■ UseWUServer ■ Set this to 1 to enable Automatic Updates to use the server running Software Update Services as specified in WUServer ■ Registry Value Type: Reg_DWORD Now, in HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\ WindowsUpdate add the following registry entries: ■ WUServer ■ Sets the SUS server by HTTP name ■ Registry Value Type: Reg_SZ ■ WUStatusServer ■ Sets the SUS statistics server by HTTP name ■ Registry Value Type: Reg_SZ Testing Software Updates Software updates were designed to fix security problems or to improve the performance or func- tionality of your network systems. With the enormous amount of software available for current Windows operating systems and with the massive amount of different types of hardware available, it is impossible from a practical standpoint to test every scenario in which a software update might be applied. Some software updates can have adverse affects on your client system performance or oper- ating capabilities. It is considered best practice to try to simulate your network environment as accu- rately as possible in a test lab environment in an effort to pre-test software updates before deploying them to your production environment. Testing should occur in a lab environment that models your production network. If possible, you should have at least two instances of each type of hardware used in your environment.This hardware should be configured with the same software and settings that typical clients with this type of system would have.You should have a server configured as a test SUS server for the network and you should have a sufficient number of servers set up in the lab to model the production network. As new updates become available, using the SUS test server, you should approve updates individually and test them against your lab systems to verify proper operation.Try to put the software through its paces, making sure that the update that was applied has not adversely affected the system. Maintain a list of tested updates, documenting any changes that you have observed as a result of the update. Now, once the client test systems seem to be functioning properly, you should approve the tested software updates on your production SUS server. If, for some reason, an update does have adverse affects on certain systems in the test environment, do not deploy the update until a workaround has been determined.You should look on Microsoft’s TechNet site to attempt to find solutions to the problems that the update is causing. Microsoft’s TechNet site is located at http://www.microsoft.com/technet.This site maintains the Microsoft Knowledgebase, a database of known problems with Microsoft products and possible solutions.You might have to contact the hardware or software vendor to resolve the problem. It is possible that you may have to go through Microsoft’s technical support to resolve the issues as well. 106 Chapter 4 • Security Templates and Software Updates 301_BD_w2k3_04.qxd 5/12/04 10:57 AM Page 106 Managing Physical and Logical Disks In this chapter: ■ Using Disk Management Tools ■ Managing Physical and Logical Disks ■ Optimizing Disk Performance ■ Understanding and Using Remote Storage ■ Troubleshooting Disks and Volumes Introduction Disk management is an important aspect of optimizing and maintaining any server and Windows Server 2003 includes a variety of tools that the administrator can use to format, partition, organize, and optimize disks. In this chapter, we take a look at how the operating system enables you to interface with the physical and logical disks in your machine, and how you can optimize disk performance to increase the overall perfor- mance of your server. Like Windows 2000, Server 2003 supports two disk types: basic and dynamic. Upgrading your disks to dynamic status enables you to take advantage of the operating system’s software RAID support, so that you can create fault-tolerant volumes. A regular schedule of defragmentation is another way you can enhance disk performance, and in this chapter, we will show you how to use both the graphical interface and the com- mand-line tool to defragment your disks and perform other disk management tasks.You will also learn to configure disk quotas for better management of disk space on the file server, and we show you how to use the Remote Storage feature to manage volumes. Finally, we will discuss basic troubleshooting techniques for tracking down problems with disks and volumes. Chapter 5 107 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 107 Working with Microsoft Disk Technologies It is important for you to know the correct terminology relating to the various disk components in Windows Server 2003.There are two primary components to understand: physical disks and logical disks. Physical disks can be either basic or dynamic. Logically, they can be separated into either parti- tions or volumes.This section explains when and how each of these is used. Physical vs Logical Disks You must be able to distinguish between a physical disk and a logical disk. Physical refers to the actual, tangible hard disk itself. A physical disk is a piece of hardware, which can be organized into logical disks. A physical disk by