer running a storage management application (such as the Microsoft Storage Manager for SANs) that uses the hardware provider to manage storage The most recent version of these hardware provider APIs is Microsoft iscsi Software Target VSS Hardware Provider version 3.3 and Microsoft iscsi Software Target VDS Hardware Provider version 3.3. Note Microsoft iscsi Software Target version 3.3 supports only version 3.3 of the Microsoft iscsi Software Target VSS Hardware Provider, and Microsoft iscsi Software Target VDS Hardware Provider. Prior versions of the hardware providers are not supported by Microsoft iscsi Software Target version 3.3. The Microsoft iscsi Software Target VSS Hardware Provider version 3.3 and the Microsoft iscsi Software Target VDS Hardware Provider version 3.3 support the following operating systems: Windows Server 2008 R2. 32-bit or 64-bit versions of Windows Server 2008 SP1. 64-bit versions of Windows Storage Server bit versions of Windows Storage Server 2008 R2. 32-bit or 64-bit versions of Windows Server 2003 SP2.

33 27 Windows Storage Server 2008 R2 Architecture and Deployment White Paper The following operating systems are not supported by Microsoft iscsi Software Target VSS Hardware Provider version 3.3, and Microsoft iscsi Software Target VDS Hardware Provider version 3.3: Any Windows client operating system, including Windows XP, Windows Vista, and Windows bit version of Windows Storage Server Supporting iscsi Boot iscsi boot allows diskless computers (computers without local disk) to boot over the network. iscsi boot support is provided on diskless computers using one of the following methods: Network adapters that support iscsi boot capability. iscsi host bus adapters that support iscsi boot capability. Network boot program software that provides iscsi boot capability. The iscsi boot process for Windows operating systems, as illustrated in Figure 3, is divided into the following phases: Pre-boot. This phase of the process is used to initiate the Window iscsi boot process. This phase is performed by the firmware on the network adapter, firmware on the host bus adapter, or network boot program, depending on the method used for the diskless computer. The components in this phase include: Int 13. The BIOS function used to access disk boot functions. These functions are redirected to the virtual disk stored on Windows Storage Server. UNDI. Universal Network Device Interface (UNDI) is an application programming interface (API) for network interface cards (NIC) used by the Preboot Execution Environment (PXE) protocol. ibft. iscsi Boot Firmware Table (ibft) is a block of information containing parameters needed to boot Windows Server 2003 and later versions of Windows using the iscsi protocol and the Microsoft iscsi Software Initiator. Independent Hardware Vendors implementing iscsi boot support in their firmware need to use the table headers defined in this specification to enable the passing of boot critical parameters to the Windows operating system. For more information, see iscsi Boot Firmware Table (ibft). Windows. This phase of the process is performed by the Microsoft iscsi Software Initiator. The Windows Boot Manager is configured to boot using LUNs that are accessible through the Microsoft iscsi Software Initiator. Figure 3. iscsi boot process for Windows operating systems For iscsi boot-enabled network adapters and host bus adapters, all the necessary preboot phase components are in firmware on the adapter. For network boot programs, these components are provided by the partner providing the program. Table 9 lists the components in an iscsi boot solution using Windows Storage Server and provides a brief description of the purpose for each component.

34 28 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Table 9. Components in an iscsi Boot Solution Using Windows Storage Server Component Microsoft iscsi Software Target Virtual disk iscsi connection in diskless computer DHCP server Trivial file transfer protocol (TFTP) server Description Provides iscsi block I/O access to virtual disks stored on Windows Storage Server. The iscsi boot process and Microsoft iscsi Software Initiator can access these virtual disks during the boot process. Virtual disk files (.vhd files) stored on Windows Storage Server. Differencing virtual disks can be used for multiple computers based on the same fixed virtual disk. This allows for fast deployment and recovery of diskless computers. The diskless computer requires an iscsi connection to Windows Storage Server, which can be any one of the following: Network adapter that supports iscsi boot. iscsi host bus adapter. iscsi boot software. Provides IP configuration for iscsi boot using network adapters using DHCP reservation that is configured for BOOTP support. Note The DHCP server is optional if the network adapter supports IP and iscsi boot configuration or if you are using an iscsi host bus adapter. However, the DHCP is practical requirement for any scalable requirement. Provides download of boot image to target computer when the virtual disk cannot be directly accessed using the iscsi connection in the diskless computer. Note The TFTP server is required only if you are using iscsi boot software that requires a TFTP server. The TFTP server is not required for network adapters that support iscsi boot or an iscsi host bus adapter. Figure 4 illustrates how diskless computers can boot from virtual disk files (.vhd files) stored on Windows Storage Server using a network boot program that provides iscsi boot capability.

35 29 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 4. iscsi boot process from Windows Storage Server DHCP and TFTP services can be provided by Windows Storage Server or Windows Server. As illustrated in Figure 4, the diskless computer can boot from a virtual disks stored on Windows Storage Server using the following steps for a network boot program: 1. The diskless client computer requests IP configuration from the DHCP Server. 2. The DHCP Server sends IP configuration information to the diskless client. 3. The diskless client computer requests a Preboot Execution Environment (PXE) boot image from the TFPT Server. 4. The TFTP Server provides a PXE boot image to the diskless computer. 5. The diskless computer establishes a connection with Windows Storage Server and connects to a virtual disk stored on Windows Storage Server.

36 30 Windows Storage Server 2008 R2 Architecture and Deployment White Paper 6. The diskless computer boots from Differencing Virtual Disk - B that is stored on Windows Storage Server, which is the iscsi LUN specified in the configuration for the computer. 7. The Windows operating system starts. 8. All subsequent disk I/O is performed using iscsi I/O to the virtual disk stored on Windows Storage Server. You can use separate virtual disks for each diskless computer or you can use differencing virtual disks. A differencing virtual disk is a virtual disk type that is based on a fixed or expandable virtual disk. Any subsequent writes to the differencing disk are written to the differencing virtual disk and the parent virtual disk is not modified. For example, you can create clean-install system boot operating system virtual disk as a parent, and create a differencing virtual disk as the current virtual disk for the diskless computer. Using this method, the operating system on the parent virtual disk stays in its original state for quick recovery or for quickly creating more boot images based on additional differencing virtual disks. Microsoft iscsi Software Target version 3.3 supports iscsi boot for the following iscsi initiators: Any Windows operating system running Microsoft iscsi Initiator version 2.07 or 2.08 Red Hat Enterprise Linux iscsi Initiator version 5.x SUSE Enterprise Linux version 10.x PCI-E network iscsi Initiator adapter Broadcom network adapter qlogic iscsi host bus adapter Netboot software For more information about iscsi boot in Windows operating systems, see: Microsoft iscsi Boot Step-by-Step Guide. About VHD. The Creating iscsi Boot Solutions section later in this white paper. Providing Access to Web Services Workloads Unlike most network access storage appliances, Windows Storage Server supports Web services workloads. Web services workloads allow users to access Web-based content stored on Windows Storage Server appliances. Windows Storage Server can support Web services workloads in homogeneous Windows network environments or heterogeneous network environments that include a variety of operating system. Windows Storage Server provides support for homogeneous or heterogeneous Web services workloads using the protocols listed in Table 10.

37 31 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Table 10. Protocols Supported for Web Services Workloads Protocol HTTP HTTPS FTP Support description Provides: Access to traditional Web-based content accessed through Web browsers. The foundation for the WebDAV protocol used in accessing file services workloads. The foundation for Web-based remote administration using Terminal Services Web Access. Provides support for the Internet Printing role service. Simplified file transfer, download only, for the same files and folders accessed using any of the file services workloads protocols, which can be essential in some heterogeneous environments. Provides the same level of support as HTTP, but includes additional security protection of using secure sockets layer (SSL) encryption between clients and Windows Storage Server. Provides a simplified file transfer, upload or download, using the same folders that can be accessed using any of the file services workloads protocols, which can be essential in some heterogeneous environments. File transfer can be performed using Windows Internet Explorer, a mapped drive, a UNC path, or from a command line. Providing Access to FTP Services Workloads Windows Storage Server 2008 R2 includes FTP services that offer the following improvements: Reduced administrative effort for FTP server services. The new FTP server is fully integrated with the IIS 7.5 administration interface and configuration store. This allows administrators to perform common administrative tasks within one common administration console. Extended support for Internet standards. The new FTP server includes support for: Improved security by supporting FTP over secure sockets layer (SSL). Support of extended character sets by including UTF8 support. Extended IP addressing features provided by IPv6. Improved integration with web-based applications and services. With the new FTP server, you can specify a, virtual host name for an FTP site. This allows you to create multiple FTP sites that use the same IP address, but are differentiated by using unique virtual host names. This allows you to provide FTP and Web content from the same website simply by binding an FTP site to a website. Reduced effort for support and troubleshooting FTP related issues. Improved logging that now supports all FTP-related traffic, unique tracking for FTP sessions, FTP sub statuses, an additional detail field in FTP logs, and more. Providing Access to Print Services Workloads Another advantage to using Windows Storage Server appliances is the ability to support print services workloads. Print services workloads allow users to access printers managed by Windows Storage Server appliances. Windows Storage Server can support

38 32 Windows Storage Server 2008 R2 Architecture and Deployment White Paper print services workloads in homogeneous Windows network environments or heterogeneous network environments that include a variety of operating system. Windows Storage Server provides support for homogeneous or heterogeneous print services workloads using the Print Server role services listed in Table 11. Table 11. Print Server Role Services Supported for Print Services Workloads Role Service Print Server Line Printer Daemon (LPD) Service Internet Printing Support description Provides support for Windows-based computers running Client for Microsoft Networks. The Print Server role service is a mandatory role service for the Print Services role. When the Print Server role is installed, the Print Services Tools Remote Server Administration Tool feature is also installed. The Print Management Console (PMC) is then accessible from Server Manager, Administrative Tools, or as an MMC snap-in. Although the installation of the Print Server role service does not require a system restart, the removal of the role service does. Select this Print Server role service to support any print services workloads in Windows Storage Server. If you are supporting only Windows-based computers that are printing with your homogeneous environment, select only this role service. Provides support for computers that run Line Printer Remote (LPR), typically used in heterogeneous environments. The LDP Service is an optional Print Services role service. The LPD Service installs and starts the TCP/IP Print Server (LPDSVC) service which is implemented in lpdsvc.dll. When the LPD Service is installed, an inbound firewall exception for TCP port 515 is created. There is no configuration necessary for the LPD service. However, the installation of the service does require a restart of the Print Spooler service, which is done automatically during installation. If the Print Spooler service is stopped or restarted after the LPD Service is installed, the TCP/IP Print Server service is also stopped and you must restart it manually. Select this Print Server role service to support LPR clients in heterogeneous environments. Provides support for computers that run an Internet Printing client, typically used in heterogeneous environments or to print over the Internet. Internet Printing provides access to shared printers using the Internet Printing Protocol (IPP) that is encapsulated in HTTP. In order to install the Internet Printing role service, the Print Services and Web Server roles must also be installed. Select the Printer Server role services when clients must print to printers using the only HTTP protocol. For more information about: The Print Services server role, see Print and Document Services. Printer management in Windows Storage Server, see Print Management.

39 33 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Providing Reduction in Power Consumption With the proliferation of physical computers in data centers, power consumption is of paramount importance. In addition to the cost-saving associated with reducing power consumption, many data centers are constrained by the number of computers they can support in their data center by the actual power available to the data center. Therefore, reducing your power consumption also allows you to support more physical computers while using the same amount of power, or less power, than before. Window Storage Server includes the following improvements to reduce power consumption: Reduced power usage of individual servers by including: A new PPM engine. Storage power management. Additional incremental power saving features. The ability to measure, manage, and budget power usage across the system. Improve the Power Efficiency of Individual Servers Windows Storage Server helps improve the power efficiency of individual servers through a variety of incremental improvements. To quantify the power savings, Microsoft measured power consumption of Windows Storage Server 2003 and Windows Storage Server 2008 R2 using a representative online transaction processing (OLTP) workload. Throughput was gradually throttled up across the utilization range of the systems, from idle up to 100 percent utilization. Measuring power usage only when hardware is fully utilized does not reflect real-world usage; average utilization for many servers is 5 to 15 percent. Figure 5shows the results, which demonstrate that many servers that operate within a range of utilization levels will benefit from the improved power efficiency of Windows Server 2008 R2. Figure 5. Power savings with Windows Storage Server Processor Power Management The PPM engine in Windows Storage Server has been rewritten and improved. It now provides the ability to fine-tune the processor s speed and power consumption to match

40 34 Windows Storage Server 2008 R2 Architecture and Deployment White Paper current demands. New parameters for PPM which administrators can configure further improve power efficiency. Core parking is a feature that enables Windows Storage Server to reduce multi-core processor power consumption by consolidating processing onto fewer processor cores and suspending the inactive cores. The workloads of every logical core in a server are tracked relative to all the others. The workloads of cores that are not fully utilized can be suspended, and their workloads then shifted to alternate cores. Keeping the unutilized cores in an idle state reduces system power consumption. When additional processing power is required, the system activates the idle processor cores to handle the increased processing requirements. Storage Power Management Another strategy for reducing power used by individual servers is to centralize their storage by using a Storage Area Network (SAN), which has a higher storage-capacity-topower-consumption ratio than a typical server. A SAN also makes more efficient use of the available disk space, because any server can have access to the available storage on the SAN. Windows Storage Server greatly improves access to storage on SANs, and also adds the following enhancements: ATA Slumber feature. This feature is integrated with the power management framework to use the new power states (partial and active). Optimized link power management for SATA disks. This feature helps reduce power usage for managing the communication bus link between the hard disk and the chipset. Asynchronous notification of media change for optical devices. Windows Storage Server provides asynchronous notification of drive media changes. This means that commands are not repeatedly sent to check for media changes, which means less communication with the drive and less power consumption. Support for remove on delete. Windows Storage Server includes support for storage devices that work with solid state drives that can power down unused RAM when a file system deletes files, thus saving power. Windows Server Storage also supports the ability to boot from a SAN, which eliminates the need for local hard disks (local storage) in the individual server computers and decreases power consumption as a result, as shown in Figure 6.

41 35 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 6. Servers without local storage that each consume less power Additional Power Saving Features Windows Storage Server includes Intelligent Timer Tick Distribution (or Tick Skipping). This feature extends processor idle or deep C-states (processor sleep states within the ACPI specification, with C3 set as the deepest-sleep state and C0 as the operating state) by not activating the CPU unnecessarily, thus saving power. One processor handles the periodic system timer tick; other processors are signaled only as necessary. However, non-timer interrupts will still activate sleeping processors.) The amount of background work that is performed by the operating system has also been reduced in Windows Storage Server. This also allows processors to better utilize the deep C-states, in which the processor consumes very little energy but requires time to return to an operational state. You can take advantage of most of these technologies in virtualization scenarios to maximize the power efficiency of your virtualized environments, as well as your physical systems. Performing Highly Automated Installations You can automate the storage subsystem configuration settings in Windows Storage Server by customizing the Windows Storage Server Unattend.xml file. OEMs can configure the FirstLogonCommand attribute in the Unattend.xml file to run Windows PowerShell scripts or any command-line program that can used to perform storage configuration tasks, such as creating a RAID set, creating LUNs, creating partitions, or formatting partitions. The benefit of this automation is that the storage configuration requires minimal or no configuration by IT pros.

42 36 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Managing Windows Storage Server You can manage Windows Storage Server using the management features in each of the following areas: Management tools for all workloads. Management of power consumption for all workloads. Management of file services workloads. Management of iscsi block I/O workloads. Management of Web services workloads. Management of Print services workloads. Management Tools for All Workloads Windows Storage Server supports the following tools, features, and technologies for managing all workloads: Initial Configuration Tasks window. After installing Windows Storage Server, and before deploying the new appliance in your enterprise, some configuration is required to identify the appliance to other computing resources on your network, secure the appliance, enable administrators to perform tasks on the appliance, and customize the appliance by adding server roles and features. You can complete these tasks by using commands in the Initial Configuration Tasks window, which opens immediately after the operating system installation is complete. For more information about the Initial Configuration Tasks window, see Windows Server Initial Configuration Tasks. Server Manager. Server Manager in Windows Storage Server provides a single source for managing a server's identity and system information, displaying server status, identifying problems with server role configuration, and managing all roles installed on the server. For more information about Server Manager, see Server Manager. Remote Desktop Services Connection. You can remotely manage Windows Storage Server using the Remote Desktop Connection feature. This feature requires the Remote Desktop Client to be installed on the computer used to manage Windows Storage Server, and the feature uses the remote desktop protocol (RDP) to communicate with Windows Storage Server. For more information, see Terminal Services in Windows Server Remote Desktop Services Web Connection. This feature requires only Internet Explorer to be installed on the computer used to manage Windows Storage Server. You make the initial connection to Windows Storage Server using Internet Explorer and the Terminal Services Web Access Web site. Then you connect to Windows Storage Server using the Microsoft ActiveX control included in Remote Desktop Client version 6.1 and later versions. For more information, see Terminal Services Web Access (TS Web Access). Microsoft Remote Server Administration Tools (RSAT). RSAT allows you to remotely manage roles and features in Windows Storage Server from a computer running Windows Vista SP1 or a later Windows operating system. You can run RSAT on 32-bit or 64-bit Windows operating systems, and you also can use it to manage 32-bit or 64-bit versions of Windows Storage Server. For more information about RSAT, see Description of Windows Server 2008 Remote Server Administration Tools for Windows Vista Service Pack 1, Description of Remote Server Administration Tools for Windows 7, and Remote Server Administration Tools Pack. Group Policy. Group Policy provides an infrastructure for centralized configuration management of Windows Storage Server, and the applications and services running on Windows Storage Server. You can use Group Policy on any Windows Storage Server appliance that is a member of an Active Directory domain. For more information, see Group Policy.

