There is a solution however! And it's based on a virtual hard disk or VHD.

I tested using junction points, (KWLINK), and I found it lacking as subfolders will not be seen by modern apps. I also looked into Paul Thurrott's blog and found too many people having issues both in the blog feedback and in our internal surfdisc DL which were related to indexing problems and folder naming conventions.

This is where a VHD can be used to create an index-able volume that can be used in libraries allowing media on the SD card to be seen in modern apps. It's an involved but simple process you'll only need to do once. Following are the steps:

Create a VHD

Get a Micro SD card. I went with a class 10 32GB mSD for about $50

Create a VHD using most of the space on the card. I say most and not all as you may want a couple GBs of free space so you can still use it to transfer data between devices easily, after all; it is removable storage.

1. Insert your micro SD card into your surface, it's under the kick stand! See figure 1
2. Launch Disk Management. (Easy way is drop your pointer to the bottom left corner and right-click:) See figure 2

    

Once your card is recognized you'll see it's probably formatted as FAT32, figure 3. We'll need to reformat it as NTFS for the VHD creation to succeed.

Figure 3

1. Right click the partition and select Format:

1. Choose your volume label name and format type, NTFS, figure 5, and once complete you'll see the resultant partition is now NTFS, figure 6

1. We're ready to create the VHD. From the Action menu in Disk Management select Create VHD, figure 7, and under 'Location:' browse to your newly formatted NTFS volume on your Micro SD card and give it a name and size, figure 8. I called it "SDVHD.VHD" and gave it 28GB leaving a couple GBs for allowing me to sneaker-net data from other Windows PCs.

Be patient as creation of the VHD will take some time, as much as 30 minutes or more depending on card size and speed

Note: You can monitor the progress of the VHD creation in the status bar of Disk Management, figure 9

1. Once the VHD is complete attach it via the Action Menu, figure 10
2. Initialize the new disk by right clicking the volume and choose 'Initialize Disk', figure 11, and choose the defaults in the following dialog, figure 12

1. Create a simple volume by right clicking the new VHD and selecting 'New Simple Volume' as in figure 13.

1. In the next three dialogs choose Next to specify Volume size and use defaults, figure 14, and assign it a drive letter, (no reason to not accept the defaults of drive letter E), figure 15

You have now completed creating a VHD on your Micro SD card, you attached the VHD and have it formatted and ready to accept media but we're not done yet! VHDs do NOT connect automatically after a reboot, we'll address that next.

Automate VHD Attachment at Boot-Up

We can automate the attachment of the VHD at boot-up by using the task scheduler to run a command that involves use of DISKPART, let's create the command 1^st

Follow these steps to create the required command:

1. Create a directory on the root of your C drive and call it something like 'VHD' as used in the following examples
2. Create a text file that contains the DISKPART commands in figure 17. Notice that d:\sdvhd.vhd is the location of the VHD on the MicroSD card we created earlier. Save the file and name it 'attachvhd.s'

   Note: When using Notepad the default behavior is to save files with a 'TXT' extension, we don't want that extension. Simply use the 'Save as type' pull down menu to select 'All Files (*.*)' and we'll keep the '.s' extension, figure 16

1. Create another file in the same directory and include the content of figure 18 and save it as "attachvhd.cmd" using the same technique to prevent adding the .txt extension to the file name as shown in figure 16.
2. You can test the command by running from a command prompt to ensure your syntax is correct. You'll need to either disconnect your newly created VHD or simply reboot your Surface. Upon reboot you'll notice your new VHD drive using drive letter E is missing. Run the command from figure 18 to confirm it reattaches.

Now we're ready to automate attaching the VHD at boot-up using the Task Scheduler, here's how:

1. Open Computer Management and navigate to Task Scheduler and right click selecting 'Create Task' shown in figure 20 below.

   NOTE: (You can find Computer Management by hitting Windows Key + Q which allows you search for the applet as shown in figure 19:)

1. In the General tab of new task check "Run whether user is logged on or not" and tick "Run with highest privileges", this will prevent a dialog from User Access Control, UAC, at startup, as shown in figure 21.

1. Navigate to the Triggers tab and select 'At startup' from the 'Begin the task' setting and ensure 'Enabled' is ticked as shown in figure 22.

1. Navigate to the 'Actions' tab and under Action select 'Start a program' and populate the 'Program/script:' dialog with the command you created from figure 18, "attachvhd.cmd", you should be able to 'Browse' to it, as shown in figure 23.

1. Navigate to the 'Conditions' tab and under 'Power' uncheck "Start the task only if the computer is on AC power" as shown in figure 24.

1. No need to make any changes in the Settings tab. Click the OK dialog to save your new task.
2. Test the scheduled task by rebooting your Surface and confirming your new scheduled task completed successfully. You can confirm by running file explorer, (Windows key + E), and confirm you see the newly created attached VHD as drive letter E by clicking on Computer as shown in figure 25.