itself is of no use to Windows. It is not until you format the physical disk and create a logical disk that it becomes a resource that is accessible from within Windows. Logical disks enable you to customize your physical disks to best fit your needs. Depending on the disk type used (basic or dynamic), logical disks consist of either partitions or volumes.These are units made up of all or part of one or more disks. Partitions are divisions of a single disk. Volumes can span multiple physical disks. Conversely, a single physical disk can contain multiple logical disks. The following illustrate a couple of real-world examples: ■ You have three physical disks installed in your server, each of which contains 30GB of disk space. However, you don’t want to use them as three separate disks. In other words, you do not want the operating system to “see” these disks as a C drive, a D drive, and an E drive. Instead, you want to access all the space contained in the three disks as if it belonged to one 90GB physical disk.To accomplish this, you can create a spanned volume (covered later in this chapter) and combine all three physical disks into one logical disk.You can now access all the storage via one drive letter (e.g., D:). ■ Maybe you have the opposite scenario.You have one large 100 GB physical disk, but you don’t want one large C: drive.You can create two or more partitions or logical drives to divide up the space.You can assign a separate drive letter for each logical disk and access the single physical disk as if it were multiple smaller physical disks. Basic vs Dynamic Disks Windows Server 2003 supports two types of physical disk configurations: ■ Basic disks ■ Dynamic disks By default, disks are initially configured as basic. Basic disks use the same disk structure used in Windows NT 4.0 and previous operating systems, all the way back to MS-DOS.That is, they are divided into primary and extended partitions, and logical drives can be created within extended partitions. Dynamic disks use a new disk structure that was introduced in Windows 2000.The basic unit of a dynamic disk is the volume (rather than the partition). Dynamic disks support features that you don’t get with basic disks and give you much more flexibility in structuring your storage space. 108 Chapter 5 • Managing Physical and Logical Disks 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 108 With dynamic disks, you can extend simple volumes (make them bigger without reformatting and losing data) to any empty space on any dynamic disk, create spanned volumes across multiple phys- ical disks and create fault tolerant (RAID 1 and 5) volumes. A single computer can contain both basic and dynamic disks. Each physical disk installed in the computer is separately identified as either basic or dynamic. Basic disks and dynamic disks both sup- port the same file systems (FAT16, FAT32, and NTFS). Basic disks can be upgraded to dynamic status at any time without losing data. Later in the chapter, you will learn how to upgrade your disks.You do not even have to reboot after upgrading to dynamic unless you are upgrading the system disk or the disk being upgraded is currently in use.As mentioned, basic disks are made up of partitions and logical drives. Basic disks do not support creating volume sets or fault-tolerant volumes. MS-DOS and all versions of Windows can use basic disks. Although dynamic disks (unlike basic disks) support creating volumes that span multiple disks and creating fault-tolerant volumes, dynamic disks are not always the best solution.The following are some limitations of using dynamic disks: ■ Dynamic disks are currently not supported on laptop computers. ■ Removable media and disks attached via FireWire (IEEE 1394), Universal Serial Bus (USB), or shared SCSI buses cannot be converted to dynamic. ■ You can install Windows Server 2003 only onto a dynamic volume that was converted from a basic boot or system partition.You cannot install onto a dynamic volume that was created from free space.This is because there must be an entry in the partition table for the setup program to recognize the volume, and such an entry does not exist on a newly cre- ated dynamic volume. ■ Even though Windows 2000, XP Pro, and Server 2003 all use dynamic disks, you cannot convert a basic disk that holds multiple instances of these operating systems to dynamic. The operating systems installed on the disk will not start if you do this. ■ Dynamic disks are not supported by Windows Cluster Service. If you need the features of dynamic disks on a clustered shared disk, you can use a third-party program called Veritas Volume Manager 4.0 to accomplish this. Booting Your Disk Two disk sectors are vital to starting your computer, the master boot record (MBR) and the boot sector.The MBR is created when a disk is initially partitioned.The boot sector is created when a partition (or volume) is formatted. The MBR is located in the first sector on the physical hard disk. It contains the master boot code, the partition table, and the disk signature for the physical disk.The master boot code is responsible for booting the machine.The partition table identifies the type and location of partitions on the physical disk.The disk signature identifies the physical disk to the operating system. The MBR performs the following operations when a disk boots: 1. It scans the partition table (or disk configuration database) for an active partition. 