43 37 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Windows PowerShell. Windows PowerShell is a task-based command-line shell and scripting language designed especially for system administration. Windows PowerShell is built on the Microsoft.NET Framework and is designed to help you automate the administration of Windows Storage Server, and the applications and services that run on Windows Storage Server. A vast library of existing Windows PowerShell scripts reduces the effort and learning curve for using Windows PowerShell to automate administrative tasks. For more information, see Windows PowerShell. Telnet. You can use any Telnet client to create a remote command console session on a Windows Storage Server appliance. You can run command-line programs, and scripts in the remote command console session, just as if you were locally logged on to the host and using a local command prompt. For more information, see Telnet. VDS. You can perform disk management for any of the workloads using VDSenabled management tools. Microsoft storage partners develop VDS hardware providers that allow management of their storage solutions. You can manage storage with VDS hardware providers using VDS-enabled management tools, such as the Diskpart command-line tool, Diskraid command-line tool, Storage Manager for SANs snap-in, or the Share and Storage Management console. Managing Power Consumption for All Workloads Windows Storage Server also helps you better measure and manage power consumption, both locally and remotely across the enterprise. In conjunction with server OEMs, Microsoft is pursuing an ACPI standards-based approach to the features that provide these capabilities. Remote Manageability of Power Policy Key in Windows Storage Server is the greatly enhanced ability to measure, manage, and budget energy usage for individual servers and across the entire server environment. For centralized power policy management, there are new features in Group Policy for Windows Storage Server, including an improved user interface, additional policy settings, and Windows PowerShell cmdlets for Group Policy, which provide the ability to manage Group Policy from the Windows PowerShell command line and to run Windows PowerShell scripts during logon and startup. Windows Storage Server supports the configuration of power policy, both locally and remotely, through Windows Management Instrumentation (WMI), providing a powerful and convenient way to capture and report information about power consumption, and in turn making power consumption data an actionable metric. WMI, the infrastructure for management data and operations on Windows-based operating systems, exposes the data that is gathered to users, scripts, or management tools in a manner that is compliant with the Distributed Management Task Force (DMTF) management profiles, ensuring interoperability across the entire IT environment. Windows Storage Server provides a new power namespace, root\cimv2\power, which enables code and scripts to query power data on compliant systems. This is useful for IT administrators who use WMI queries in scripts to monitor and administer their infrastructure. IT workers responsible for power management can control power policies and receive power condition events, providing them with the data they need to make informed and timely power management decisions. Power metering and budgeting in Windows Storage Server require no additional drivers or hardware changes, only hardware platform support.

44 38 Windows Storage Server 2008 R2 Architecture and Deployment White Paper In-Band Power Metering and Budgeting The new power features introduce new opportunities for managing power consumption. An administrator can use the performance monitor on a server to view the moment-bymoment power consumption, or in a more likely scenario, the IT administrator can write a script or use Microsoft System Center to centrally collect and monitor power consumption data across the datacenter. Now that power consumption is measurable, it becomes an actionable metric for IT staff when appropriate hardware support is available. Microsoft recommends a collaborative model between the server platform and the operating system for power metering and budgeting (the process that lets administrators set power limits, or caps, on datacenter components as small as a single server). The server platform reports information in-band to the Windows Storage Server through the use of ACPI. The WMI namespace additions for power meters and supplies mean that the user mode power service can provide data to the WMI namespace, and this means power data can be queried by Microsoft System Center and other management tools to budget and monitor power usage across the entire IT environment. An administrator can set power budgets for the servers and the system, and can configure the system so that it automatically takes action when the budget is exceeded. Another set of metrics can be used for virtualization and consolidation. Based on the information gathered, the workloads of underutilized servers can be consolidated onto a smaller number of better-utilized physical machines using live migration (the ability to move virtual machines between servers with virtually no downtime) with Hyper-V. Fewer physical machines can lead to reduced costs through lower hardware and energy costs and through reduced management overhead. Managing File Services Workloads Managing file services workloads includes managing disk volumes, the folder structure to store the files, and the files themselves. You manage file services workloads running on Windows Storage Server by using: File Server Resource Manager. Share and Storage Management. DFS management tools. Single Instance Storage management tools. Managing File Services Using File Server Resource Manager File Server Resource Manager is a suite of tools in Windows Storage Server that enables you to place storage limits on volumes and folders, prevent users from saving specific file types to the server, and generate comprehensive storage reports. File Server Resource Manager not only helps you efficiently control and monitor existing storage resources from a central location, it also aids in the planning and implementation of future changes to the storage infrastructure. Managing Disk Usage Quotas, Unauthorized File Types, and Storage Reports With the File Server Resource Manager snap-in, you can perform three tasks to manage storage resources on local or remote servers: Quota management. Set soft or hard space limits on a volume or folder tree. You can create and apply quota templates with standard quota properties.

45 39 Windows Storage Server 2008 R2 Architecture and Deployment White Paper File screening management. Define filtering rules that monitor or block attempts by users to save certain file types on a volume or folder tree. You can create and apply screening templates with standard file exclusions. Storage reports management. Generate built-in reports to track quota usage, file screening activity, and patterns of storage use. The File Classification Infrastructure feature is also managed with the File Services Resource Manager snap-in, but is covered separately in the Managing File Services Workloads Using File Classification Infrastructure section in this white paper. You can also apply quota and file screening policies when you provision a shared folder, or through a command-line interface. For more information, see File Server Resource Manager. Managing File Services Workloads Using File Classification Infrastructure Managing data stored on file services is usually challenging because of the sheer number of files being stored on network shared folders. Because users store files on a network shared with little or no restrictions, the user storing the files is the only individual who has any knowledge of the information stored in the files and other characteristics about the files, such as sensitivity or criticality of the information in them. Even with this knowledge, you cannot rely on the user to properly determine the proper classification of information, data archival schedule, and other common IT operations tasks. You need to be able to centrally categorize these files and then perform IT file operations based on the classification of the files. The Windows File Classification Infrastructure in Windows Storage Server provides insight into your data to help you manage your data more effectively, reduce costs, and mitigate risks. The Windows File Classification Infrastructure allows you to establish policies for classifying files and then performing common administrative tasks based on the classification. You can use the Windows File Classification Infrastructure to identify files that: Contain sensitive information on servers with lower security to move the files to servers with higher security. Contain sensitive information to encrypt those files. Are no longer essential to automatically remove the files from servers. Are not accessed frequently to move the files to slower, more affordable storage solutions. Require different backup schedules to back up the files accordingly. Require different backup solutions based on the sensitivity of the information in the files. The Windows File Classification Infrastructure allows you to: Centrally define policy-based classification of the files stored in your intranet. Perform file management tasks based on the file classification that you define, rather than on only simple information such as the location, size, or date of the file. Generate reports about the types of information stored in the files in your intranet. Notify content owners when a file management task is going to be performed on their content. Create or purchase custom file management solutions based on the Windows File Classification Infrastructure. Policy-based Classification of Files One of the key advantages to the Windows File Classification Infrastructure is the ability to centrally manage the classification of the files by establishing classification policies

46 40 Windows Storage Server 2008 R2 Architecture and Deployment White Paper using the File Services Resource Manager snap-in. This centralized approach allows you to classify user files without requiring their intervention. You can use the Windows File Classification Infrastructure to: Define classification properties and values, which can be assigned to files on a per-server basis by running classification rules. Property types can include Boolean, date, numbered, ordered lists, and string values. Create, update, and run classification rules. Each rule assigns a single predefined property and value to files within a specified directory, based on installed classification plug-ins. When running a classification rule, optionally re-evaluate files that are already classified. You can choose to overwrite existing classification values, or add the value to properties that support multiple values. File Management Tasks The Windows File Classification Infrastructure allows you to perform file management tasks based on the classifications that you define using the File Services Resource Manager snap-in. You can use the Windows File Classification Infrastructure to help you perform common file management tasks, including: Grooming of data. You can automatically delete data by using policies based on data age or classification properties to free valuable storage space and intelligently reduce storage demand growth. Custom Tasks. Execute custom commands based on age, location or other classification categories. For example, IT administrators are able to automatically move data based on policies for either centralizing the location of sensitive data or for moving data to a less expensive storage resource. The Windows File Classification Infrastructure allows you to automate any file management task by using the file classifications you establish for your organization. Reporting on Information Stored in Files Most IT organizations have no easy method of providing information about the types of files that are stored and managed. Without classification of the files, there is minimal information that can be used to help identify the usage of the files, the sensitivity of the files, and other relevant information about the files. The Windows File Classification Infrastructure allows you to generate reports in multiple formats that can provide statistical information about the files stored on each file server. You can use the reporting infrastructure to generate information that can be used by another application (such as a comma separated variable format text file that could be imported into Microsoft Excel ). File Owner Notification of File Management Tasks Another feature of the Windows File Classification Infrastructure that reduces your administrative effort is the ability to send notifications to content owners when an automated file management task runs. For example, when files become old enough to be automatically expired, the content owners can be notified in advance and given the opportunity to prevent the files from being archived or deleted. You can also select the method for notification based on the type of file management task being performed. And the extensible nature of the Windows File Classification Infrastructure allows you to integrate with existing messaging systems or information portals. Improved Development of File Management Tasks You can extend the file management features of the Windows File Classification Infrastructure by creating your own custom file management solution or purchasing a file management solution from an independent software vendor. The architecture of the Windows File Classification Infrastructure allows the use of any supported development

47 41 Windows Storage Server 2008 R2 Architecture and Deployment White Paper environments for Windows Storage Server including Windows PowerShell and Microsoft Visual Basic Scripting Edition (VBScript). This architecture allows you to select the level of programming sophistication required to automate your file management tasks. For example, you could write Windows PowerShell scripts to manage files based on the classifications you define for your organization. Managing File Services Using Share and Storage Management Share and Storage Management in Windows Storage Server provides a centralized location for you to perform: Shared resource management. You can configure shared folders for SMB or NFS protocols and DFS settings using Share and Storage Management. You can perform the following tasks using this tool: Specify the folder or volume that you want to share or create a new folder to share. Specify the network sharing protocol used to access the shared resource. Manage the local NTFS permissions for the folder or volume you will be sharing. Manage the share access permissions, user limits, and offline access to files in the shared resource. Publish the shared resource to a DFS namespace. Manage NFS-based access permissions for the shared resource. If File Server Resource Manager is installed, apply storage quotas to the new shared resource, and create file screens to limit the type of files that can be stored in it. Stop the sharing of a folder or volume. See which users are currently accessing a folder or a file and disconnect a user if necessary. Multi-vendor storage management. You can manage storage on disks available on your server, or on storage subsystems that have a VDS Hardware Provider using Share and Storage Management, such as the Microsoft iscsi Software Target VDS Hardware Provider. Each vendor supplies the VDS Hardware Provider, which can be installed and configured for use in Windows Storage Server. You can perform the following tasks using this tool: Extend the size of a volume. Format a volume. Delete a volume. Change volume properties like compression, security, offline availability and indexing. Access disk tools for error checking, defragmentation, and backup. For more information about Share and Storage Management, see Overview of Share and Storage Management. Managing DFS Namespaces and DFS Replication The Distributed File System (DFS) technologies offer wide area network (WAN)-friendly replication as well as simplified, highly-available access to geographically dispersed files. The technologies in DFS include the following: DFS Namespaces. DFS Namespaces lets you group shared folders located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. This structure

48 42 Windows Storage Server 2008 R2 Architecture and Deployment White Paper increases availability and automatically connects users to shared folders in the same AD DS site, when available, instead of routing them over WAN connections. DFS Replication. DFS Replication is an efficient, multiple-master replication engine that you can use to keep folders synchronized between servers across limited bandwidth network connections. DFS Replication uses a new compression algorithm known as remote differential compression (RDC), which replaces the File Replication Service (FRS) as the replication engine for DFS Namespaces, as well as AD DS SYSVOL folder replication in domains that use the Windows Server 2008 domain functional level. RDC is a "diff-over-the wire" client-server protocol that can be used to efficiently update files over a limited-bandwidth network. RDC detects insertions, removals, and re-arrangements of data in files, enabling DFS Replication to replicate only the changed file blocks when files are updated. This can greatly reduce the amount of traffic transferred over limited-bandwidth networks, such as in Branch office locations. Read-only DFS Replication. Read-only DFS Replication is a secure method for replicating data where read-only access is required to the data. For example, you can use read-only DFS Replication to publish data from a head office to branch offices where users in the branch office should not change the data, and the data is not replicated back to the head office. For more information, see the following sections in this white paper: Securing File Services Workloads Creating Branch Office Solutions You can manage DFS Namespaces and DFS Replication using the: The DFS Management snap-in hosted by Server Manager. The DFS Management snap-in from the Administrative Tools folder. The following command line tools: DfsUtil.exe DfsCmd.exe DfsDiag.exe DfsrAdmin.exe DfsrDiag.exe You also can use DFS to replicate files and folders in geographically dispersed environments so that users have a local copy of the files and folders. In addition, you can replicate files and folders to another location using DFS for disaster recovery scenarios. For more information about: DFS, see Distributed File System. Managing DFS Namespaces and DFS Replication, see DFS Management. Using DFS to replicate file services workloads for disaster recovery scenarios, see the section "Using DFS Replication to Protect Data," later in this white paper. For more information about DFS Replication, see Replication.

49 43 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Managing Single Instance Storage The Single Instance Storage feature in Windows Storage Server reduces the amount of space used to store data on a volume. Single Instance Storage does this by replacing duplicate files with logical links that point to a single copy of the file in the SIS Common Store, which is a hidden folder located in the root directory of the volume. Identifying Single Instance Storage Architecture Single Instance Storage consists of the following components that together maintain a database of file signatures: Groveler service. The Groveler service scans the hard-disk volumes on a server for duplicate copies of files. The Groveler discovers duplicate files and initiates the deduplication of files. The Groveler service runs in user-mode. Single Instance Storage Filter. The Single Instance Storage Filter is a file system filter service that redirects reads to the common store and performs the replacement of file pointers when users start changing a duplicate file. The Single Instance Storage Filter runs in kernel mode. For more information about: The Single Instance Storage feature, see Single Instance Storage. Managing Single Instance Storage using Sisadmin.exe, see Managing SIS Using SisAdmin.exe. Identifying Single Instance Storage Management Tools You can enable or disable Single Instance Storage on a volume through the Share and Storage Management console, but the primary administration tool for this feature is Sisadmin.exe. You can also automate the administration of Single Instance Storage using Windows PowerShell scripting or any other scripting language that supports WMI. Identifying Single Instance Storage Specifications Table 12 lists the specifications for the Single Instance Storage feature in Windows Storage Server. Table 12. Single Instance Storage Feature Specifications in Windows Storage Server Specification Value Maximum number of volumes per appliance. 128 Failover cluster support. Ability to undo single instancing of files. WMI support. Minimum file size supported. Supports replication of files using DFS Replication. Requires volumes to be formatted as NTFS. Supports system drives. Supports boot drives. Supports remote drives. Support files with extended attributes. Support backup of single instance of file using Single Instance Storage APIs in sisbkup.dll. Yes Yes Yes 32 KB Yes Yes No No No No Yes

50 44 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Identifying Typical Reduction in Storage Usage Using Single Instance Storage The extent to which the Single Instance Storage feature in Windows Storage Server can help reduce storage usage depends on the number of duplicate files stored on the appliance. Files stored in user home folders provide the most typical scenario where the larger reduction of storage usage is realized. In this scenario, IT organizations typically realize storage savings that average from 10 percent to 30 percent. For files in a software development environment, build and release provides the largest reduction of storage usage. In this scenario, IT organizations typically realize storage savings of more than 50 percent. Managing Single Instance Storage Using Windows PowerShell You can manage the Single Instance Storage feature using the SingleInstanceStorage module, which is included in Windows Storage Server. Table 14 lists the Windows PowerShell cmdlets included in the SingleInstanceStorage module and provides a brief description of each cmdlet. Table 13. Windows PowerShell Cmdlets for Managing Single Instance storage Category Cmdlet and description SIS linked files Get-SisLinkFile. Returns a list of all the linked files and the corresponding filename in the SIS Common Store. SIS disk volumes Uninstall-SisVolume. Uninstalls SIS from a volume. This will cause all linked files to revert to the original file stored in the SIS common store. Set-SisVolume. Configures SIS after it has been installed on a volume. Install-SisVolume. Installs SIS on a volume. Disable-SisVolume. Disables SIS on a volume. Enable-SisVolume. Enables SIS on a volume. Get-SisVolume. Lists all the volumes that have SIS installed enabled. Get-SisVolumeReport. Displays a SIS summary report for each volume, including the: Spaced saved. Percentage of the volume saved. Number of linked files. Number of files in the SIS Common Store. For more information about managing the Single Instance Storage feature using Windows PowerShell, see Single Instance Storage Cmdlets in Windows PowerShell. Managing iscsi Block I/O Workloads The types of management tasks for disk block I/O workload include managing iscsi targets, virtual disks, and connections to storage arrays. You can manage iscsi block I/O workloads running on Windows Storage Server for the following components: Microsoft iscsi Software Target Microsoft iscsi Software Initiator

