Hello, Cloud Gurus, and welcome back.
In this lesson, we're going to briefly review
Windows Server file sharing.
Let's take a look at what we're going to cover.
First up, we'll do a really high-level review
of configuring file shares on Windows Server.
And then we'll review all of the features
that have been added
in the recent versions of Windows Server.
And finally, we'll wrap up with a demo
of configuring a file server to host an SMB share.
Let's get started.
Server Message Block or SMB
is the protocol used by Windows to share files
and allow people and applications to open,
edit, and save those files.
And historically, SMB was almost solely used
for the purposes of storing user data,
like documents and spreadsheets.
But in more recent versions of Windows Server,
significant improvements have been made
to enable support for both SQL Server,
and more recently, Hyper-V.
And we'll explore these features in more detail
in just a moment.
But first, let's take a look
at how you configure Windows file server permissions.
And in my experience,
this is an often misunderstood concept.
And knowing how this works will save you quite a few hours.
Not only when troubleshooting on-premises file servers,
but in future, cloud shares like Azure Files,
which we'll explore more in an upcoming lesson.
All Windows file shares
start with just a folder on a volume.
And from there, you create one or more SMB shares
to allow access over the network.
And when you configure a file share,
you need to provide a name and some share-level permissions.
The name allows you to access the file share
over the network using a universal naming convention
or UNC path that includes both the server and share name.
What's important to know about the share name
is that you can include a $ symbol
at the end of the share name to hide the share.
So when someone browses to the server using the UNC path,
shares that are named like this won't be visible.
And you'll also need to provide share-level permissions.
And the share-level permissions
you can set are full control, change, or read.
But what's important to know about share-level permissions
is that they only apply when a user accesses the data
using the SMB protocol.
If a user accesses the data locally,
on the server for example,
if they can log on to the server locally,
the share-level permissions do not apply.
So it's important to know that you can also set permissions
using NTFS access control lists or ACLs.
And NTFS ACLs apply whether the files
are being accessed locally or via SMB.
And NTFS ACLs are sometimes referred to as Windows ACLs,
because they also work with ReFS.
And it's because NTFS permissions always apply
that it's common practice to use NTFS permissions
to control access instead of using SMB share permissions.
You can set the share permissions to everyone
with full control and use NTFS permissions
to more granularly control the permissions.
And there are just 2 important things to know
about setting file server permissions.
The first is that deny always overrides allow.
So avoid using deny permissions whenever possible,
as it complicates things when you're evaluating permissions.
And the other important point to remember
is that permissions can be inherited.
So you can sit fairly light permissions
at a high level using something like the list permission,
and use permissions like modify
to grant more specific permissions as required.
And finally, you can also break inheritance
to set explicit permissions on a lower level folder,
ignoring and removing those permissions
that are applied at a higher level.
Over the last few releases of Windows Server,
Microsoft has made several improvements
to Windows file servers that use the SMB protocol.
And if you're a Windows Server Administrator,
with your head down day to day getting stuff done,
you might have missed these features.
So let's quickly cover them off.
In Windows Server 2012, Microsoft introduced SMB 3,
the big game changer.
SMB 3 introduced SMB Transparent Failover,
allowing clients accessing a file server
running on a Windows Server failover cluster
to transparently failover
between nodes in the event of a node failure.
And if you're not super familiar
with Windows Server failover clustering,
it's something that you'll cover
when you take a look at the AZ-801 exam.
Windows Server 2012 also got SMB Scale-Out,
which uses cluster shared volumes
to allow multiple servers to write data
to a share simultaneously,
which significantly improve the scalability
and reliability of SMB file shares.
And SMB Multichannel allows clients to create
multiple channels for data
between the file server and the client,
significantly boosting performance.
And SMB Direct uses RDMA capable network adapters--
and you'll remember we took a look
at those in the Hyper-V section of this course--
to improve the latency of SMB traffic
without impacting the CPU overhead.
SMB direct is enabled by default
on Windows Server 2012 and later.
SMB Encryption was also introduced,
which secures all of the SMB traffic
with end-to-end encryption
without the need to deploy complex IPSec-based encryption.
And there were some more enhancements added in SMB 3,
but these are the most prominent to be aware of.
And SMB 3.02 and Windows Server 2012 R2
improved on some of these features,
including benefits to performance
and added support for SMB bandwidth limits.
And SMB 3.11 with Windows Server 2016
added a range of security features,
including improvements for encryption,
better protection against man-in-the-middle attacks
with pre-authentication integrity,
and improved directory caching
to improve the performance
when listing the contents of a file share.
And it's because of all of these new features
introduced in SMB version 3,
that it's recommended you disable SMB version 1
and SMB version 2 where it's no longer required.