2. It finds the starting sector for the active partition. Managing Physical and Logical Disks • Chapter 5 109 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 109 3. It loads a copy of the boot sector of the active partition into memory. 4. It passes control to the boot sector. There is a boot sector for each partition on your physical disk.The boot sector (like the MBR) contains code that is required to boot. Among other things, it also contains information required by the file system to access the partition or volume.The boot sector loads NTLDR (the Windows startup file) into memory and gives it control of the boot process. Unlike basic disks, dynamic disks do not use a partition table to store their configuration infor- mation. Instead, they use a private database that is stored at the end of the disk, called the Logical Disk Manager or LDM database.This database is exactly 1MB in size and is replicated to all the dynamic disks within a machine.This addresses the problem of the partition table as a single point of failure.The LDM database includes such information as volume types, offsets, memberships, and drive letters for each volume on the disk.The LDM replicates and synchronizes the databases across the disks, so that all dynamic disks on the system are aware of one another.There is a unique DiskID in the LDM header of each dynamic disk that enables LDM to identify each disk and dis- tinguish it from the others. Partitions vs Volumes Both partitions and volumes enable us to divide one physical disk into sections so that each section appears as a separate disk. Each section is individually formatted (different sections can be formatted in different file systems) and can have its own drive letter. Basic disks contain partitions. Partitions cannot be configured to span disks and therefore cannot provide any fault tolerance. Dynamic disks contain volumes. Volumes can span disks and can provide fault tolerance. Partition Types and Logical Drives There are two types of partitions: ■ Primary parititons ■ Extended partitions Primary partitions are assigned drive letters and formatted as a whole; they cannot be subdi- vided. Extended partitions simply group free space so that it can be subdivided into logical drives, which can be individually formatted and used for storage. Primary Partitions After a primary partition is formatted and assigned a drive letter, it appears as a separate disk to the OS. Depending on the disk-partitioning method used, basic disks can have between four and 128 primary partitions. When using the 32-bit editions of Windows Server 2003, basic disks use the Master Boot Record (MBR) for partitioning and can have up to four primary partitions.The 64-bit editions of Windows Server 2003 can use the GUID partition table (GPT) for partitioning.The GPT utilizes primary and backup partitions for redundancy and allows for up to 128 partitions. 110 Chapter 5 • Managing Physical and Logical Disks 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 110 Extended Partitions Extended partitions can be created only on an MBR-partitioned disk. Extended partitions enable you to have more than four drives on a basic disk.You can only have one extended partition per basic disk, but it can be divided into multiple logical drives.You do not format the extended parti- tion itself. Creating an extended partition simply pools free space that can then be divided into log- ical drives. In other words, until you create a logical drive for your extended partition, you cannot access the space on that partition. Logical Drives Logical drives are created when you divide up the space contained within an extended partition. Logical drives are formatted and assigned a drive letter just like primary partitions. An extended par- tition can contain an unlimited number of logical drives.The Windows system partition cannot be stored on a logical drive. Volume Types Dynamic disks are made up of volumes.A single dynamic disk can hold up to 2,000 volumes, but Microsoft recommends that you limit the volumes per disk to 32. As with partitions, you can have multiple volumes per disk, but unlike partitions, volumes can span multiple disks. Some volume types are designed to increase performance and some types are designed to provide fault tolerance. Windows Server 2003 supports the following five volume types: ■ Simple ■ Spanned ■ Striped ■ Mirrored ■ RAID-5 Simple Volumes Simple volumes are made up of free space on a single dynamic disk.They function much like pri- mary partitions on a basic disk. If you have only one physical disk, all the volumes you create on it will be simple volumes. Simple volumes are not fault tolerant. However, you can mirror them (discussed below) to make them fault tolerant, in which case they become mirrored volumes. Simple volumes can be extended on a single disk as long as the disk is not the boot or system disk. Extending a simple volume involves taking free space on a disk and