51 45 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Managing the Microsoft iscsi Software Target for iscsi Block I/O Workloads The Microsoft iscsi Software Target feature allows Windows Storage Server appliances to act as an iscsi target. You can manage this feature by using the: Microsoft iscsi Software Target snap-in. Share and Storage Management console. Managing the Microsoft iscsi Software Target Using Microsoft iscsi Software Target Snap-in Typical tasks that you use the Microsoft iscsi Target snap-in to perform include managing: iscsi targets. iscsi targets are the logical endpoint to which an iscsi initiator connects. Typically, you assign just one iscsi initiator to each iscsi target. If you assign multiple iscsi initiators to the same iscsi target, there is a potential for conflict between the computers running the iscsi initiators. The most typical reason for assigning multiple iscsi initiators to the same iscsi target is for shared storage in failover clusters. You manage iscsi targets using the iscsi Targets node in the Microsoft iscsi Software Target snap-in. Virtual disks. Virtual disks are the LUNs that the computer running an iscsi initiator uses. An iscsi target can manage multiple virtual disks, but a virtual disk can only be managed by one iscsi target. You manage virtual disks using the iscsi Targets node in the Microsoft iscsi Software Target snap-in. Virtual disk snapshots. Virtual disk snapshots are point-in-time copies of virtual disks that you can use to back up active virtual disks for disaster recover scenarios or to restore a LUN to a previous state. You manage virtual disks using the Snapshots node in the Microsoft iscsi Software Target snap-in. For more information about using virtual disk snapshots for backup and in disaster recovery scenarios, see the section "Using Virtual Disk Snapshots to Protect iscsi Block I/O Workload Data," later in this white paper. Managing the Microsoft iscsi Software Target Using Share and Storage Management Console You can manage storage on the Microsoft iscsi Software Target using Share and Storage Management. The Microsoft iscsi Software Target includes the Microsoft iscsi Software Target VDS Hardware Provider that allows LUNs on Windows Storage Server to be managed by any application that uses VDS, such as Share and Storage Management. For more information about the Microsoft iscsi Software Target VDS Hardware Provider, see the previous section, "Identifying Microsoft iscsi Software Target Support for VSS and VDS Providers" in this white paper. For more information about Share and Storage Management, see Overview of Share and Storage Management. For more information about managing Microsoft iscsi Software Target for iscsi block I/O workloads, see: Configuring the Microsoft iscsi Software Target. Microsoft iscsi Software Target 3.3 Managing the Microsoft iscsi Software Initiator for iscsi Block I/O Workloads The Microsoft iscsi Software Initiator enables you to connect Windows operating systems to an external iscsi-based storage array, such as the Microsoft iscsi Software Target, through an Ethernet network adapter. All current Windows operating systems support the Microsoft iscsi Software Initiator, and the most current version of the

52 46 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Microsoft iscsi Software Initiator is version The Microsoft iscsi Software Initiator in Windows Storage Server allows the server software to connect to other external iscsibased storage arrays, such as those described in the section "Using Windows Storage Server in a NAS Gateway Configuration," later in the white paper. You can manage the Microsoft iscsi Software Initiator by using the: Graphical user interface in the Microsoft iscsi Software Initiator. iscsi Control Panel configuration utility (iscsicpl.exe). iscsicli.exe tool from a command line. For more information about managing the Microsoft iscsi Software Initiator, see the Microsoft iscsi Initiator Step-by-Step Guide. Managing iscsi Block I/O Workloads Using Windows PowerShell You can manage the Microsoft iscsi Software Target version 3.3 using the MicrosoftIscsiTarget module, which is included in Windows Storage Server. Table 14 lists the Windows PowerShell cmdlets included in the MicrosoftIscsiTarget module and provides a brief description of each cmdlet. Table 14. Windows PowerShell Cmdlets for Managing Microsoft iscsi Software Target Version 3.3 Category Cmdlet and description iscsi target management New-IscsiServerTarget Creates a new iscsi target object with the specified name. Afterwards, the iscsi target can be assigned to an iscsi initiator, and then a virtual disk can be associated with the target. Get-IscsiServerTarget. Obtains the iscsi targets and their associated properties from the local server or specified computer. Set-IscsiServerTarget. Modifies settings for the iscsi target and returns the corresponding iscsi target object if the PassThru parameter is specified. Remove-IscsiServerTarget. Deletes an iscsi target object. An iscsi initiator cannot access the VHD or LUN after the target is deleted. Virtual disk management New-IscsiVirtualDisk. Creates a new iscsi virtual hard disk (VHD) object with the specified file path and size. Afterwards, the virtual disk can be assigned to an iscsi target. Once a virtual disk has been assigned to a target, an iscsi initiator can access the virtual disk after the initiator connects to the target. Get-IscsiVirtualDisk. Obtains the iscsi virtual disks and their associated properties. Set-IscsiVirtualDisk. Modifies the settings for the virtual disk and returns the corresponding iscsi virtual disk object if the PassThru parameter is specified. Remove-IscsiVirtualDisk. Deletes the iscsi virtual disk object. The VHD file is not deleted.

53 47 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Category Cmdlet and description LUN management Add-VirtualDiskTargetMapping. Assigns a virtual disk to an iscsi target. Once a virtual disk has been assigned to a target, an iscsi initiator can access the virtual disk after the initiator connects to the target. All the virtual disks assigned to the same iscsi target will be accessible by the connected iscsi initiator. Remove-VirtualDiskTargetMapping. Removes the assignment between a virtual disk and iscsi target. The virtual disk will be no longer accessible by an iscsi initiator once the assignment is removed. For more information about managing the Microsoft iscsi Software Target version 3.3 using Windows PowerShell, see PowerShell cmdlets for the Microsoft iscsi Target 3.3. Managing Web Services Workloads Web services workloads in Windows Storage Server can be managed by any of the management methods available for IIS 7.0. The management tools available for managing IIS 7.0, and for managing Web services workloads, are listed in Table 15. Table 15. Tools for Managing Web Services Workloads in Windows Storage Server Tool Internet Information Services Manager snap-in Appcmd.exe Description You can manage IIS 7 using the Internet Information Services Manager snap-in, which lets you: Manage IIS and ASP.NET in one tool. View health and diagnostic information that includes the ability to view currently running requests in real time. Configure user and role authorization for sites and applications. Delegate site and application configuration to nonadministrators. Connect to a web server, site, or application remotely by using HTTP. Note You cannot use IIS Manager to manage FTP sites in IIS 7 on Windows Storage Server. Use IIS 6.0 tools to manage FTP sites. For more information, see IIS Manager (IIS 7). You can manage IIS 7 using the command-line tool Appcmd.exe to configure and query objects on your web server, and to return output in text or you can use XML.Appcmd.exe, which provides consistent commands for common queries and configuration tasks, reducing the complexity of learning syntax. In addition, you can combine commands to return more complex data about objects on your web server or to perform tasks that are more complex. For example, you can complete complex tasks like stopping all sites with pending requests that have been running longer than sixty seconds. For more information, see Appcmd.exe.

54 48 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Tool Configuration store Scripts using WMI Description You can manage IIS 7 using the XML-based configuration store that is modeled after the ASP.NET configuration. IIS configuration is stored in the ApplicationHost.config file and can also be distributed among Web.config files for sites, applications, and directories. Settings configured at one level are inherited automatically by lower levels, unless they have been locked to prevent changes. By default, the server administrator is the only user who has permission to view and edit the ApplicationHost.config file. For more information, see Configuration Store (IIS 7). You can use WMI to build scripts for web administration. The IIS 7 WMI provider namespace, WebAdministration, contains classes and methods that enable you to script administration of websites, web applications, and their associated objects and properties using any scripting language that supports WMI, such as Windows PowerShell. For more information, see Windows Management Instrumentation (WMI) in IIS 7. Windows Storage Server includes the following features which help reduce administration, support, and troubleshooting effort: Automation of common tasks through the PowerShell provider. The Windows PowerShell Provider for IIS is a Windows PowerShell snap-in that allows you to perform IIS administrative tasks, and manage IIS configuration and run-time data. In addition, a collection of task-oriented cmdlets provide a simple way to manage websites, web applications and web servers. Enhancements to IIS Manager. New features have been added to IIS Manager for the 7.5 release that make it possible to manage obscure settings such as those used for FastCGI and ASP.NET applications or adding and editing request filtering rules through a graphical user interface. These enhancements include updates to: Configuration Editor. Allows you to manage any configuration section available in the configuration system. Configuration Editor exposes several configuration settings that are not exposed elsewhere in IIS Manager. IIS Manager UI extensions. Utilizing the extensible and modular architecture introduced with IIS 7.0, the new IIS 7.5 integrates and enhances existing extensions and allows for further enhancements and customizations in the future. The FastCGI module, for example, allows management of FastCGI settings while the ASP.NET module allows management of authorization and custom error settings. Request Filtering. This module includes the filtering features previously found in URLScan 3.1. By blocking specific HTTP requests, the Request Filter module helps prevent potentially harmful requests from being processed by Web applications on the server. The Request Filtering user interface provides a graphical user interface for configuring the Request Filtering module. Managed service accounts. Windows Storage Server allows domain-based service accounts to have passwords that are managed by AD DS. These new type of accounts reduce the recurrent administrative task of having to update passwords on processes running with these accounts. IIS 7.5 supports the use of managed service accounts for application pool identities. Hostable Web Core. Developers are able to service HTTP requests directly in their applications by using the hostable Web core feature. Available through a set of APIs, this feature lets the core IIS Web engine to be consumed or hosted by other applications, allowing those apps to service HTTP requests directly. The hostable

55 49 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Web core feature is useful for enabling basic Web server capabilities for custom applications or for debugging applications. Enhanced auditing of changes to IIS 7.5 and application configuration. The new Configuration Logging feature in IIS 7.5 provides enhanced auditing of changes to IIS and application configuration, which allows you to track the configuration changes made to your test and production environments. This provides logging of both reads and writes, as well as logon attempts, changes to path mappings, file creations and more. Failed Request Tracing for FastCGI. In IIS 7.5, PHP developers can use the FastCGI module to include IIS trace calls in their applications. This reduces the effort required for debugging code during development and troubleshooting application errors after deployment by using IIS Failed Request Tracing. Best Practices Analyzer (BPA). The BPA for IIS 7.5 is a management tool that can help you reduce best practice violations by scanning an IIS 7.5 Web server and reporting on potential configuration issues found. You can access the BPA through Server Manager and Windows PowerShell. Managing Print Services Workloads The Print services workloads in Windows Storage Server that the Print Server role provides can be managed by using the tools listed in Table 16. Table 16. Tools for Managing Print Services Workloads in Windows Storage Server Tool Server Manager Print Management snap-in Group Policy Description Use Server Manager to install the Print Services server role, optional role services, and features. Server Manager also displays print-related events from Event Viewer and includes an instance of the Print Management snap-in, which can administer the local server only. For more information, see Server Manager and the Print Services Role. The Print Management snap-in provides current details about the status of printers and print servers on the network. Use Print Management to install printer connections to a group of client computers simultaneously and to monitor print queues remotely. Print Management can also help you find printers that have an error condition by using filters. It can also send notifications or run scripts when a printer or print server needs attention. On printers that provide a web-based management interface, Print Management can display more data, such as toner and paper levels. For more information, see the Print Management Step-by-Step Guide. Use Print Management with Group Policy to automatically deploy printer connections to users or computers and install the appropriate printer drivers for computers running Windows Vista and later Windows operating systems. For Windows operating systems prior to Windows Vista, use the PushPrinterConnections.exe tool in a startup script (for percomputer connections) or in a logon script (for per-user connections). For more information, see the Print Management Step-by-Step Guide.

56 50 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Tool Printer Migration Wizard Printbrm.exe command-line tool Windows PowerShell Description The Printer Migration Wizard allows you to export print queues, printer settings, printer ports, and language monitors, and then import them on another print server that is running a Windows operating system. This is an efficient way to consolidate multiple print servers or replace an older print server. For more information, see the Print Migration Tool. Provides the same features and functionality as the Printer Migration Wizard. Use Windows PowerShell to manage print services workloads. For more information about using Windows PowerShell to manage print services workloads, see Printer Management Using PowerShell.

57 51 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Protecting Windows Storage Server Workload Data One of the essential aspects to ongoing operations of Windows Storage Server workloads is the ability to protect the data that the server software manages. Using proper backup and disaster recovery processes, tools, and technologies, helps protect the data managed by Windows Storage Server, and reduce the risk of potential data loss. Note In addition to the products and technologies discussed in this section, you can use most backup and disaster recovery products offered by Microsoft partners for Windows Server 2008 to protect data managed by Windows Storage Server. You can protect the data managed by Windows Storage Server using: The Windows Server Backup feature. The Shadow Copies of Shared Folders feature. The Volume Shadow Copy Service feature. The LUN resynchronization capabilities. The DFS Replication feature. The Automated System Recovery feature. System Center Data Protection Manager, which is available separately. The Appcmd.exe tool to backup IIS configuration. The PrintBRM.exe tool to backup printer information. Using Windows Server Backup to Protect Data The Windows Server Backup feature in Windows Server 2008 R2 consists of a MMC snap-in and command-line tools that provide a solution for backup and recovery requirements. Table 17 lists the features and limitations of this feature. Table 17. Features and Limitations of Windows Server Backup Features Use Windows Server Backup to: Back up a full server (all volumes), selected volumes, or the system state. Recover volumes, folders, files, certain applications, and the system state. Perform a system recovery in case of disasters like hard disk failures, which will restore your complete system onto the new hard disk by using a full server backup and the Windows Recovery Environment. Perform backups of applications like SQL Server to protect application data using VSS functionality. Limitations Windows Server Backup has the following limitations: Supports backing up only to external and internal disks, DVDs, and shared folders. You cannot perform backups to tape. However, support of tape storage drivers is still included in Windows Storage Server. Cannot back up shared storage in a failover cluster if the storage is moved between active nodes. Can only back up volumes 2 terabyte or less in size. Does not implement a method of including media rotation strategies. Does not include the ability to or provide notification of the backup status report. Does not support a centralized monitoring ability for enterprise environments.

58 52 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Features Limitations Only supports backup of entire volumes (cannot be used to backup individual files and folders. Only supports backup of local volumes (cannot be used to backup network shared folders). If your backup and recovery requirements are affected by any of the limitations listed above, consider using: System Center Data Protection Manager For more information, see the section "Using System Center Data Protection Manager 2007 to Protect Data," later in this white paper. Backup and recovery solutions from Microsoft partners. For more information, contact the appropriate Microsoft partner. Using Shadow Copies of Shared Folders to Protect Data The Shadow Copies of Shared Folders feature in Windows Storage Server is a feature in Windows Server that transparently maintains previous versions of files on selected volumes by using shadow copies. It works by taking snapshots of an entire volume at particular points in time. This feature allows a user to restore selective files or folders from previous versions without IT assistance. The Shadow Copies for Shared Folders features uses the Volume Shadow Copy Service to create the file copies. With Shadow Copies of Shared Folders, you can view shared files and folders as they existed at points of time in the past. Accessing previous versions of files, or shadow copies, is useful because you can: Recover files that were accidentally deleted. If you accidentally delete a file, you can open a previous version and copy it to a safe location. Recover from accidentally overwriting a file. If you accidentally overwrite a file, you can recover a previous version of the file. (The number of versions depends on how many snapshots you have created.) Compare versions of a file while working. You can use previous versions when you want to check what has changed between the versions of a file. Shadow Copies of Shared Folders is enabled for an entire volume. You cannot enable this feature for specific shared folders and files on a volume. The default configuration for this feature is as follows: A default task is scheduled to create shadow copies at 7:00 A.M. and 12:00 P.M, Monday through Friday. Note This default task can be customized to meet the specific needs of an organization. The default storage area is on the same volume and its size requires 10 percent of the available space. There is a limit of 64 shadow copies per volume (when this limit is reached, the oldest shadow copy will be deleted and cannot be retrieved). Note Shadow copies are read-only and as such you cannot edit the contents of a shadow copy. For more information about the Shadow Copies of Shared Folders feature, see: Shadow Copies for Shared Folders Technical Reference. Shadow Copies of Shared Folders.

59 53 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Using the Volume Shadow Copy Service to Protect Data The Volume Shadow Copy Service feature in Windows Storage Server provides the ability to take point-in-time snapshots of files and is the foundation for other applications or features, such as those in the sections about "Windows Server Backup," "Shadow Copies of Shared Folders," and "Virtual Disk Snapshots" in this white paper. Figure 7 illustrates the architecture of the Volume Copy Shadow Service in Windows Storage Server. This architecture allows the point-in-time snapshots of files stored in Windows Storage Server. Figure 7. Volume Shadow Copy Service Architecture Table 18 lists the components in the Volume Shadow Copy Service architecture and how the components relate to each other. Table 18. Components in the Volume Shadow Copy Architecture Component Volume Shadow Copy Service Requestor Writer Provider Source volume Storage volume Description A service that coordinates various components to create consistent shadow copies of one or more volumes. An application that requests that a volume shadow copy be taken. For example, the Windows Server Backup feature, Shadow Copy of Shared Folders feature, System Center Data Protection Manager, or the Diskshadow command-line tool. A component of an application that stores persistent information on one or more volumes that participate in shadow copy synchronization. Typically, this is a database application like SQL Server or Exchange Server, or a system service like Active Directory. A component that creates and maintains the shadow copies. Examples include the system provider included with the Windows Storage Server operating system, and the hardware providers included with storage arrays, such as the Microsoft iscsi Software Target VSS Hardware Provider. The volume that contains the data to be shadow copied. The volume that holds the shadow copy storage files for the system copy-on-write software provider.