And we'll take a look at that in the demo right up next.
All right, let's take a look at a demo
of configuring file shares.
We have a new file server, CORP-BNE-FS01,
that we deployed in a previous lesson.
In this demo, we'll take a look
at how you can improve the security of your file servers
by disabling SMB version 1,
and then we'll take a look at how you can enforce
server-wide SMB Encryption.
And finally, we'll step through the process
of creating a file share.
And then we'll wrap up the demo
by testing access to the file share.
Let's take a look.
All right, so here I am logged on to CORP-BNE-FS01.
Let's first go ahead and disable SMB 1.
I've gone ahead and launch Windows PowerShell.
So let's use PowerShell to disable SMB 1.
We're going to first check if SMB 1 is enabled
using the Get-WindowsOptionalFeature
PowerShell cmdlet.
And we're going to use the Online parameter
to specify that we want to get the features
from our online server,
the one that we're currently accessing,
and we're going to provide
the feature name SMB1Protocol.
We'll go ahead and run that.
And we can see that SMB 1 is currently disabled.
And all of the software binaries
that are required to make SMB 1 work
are actually removed from the server as well.
Now, if we wanted to remove SMB 1 from the server,
we could use the DisableWindowsOptionalFeature
PowerShell cmdlet,
or we could use group policy.
Now, it's disabled on the latest versions
of Windows Server by default,
so we don't need to disable it here.
But you could definitely audit and disable SMB 1
on any of your older servers and clients that you have.
And this is definitely recommended by Microsoft.
All right, now let's configure server-wide SMB encryption
using this Set-SMBServerConfiguration
PowerShell cmdlet.
And we'll specify that encrypted data should be set to true.
And we'll go ahead and confirm that with Y.
Now be aware that enforcing server wide SMB encryption
does have a performance impact on your file server.
And it also disables access using SMB version 2
and SMB version 1, which will affect
some older Windows clients.
All right, now with our service secured,
let's go ahead and configure a file share.
To do that, we'll use Server Manager,
so I'll go ahead and launch Server Manager
We'll navigate to the Local Server.
and then we'll navigate to File and Storage Services
and then we'll select Shares.
Now be aware that you can configure a share
by directly accessing the folder that you want to share,
but we're going to use Server Manager in this instance.
So we'll go ahead and select to start the new Share wizard.
Now it gives you a few options here.
You can create a quick SMB share,
and advanced share or an application share.
The purpose of a quick share
is for a general purpose file server.
Advanced is for when you want to use
File Server Resource Manager,
which we'll cover in a lesson later in this section.
And applications is for when you want to configure a share
for use with Hyper-V or SQL Server.
We're going to use Quick
to create a general purpose file share, and select Next.
We're going to use a custom path.
And we're just going to use the path S Drive data.
We'll go ahead and select Next.
And you can see that when we create the share,
it's going to be accessible using the server name
and then the share name.
And that's going to provide access
to the S Drive data directory.
We'll go ahead and select Next.
And you can see that because we've enabled
server-wide encryption,
encrypt data access is grayed out here and it's enabled.
So we'll go ahead and select Next.
Now let's go ahead and customize our permissions.
And you can see here,
you've got 2 tabs for setting permissions,
you have the NTFS or Windows ACL permissions,
and then you have the share-level permissions.
Let's go ahead and take a look
at the share-level permissions.
We can see we have everyone set to Full Control,
which is ideal.
Let's navigate back to the Permissions tab.
And you can see here where you can disable inheritance
and set your own permissions on the share if you want to.
These defaults are okay for us,
so we'll go ahead and click OK.
But we could customize these NTFS permissions
if we wanted to.
We'll go ahead and click Next.
And then we'll go ahead and click Create.
Now we can go ahead and click Close.
All right, our share is created.
Now let's go ahead and access our share,
so we'll just navigate to File Explorer.
And then we'll navigate to the server.
And then we can see we had that share located here.
And if we double click that share,
we now have access to the share
using the UNC path that includes the server name
and the share name.
All right, that concludes this demo.
Now let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered?
SMB file shares are accessed over the network
using the UNC path.
And share names that end with a $ character
are hidden when the server is browsed
over the network using the UNC path.
And to avoid managing both share and NTFS permissions,
you can set the share permissions to full control
and use NTFS permissions to manage access.
And you should avoid using deny
when configuring NTFS permissions
as deny permissions override all other permissions.
And use SMB 3 or later
for improved performance with SMB Direct,
SMB Multichannel and improved caching
and security improvements,
including support for end-to-end encryption
and protection against man-in-the-middle attacks.
All right, that concludes this lesson.
Thanks for being with me, and I hope you found it useful,
and I look forward to seeing you in the next lesson.