adding it to the existing volume.You can also extend a simple volume across multiple disks, but then it becomes a spanned volume. Note that you can’t combine these operations (that is, you can’t mirror a spanned volume). Simple volumes provide almost 100 percent utilization of disk space. In other words, if you pur- chase two 100 GB disks and format them as simple volumes, you have a total of 200 GB total storage, minus the 1MB per disk overhead for the LDM database.You are able to use more of the purchased disks’ space than is true with other types of volumes. Managing Physical and Logical Disks • Chapter 5 111 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 111 Spanned Volumes Spanned volumes support two to 32 disks. Each disk can be a different size (as shown in Figure 5.1). Creating a spanned volume is like extending a simple volume except that it spans multiple disks (hence the name, spanned volume). In fact, if you extend a simple volume across multiple disks, by definition it becomes a spanned volume. Spanned volumes are not fault tolerant and cannot be mir- rored. Spanned volumes do not provide any performance improvements over simple volumes.They are used merely to increase the amount of space that can be accessed as a single unit. Like simple volumes, spanned volumes provide 100 percent drive utilization (minus the 1MB used for the LDM database). As data is written to the spanned volume, it is first written to the first disk in the set. When the first disk is full, the data is then written to the second disk, and so on. You can extend a spanned volume to make it larger (if it is formatted with NTFS).This consists of adding unallocated space to the volume, like extending a simple volume, except that the unallo- cated space does not have to be contiguous and can be on any dynamic disk attached to the com- puter. No data is lost; the new space is formatted without any impact on the existing data. Striped Volumes Striped volumes are made up of two to 32 disks. Each disk should be the same size to efficiently use all space. It is possible to use different-sized disks, but the stripe size on every disk will be limited to the amount of free space on the smallest disk, so there will be space wasted on the larger disk(s). In other words, if you created a striped volume with one 5 GB drive and two 10 GB drives, you would only be able to use 5 GB of each drive because that is the maximum amount that is available on all disks.This would create a 15 GB striped volume, wasting 10 GB of disk space (5 GB on each of the 10GB disks). If you use equal-sized disks, striped volumes provide 100 percent drive utiliza- tion (minus 1MB overhead for the LDM database). Striped volumes cannot be mirrored or extended and they are not fault tolerant. However, striped volumes do provide performance advantage. Striping increases read and write access to the volume, because all the disks are working at the same time. In fact, striped volumes offer the best 112 Chapter 5 • Managing Physical and Logical Disks Figure 5.1 Understanding Spanning Volumes 1 2 3 4 5 6 7 8 9 15 16 17 18 19 13 14 20 21 22 23 24 25 26 Disk 0 Disk 1 Disk 2 Disk 3 Drive D: 100GB 250GB 75GB50GB25GB Data 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 112 performance of all Windows Server 2003 volume types.This is because of the way data is stored (as shown in Figure 5.2). Data is written evenly across all disks in 64 KB chunks. Mirrored Volumes Mirrored volumes require exactly two disks and these two disks should be identical. Not only should they be the same size, but Microsoft recommends that both disks be the same model, from the same vendor. Mirrored volumes provide fault tolerance by making a duplicate copy of every- thing that is written to the volume (see Figure 5.3), with one copy on each physical disk. If one disk in the mirrored volume fails, the other disk will take its place. However, when this happens, you no longer have fault tolerance.You need to break the mirror so you can then create a new, mirrored volume with another disk, to restore fault tolerance. Mirrored volumes cannot be extended, and they provide only 50 percent disk utilization. In other words, every 1 GB of storage space that you buy gets you 500MB of actual storage.The ben- efit of a mirror is that you have an exact duplicate of everything. With a mirror, you can lose one disk and still have all your data intact. Only if you lost both disks at the same time would you lose your data. Because all the data is there on the duplicate disk, you can get back up and running after a failure much faster than with a RAID-5 volume, where the data must be regenerated from the parity information following a failure before it can be accessed. Mirroring can have a negative impact on system performance, because of the overhead of writing to two disks at the same time. An even more fault-tolerant form of disk mirroring is called disk duplexing. Disk duplexing is the same as disk mirroring, except that each disk in the mirror is connected to a different disk con- troller.This eliminates the disk controller as a single point of failure. Duplexed disks appear to the operating system the same as mirrored disks; if you