60 54 Windows Storage Server 2008 R2 Architecture and Deployment White Paper As described in Table 18 and illustrated in Figure 7, the Microsoft iscsi Software Target Volume Shadow Copy Service Hardware Provider is required to create point-in-time snapshots, or copies, of the virtual hard disks managed by the Microsoft iscsi Software Target. The Volume Shadow Copy Services uses the Microsoft iscsi Software Target Volume Shadow Copy Service Hardware Provider to create these snapshots. Note You can use DiskShadow.exe command-line tool to manage Volume Shadow Copy Services for the Microsoft iscsi Software Target. For more information about the: Volume Shadow Copy Service, see Volume Shadow Copy Service Technical Reference. Microsoft iscsi Software Target VSS Hardware Provider, see the "Hardware Providers" section of Virtual Disks and Snapshots. Using LUN Resynchronization to Protect Data Windows Server 2008 R2 includes support for LUN resynchronization (also known as LUN resynch or LUN revert). LUN resynchronization creates hardware-based shadow copies that allow you to recover a volume from an existing shadow copy of the volume. LUN resynchronization is a method for quickly restoring volumes that takes advantage of the capabilities of storage arrays, such as SANs. This allows you to create shadow copies of entire LUNs, and then restore from those shadow copies, using the inherent snapshot or copying features in the storage array. You can also use LUN resynchronization to help quickly create duplicates of productions LUNs for use in a storage environment for backup or in test, or development environments. Comparison of LUN Resynchronization and Traditional Volume Shadow Copy Service Window Server 2008 R2 LUN resynchronization support is an extension of the features provided by the Volume Shadow Copy Service in Windows Server 2008 R2. LUN resynchronization uses the same application programming interfaces (APIs) that are used by the Volume Shadow Copy Service. Table 19 lists the differences between LUN resynchronization and current features in Volume Shadow Copy Service. Table 19. Comparison of LUN Resynchronization and Traditional Volume Shadow Copy Service LUN resynchronization Recovers entire LUN, which may contain multiple volumes. Performed by storage array hardware. Typically takes less time than restoring by using traditional Volume Shadow Copy Service. Traditional volume shadow copy service Recovers only a volume. Performed by server computer. Typically takes more time than restoring by using LUN resynchronization.

61 55 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Comparison of LUN Resynchronization and LUN Swap LUN swap is a fast volume recovery scenario supported since the release of Windows Server 2003 Service Pack 1 (SP1). In a LUN swap, a shadow copy version of a LUN is exchanged with the active LUN. Table 20 lists the differences between LUN resynchronization and a LUN swap. The source LUN is the shadow copy of the LUN that contains the data you wish to use. The destination LUN is the target LUN that will be synchronized or swapped with the source LUN. Table 20. Comparison of LUN Resynchronization and LUN Swap LUN resynchronization Source (shadow copy) LUN remains unmodified after the resynchronization completes. Destination LUN contains the same information as the source LUN, and any information written during the resynchronization. Source LUN can be used for recovery again. Requires that the destination LUN exists and is usable. Source LUN can exist on slower, less expensive storage. LUN swap Source (shadow copy) LUN becomes the active LUN and is modified. Contains only the information on the source LUN. Must create another shadow copy to perform recovery. Destination LUN does not have to exist or can be unusable. Source LUN must have the same performance as the production LUN. Benefits of Performing Full Volume Recovery Using LUN Resynchronization The benefits of LUN resynchronization include the following: Perform recovery of volumes with minimal disruption of service. After the recovery of a volume using LUN resynchronization is initiated, users can continue to access data on the volume while the synchronization is being performed. Although there may be a reduction in performance, users and applications are still able to access their data. Reduce the workload while recovering volumes. Because the hardware storage array is performing the resynchronization, the server hardware resources are only minimally affected. This allows the server to continue processing other workloads with the same performance while the LUN resynchronization process completes. Integration with existing volume recovery methods. The APIs used to perform LUN resynchronization are the same APIs that perform a traditional Volume Shadow Copy Service recovery. This helps ensure that you can use the same tools and processes for a traditional Volume Shadow Copy Service recovery. Compatibility with future improvements. Because LUN resynchronization uses published, supported APIs in Windows Server 2008 R2, future versions of Windows Server will also provide support for LUN resynchronization.

62 56 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Process for Performing Full Volume Recovery Using LUN Resynchronization Before you can perform a full volume recovery using LUN synchronization, you need to have a hardware shadow copy (snapshot) of the LUN. You can make full or differential shadow copies of the LUN. The following includes the sequence of events that occur when performing a full volume restore using LUN synchronization: 1. The source and destination LUNs are identified. 2. The LUN resynchronization is initiated between the source (shadow copy) and the destination LUNs. 3. During the LUN resynchronization, users can access the volume using the following methods: For read operations, volume requests are directed to the source LUN. For write operations, volume requests are directed to the destination LUN. 4. The LUN resynchronization continues by performing a block-level copy from the source (shadow copy) LUN to the destination LUN. 5. The LUN resynchronization completes and all user requests are now performed from the destination LUN. Note At the end of the LUN resynchronization process, the source LUN is unmodified and the destination LUN contains the same information as the source LUN, plus any data that was written to the destination LUN during the LUN resynchronization process. You can find more information about how these steps are performed by viewing the Volume Shadow Copy Service APIs on MSDN, and in the Windows Software Development Kit (SDK) for Windows 7 and Windows Server 2008 R2. Using DFS Replication to Protect Data DFS Replication can be used as part of a centralized backup solution. You can use DFS Replication to create replica copies of data in a centralized location and then back up the replica copies. For example, you can use this method in branch office scenarios to create replica copies of data in the branch offices in the head office and then back up the data in the head office. For more information about DFS Replication in branch office scenarios for data protection, see the section "Creating Branch Office Solutions" later in this white paper. Using Automated System Recovery to Protect Data While backing up data to tape protects mission critical data from catastrophic events, such as fire or electrical surges, it does nothing to protect system software stored on the hard drive, because that information is not copied during the backup process. A critically damaged hard drive will lose all critical registry information, system files, and disk partition information; nothing remains but the bare metal. Restoring the base operating system plus the backup application (the minimum required to restore backed up applications and data) is a time intensive process. With the Automated System Recovery (ASR) technology in Windows Storage Server, a system administrator prepares for such a disaster by saving to physical media a complete backup set of information about the how the server was configured, including any volume information. In the event of system failure, this backup set is used with the ASR restore CD (which contains the necessary software and drivers to allow the restore) to rapidly restore all system setup information. ASR is tightly integrated with VSS.

63 57 Windows Storage Server 2008 R2 Architecture and Deployment White Paper ASR provides a VSS Writer for the preparation of an ASR set. During a restore operation the ASR VSS writer is executed within the Windows PE environment, which recreates all critical volumes and restores the required data. Finally, in addition to supporting dynamic disks, ASR has been enhanced to support EFI system partitions. This change removes a previous problem in which dynamic disks were always recreated even if a restoration was not necessary. Windows 2008 also provides the Recovery Console that utilizes the Windows Recovery Environment (Windows RE), a version of Windows PE that contains numerous troubleshooting and system resolution utilities. Using System Center Data Protection Manager 2007 to Protect Data Microsoft System Center Data Protection Manager 2007 is designed to provide and restore Windows Server applications. Focused on the primary Microsoft server workloads, Data Protection Manager 2007 was specifically designed to protect and recover files services for SQL Server, Exchange Server, SharePoint Portal Server, Microsoft Virtual Server, and Windows Server operating systems. In addition, Data Protection Manager 2007 blends the best aspects of continuous data protection (CDP) to disk storage with traditional tape backup. Data Protection Manager 2007 includes the following benefits: Continuous data protection for Windows application and file services workloads. Data Protection Manager 2007 protects core Windows Server workloads by continuously capturing data changes with application-aware byte-level agents, providing an easy-to-manage and robust disk/tape back-end platform, and one-click lossless application recovery. Rapid and reliable recovery. Data Protection Manager 2007 enables IT administrators and users to easily recover data in minutes from easily accessible disk instead of locating and restoring from less-reliable tapes. Advanced technology for enterprises of all sizes. Data Protection Manager 2007 combines the best aspects of CDP real-time protection with traditional tape backup/restore to provide a comprehensive disk-to-disk-to-tape data recovery solution. Combined with Windows Server technology, Data Protection Manager 2007 provides technically advanced and comprehensive data protection for organizations ranging in size from small business environments to enterprise environments. For more information about System Center Data Protection Manager 2007, see System Center Data Protection Manager Using Virtual Disk Snapshots to Protect Data The disks you create by using the iscsi Software Target are iscsi virtual disks, which are files in the fixed virtual hard disk (VHD) format. These virtual disks offer flexible and effective storage. They can be extended to provide extra capacity on demand, enable efficient storage utilization, minimize the time required to create disks, and minimize the down time that is typically required to install new disks. To facilitate backup and recovery operations, you can schedule and create snapshots of iscsi virtual disks. A snapshot is a point-in-time, read-only copy of an iscsi virtual disk. Snapshots are useful for backups. They offer the following advantages: Snapshots can be scheduled to be created automatically. Snapshots are space-efficient because they are differential copies. Snapshots are useful for fast system recovery of files and volumes, in case of accidental data deletion by a user, overwritten data, or data corruption resulting from a malicious program.

64 58 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Snapshots can be mounted locally or exported to facilitate backup and recovery operations. Snapshots do not require that you close files or stop programs when you create them, so application servers can continue servicing clients without disruption. Note Snapshots that are created on the iscsi target server are crash consistent. Most modern file systems can recover from this state. To create an application-consistent snapshot, the snapshot must be created from the iscsi initiator computer by using the Microsoft iscsi Software Target Volume Shadow Copy Service Hardware Provider and other backup software that works with the Volume Shadow Copy Service. Table 21 lists scenarios for using virtual disk snapshots. Table 21. Uses for Virtual Disk Snapshots Scenario Provide disaster recovery Create a restore point Use of the virtual disk snapshots The snapshots can be saved to other appliances, servers, or archival media and then later used to restore the data in the event of a failure. The snapshot can be used to provide the ability to rollback services to a previous version. For example, you could create snapshots prior to performing an upgrade to provide the ability to roll back the environment should the upgrade fail. Virtual disk snapshots require the Volume Shadow Copy Service and the Microsoft iscsi Software Target Volume Shadow Copy Service Hardware Provider. To perform backups of the virtual disks, you need to use backup software that works with Volume Shadow Copy Service from a Microsoft partner. For more information about: Virtual disks and virtual disk snapshots, see Virtual Disks and Snapshots. The Volume Shadow Copy Service, see the previous section "Using the Volume Shadow Copy Service to Protect Data," in this white paper. Using the Appcmd.exe Tool to Backup IIS Configuration You can protect data managed by Web services workloads using the Appcmd.exe tool in Windows Storage Server. You can back up the configuration files for IIS 7.0 using this tool. For more information about the Appcmd.exe tool, see How to backup/restore IIS7 configuration. Using the PrintBRM.exe Tool to Backup Printer Information You can protect data managed by Print services workloads using the PrintBRM.exe tool in Windows Storage Server. The PrintBRM.exe tool allows you to export printer information on a periodic basis as a way of backing up a print server. For more information, see Migrate Print Servers.

65 59 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Securing Windows Storage Server Workloads Windows Storage Server includes a number of features and technologies to help you secure your workloads. Windows Storage Server includes all of the security features and technologies found in Windows Server. In addition, you can further secure your workloads using products and technologies from Microsoft partners. Secure Windows Storage Server workloads by securing: Windows Storage Server for all workloads File services workloads Disk block I/O workloads Web services workloads Print services workloads Securing Windows Storage Server for All Workloads Before securing specific workloads, secure the Windows Storage Server operating system. These security measures can be implemented, regardless of the workloads running on Windows Storage Server. Table 22 lists the features or technologies that you can use to secure Windows Storage Server. Table 22. Security Features or Technologies for All Workloads Feature or technology BitLocker Drive Encryption Active Directory Domain Services (AD DS) NTFS permissions Description BitLocker Drive Encryption, included in Windows Storage Server, encrypts data stored on hard disks. This encryption helps protect the data by preventing unauthorized users from breaking Windows file and system protection on lost, stolen, or inappropriately decommissioned appliances. This is especially important for Branch Office scenarios where the physical security may not be as strong as in a data center. For more information, see BitLocker Drive Encryption. AD DS provides centralized management of credentials, accounts, passwords, and is used for accessing all workloads. For more information, see Active Directory Domain Services Overview. NTFS permissions, included in Windows Storage Server, help prevent unauthorized local and network access to files and folders stored on NTFS volumes. NTFS permissions work with share folder permissions to help prevent unauthorized network access to files and folders stored on NTFS volumes. Note For remote or network users, access to files and folders are defined by the combination of NTFS permissions and shared folder permissions. For more information, see the section "NTFS Permissions" in Managing Permissions for Shared Folders.

66 60 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Feature or technology Shared folder permissions Windows Firewall with Advanced Security IPsec Microsoft Forefront Description Shared folder permission, included in Windows Storage Server, only help prevent unauthorized network access to the files and folders stored on Windows Storage Server. These shared folder permissions affect users accessing the files and folders using the SMB protocol. Shared folder permissions work with NTFS permissions to help prevent unauthorized network access to files and folders stored on NTFS volumes. Note For remote or network users, access to files and folders are defined by the combination of NTFS permissions and shared folder permissions. For more information, see the section "SMB Permissions" in Managing Permissions for Shared Folders. Windows Firewall with Advanced Security, included in Windows Storage Server, helps reduce the attack surface by blocking unauthorized network traffic flowing into or out of the appliance. Windows Firewall with Advanced Security is integrated with Network Awareness so that it can apply security settings appropriate to the types of networks to which the computer is connected. Windows Firewall is also integrated with Internet Protocol Security (IPsec), so that the IPsec configuration settings are integrated into the Windows Firewall with Advanced Security snap-in. For more information, see Windows Firewall with Advanced Security and IPsec. IPsec, included in Windows Storage Server, allows you to protect the communications between Windows Storage Server and other Windows operating systems. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. You can centrally manage IPsec using Group Policy, which dramatically reduces the ongoing administrative and operations effort. For more information, see IPsec and Windows Firewall with Advanced Security and IPsec. Microsoft Forefront products, available separately, provide protection, and access, and management solutions that are integrated with Microsoft user identity management, Windows operating systems, and other Microsoft products. Specifically, you can help protect: Windows Storage Server and other Windows-based computers or appliances that communicate with the appliance using Forefront Client Security. Communication with other computers or appliances over the Internet using Forefront Threat Management Gateway Remote connectivity to Windows Storage Server using Forefront Unified Access Gateway 2010.

67 61 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Feature or technology Microsoft partner products Description There are a large number of security related products and technologies that are available from Microsoft partners. Typically, any security product that is compatible with Windows Server 2008 R2 is also compatible with Windows Storage Server 2008 R2. In addition to features and technologies listed in Table 22, you can use the following resources to help secure Windows Storage Server: Microsoft Security. This is the home page for all Microsoft security products and technologies for all operating systems and products. Security Solution Accelerators. This collection of tools and guidance are free, authoritative resources to help you to proactively plan, integrate, and operate your security infrastructure. Specifically, the Security Compliance Management Toolkit Series provides an end-to-end solution to help plan, deploy, and monitor security baselines of Windows operating systems. Securing File Services Workloads File services workloads are secured based on the protocol that provides access to the file services workloads. Table 23 lists the file services protocols and how to secure the protocol. Note The assumption is that Windows Storage Server has been secured using the features and technologies described in the section "Securing Windows Storage Server for All Workloads," earlier in this white paper. Table 23. File Services Protocols and How to Secure the Protocols Protocol How to secure this protocol SMB Use NTFS permissions and shared folder permissions to secure SMB-based access to shared resources. For more information, see "NTFS Permissions" and "SMB Permissions" sections in Managing Permissions for Shared Folders. Use read-only DFS Replication to provide read-only copies of file and folders to servers where only readonly access is allowed. For more information, see the Creating Branch Office Solutions section in this white paper. NFS NFS-based access control for a shared resource is determined based on network names and groups. To use NFS permissions, you must first install the Services for Network File System (NFS) role service using Server Manager. After installing Services for NFS, use NFSAdmin.exe to create client groups and to add client computers to those groups before configuring NFS share permissions. You can manage the NFS share permissions using the Share and Storage Management snap-in. For more information, see the "NFS Permissions" section in Managing Permissions for Shared Folders. Use read-only DFS Replication to provide read-only copies of file and folders to servers where only read-

68 62 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Protocol How to secure this protocol only access is allowed. For more information, see the Creating Branch Office Solutions section in this white paper. WebDAV Encrypt all WebDAV communication with the appliance using secure socket layer (SSL). For more information, see Authentication and Security Using WebDAV. Require authentication for all users that access the appliance using WebDAV. For more information, see Authentication and Security Using WebDAV. Windows SharePoint Services Encrypt all Windows SharePoint communication with the appliance using SSL. For more information, see Plan authentication settings for Web applications (Windows SharePoint Services). Require authentication for all users that Windows SharePoint Server on the appliance. For more information, see Plan authentication settings for Web applications (Windows SharePoint Services). Securing iscsi Block I/O Workloads Disk block I/O workloads are secured by configuring the appropriate security between the Microsoft iscsi Software Target and the iscsi initiators, such as the Microsoft iscsi Software Initiator. Table 24 lists the methods of securing the communication for the iscsi block I/O workloads. Table 24. Securing Communication for iscsi Block I/O Workloads Protocol Require authentication How to secure Require all iscsi initiators to authenticate with the Microsoft iscsi Software Target using one of the following methods: One-way CHAP authentication. With this level of security, only the iscsi target authenticates the initiator. The Challenge Handshake Authentication Protocol (CHAP) secret is set just for the target. All initiators that want to access that target need to use the same secret to start a logon session with the target. Mutual CHAP authentication. With this level of security, the iscsi target and the initiator authenticate each other. A separate secret is set for each target and for each initiator. RADIUS authentication. With this level of security, the iscsi initiator is authenticated by a Remote Authentication Dial-In User Service (RADIUS) server. Transactions between the iscsi initiator and the RADIUS server are also authenticated through the use of a shared secret. To use this level of security, you must have a RADIUS server running on your network, or you must deploy one. IPsec authentication. The IPsec protocol enforces

69 63 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Protocol Encrypt all communication Isolate iscsi network segments How to secure authentication at the IP packet layer. Note At a minimum, use one-way CHAP authentication between iscsi initiators and the Microsoft iscsi Software Target. For more information, see iscsi Security. Protect communication between the iscsi initiators and the Microsoft iscsi Software Target using IPsec encryption. For more information, see IPsec and Windows Firewall with Advanced Security and IPsec. Isolate the network segments used for communication between the iscsi initiators and the Microsoft iscsi Software Target by using separate physical network segments or by using virtual local area networks (VLANs). Securing Web Services Workloads Web services workloads are secured based on the protocol that provides access to the Web services workloads. Table 25 lists the Web services protocols and how to secure the protocol. Note The assumption is that Windows Storage Server has been secured using the features and technologies described in the section "Securing Windows Storage Server for All Workloads," earlier in this white paper. Table 25. Web Services Protocols and How to Secure the Protocols Protocol How to secure this protocol HTTP Use the HTTPS protocol instead to provide encryption of all communication between the appliance and the clients. Allow connectivity to the appliance only from computers on your internal network. Ensure that all HTTP connections require authentication as necessary. Note HTTP is an insecure protocol and sends all traffic in clear text. HTTPS HTTPS is a secure protocol and does not need further protection for confidentiality. Ensure that all HTTPS connections require authentication as necessary. FTP Ensure that all FTP connections require authentication. Allow connectivity to the appliance only from computers on your internal network. Use IPsec to protect communication between the appliance and FTP clients. Note FTP is an insecure protocol and sends all traffic in clear text. IIS 7.5 builds on the application pool isolation that was available with IIS 7.0 that increased security and reliability, every IIS 7.5 application pool now runs with a unique, less-privileged identity. This helps harden the security of applications and services running on IIS 7.5.

