Lab: Redundant file server with correction

What you will learn in this TP

• Create a pool and a mirrored virtual disk
• Combine share and NTFS permissions
• Enable shadow copies and quotas

Introduction #

What you will learn in this section

• Create a pool and a mirrored virtual disk
• Combine share and NTFS permissions
• Enable shadow copies and quotas

Context. The accounting file server runs on a single disk. You replace it with a mirrored volume and a properly secured share.

Prerequisites: a Windows Server 2025 VM to which you can add 2 virtual disks of 20 GB (Hyper-V, VirtualBox or cloud)  ·  Estimated duration: 50 min

A mirrored S: volume, the \\server\Compta share, verified permissions and a simulated disk failure.

Setup #

Guided steps, with their solution.

1. 1. Add the disks

   Why? Storage Spaces needs blank, unpartitioned disks.

   Add two 20 GB disks to the VM (on Hyper-V, from the host), then check that they can be pooled.
   See the correction

   # Sur l'hôte Hyper-V (adapter le nom de la VM)
   1..2 | ForEach-Object {
       New-VHD -Path "D:\VM\fs-data$_.vhdx" -SizeBytes 20GB -Dynamic
       Add-VMHardDiskDrive -VMName SRV-FS01 -Path "D:\VM\fs-data$_.vhdx"
   }
   # Dans la VM
   Get-PhysicalDisk -CanPool $true | Format-Table FriendlyName, Size, MediaType, CanPool

2. 2. Pool and mirror

   Why? A two-way mirror survives the loss of one disk.

   Create the PoolFS pool, a two-way mirror virtual disk Miroir, then the NTFS volume S: labelled Partages.
   See the correction

   New-StoragePool -FriendlyName PoolFS -StorageSubSystemFriendlyName 'Windows Storage*' -PhysicalDisks (Get-PhysicalDisk -CanPool $true)
   New-VirtualDisk -StoragePoolFriendlyName PoolFS -FriendlyName Miroir -ResiliencySettingName Mirror -NumberOfDataCopies 2 -UseMaximumSize
   Get-VirtualDisk Miroir | Get-Disk | Initialize-Disk -PartitionStyle GPT -PassThru |
       New-Partition -UseMaximumSize -DriveLetter S | Format-Volume -FileSystem NTFS -NewFileSystemLabel Partages -Confirm:$false
   Get-VirtualDisk | Select-Object FriendlyName, ResiliencySettingName, HealthStatus, Size

3. 3. NTFS permissions

   Why? Breaking inheritance then granting rights to groups makes access predictable.

   Create S:\Compta, break inheritance, give Full control to Administrators and SYSTEM, and Modify to a local group Compta (or CORP\DL_Partage_Compta_M if you did the AD lab).
   See the correction

   New-LocalGroup -Name Compta -Description 'Accès au partage Compta'
   New-LocalUser -Name compta1 -Password (Read-Host -AsSecureString 'Mot de passe compta1')
   Add-LocalGroupMember -Group Compta -Member compta1
   New-Item -ItemType Directory S:\Compta
   icacls S:\Compta /inheritance:r
   icacls S:\Compta /grant '*S-1-5-32-544:(OI)(CI)F' 'SYSTEM:(OI)(CI)F' 'Compta:(OI)(CI)M'
   icacls S:\Compta

4. 4. Publish the share

   Why? Broad share, precise NTFS: the simplest rule to maintain.

   Share S:\Compta as Compta with access-based enumeration and SMB encryption, then test access as compta1.
   See the correction

   New-SmbShare -Name Compta -Path S:\Compta -FullAccess 'Administrateurs' -ChangeAccess 'Compta' -FolderEnumerationMode AccessBased -EncryptData $true
   Get-SmbShareAccess Compta
   $cred = Get-Credential compta1
   New-PSDrive -Name T -PSProvider FileSystem -Root "\\$env:COMPUTERNAME\Compta" -Credential $cred
   Set-Content T:\test.txt 'écriture OK' ; Get-Content T:\test.txt
   Remove-PSDrive T

5. 5. Shadow copies and quota

   Why? Previous versions avoid many restores; the quota avoids a full disk.

   Enable shadow copies on S:, create one, then install FSRM and set a 5 GB quota on S:\Compta.
   See the correction

   vssadmin add shadowstorage /for=S: /on=S: /maxsize=10%
   vssadmin create shadow /for=S:
   vssadmin list shadows /for=S:
   Install-WindowsFeature FS-Resource-Manager -IncludeManagementTools
   New-FsrmQuota -Path S:\Compta -Size 5GB -Description 'Quota Compta'
   Get-FsrmQuota -Path S:\Compta | Select-Object Path, Size, Usage

6. 6. Simulate a failure

   Why? Checking that redundancy works before you need it.

   Remove one of the two disks (VM off or disk disconnected from the host), check that S:\Compta stays readable and the virtual disk is “Degraded”, then put the disk back and repair.
   See the correction

   # Sur l'hôte : Remove-VMHardDiskDrive -VMName SRV-FS01 -ControllerType SCSI -ControllerNumber 0 -ControllerLocation 2
   Get-VirtualDisk Miroir | Select-Object FriendlyName, OperationalStatus, HealthStatus
   Get-Content S:\Compta\test.txt
   # Après avoir remis le disque :
   Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus, OperationalStatus
   Repair-VirtualDisk -FriendlyName Miroir
   Get-StorageJob

Difficulty level : ●●○○○ (2/5)