have duplexed disks, they will be shown as mir- rored disks in the Disk Management console. Managing Physical and Logical Disks • Chapter 5 113 Figure 5.2 Understanding Striped Volumes 1 32 4 Disk 0 Disk 1 Disk 2 Disk 3 14 15 10 11 6 7 16 12 8 13 9 5 Drive D: 100GB 400GB 100GB100GB100GB Data 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 113 You can mirror any simple volume, including the boot and system volumes. Microsoft recom- mends that you use separate controllers (duplexing) if you mirror the system or boot volumes.The controllers should be identical (same model and vendor) to prevent problems with starting from the mirror if the primary disk fails. Always test a mirrored system or boot volume to ensure that the operating system will be able to start from a remaining mirror in case of failure. There are several conditions that must be met in order for Windows to start from a remaining mirror. If the disks in a mirror are SCSI disks on separate controllers, both controllers must have translation enabled or disabled (one cannot be enabled while the other is disabled). If the disks are SCSI disks on the same controller and there are additional disks on the controller, the controller’s BIOS has to support the capability to choose which device to boot from. If the disks are IDE disks, you must ensure that the remaining disk after a failure has its jumpers set to the “master” position. RAID-5 Volumes RAID-5 volumes consist of three to 32 disks. RAID-5 volumes provide increased performance for read operations, as well as fault tolerance.The performance boost is due to the way RAID-5 vol- umes stripe data across all the disks and the fault tolerance is provided by parity information. As with a striped volume, data is written evenly across all disks in 64 KB chunks (see Figure 5.4). Unlike with disk striping, the available space (the stripe) on one disk is used for parity information. To increase performance, the parity information is split across all the disks in the volume, written in stripes like the data. Write performance is lower, because the parity must be calculated during the write operation. If most operations are read-oriented (for instance, users accessing files on a file server), RAID-5 provides significant performance advantages. Windows Server 2003’s RAID-5 volumes cannot be extended or mirrored, and the boot and system partitions cannot be part of a RAID-5 volume. Disk utilization depends on how many disks are part of the RAID array.The equivalent of one disk is used for writing the parity information. If you have three disks, one-third of the total disk space is used for parity information, so you are able to utilize two-thirds of the space you purchase 114 Chapter 5 • Managing Physical and Logical Disks Figure 5.3 Understanding Mirrored Volumes 1 2 3 4 5 6 7 8 9 1 2 3 4 5 6 7 8 9 Disk 0 Disk 1 Drive D: 100GB 100GB 100GB Data 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 114 for data. If you have 10 disks in the array, only one-tenth of the total space is used for parity.Thus, the more disks you have in the set, the more efficient disk usage becomes. Using Disk Management Tools Microsoft provides a variety of disk management tools in Windows Server 2003.These include command-line utilities such as diskpart.exe, fsutil.exe, and rss.exe.These tools support scripting, which enables you to automate many of your disk management responsibilities.You can also manage your disks through the graphical interface via the disk management MMC.This section will show you how to manage disks both from the GUI and from the command prompt. Using the Disk Management MMC You can access the disk management MMC, shown in Figure 5.5, in a couple of different ways: ■ You can get there via Computer Management, by clicking Start | Programs | Administrative Tools | Computer Management. ■ You can right-click the My Computer icon on the desktop or in the Start menu and select Manage from the context menu. ■ You can create a custom MMC console to use the Disk Management snap-in. Figure 5.5 shows the default view for the Disk Management MMC. Notice that the details pane is divided into two sections, a top section and a bottom section.There are three different views that you can use for either section: ■ Disk list ■ Volume list ■ Graphical view Managing Physical and Logical Disks • Chapter 5 115 Figure 5.4 Understanding RAID-5 Volumes 1 32 Parity Disk 0 Disk 1 Disk 2 Disk 3 10 11 Parity 8 5 Parity 12 9 6 Parity 7 4 Drive D: 100GB 300GB 100GB100GB100GB Data 301_BD_W2k3_05.qxd 5/12/04 12:31 PM Page 115 . HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoft Windows WindowsUpdate add the following registry entries: ■ WUServer ■ Sets the SUS server by HTTP name ■ Registry Value Type: Reg_SZ ■ WUStatusServer ■ Sets the SUS statistics server. booting the machine .The partition table identifies the type and location of partitions on the physical disk .The disk signature identifies the physical disk to the operating system. The MBR performs the. 1MB used for the LDM database). As data is written to the spanned volume, it is first written to the first disk in the set. When the first disk is full, the data is then written to the second disk,