70 64 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Securing Print Services Workloads Print services workloads are secured based on the Print Server role service that provides access to the file services workloads. Table 26 lists the Print Server role services and how to secure the role service. Note The assumption is that Windows Storage Server has been secured using the features and technologies described in the section "Securing Windows Storage Server for All Workloads," earlier in this white paper. Table 26. Print Server Role Services and How to Secure the Role Service Role service Print Server LPD Service Internet Printing How to secure this protocol Use printer permissions to control access to the appliance running the Print Server role services using the Print Management snapin. For more information, see Assigning Delegated Print Administrator and Printer Permission Settings in Windows Server 2008 R2. The communication between the LPD Service and LPR clients is unsecured. There is no authentication available or security permissions available. If required, use IPsec to protect the communication between the LPD Service and LPR clients. For more information, see IPsec and Windows Firewall with Advanced Security and IPsec. Protect all communication between the Internet Printing clients and the appliance using SSL. Use the HTTPS protocol instead when connecting to the URL for the printer. For more information, see Internet Printing and Resulting Internet Communication in Windows Server 2008.

71 65 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Improving Availability of Windows Storage Server Workloads High levels of availability are essential for mission-critical applications and services. Windows Storage Server includes all of the high availability features and technologies found in Windows Server. In addition, you can further improve the availability of your workloads using products and technologies from Microsoft partners. Improve the availability of Windows Storage Server workloads by: Improving File services workload availability Improving iscsi block I/O workload availability Improving Web services workload availability Improving Print services workloads availability Improving Availability of File Services Workloads The availability of file services workloads in Windows Storage Server can be improved based on the protocol used to access the file services. Table 27 lists the methods for improving the availability for file services workload and which protocols can use that method. Table 27. Methods for Improving File Services Workload Availability Method SMB NFS WebDAV Windows SharePoint Services Failover clusters. Failover clusters in Windows Storage Server, as illustrated in Figure 8, can be used to improve the availability of SMB-based file services workloads. The method supports read and write access to the files. Windows Storage Server provides an easy to install and configure user interface for creating a two node failover cluster. This user interface reduces the learning curve, complexity, and effort required to create a two node cluster. For more information about failover clusters for file services workloads, see Failover Clusters in Windows Server 2008 and Failover Cluster Step-by-Step Guide: Configuring a Two-Node File Server Failover Cluster. DFS. You can use DFS Replication to create replica copies of shared network folders. Then you can use DFS Namespace to provide automatic failover to replica copies of content when a local copy of the content is unavailable. In addition, you can improve DFS Replication availability by running on failover clusters in Windows Storage Server.

72 66 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Method SMB NFS WebDAV Windows SharePoint Services For more information, see Distributed File System. Network Load Balancing. The Network Load Balancing (NLB) feature in Windows Storage Server can be used to provide fault tolerance for file services workloads. For more information about using NLB to improve availability for file services workloads, see Network Load Balancing. The most common method of improving the availability for file services workloads is by using failover clusters. Figure 8 illustrates a typically two-node failover cluster for file services workloads. The shared storage in Figure 8 can be iscsi, SAS, or Fibre Channel connected storage. PCI RAID controllers are not supported for shared storage. Note The cluster storage illustrated in Figure 8 could be provided by the Microsoft iscsi Software Target in Windows Storage Server.

73 67 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 8. Typical two-node failover cluster for file services workloads Improving Availability of iscsi Block I/O Workloads You can improve the availability iscsi block I/O workloads by using a combination of the following features in Windows Server products: Failover clustering. A failover cluster is a group of independent computers that work together to increase the availability of applications and services. The most common failover cluster used for iscsi block I/O workloads is a file server failover cluster. You can use failover clusters to improve the availability for the iscsi initiator running a Windows Server operating system or the iscsi target running the Microsoft iscsi Software Target. For more information, see Failover Clusters in Windows Server 2008 and the Failover Cluster Step-by-Step Guide: Configuring a Two-Node File Server Failover Cluster. Multipath I/O. Multipath I/O uses physical path components adapters, cables, and switches to create logical paths between the iscsi initiator and the appliance

74 68 Windows Storage Server 2008 R2 Architecture and Deployment White Paper running the Microsoft iscsi Software Target. In the event that one or more of these components fails, causing the path to fail, multipathing logic uses an alternate path for I/O so that applications running on the iscsi initiator can still access their data. Each iscsi network interface card should be connected by using redundant switch infrastructures to provide continued access to storage in the event of a failure in a storage fabric component. Note Multipath connections for Microsoft iscsi Software Initiators is provided by the MPIO feature in Windows Server. Redundancy for iscsi initiators on other operating systems or hardware iscsi initiators is provided by network adapter teaming from the network adapter vendor. Redundancy for file services and print services is also provided by network adapter teaming support from the network adapter vendor. For more information, see Multipath I/O Overview. This section also discusses the following combinations of failover clustering and multipath I/O features: Creating highly-available iscsi targets with single or multipath connections. Creating highly-available iscsi initiators with single or multipath connections. Creating Highly-Available iscsi Targets The highest priority in improving the availability of iscsi block I/O workloads is to improve the availability of the appliances running the Microsoft iscsi Software Target. As illustrated in Figure 9, you can use failover clusters to improve the availability of the appliances running the Microsoft iscsi Software Target in Windows Storage Server. The configuration in Figure 9 helps prevent loss of iscsi block I/O workloads in the event of a failure of one of the appliances. However, there is no fault tolerance depicted in the connection between the iscsi initiator and the clustered iscsi targets (the storage fabric).

75 69 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 9. Highly-available Microsoft iscsi Software Target with a single path connection The configuration in Figure 10 illustrates combining multipath I/O with the failover cluster solution. The network infrastructure for the iscsi communication between the iscsi initiator and the clustered nodes running the Microsoft iscsi Software Target has been updated to include redundant network adapters, switches, and network cables. This redundancy in the physical connectivity helps eliminate any single point of failures due to the network infrastructure for the storage fabric used by iscsi, such as a switch failure or a disconnected network cable.

76 70 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 10. Highly-available Microsoft iscsi Software Target with multipath connections Creating Highly-Available iscsi Initiators After improving the availability of the appliances running the Microsoft iscsi Software Target, you can improve the availability of the iscsi initiators running Windows Server operating systems. As illustrated in Figure 11, you can use failover clusters to improve the availability of the computers or appliances running the Microsoft iscsi Software Initiator in Windows Server operating systems. The configuration in Figure 11 helps prevent loss of iscsi block I/O workloads in the event that one of the computers or appliances running the Microsoft iscsi Software Initiator or Microsoft iscsi Software Target fails. However, there is no fault tolerance depicted in the connection between the clustered iscsi initiators and the clustered iscsi targets (the storage fabric).

77 71 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 11. Highly-available Microsoft iscsi Software Target and iscsi initiators with single path connections The configuration in Figure 12 illustrates combining multipath I/O with the failover cluster solution for the iscsi initiators and iscsi targets in Figure 11. The network infrastructure for the iscsi communication between the clustered nodes running the iscsi initiators and the clustered nodes running the Microsoft iscsi Software Target has been updated to include redundant network adapters, switches, and network cables. This redundancy in the physical connectivity helps eliminate any single point of failure due to the network infrastructure for the storage fabric used by iscsi, such as a switch failure or a disconnected network cable.

78 72 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 12. Highly-available Microsoft iscsi Software Target and iscsi initiators with multipath connections Improving Availability of Web Services Workloads The NLB feature in Windows Storage Server can be used to provide fault tolerance for Web services workloads. The assumption of this solution is that each of the appliances in the NLB cluster have identical content and are continuously synchronized (such as by DFS Replication). For more information about using NLB to improve availability for Web services workloads, see Network Load Balancing. Note If the Web applications use a centralized SQL Server database for storing information, you can also use failover clustering to improve the availability of the database. For more information, see Getting Started with SQL Server 2008 Failover Clustering.

79 73 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Improving Availability of Print Services Workloads Failover clusters in Windows Storage Server can be used to improve the availability of Print services workloads. Figure 13 illustrates a typically two-node failover cluster for Print services workloads. Note The cluster storage illustrated in Figure 13 could be provided by the Microsoft iscsi Software Target in Windows Storage Server. Figure 13. Typical two-node failover cluster for Print services workloads This method helps prevent any print services outages due to the failure a node in the cluster. Print services outages for specific printers occur in the event of a printer failure. However, the print jobs for the printer continue to be queued until the printer failure is resolved and the printer is restored to normal operation. For more information about failover clusters for file services workloads, see Failover Clusters in Windows Server 2008 and the Failover Cluster Step-by-Step Guide: Configuring a Two-Node Print Server Failover Cluster.

80 74 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Improving Performance and Scalability for Windows Storage Server Solutions The ability to take full advantage of the system resources of Windows Storage Server - based appliance is essential to creating successful solutions. Windows Storage Server includes all of the performance and scalability features and technologies found in Windows Server In addition, you can further improve the performance and scalability of your workloads using products and technologies from Microsoft partners. Improve the performance and scalability of Windows Storage Server workloads by improving performance and scalability for: All workloads. File services workloads. iscsi block I/O workloads. Web services workloads. Print services workloads. Improving Performance and Scalability for All Workloads Windows Storage Server includes a number of technologies and features that will improve the performance and scalability for all workloads. These performance and scalability improvements are inherent in Windows Storage Server. Improve the performance and scalability for all workloads by taking advantage of the: Improvements in processor and memory capacity. Improvements in the Next Generation TCP/IP protocol. Improvements in network adapter performance. Reduction in processor utilization for I/O operations. Improvements in Processor and Memory Capacity The improvements in computer design have resulted in modern server computers that support an ever increasing number of processors and increased memory capacity. Current server computers are only shipping with 64-bit processors, multiple processors, and higher memory capacity than ever before. These improvements allow you to create application platforms that are able to support larger workloads, reduce rack space in your data center, reduce power consumption, provide improved reliability, and reduce your overall administrative effort. Improved Physical Processor and Memory Resources 32-bit processors impose system resource limitations that restrict your ability to handle increased workloads without investing in additional server computers. 64-bit processors allow you to support larger workloads, while minimizing the number of physical computers in your data center. Also, server consolidation by using virtualization requires 64-bit processors to provide the processing and memory resources to support higher ratios of server consolidation. To support the increased processor performance and memory capacity provided by 64- bit processors, Windows Storage Server is only available for 64-bit processor architectures. Windows Storage Server supports up to 256 logical processor cores for a single operating system instance.

81 75 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Increased Logical Processor Support Hyper-V in Windows Storage Server can support up to 64 logical processors. This increased processor support makes it possible to run even more demanding workloads on a single computer, or scale workloads to greater extremes to match changing demand. Hyper-V in Windows Storage Server also supports Second-Level Address Translation (SLAT) and CPU Core Parking. SLAT uses special processor functionality available in recent Intel and AMD processors to carry out some virtual machine memory management functions, significantly reducing hypervisor processor time and saving about 1MB of memory per virtual machine. CPU Core Parking enables power savings by scheduling virtual machine execution on only some processor cores and placing the remaining processor cores in a sleep state. Improvements in the Next Generation TCP/IP Protocol With the introduction of Windows Vista and Windows Server 2008, Microsoft included a new version of the TCP/IP protocol suite, also referred to as the Next Generation TCP/IP protocol suite. The Next Generation TCP/IP protocol suite includes a new set of performance enhancements to increase throughput in high-bandwidth, high-latency, and high-loss networking environments. The performance and scalability features in the Next Generation TCP/IP protocol suite include: Offloading TCP/IP protocol processing to specialized network adapter hardware. Offloading some of the TCP/IP protocol processing to a network adapter reduces the processor utilization associated with handling TCP/IP connections. TCP/IP offloading can be used when a server is performing heavy receive processing with less than 1,500 persistent active connections. However, the exact number of connections is vendor specific. For example, when the computer is performing a backup over the network. Automating the tuning of the maximum receive window size. This feature automatically determines the value of the maximum receive window size for a connection based on the current conditions of the network. Optimizing the network to receive TCP data can substantially increase overall network utilization by applications. This feature works with the Compound TCP feature on the sender side. Automatically tuning the receive window size allows the maximum amount of data to be transmitted between Windows Server 2008 and Windows Vista, and improves overall network performance, especially on high latency connections. Aggressively increasing the TCP Send windows size by using Compound TCP (CTCP). CTCP more aggressively increases the Send window for connections with large Receive window sizes and large bandwidth-delay products. CTCP attempts to maximize throughput on these types of connections by monitoring delay variations and losses. CTCP also ensures that its behavior does not negatively impact other TCP connections. Aggressively increasing the TCP Send window size allows the maximum amount of data to be transmitted between Windows Server 2008 and Windows Vista, and improves overall network performance. Improving black hole router detection. This feature senses when large TCP segments retransmit and automatically adjusts the Path Maximum Transmission Unit (PMTU) for the connection, rather than relying on the receipt of the Internet Control Message Protocol (ICMP) error messages. Reducing the number of retransmitted TCP segments improves the overall performance of traffic that used the TCP protocol. Reducing IP packet resending due to router congestion. With Explicit Congestion Notification (ECN) support on both TCP peers and in the routing infrastructure, routers experiencing congestion mark the IP packets as they forward them. TCP peers receiving marked IP packets lower their transmission rate to ease congestion

82 76 Windows Storage Server 2008 R2 Architecture and Deployment White Paper and prevent segment losses. Reducing IP packet resending improves the overall performance of traffic that uses the TCP protocol. For more information about the Next Generation TCP/IP protocol suite in Windows Server 2008, see: Next Generation TCP/IP Stack. New Networking Features in Windows Server 2008 and Windows Vista. Performance Enhancements in the Next Generation TCP/IP Stack. Improvements in Network Adapter Performance RSS in NDIS 6.0 balances the network load from a network adapter across multiple processors. NDIS 5.1 allows a single deferred procedure call (DPC) for each network adapter. NDIS 6.0, using RSS, enables multiple DPCs on different processors for each instance of a network adapter miniport driver, while preserving in-order delivery of messages on a per-stream basis. RSS also supports dynamic load balancing, a secure hashing mechanism, parallel interrupts, and parallel DPCs. Note RSS support has also been released in the scalable networking pack for Windows Server Figure 14 illustrates how the architecture of NDIS 6.0 with RSS prevents bottlenecks for incoming network traffic. Because all processors are able to process incoming network traffic, all processors have available capacity and none are a bottleneck for incoming network traffic. Figure 14. Incoming network traffic with RSS For more information about RSS, see Receive-Side Scaling Enhancements in Windows Server 2008.

83 77 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Reduction in Processor Utilization for I/O Operations Windows Server 2008 performs dynamic redirection of I/O interrupts and I/O completion processing to reduce overall processor utilization. Disk controller drivers can make use of new application programming interfaces (APIs) that allow Windows to specify the processor on which to efficiently perform completion processing for each I/O, when the request is initiated. In prior versions of Windows, the selection of processors to interrupt and perform completion processing was statically chosen when the device was detected (similar to a round-robin order across all processors). A disk controller takes advantage of the Non- Uniform Memory Access (NUMA) I/O functionality in Windows Server 2008 and can use the information specified during the initiation of the I/O operation to select a processor that can most efficiently perform the necessary processing of the completed I/O. NUMA I/O functionality improves the hardware cache hit ratios, reduces the hardware interconnect activity, reduces the possibility of interrupting an application unrelated to the I/O operation, and minimizes I/O completion processing time. Figure 15 illustrates an example of the components that might be required for processing a statically directed I/O completion. Although the I/O operation is initiated on Processor 3, the interrupt from the disk is directed to Processor 2 because of the static assignment made when the disk was detected at boot time. The interrupt and subsequent completion processing of the I/O operation occurs on Processor 2. Processor 2 subsequently interrupts Processor 3 to indicate that the I/O operation is complete (assuming that the application waiting for the I/O is executing on Processor 3). Furthermore, if the completion processing accesses data read from the disk (for example to perform virus detection, decryption, or decompression of the data), that data will have to go from memory to Processor 2 over the node interconnect and then back over the node interconnect to Processor 3 when the application starts to access the data. Figure 15. Multiprocessor I/O operation without NUMA optimization Figure 16 illustrates an example of the components that might be required for processing a dynamically directed I/O completion by using NUMA I/O. In this example, the I/O operation is initiated on Processor 3, the interrupt from the disk is directed to Processor 3, and the subsequent completion processing of the I/O occurs on Processor 3. If the completion processing accesses the data read from the disk, the data will go from memory to Processor 3, and the application will experience a high cache hit ratio when it accesses the data.

84 78 Windows Storage Server 2008 R2 Architecture and Deployment White Paper In this example, the node interconnect and all unrelated processors are unaffected by the I/O completion. In scenarios where the system consists of only Processors 3 and 4 in a single node configuration, the fact that Processor 4 is unaffected by the I/O operation still results in performance benefits. Figure 16. Multiprocessor I/O operation with NUMA optimization The dynamic I/O completion redirection (NUMA I/O) improvements in Windows Server 2008 provide the following benefits: Support for the Message Signaled Interrupt extension (MSI-X) that enables a PCI-X or PCI-Express device to use new APIs to specify a processor to complete processing of each specific I/O operation. Better NUMA and non-numa processor architecture. For NUMA architectures, the I/O processing is localized to a NUMA node or a specific processor within the node. For non-numa architectures, the I/O processing is performed on a specific processor. In the current implementation, the selected completion processor for an I/O is ideally the same processor that initiated the I/O operation. For more information about NUMA support in Windows Server 2008, see: The "NUMA Support" section of the "Advances in Memory Management for Windows" white paper. Download NUMA I/O Optimizations. Improving Performance and Scalability for File Services Workloads File services workloads in Windows Storage Server have improved performance and scalability compared to previous versions of Windows Server. These improvements are largely due to improvements in the SMB2 protocol. Identify the performance and scalability improvements for file services workloads by: Reviewing the performance and scalability improvements in the SMB2 protocol. Reviewing SMB-based file services workload test results. Reviewing performance improvements in SMB Version 2.1 in Windows Server 2008 R2. Improving network performance between head offices and branch offices using the BranchCache feature.

85 79 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Improving network performance between client computers and Windows Storage Server for the folder redirection and offline files features. Review Improvements in the SMB2 Protocol Windows Storage Server 2008 R2 includes the latest version of SMB, SMB2, which is optimized for greater performance over high-latency links. Windows includes an SMB client (the Client for Microsoft Windows component) and an SMB server (the File and Printer Sharing for Microsoft Windows component). SMB 1 the technology behind Windows Server versions prior to Windows Server 2008 was originally designed for early Windows-based network operating systems, such as Microsoft LAN Manager and Windows for Workgroups. SMB in Windows Server 2008 and later versions supports SMB 1 as well as SMB2, the new version of SMB that has been redesigned for today s complex networking environments and next-generation file servers. The SMB2 protocol provides a number of communication enhancements, including greater performance when servers connect to file shares over high-latency links, and better security through the use of mutual authentication and message signing. The SMB2 protocol features include: Support for sending multiple SMB commands within the same packet. This reduces the number of packets sent between an SMB client and server, a common issue in the effective tuning of SMB 1. Support for much larger buffer sizes when compared to SMB 1. An increase in the restrictive constants within the protocol design to allow for scalability. Examples include an increase in the number of concurrent open file handles on the server and the number of file shares that a server can have. Support for durable handles that can withstand short interruptions in network availability. Support for symbolic links. Figure 17 illustrates how SMB 1 processes multiple write operations between a client computer running Windows XP and a server computer running Windows Server In SMB 1, each write request must wait for the write response from a previous write request. For example, write request 2 must wait for the write response from write request 1.

86 80 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 17. Write operations in SMB 1 Figure 18 illustrates how SMB2 processes multiple write operations between a client computer running Windows Vista and a server computer running Windows Server In SMB2, multiple write requests can be issued before receiving a write response. The overall effect, especially on high-latency network connections, is that remote file operations are much faster.

87 81 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 18. Write operations in SMB2 For more information about SMB2, see the "Server Message Block 2.0" section of New Networking Features in Windows Server 2008 and Windows Vista.

88 82 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Review SMB-based File Services Workload Test Results The File Services server role is one of the most common server roles deployed. The File Services server role implements SMB-based file services. Figure 19 illustrates the environment for tests performed over a WAN connection. This test environment emulates two geographic locations (New York and London) separated by a WAN connection. The server computers running Windows Server 2008 and Windows Server 2003 are in New York while the client computers running Windows Vista and Windows XP are in London. Figure 19. Environment for performing File Services role tests The following tests were performed for the File Servers role: Running the Microsoft File Server Capacity Tool (FSCT) on a high-speed network. Copying large files to a remote location over a WAN connection. Accessing files on a shared folder at a remote location over a WAN connection. Note The tests results reflect the performance of Windows Server 2008 with Windows Firewall enabled. The test results for Windows Server 2003 do not include Windows Firewall. Windows Firewall imposes a minimal impact (approximately 5 percent) on network throughput. The performance gains that are illustrated in these tests are a direct result of the performance and scalability features in Windows Server Running Microsoft File Server Capacity Tool On a High-Speed Network For this test, the Microsoft File Server Capacity Tool (FSCT) was run against a server running Windows Server This tool simulates a home folders file workload on a set of client computers and computes the maximum number of users a server can support based on the response time of simulated scenarios as illustrated in Figure 20.

89 Number of Scenarios per Second Procesor utilization 83 Windows Storage Server 2008 R2 Architecture and Deployment White Paper % % % % 60.00% 50.00% 40.00% 30.00% Average scenario throughput CPU utilization % % Number of users 0.00% Figure 20. File Services Role scalability test results The scenarios include common operations such as browsing a directory, copying files, and modifying Microsoft Office files. For a given number of users accessing data on a file server, the tool will compute a throughput number corresponding to the average scenario per second that the server is able to sustain. The tool also provides the ability to collect performance counters such as processor, memory, network, and disk subsystem utilization details to help identify potential bottlenecks. Table 28 lists example performance characteristics for appliances with different system resources. In these examples, the appliances contained only a single or dual processor socket that is typical for these types of appliances at the time of writing. As reflected by these performance characteristics, you can expand the processor and disk resources of the appliances to support tens of thousands of users on a single appliance. Table 28. Example Performance Characteristics of Appliances with Different System Resources Processor sockets Disk configuration Raid level Users supported Processor utilization Single socket 4 SATA drives RAID % Single socket 10 SATA drives RAID 5 1, % Single socket 10 SATA drives RAID 1+0 1, % Dual socket 24 SAS drives RAID 1+0 5, % A significantly higher number of users can be supported by adding more drives, memory, and processors. The number and speed of the drives has the largest influence on the number of users who can be supported.

90 84 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Copying Large Files to a Remote Location Over a WAN Connection For this test, two scenarios were performed (as illustrated in Figure 21) over a simulated WAN connection. In the first scenario, megabyte (MB) files were copied between the client computers and the server computers. In the second scenario, one 268-MB file was copied between the client computers and the server computers. The test scenarios were performed for the combination of Windows Vista SP1 with Windows Server 2008, and Windows XP SP2 with Windows Server 2003 SP2. For both scenarios, the combination of Windows Vista SP1 and Windows Server 2008 provided dramatic performance improvements compared to the combination of Windows XP SP2 and Windows Server 2003 SP2. In the chart in Figure 21, a lower length of time indicates that the file copy process occurred faster. Figure 21. Remote large file copy test results Accessing Files at a Remote Location Over a WAN Connection This test series provides an indication of how typical user applications perform when accessing files and folders on network shared folders on server computers running Windows Server 2008 and Windows Server For this test, the scenarios were performed (as illustrated in Figure 21) over a simulated WAN connection: Opening a 47-KB Excel spreadsheet stored on a network shared folder in Excel Opening a 2-MB Word document stored on a network shared folder in Word Browsing a network shared folder that contains 50 files in Windows Explorer. Copying a 6-MB file to a network shared folder in Windows Explorer. In all these scenarios, the combination of Windows Vista SP1 and Windows Server 2008 provided dramatic performance improvements compared to the combination of Windows XP SP2 and Windows Server 2003 SP2. In the chart in Figure 22, a lower length of time indicates that the file operation occurred faster.

91 85 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 22. Remote file application test results Reviewing Performance Improvements in SMB Version 2.1 in Windows Server 2008 R2 Windows Server 2008 R2 includes a new version of SMB, SMB version 2.1, which includes the following improvements over previous versions of SMB: Support for large protocol data unit (PDU) and maximum transmission unit (MTU). This improvement helps performance by sending larger SMB packets. Previously, SMB packet size was limited to 64 KB. In SMB version 2.1, the SMB packet size can now increase up to 1 MB. This increase in packet size significantly improves the performance for file copies and directory enumerations. For example, a single packet can now contain thousands of directory entries. Improved opportunistic file locking method. This improvement helps performance when multiple files are opened in sequence or in parallel by the same client. This method helps improve application performance when opening and closing files, such as files for Microsoft Office System applications. Improved performance for file copy operations. This improvement helps file copy operations performed remotely on network shared folders using the SMB protocol. The Microsoft File Server Capacity Tool (FSCT) can be used to help perform file server capacity and performance planning and troubleshooting for CIFS, SMB, or SMB2 client requests. Figure 23 and Figure 24 illustrate the SMB performance differences between Windows Server 2008 and Windows Server 2008 R2 on two servers with different system resources.

92 86 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 23. Performance results with first hardware configuration In the performance results comparison in Figure 23, the server has the following system resources: One processor. 16 GB of memory. 24 hard disks configured in a RAID-10 array. One Fibre Channel host bus adapter. Figure 24. Performance results with second hardware configuration

93 87 Windows Storage Server 2008 R2 Architecture and Deployment White Paper In the performance results comparison in Figure 24, the server has the following system resources: Two processors. 72 GB memory. 96 hard disks configured in a RAID-10 array. Two Fibre Channel host bus adapters. As illustrated in Figure 24, the increased system resources allow Windows Server 2008 R2 to support almost twice as many users as the system resources in Figure 23. The performance improvements in SMB 2.1 are realized only when both operating systems support SMB 2.1. Table 29 shows the version of SMB used between two computers running different combinations of operating systems. Table 29. Versions of SMB Supported Between Different Windows Operating Systems Windows Vista, Windows Server 2003, and prior operating systems. Windows Vista Service Pack 1 and Windows Server 2008 Windows 7 and Windows Server 2008 R2 Windows Vista, Windows Server 2003, and prior operating systems Windows Vista Service Pack 1 and Windows Server 2008 Windows 7 and Windows Server 2008 R2 SMB 1 SMB 1 SMB 1 SMB 1 SMB2 (v2.002) SMB2 (v2.002) SMB 1 SMB2 (v2.002) SMB 2.1 For example, if a computer running Windows XP is accessing a computer running Windows Server 2008 R2, SMB 1 is used for file services traffic. SMB 2.1 is only supported when both computers are running Windows 7 or Windows Server 2008 R2. Improving Performance for Branch Offices Using BranchCache One of the largest problems facing branch offices is how to improve the performance of accessing intranet resources in other locations, such as the head office or regional data centers. Typically branch offices are connected by wide area networks (WANs) that usually have slower data rates than your intranet. Reducing the network utilization on the WAN network segments provides available network bandwidth for applications and services. The BranchCache feature in Windows Storage Server and Windows 7 reduces the network utilization on WAN segments that connect branch offices by locally caching frequently used files on computers in the branch office. The type of content that is cached is content returned by SMB requests and HTTP requests. BranchCache Modes BranchCache supports the following operational modes: Distributed Cache mode Hosted Cache mode

94 88 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Distributed Cache Mode In Distributed Cache mode, content is cached on the branch on client computers running Windows 7. The disadvantage to this solution is that content is cached on client computers, so if the computer containing the cached content is unavailable, the content must be retrieved over the WAN connection, as illustrated in Figure 25. Figure 25. BranchCache Distributed Cache mode The following sequence reflects how the Distributed Cache mode caches content: 1. Client 1 issues a request for a file on a BranchCache-enabled server in the head office. This request can be transmitted over any of the BranchCache-enabled protocols, such as SMB, HTTP, or Background Intelligent Transfer Service (BITS). The client computer indicates to the server that it is BranchCache capable, using fields, messages, or headers that are already part of the BranchCache-enabled protocol. The server responds, and transmits a set of identifiers that describe the chunks of content the client computer wants to download. These identifiers are transmitted by using the BranchCache-enabled protocol. 2. Client 1 searches locally for a computer that has already downloaded and cached the content. This search is conducted by using the BranchCache discovery protocol, which in turn uses WS-Discovery, a multicast protocol sent over UDP. Client 1 is the first computer in the branch to download this piece of content, so it does not receive any responses. 3. Client 1 issues another request to the server in the head office by using the BranchCache-enabled protocol, such as SMB, HTTP, or BITS. This request is not marked as BranchCache capable. The server responds with the requested data. The client then adds this data to its local cache. 4. Client 2 issues a request for the same content that Client 1 downloaded earlier. Client 2 receives identifiers describing the content from the server in the head office. 5. Client 2 uses the BranchCache discovery protocol to search for the content. Client 1 receives this request, finds the requested content in its local cache, and sends a response to Client Client 2 requests the content from Client 1 by using the BranchCache retrieval protocol, which in turn uses HTTP. Client 1 transmits the content to Client 2, protecting it with the BranchCache encryption scheme. Client 2 verifies the data against the identifiers downloaded from the server in the head office.

95 89 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Note Hosted Cache mode and Distributed Cache mode are mutually exclusive. A client computer can be configured to use only a single caching mode at one time. Hosted Cache Mode In Hosted Cache mode, content is cached at the branch office on client computers running Windows Server 2008 R2. The advantage to this mode is that the server is always available, so the cached content is always available. The unavailability of any client computer running Windows 7 does not affect the availability of the content cache, as illustrated in Figure 26. Figure 26. BranchCache Hosted Cache mode The following sequence reflects how the Hosted Cache mode caches content: 1. Client 1 issues a request to a BranchCache-enabled server in the head office. This request can be transmitted over any of the BranchCache-enabled protocols, such as SMB, HTTP, or BITS. The client computer indicates to the server that it is BranchCache capable, using fields, messages, or headers that are already part of the BranchCache-enabled protocol. The server responds, and transmits a set of identifiers that describe the chunks of content that the client computer wants to download. These identifiers are transmitted by using the BranchCache-enabled protocol. 2. Client 1 requests the content from the hosted cache in the branch office by using the BranchCache retrieval protocol (MS-PCCRD), which in turn uses HTTP. The hosted cache response informs Client 1 that the target data is not available. 3. Client 1 issues another request to the server in the head office by using the BranchCache-enabled protocol, such as SMB, HTTP, or BITS. This request is not marked BranchCache capable. The server responds with the requested data. 4. Client 1 advertises the newly downloaded content to the Hosted Cache server running Windows Storage Server by using the BranchCache hosted cache protocol (MS-PCHC), which in turn uses HTTPS.

96 90 Windows Storage Server 2008 R2 Architecture and Deployment White Paper 5. The Hosted Cache server connects to the client and downloads the recently advertised content by using the BranchCache retrieval protocol (MS-PCCRD), which in turn uses HTTP. 6. Client 2 issues a request for the same content that Client 1 downloaded earlier. Client 2 receives identifiers describing the content from the server in the head office. 7. Client 2 requests the content from the hosted cache in the branch office by using the BranchCache retrieval protocol (MS-PCCRD), which in turn uses HTTP. The hosted cache responds with the data. Client 2 verifies the data by using the identifiers downloaded from the server in the head office. If a client computer cannot locate content on the hosted cache server, the client computer returns to the server in the head office and requests a download. Note Hosted Cache mode and Distributed Cache mode are mutually exclusive. A client computer can be configured to use only a single caching mode at one time. BranchCache Management You can configure BranchCache behavior by using Group Policy. Windows Storage Server includes a Group Policy administrative template that you can use to administer the BranchCache configuration settings. You can also manage BranchCache by using the NetSH command. For more information about configuring BranchCache by using the NetSH command, see Network Shell (Netsh) Commands for BranchCache. Improving Performance for Folder Redirection and Offline Files Windows 7 includes the following features that allow users to provide user state virtualization: Folder redirection. This feature allows users to store the user s folders in a shared folder on Windows Storage Server. Folder redirection allows users to quickly recover from local failures of their computer. Offline files. This feature allows users to locally cache files stored on a shared folder on Windows Storage Server. Users are able to modify local copies of files in the event they are disconnected from the network. Both of these features require access to shared network folders on Windows Storage Server. All of the performance features listed in this section will also improve the performance for folder redirection and offline files. Improving Performance and Scalability for iscsi Block I/O Workloads File services workloads in Windows Storage Server have improved performance and scalability compared to previous versions of Windows Server. You can improve the performance and scalability for iscsi block I/O workloads by: Identifying methods for improving iscsi block I/O workload performance and scalability. Reviewing the results of I/O storage workload tests. Identify Methods for Improving iscsi Block I/O Workload Performance and Scalability You can improve the performance and scalability for iscsi block I/O workloads by using the following methods: Ensure the system resources of the appliance are sufficient. The typical system resources that are heavily utilized by iscsi block I/O workloads include memory,

97 91 Windows Storage Server 2008 R2 Architecture and Deployment White Paper disk, and network. Ensure that the appliance has sufficient resources to provide adequate performance and scaling. Always size disks for performance in addition to capacity. Although a given number of disks may have adequate storage capacity, the number may not provide sufficient I/O throughput. After ensuring the number of disks is sufficient for capacity, also ensure they are sufficient for I/O throughput. Isolate different types of workloads using dedicated physical arrays. Different types of workloads on the same physical array can degrade performance for the workloads, such as sequential I/O workloads, random I/O workloads, NFS workloads, or SMB workloads. Dedicate a physical array for each conflicting workload. Isolate different types of workloads using separate physical network segments. Different types of workloads on the same physical network can cause overutilization and performance problems. When encountering network utilization problems, segregate each type of workload to a separate physical network segment to reduce network contention. Configure sector alignment for iscsi Target volumes and.vhd files. Sector alignment allows Windows Storage Server to create partitions that align with the underlying physical disk. Sector alignment helps prevent an I/O operation from spanning two tracks, which causes performance degradation. You can configure sector alignment for physical disks using the Diskpart.exe command line tool. Note Consult your storage vendor to determine the proper values to use with the Diskpart.exe. Isolate different types of workloads using separate physical network segments. Different types of workloads on the same physical network can cause overutilization and performance problems. When encountering network utilization problems, segregate each type of workload to a separate physical network segment to reduce network contention. Figure 27 illustrates a Windows Storage Server solution that has been optimized to provide improved performance and scalability. In this example, the Windows Storage Server solution is optimized to support Exchange Server connecting to disk LUNs on Windows Storage Server.

98 92 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 27. A Windows Storage Server solution optimized for performance For the sample scenario in Figure 27, the following optimizations were chosen: Sufficient system resources of the Windows Storage Server appliance for the given workloads. An optimized number of disks for disk I/O bandwidth capacity. Separate network segments for workload types, including iscsi sequential I/O, iscsi random I/O, and file services access using SMB or NFS. Separate network adapters in the Exchange server to support the separate network segments. Separate arrays dedicated to different iscsi I/O traffic as the Exchange storage group data is random I/O, while the Exchange storage group logs are sequential I/O. Separate iscsi targets that corresponds to the iscsi sequential I/O and iscsi random I/O.

99 93 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Sector-aligned disk arrays to help prevent I/O operations from spanning multiple tracks. Review I/O Storage Test Results The results of this test provide an indication of the improvements in disk I/O operations, regardless of the server role running on the server computer. The test result, shown in the chart in Figure 28, illustrates the number of disk I/O operations per second performed by Windows Server 2008 and Window Server 2003 running on identical hardware. For this test, the server computer had 16 dual-core processors for a total of 32 processor cores. Windows Server 2008 can perform more than 20 percent more disk I/O operations per second than Windows Server Figure 28. General disk I/O operation test results

100 94 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Improving Performance and Scalability for Web Services Workloads Web services workloads running on Internet Information Services (IIS) 7.0 in Windows Storage Server have improved performance and scalability compared to previous versions of IIS and Windows Server. These improvements are largely due to improvements in data compression of content and caching of content. You can improve the performance and scalability for Web services workloads by: Identifying methods for improving Web services workload performance and scalability. Reviewing Web services workload test results. Identify Methods for Improving Web Services Workload Performance and Scalability IIS 7.0 provides a powerful, unified facility for output caching by integrating the dynamic output-caching capabilities of ASP.NET with the static output-caching capabilities that were present in IIS 6.0. IIS also lets you use bandwidth more effectively and efficiently by using common compression mechanisms such as Gzip and Deflate. Performance includes the following features: Compression. HTTP compression lets you make more efficient use of bandwidth and enhances the performance of sites and applications. You can configure HTTP compression for both static and dynamic sites. For more information about how to configure compression, see Configuring HTTP Compression in IIS 7. Output Caching. Output caching allows you to manage output caching rules and to control the caching of served content. In IIS Manager, you can create caching rules, edit existing caching rules, and configure output cache settings. For more information about configuring output caching, see Configuring Output Caching in IIS 7. For more information about improving Web services workload performance and scalability, see Optimize IIS Performance (IIS 7). Review Web Services Workload Test Results These results were obtained by measuring the performance of running IIS 6.0 on Window Server 2003, and IIS 7.0 running on Windows Server The results were obtained by closely monitoring the performance over a 72-hour period for both test cases. The chart in Figure 29 illustrates the performance gain by running IIS 7.0 and Windows Server 2008 on the same computer resources. IIS 7.0 and Windows Server 2008 can support more than 10 percent higher throughput than IIS 6.0 and Windows Server This improvement in performance results in processing more than an additional 100 million requests per day at the same processor utilization.

101 95 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 29. Web Services (IIS) Role test results Improving Performance and Scalability for Print Workloads Print server scalability plays a key role in the deployment of Windows Storage Server print servers. The maximum load and performance level of a print server greatly depends on key configuration decisions. This section of the white paper provides information to help you size a server to meet an organization's needs by identifying and investigating primary issues and configuration details to maximize print server performance. Some of the factors that influence print server performance and capacity include: The number of print server clients. The operating system version or versions on each client machine. The number, size, and frequency of print jobs. The types of print jobs sent to the print server. The number and type of printers served by the print server and the types of printer drivers each printer uses. For more information about improving the performance and scalability of print services workloads, see the Windows Print Server Scalability and Sizing Technical Overview.

102 96 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Windows Storage Server Deployment Scenarios You can use Windows Storage Server to provide a wide range of storage solutions. To select the appropriate deployment scenario for you, review the following: Overview of NAS configurations. Creating branch office solutions. Creating small- to medium-sized business solutions. Creating solutions for storage consolidation. Creating highly-available solutions. Creating solutions for heterogeneous environments. Creating application consolidation solutions. Creating unified storage solutions. Creating virtualization solutions. Creating iscsi boot solutions. Overview of Windows Storage Server Configurations Window Storage Server provides a wide range of storage solutions for all size organizations. Regardless of the solution complexity, Windows Storage Server provides the following basic configurations: Stand-alone network attached storage (NAS). Highly-available NAS. NAS gateway. Using Windows Storage Server in a Stand-Alone NAS Configuration The stand-alone NAS configuration, illustrated in Figure 30, is based on a single Windows Storage Server appliance. The typical characteristics of the appliance are as follows: The appliance has the appropriate system resources based on the information in Table 28 in the previous section "Running Microsoft File Server Capacity Tool On a High-Speed Network," in this white paper. The processors and storage reside in a single appliance enclosure. The solution is based on low cost, industry standard hardware that can be readily expanded. It can create a variety of disk configurations, such as Just a Bunch of Disks (JBOD Disks) or RAID configurations (RAID 5 or RAID 1+0). It can support 4 to 12 disks in the single enclosure using RAID interfaces. However, some Microsoft partners provide additional storage in external enclosures.

103 97 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 30. Windows Storage Server stand-alone NAS configuration Using Windows Storage Server in a Highly-Available NAS Configuration The highly-available NAS configuration, illustrated in Figure 31, is based on two or more Windows Storage Server appliances that provide some degree of fault tolerance. The typical characteristics of the appliances are as follows: They have the appropriate system resources based on the information in Table 28 in the previous section "Running Microsoft File Server Capacity Tool On a High-Speed Network," in this white paper. Multipath I/O connections exist between the appliances. The appliances are configured as nodes in a Windows failover cluster to provide higher availability. Storage is separate from the appliance enclosure, and it is shared between two or more appliances. Additional appliances can be added to the solution to provide improved scalability. New storage is included as part of the solution (existing storage is not used in the solution). Note The failover cluster in Figure 31 can be quickly and easily configured using the Initial Configuration Tasks form in Windows Storage Server.

104 98 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 31. Windows Storage Server highly-available NAS configuration Using Windows Storage Server in a NAS Gateway Configuration The NAS gateway configuration, in Figure 32, is based on one or more Windows Storage Server appliances that provide connectivity to existing storage devices. The typical characteristics of the appliances are as follows: They have the appropriate system resources based on the information in Table 28 in the previous section "Running Microsoft File Server Capacity Tool On a High-Speed Network," in this white paper. They connect to existing storage that supports SAN block I/O protocols.

105 99 Windows Storage Server 2008 R2 Architecture and Deployment White Paper They provide an inexpensive iscsi target, SMB file access, and NFS file access to storage. They provide highly-available configurations based on solution availability requirements. Figure 32. Windows Storage Server NAS gateway configuration

106 100 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Using Windows Storage Server in iscsi Block I/O Configuration The iscsi block I/O configuration, in Figure 32, is based on one or more Windows Storage Server appliances that provide iscsi access to storage resources. The typical characteristics of the appliances are as follows: They have the appropriate system resources based on the information in Table 28 in the previous section "Running Microsoft File Server Capacity Tool On a High-Speed Network," in this white paper. They can be used with any combination of the following storage configurations: Located within the appliance. Located within an enclosure external to the appliance. Existing storage subsystem that supports SAN block I/O protocols. They provide highly-available configurations based on solution availability requirements. They provide an inexpensive iscsi target access to storage. They provide iscsi boot support for diskless computers. They integrate with DHCP and TFTP servers to provide iscsi boot support for diskless computers. Figure 33. Windows Storage Server iscsi Block I/O configuration

107 101 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Creating Branch Office Solutions In a branch office solution, an organization has a number geographically distributed branch office locations that are connected to one or more centralized head offices. Table 30 lists the types of data to manage in the branch office solution, as illustrated in Figure 34, and a description of the type of data. Table 30. Types of Data to Manage in the Branch Office Solution Type of data User folders Published content Collaboration content Description Contains user home directories and user shares within the branch office in addition to the well-known Windows folders, such as Documents, Videos, Pictures, and Music. The well-known Windows folders are typically stored on the local computer, but can be stored on network shared folders using the Folder Direction feature. The Folder Redirection feature allows user folders to be stored on appliances in the branch offices and to be replicated to appliances in the head office for backup and centralized management using DFS Replication. The user folders are accessed within the branch office, but are archived in the head office. Contains content that is published from the head offices to the branch offices as read-only content. The content is a set of data that is relevant to the branch office, regardless of the region where the branch office is located, for example: Templates, such as Word or Excel templates. Source for software distribution files, such as files from 2007 Microsoft Office System or Windows 7. Contains content used in collaborative efforts between branch offices. The collaboration content is stored on the Windows Storage Server appliances in the head office. Users in the branch offices access the collaboration content over the WAN connections. The collaboration content can be stored in network shared folders or in Windows SharePoint Service document libraries.

108 102 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 34. Branch office solution for Windows Storage Server

109 103 Windows Storage Server 2008 R2 Architecture and Deployment White Paper The assumptions in this scenario are: The data centers have local IT personnel, while the branch offices have minimal or no local IT personnel. Most of the configuration and all of the support is provided by the IT personnel in the head office. Centralized management of the appliances in the branch office is essential and remote administration is required. Stand-alone NAS appliances are used. Due to cost constraints and lack of local IT personnel, failover clusters can be an optional part of this solution, depending on the availability requirements of the branch offices. For more information about this type of appliance, see the previous section "Using Windows Storage Server in a Stand-alone NAS Configuration," in this white paper. Minimizing the utilization of the WAN connections is essential. The available network speed of the WAN connections between the head offices and the branch offices is a limited resource in terms of both available bandwidth and cost. The solution must minimize the utilization of the WAN connection as much as possible. Computers are running mostly Windows operating systems. Most of the computers in the branch office are running Windows operating systems. In some instances there may be computers running other operating systems, such as Linux or the Mac OS. Users must have access to their user folders regardless of connectivity to the branch office appliance. Mobile users need to access their user folders when they are not connected to the internal network in the branch office. Also, all users need to access their user folders regardless of any scheduled maintenance of the appliance or appliance failure. Consolidating of data in head office to provide centralized management. All user profile folders in the branch offices need to be copied to the head offices for centralized management, such back up and data protection. This helps protect the user profile folders in the branch office in the event of a catastrophic disaster in the branch office location that results in the total failure of the appliance. Centralized management of the branch office. The branch offices typically do not have local IT personnel and require assistance from the IT personnel in the head office. IT personnel in the head office must be able to manage the configuration settings of the devices and users in the branch offices. Table 31 lists the Windows Storage Server and Windows client operating system features used in the branch office solution and provides a brief description of the role each plays in the solution. Table 31. Features Used In Branch Office Solutions Feature File services using SMB2 File services using NFS BranchCache in hosted caching mode Description Provides file services for computers running Windows operating systems. In addition, SMB2 helps minimize WAN network utilization because of the efficiencies provided by SMB2. For more information, see the section "Review Improvements in the SMB Protocol," earlier in this white paper. Provides file services for computers running NFS clients, including the computers running Linux or Mac OS. Provides local caching of the collaboration content stored on the appliances in the head office. The appliance in the branch office is configured for BranchCache hosted caching mode, which allows the appliance to provide local caching of the collaboration content accessed using the SMB and HTTP protocols. BranchCache dramatically reduces the network

110 104 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Feature DFS Replication Read-only DFS Replicated Folders Shadow Copies of Shared Folders Folder Redirection Description utilization for accessing these files. Any updates to the collaboration content are automatically saved on the appliances in the head office. For more information, see the section, "Improving Performance for Branch Offices Using BranchCache," earlier in this white paper. Provides replication of files and folder structure from the branch offices to the head office, which provides data consolidation in the head office so that all backups are performed in the head office. This allows the head office to avoid doing backups over the WAN link. DFS Replication uses RDC to transmit only the changes to a file, which dramatically reduces the network bandwidth utilization. For more information, see the section, "Using DFS Replication to Protect Data," earlier in this white paper. Uses DFS Replication to provide replication of files and folder structure from the head office to the branch offices, which: Reduces WAN network utilization by providing local access to the files. Provides improved file access for users in the branch office because the files are accessed locally instead of over the WAN connection. This is primarily for files that are for public use and are typically read-only at the branch office. The files and folders are set to read-only access by DFS Replication. For more information, see the section, "Using DFS Replication to Protect Data," earlier in this white paper. Allows users to recover files by themselves without the assistance of IT professionals. Helps reduce the effort spent by IT personnel in data centers for recovery of files. For more information, see the section "Using Shadow Copies of Shared Folders to Protect Data," earlier in this white paper. Computers running Windows client operating systems are using the Folder Redirection feature to redirect the user folders to network shared folders on the appliance in the branch office. The Folder Redirection feature allows the user folders to be available from any computer on the network. The user folders are copied to the head office for backup and centralized management functions. The Folder Redirection feature is available in all current Windows client operating systems, including Windows 7, Windows Vista, and Windows XP. You can administer the Folder Redirection feature using Group Policy. For more information, see: Folder Redirection Overview.

111 105 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Feature Offline Files Print Server LPD Print Services Description Folder redirection overview for GPMC. Configuring Folder Redirection. The Improving Performance for Folder Redirection and Offline Files section in this white paper. The Offline Files feature allows users to always have access to files from network shared folder by synchronizing the contents of the network shared folder to the Offline Files cache on the user s computer. The Offline Files feature provides access to files: When users are not connected to the branch office network. Mobile users may want to access their files while away from the office. The Offline Files feature allows users to modify local copies of their files while disconnected from the network. When users reconnect to the network, any new or modified files are automatically synchronized with the network shared folders on the appliance. In the event the appliance is taken offline for maintenance or of an appliance failure. Users can continue to work on copies of the files on their local computers. When the appliance is restored to service, any new or modified files are automatically synchronized with the network shared folders on the appliance. The Offline Files feature is available in all current Windows client operating systems, including Windows 7, Windows Vista, and Windows XP. You can administer the Offline Files feature using Group Policy. For more information, see: Understanding offline files. Working with network files when you are offline. Configuring Offline Files. Configuring Group Policy for Offline Files. The Improving Performance for Folder Redirection and Offline Files section in this white paper. Computers running Windows can print to the printers in the branch office using the print services workloads provided by Windows Storage Server. For more information, see the section "Providing Access to Print Services Workloads," earlier in the white paper. Computers running Linux or Mac OS can print to the printers in the branch office using the print services workloads provided by Windows Storage Server. For more information, see the section "Providing Access to Print Services Workloads," earlier in the white paper. Read-only domain controller Authentication is performed using an AD DS read-only domain controller on the local appliance. The read-only domain controller provides enhanced security by preventing unauthorized or inadvertent updates to AD DS. The local read-only domain controller also

112 106 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Feature DNS Server DHCP Server File Server Resource Manager Group Policy Description reduces network traffic between the head office and branch offices because authentication is performed locally. Computers in the branch office can resolve DNS names using the DNS Server running on the local appliance. The local DNS Server reduces network traffic between the head office and branch offices because DNS queries are resolved locally. Computers in the branch office that are configured using DHCP can be configured using the DHCP Server running on the local appliance. The local DHCP Server reduces network traffic between the head office and branch offices because DHCP configuration is performed locally. File Server Resource Manager allows you to understand, control, and manage the quantity and type of data stored on Windows Storage Server 2008 R2. You can use File Server Resource Manager to: Limit the amount of disk space used by using the Quota Management feature. Prevent storage of certain file types by using the File Screening feature. Use Storage Reports to profile storage usage and trends within the branch. For more information, see File Server Resource Manager. Group Policy allows you to centrally configure the Windows Storage Server appliances and Windowsbased computers in the branch office. Most of the features and configuration settings available in all Windows products can be configured by using Group Policy. For more information, see Group Policy. Table 32 lists how to manage each type of data is accessed by users. Note All of these features operate transparently to users in the branch office, and they are centrally configured by the IT personnel in the head office using Group Policy.

113 107 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Table 32. Managing Types of Data in the Branch Office Solution Type of data Managed using User folders Offline Files. This feature allows users to access their user profile folders when not connected to the appliance. Any new files or changes made to the cached copy of the files are automatically synchronized when the connection to the appliance is restored. Once these files are synchronized with the branch office appliances, any changes in the user profile folders are replicated to the head office using DFS Replication. Remote Differential Compression in DFS Replication replicates only the changes to the user profile folders, which minimizes the bandwidth utilization on the connection between the branch offices and the head office. Folder Redirection. This feature stores the user profile folders, which are typically stored locally on the user s computer, on the branch office appliance. After the user profile folders are stored on the branch office appliance. DFS Replication replicates the user profile folders to the head office so that they can be centrally backed up and managed by the IT personnel. In addition, the Folder Redirection feature helps in fast recovery of computers because the user profile folders are not stored on the local computer. Published content Read-only DFS Replicated Folders. DFS Replication replicates the published content stored on the head office appliances to the branch office appliances. The replica copies of the published content in the branch offices are maintained read-only by DFS Replication so that users in the branch office have read-only access to the replica content. DFS Namespace. This feature allows for users to transparently access the published content on the appliances in the branch office or in the head office, depending on the availability of the branch office appliance. This feature determines which replica copy to access based on the availability of the copy and the location of the copy using Active Directory sites. The head office and each of the branch offices is a separate Active Directory site. DFS Namespace always preferentially directs client computers to access a local replica copy of the published content within the local site (lower cost than other sites). If the branch office replica copy is unavailable, then DFS Namespace directs the client computers to access the replica copy in the Active Directory site with the next lowest cost, which in this scenario is the head office. When the branch office replica copy becomes available again, DFS Namespace will automatically direct users to use the replica copy in the branch office.

114 108 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Type of data Managed using Collaboration content Network shared folders. This feature allows users to access the content from the head office appliances. The SMB2 protocol dramatically reduces the bandwidth utilization between the head office and the branch offices for: The initial local caching of the content using BranchCache. Any updates to the content from users in the branch offices. The BranchCache feature dramatically reduces the bandwidth utilization between the head office and the branch office when users access content stored on the network shared folders that has already been locally cached on the appliance in the branch office. Windows SharePoint Services. This feature allows users to access the content from the head office appliances using the HTTP or HTTPS protocol. This feature also supports version control, check in, and check out capabilities. The BranchCache feature dramatically reduces the bandwidth utilization between the head office and the branch offices when users access Web content that has already been locally cached on the appliance in the branch office. For the collaboration content in Table 32, network shared folders and Windows SharePoint services are used instead DFS Replication. This is because DFS Replication in Windows Storage Server is appropriate when only one copy of the content is centrally modified and all replica copies are read-only. Because multiple users need to modify the content, network shared folders and SharePoint Services with the BranchCache feature provide the appropriate solution.

115 109 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Creating Highly-Available Solutions In a highly-available solution, the workloads provided by Windows Storage Server must provide improved fault tolerance. Figure 35 illustrates how to create highly-available solutions using Windows Storage Server and Windows Server operating systems using Windows failover clusters and multipath I/O. Figure 35. Highly-available solution using Windows Storage Server The key elements of the highly-available solution include: The appliances have the appropriate system resources based on the information in Table 28. The application servers are configured in a failover cluster to provide fault tolerance in the event of an application server failure.

116 110 Windows Storage Server 2008 R2 Architecture and Deployment White Paper The Windows Storage Server appliances act as iscsi targets by running the Microsoft iscsi Software Target. The appliances are configured in a failover cluster to provide fault tolerance in the event of an appliance failure. The application servers are using the multipath I/O feature to provide redundant connections to the clustered appliances. There are redundant network connections between the cluster application servers and the clustered appliances to provide fault tolerant network connectivity. For more information about Windows failover clustering for iscsi targets, see the following sections earlier in this white paper: "Improving Availability of iscsi Block I/O Workloads." "Using Windows Storage Server in a Highly-Available NAS Configuration." "Using Windows Storage Server in a NAS Gateway Configuration." For more information about Multipath I/O for iscsi initiators in Windows Server operating system, see the following sections earlier in this white paper: "Improving Availability of iscsi Block I/O Workloads." "Using Windows Storage Server in a NAS Gateway Configuration." Creating Solutions for Storage Consolidation In the storage consolidation solution, all the myriad of devices providing SMB file services, NFS file services, and iscsi block I/O are consolidated into a few, highlyavailable Windows Storage Server appliances. Typically this solution is used in medium to large organizations that want to reduce the number and types of devices in the organization. This consolidation effort can help reduce the ongoing operating effort and complexity. Figure 36 illustrates an IT environment prior to implementing the storage consolidation solution. There are a number of different computers providing file services and applications. Each computer has local storage that is used to support the services that each provides. This configuration provides inefficient storage management and usage. For example, one Exchange server may have insufficient available disk space while a file server may have many more times the available disk space than is required.

117 111 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 36. IT environment prior to implementing the storage consolidation solution Figure 37 illustrates the same IT environment after implementing the storage consolidation solution. The number of computers to be supported has been dramatically decreased, which reduces ongoing operations effort and complexity. Also, the overall availability of workloads has been improved. Because storage is centralized, the effort for ongoing storage management is dramatically reduced. And, because all storage resources are pooled, storage can be easily allocated to the appropriate computer.

118 112 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Figure 37. IT environment after implementing the storage consolidation solution

119 113 Windows Storage Server 2008 R2 Architecture and Deployment White Paper The key elements of the storage consolidation solution include: The appliances have the appropriate system resources based on the information in Table 28. The Windows Storage Server appliances are: Acting as iscsi targets and are running the Microsoft iscsi Software Target. Providing SMB file services. Providing NFS file services. The appliances are configured in a failover cluster to provide fault tolerance in the event of an appliance failure. The appliances have redundant network connections to support the multipath I/O feature from the storage fabric. There are redundant network connections between the cluster application servers and the storage fabric to provide fault tolerant network connectivity. Creating Small to Medium Business Solutions In small- to medium-sized business solutions, the organization needs to provide multiple workloads on Windows Storage Server appliances. The key elements of the small- to medium-sized business solution include: The appliances have the appropriate system resources based on the information in Table 28. The Windows Storage Server appliances provide: SMB file services for Windows operating systems or for other operating systems with CIFS support. NFS file services for NFS clients. Windows print services, LPR print services, and Internet printing. Access to Web-based content using IIS 7.0. Collaboration using Windows SharePoint Services. Centralized storage for application servers using Microsoft iscsi Software Target, such as providing iscsi LUNs for SQL Server or Exchange Server. Typically configured as a stand-alone NAS, as described in the section "Using Windows Storage Server in a Stand-Alone NAS Configuration," earlier in this white paper. The appliances may be configured in a failover cluster to provide fault tolerance in the event of an appliance failure, depending on the availability requirements of the organization. The appliances provide centralized storage management, which dramatically reduces the level of effort for ongoing operations and management. Highly-automated management tools, such as Group Policy, help reduce the effort required for ongoing operations and management. Creating Solutions for Heterogeneous Environments In solutions for heterogeneous environments, the organization needs to support a variety of operating systems. The key elements of the solutions for heterogeneous environments include: Windows Storage Server appliances that provide: SMB file services for Windows operating systems or for other operating systems with CIFS support.

120 114 Windows Storage Server 2008 R2 Architecture and Deployment White Paper NFS file services for NFS clients. Windows print services for Windows operating systems. LPR print services for other operating systems. Access to Web-based content using IIS 7.0. Collaboration using Windows SharePoint Services. Centralized storage for all operating systems that have supported iscsi initiators using Microsoft iscsi Software Target. For more information about supported iscsi initiators, see the section "Identifying Microsoft iscsi Software Target Support for iscsi Initiators" earlier in this white paper. AD LDS can be used to provide identity mapping for NFS file services in environments where an Active Directory infrastructure does not already exist. For more information, see AD LDS Identity Mapping for Services for NFS. The appliances may be configured in a failover cluster to provide fault tolerance in the event of an appliance failure, depending on the availability requirements of the organization. The appliances have redundant network connections to support the multipath I/O feature from the storage fabric. There are redundant network connections between the cluster application servers and the storage fabric to provide fault tolerant network connectivity. The appliances provide centralized storage management, which dramatically reduces the level of effort for ongoing operations and management. Highly-automated management tools, such as Group Policy, help reduce the effort required for ongoing operations and management. Creating Application Consolidation Solutions In the application consolidation solution, all the local or shared storage for the application servers in the IT environment are consolidated into a few, highly-available Windows Storage Server appliances. This solution is very similar to the storage consolidation solution described in the section "Creating Solutions for Storage Consolidation" and as illustrated in Figure 36 and Figure 37, earlier in this white paper. The types of application servers that are consolidated include those running Exchange Server, SQL Server, and other application servers that have a significant dependency on storage. Typically this solution is used in medium to large organizations that want to increase the efficiency of storage allocation and management for application servers. This consolidation effort can help reduce the ongoing operating effort and complexity. The key elements of the application consolidation solution include: The appliances have the appropriate system resources based on the information in Table 28. The Windows Storage Server appliances act as iscsi targets and are running the Microsoft iscsi Software Target. The appliances are configured in a failover cluster to provide fault tolerance in the event of an appliance failure. The appliances have redundant network connections to support the multipath I/O feature from the storage fabric. There are redundant network connections between the cluster application servers and the storage fabric to provide fault tolerant network connectivity. Typically the application servers are configured in clustered configurations to improve availability, such as described in the section "Creating Highly-Available Solutions" earlier in this white paper.

121 115 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Creating Unified Storage Solutions In the unified storage consolidation solution, file and iscsi block I/O storage services in the IT environment are consolidated into a few, highly-available Windows Storage Server appliances. This solution is very similar to the storage consolidation solution described in the section "Creating Solutions for Storage Consolidation" and as illustrated in Figure 36 and Figure 37, earlier in this white paper. In this scenario, the existing IT environment has separate devices provide SMB-based file services, NFS-based file services, iscsi block I/O storage, and other storage connections (such as Fibre Channel or SAS). After implementing this scenario, all of the storage resources in the organization are managed using Windows Storage Server. This centralization of storage management helps reduce the inefficiency of storage allocation and management and helps reduce the ongoing operating effort and complexity. The key elements of the solutions for heterogeneous environments include: Windows Storage Server appliances that provide: SMB file services for Windows operating systems or for other operating systems with CIFS support. NFS file services for NFS clients. Centralized storage for all operating systems that have supported iscsi initiators using Microsoft iscsi Software Target. For more information about the supported iscsi initiators, see the section "Identifying Microsoft iscsi Software Target Support for iscsi Initiators" earlier in this white paper. NAS gateway services for existing storage solutions that do not provide SMBbased file services, NFS-base file services, or iscsi connectivity. For more information about NAS gateway configurations, see the section "Using Windows Storage Server in a NAS Gateway Configuration" earlier in this white paper. AD LDS can be used to provide identity mapping for NFS file services in environments where an Active Directory infrastructure does not already exist. For more information, see AD LDS Identity Mapping for Services for NFS. The appliances are typically configured in a failover cluster to provide fault tolerance in the event of an appliance failure, depending on the availability requirements of the organization. The appliances have redundant network connections to support the multipath I/O feature from the storage fabric and provide fault tolerant network connectivity. The appliances provide centralized storage management, which dramatically reduces the level of effort for ongoing operations and management. Highly-automated management tools, such as Group Policy, help reduce the effort required for ongoing operations and management.

122 116 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Creating Virtualization Solutions You can create virtualized solutions using Windows Storage Server by: Connecting virtual machines to iscsi LUNs managed by Windows Storage Server. Running virtual machines on Windows Storage Server. Connecting Virtual Machines to iscsi LUNs Virtual machines running on Hyper-V can access iscsi LUNs using a number of different methods. In the virtualization solution, as illustrated in Figure 38, Windows Storage Server runs the Microsoft iscsi Software Target to provide iscsi LUNs for use by virtual machines performing the Hyper-V server role in Windows Server In Hyper-V, the physical computer is referred to as the parent partition. Each virtual machine is referred to as a child partition. Figure 38. Windows Storage Server in virtualization solutions Table 33 lists the different methods that virtual machines can use to connect to iscsi LUNs

123 117 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Table 33. Methods that Virtual Machines Can Use to Connect to iscsi LUNs Method VHD created on parent partition volume Pass-through parent partition disk Child partition iscsi initiator direct to LUN Description The iscsi LUN is attached to the parent partition and is formatted as an NTFS volume and assigned a drive letter in the parent partition. A.vhd file is created on the volume that is accessed by the virtual machine. As illustrated in Figure 38, the parent partition formats LUN-C as E: and the.vhd file for Virtual Machine C is created on the E: volume. This method: Allows multiple virtual machines to store.vhd files on the same iscsi LUN. Works for all supported operating systems in the virtual machine, regardless if the operating system supports an iscsi initiator. Allows the virtual machine to boot from the iscsi LUN. Supports Live Migration scenarios using Cluster Shared Volumes. For more information, see Hyper-V: Using Live Migration with Cluster Shared Volumes in Windows Server 2008 R2. The iscsi LUN is attached to the parent partition and the virtual machine directly accesses the partition. As illustrated in Figure 38, the parent partition connects to LUN-B and Virtual Machine B directly connects to the partition. This method: Allows only one virtual machine to use the iscsi LUN. However, the parent partition is also aware of the child partition using the LUN. Works for all supported operating systems in the virtual machine, regardless if the operating system supports an iscsi initiator. Allows the virtual machine to boot from the iscsi LUN. The iscsi LUN is attached to the child partition and the virtual machine directly accesses the partition. As illustrated in Figure 38, the child partition connects to LUN-A. This method: Allows only one virtual machine to use the iscsi LUN. However the parent partition is unaware of the child partition using the LUN because the child partition is directly accessing the LUN. Works for all supported operating systems in the virtual machine that have a supported iscsi initiator. Does not natively support boot from the iscsi LUN and requires products available from Microsoft partners to support iscsi boot for virtual machines.

124 118 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Note Performing a complete backup of the parent partition will back up iscsi LUNs that are connected using the VHD created on parent partition method. iscsi LUNs that are connected using the Pass-through parent partition disk or the Child partition iscsi initiator direct to LUN methods must be backed up separately in addition to performing a complete backup of the parent partition. The recommended method is the VHD created on parent partition method for the following reasons: Backups are complex using the Pass-through parent partition disk or the Child partition iscsi initiator direct to LUN methods. The associated virtual machine files, such as the.bin files, are stored on the same LUN where the.vhd files reside using this method. There is minimal performance difference between the VHD created on parent partition and the Pass-through parent partition disk methods. It is also recommended that you create a separate iscsi target for each LUN that you connect to the parent partition to improve performance. Creating a separate iscsi target for each LUN will improve performance because each iscsi target has its own I/O submission queue. Running Virtual Machines on Windows Storage Server Windows Storage Server can also run the Hyper-V server role. You can run up to two virtual machines on Windows Storage Server depending on the Windows Storage Server edition. You can run: One virtual machine on Windows Storage Server Standard Edition. Two virtual machines on Windows Storage Server Enterprise Edition. This feature allows you to provide other services in the virtual machines running on Windows Storage Server. This reduces the complexity in providing your solution by reducing the number of physical appliances to manage and minimizes the power consumption for your solution (with the appropriate licensing). For example, you could install an instance of Active Directory Lightweight Directory Services (AD LDS) in a virtual machine that can be used for NFS account mapping. This allows you to create a NFS file access solution that runs on one appliance.

125 119 Windows Storage Server 2008 R2 Architecture and Deployment White Paper Creating iscsi Boot Solutions The Microsoft iscsi Software Target in Windows Storage Server supports iscsi boot for solutions that include diskless physical computers or virtual machines. There are many solutions that can take advantage of iscsi boot, including those that provide iscsi boot services for: Web blades configured to support the same application in a web farm. Computer nodes in Windows High-Performance Computing (HPC) Server clusters. Thin clients in libraries or schools. Interactive kiosks in retail stores. For more information about how to support iscsi boot using Windows Storage Server, see the Supporting iscsi Boot section earlier in this white paper. Figure 39 illustrates how iscsi boot can support a Windows HPC Server cluster solution. In this solution, Windows Storage Server centralizes the storage for the HPC cluster. Figure 39. Windows Storage Server in Windows HPC iscsi Boot Deployment By using iscsi and Windows Storage Server, the nodes in the cluster do not require a local hard disk drive to serve as a system disk. Instead, the nodes can use the storage