Notes:

• In figure 24 above you'll notice the Media (E:) drive under Hard Disk Drives and you'll see your Micro SD under 'Devices with Removable Storage' showing that it's near capacity, in red, as our VHD is consuming most of the SD card
• If for some reason you do not get the expected result confirm your commands from figures 17 and 18 are correct. You can run the attachvhd.cmd from a command prompt to confirm it attaches your VHD, if that works, examine your task to ensure its setup as specified in this document

Add VHD Folders to your Libraries

Now that you've got a virtual hard disk on your micro SD you're ready create folders and add them to your libraries. This is required for Modern apps to see media stored on the VHD and is done via the File Explorer.

1. Launch File Explorer, (use windows key + E or run it from your desktop) and create folders for each type of media you'd like include in your libraries. I created folders for pictures, videos and music as shown in figure 25.

1. Add the newly created folders to the appropriate library using the Library tools in File Explorer, the following will demonstrate the 'Music' Library. Click on Music below the 'Libraries' folder in the left pane of File Explorer and the Library Tools on the title bar will revealed shown in Figure 26.

1. Click on the Library Tools shown on the title bar and select 'Manage Library' from the ribbon and add the newly created Music folder on your VHD, the E drive as shown in figure 27.

1. Repeat steps 2 and 3 above for each folder from your VHD which you'd like to include in your library.
2. Add some media to the VHD folders and test the library configuration by running a modern app such as photos, video, music, etc. and confirm the media saved on your VHD is visible from within the modern app.

Final Notes

• Now that you're micro SD contains a Virtual Hard Disk with folders which have been added to your libraries you need to ensure it remains inserted in the SD slot when your Surface is powered up. If you need to remove it to copy a file from another windows device ensure your Surface powered off, being asleep will not be enough.

• I noticed that high megapixel images, 16MP in my tests, actually rendered faster in the photo app. This may be based on the speed of the Micro SD card I'm using compared to the ROM memory used in the Surface or lack of overhead the file system imposes on a drive that shares media with everything else, whatever the reason; it was a pleasant surprise.

The steps to deploy the ASA credential are as follows:

• Create a computer account to be used as the ASA credential.
• Deploy the ASA credential to the CAS members (using the RollAlternateserviceAccountPassword.ps1 script)
• Confirm the setting on each CAS server
• Convert the Offline Address Book (OAB) virtual directory to an application using the CovertOABVdir.ps1 script
• Assign the SPNs to the ASA credential computer account.
• Confirming Kerberos at the client

To configure Kerberos ASA:

1. Create a computer object service account. (All computer accounts must end with the "$" character but do not add "$" to the computer account name, it will be added automatically and will be shown in the SAMAccountName in LDP.) The password is not important; it will be reset by the script. A Machine (computer) account is preferred. Only one service account is required for multiple Active Directory sites. NOTE: The CAS array members in multiple sites will use this same service account but different SPNs.

EXAMPLE

In my lab I'm using ADUC to create the ASA account:

Proceeded by filling in the details, no need for pre-windows 2000 assignment:

And no need for ticking "This is a managed computer"

1. Deploy the ASA credential to the CAS members (using the RollAlternateserviceAccountPassword.ps1 script)

Execute the following from the Exchange 2010 Management Shell:

1. To target only members of a specific CAS array:

.\RollAlternateserviceAccountPassword.ps1 -ToArrayMembers <CASArrayName>
-GenerateNewPasswordFor <Domain\Account$>

1. Select Yes at the prompt to change password

If this syntax is used then the command must be run twice, once for each datacenter.

1. To target all Exchange 2010 CAS servers in the forest:

.\RollAlternateserviceAccountPassword.ps1 -ToEntireForest
-GenerateNewPasswordFor <Domain\Account$>

1. Select Yes at the prompt to change password

1. To target a newly installed CAS server:

.\RollAlternateServiceAccountPassword.ps1 -CopyFrom <ExistingServerName>
-ToSpecificServers <NewServerName> -Verbose

EXAMPLE

In my lab have multi-role servers running MB, HT and CAS which means I'm running the cluster service which mean I can't add NLB to the CAS servers which means I can't create a CAS array. But the above commands will apply to most environments and the example below is for adding the ASA credential to my individual CAS servers:

Prior to setting the ASA the above command you can run the following command showing the ASA is not set:

Get-ClientAccessServer -Identity e2010 -IncludeAlternateServiceAccountCredentialStatus | fl AlternateServiceAccountConfiguration

My CAS server name is E2010

Now I'm running the following script pointing to my 1^st CAS server:

.\RollAlternateserviceAccountPassword.ps1 -ToSpecificServers e2010 -GenerateNewPasswordFor "jy.com\ASA$" -Verbose

Which produces this output:

And the rest of script output asking for the Password change:

Once you select Y you'll see the script complete:

Next I'll run the following command to add the ASA credential to another CAS server, e2010B. You would do this to newly deployed CAS servers:

.\RollAlternateServiceAccountPassword.ps1 -CopyFrom e2010 -ToSpecificServers e2010B –Verbose

1. Confirm the setting on each CAS server by running the following:

Get-ClientAccessServer -Identity <CASServerName>
-IncludeAlternateServiceAccountCredentialStatus | fl AlternateServiceAccountConfiguration

EXAMPLE

Now that I've deployed the ASA credential I'll run the above command confirming the ASA credential has been deployed to my CAS servers, looking at just the e2010 CAS server:

1. Convert the OAB virtual directory

This script will convert the OAB virtual directory to an IIS web application as well as create the new application pool, MSExchangeOabAppPool. Converting the OAB virtual directory is necessary to support different authentication methods like Kerberos and Certificate authentication and must be done before you configure Kerberos Client Authentication. The name of the script is ConvertOABVdir.ps1. The script is located in the Scripts subdirectory of the Exchange install path.

.\ConvertOABVdir.ps1

EXAMPLE

This is easy and will complete quickly:

Done! Above is the result you're looking for.

1. Register the SPNs for this account

This is done only once using the SETSPN.EXE utility. Depending on how Active Directory permissions are implemented, the operation may require Domain Administrator rights. The step should only be completed after all previous steps have completed successfully.

NOTE: RollAlternateserviceAccountPassword.ps1 -This step must be performed immediately with production servers that are added in the future. Failure to do so will result in poor client performance if a new server is added to the CAS array and the steps above are not followed. Microsoft recommends that you schedule this password change via a schedule task.

EXAMPLES

• Use the created service account in Active Directory from step 1 above: JY\ASA
• Register the SPN's on this account
  • setspn -F -S exchangeMDB/webmail.jy.com JY\ASA
  • setspn -F -S exchangeRFR/webmail.jy.com JY\ASA
  • setspn -F -S exchangeAB/webmail.jy.com JY\ASA
  • setspn -F -S HTTP/webmail.jy.com JY\ASA
  • setspn -F -S exchangeMDB/webmail JY\ASA
  • setspn -F -S exchangeRFR/webmail JY\ASA
  • setspn -F -S exchangeAB/webmail JY\ASA
  • setspn -F -S HTTP/webmail JY\ASA

• The following steps have to be executed on each CAS server ?$cred = get-credential "JY\ASA"
  • Set-clientaccessserver -Identity CASserver -AlternateServiceAccountCredential $cred
  • iisreset
  • restart-service MSexchangeAB
  • restart-service MSexchangeRPC

• To verify the setting, execute the following on each CAS server:

• Get-ClientAccessServer -Identity CASserver -IncludeAlternateServiceAccountCredentialStatus |fl AlternateServiceAccountConfiguration

Once you've registered your SPN for your environment you can view the registration via the following command, here's I'm using my ASA account in my jy.com domain:

Setspn –L jy.com\ASA

1. Confirming Kerberos at the client

Note; you'll need to run an IISReset, and restart the Exchange Address Book Service and the Exchange RPC Client Access Service on each CAS server after all the above steps are completed

EXAMPLE 1

Configure your Outlook profile to use Kerberos authentication via the Account settings of the profile via Change E-mail Account | More settings | Security and Restart Outlook if running:

Check the connection status by right-clicking the systray Outlook icon and selecting connection status:

If your connection is TCP/IP you're successfully using Kerberos for MAPI connected clients, if HTTPS than you are not:

EXAMPLE 2

You can also run klist from a command prompt to see the Kerberos tickets for Outlook access:

EXAMPLE 3

Another method to ensure Kerberos is being accepted by the CAS servers using logs from OAB:

1. Update your OAB from EMC:

1. Followed by looking at the logs in their default location:

C:\Program Files\Microsoft\Exchange server\v14\Logging\AddressBook Service

1. Confirm the AddressBook_... is reflecting the time of your update and open it.  Once you scroll to the end you should see something like this, notice the 'Kerberos' at the end of last line:

2013-02-11T21:09:20.994Z,6,0,/o=JY/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Administrator,,192.168.0.13,e2010,ncacn_ip_tcp,GetFQDNFromLegacyDN,,7,,,Kerberos,

EXAMPLE 4

Capture a netmon trace and look to see if the Kerberos Token is seen:

1. Periodically Changing the Password for the ASA Credential Account

It's recommended to periodically change the password for the ASA credential account. To do so you would need to create a scheduled task that runs the RollAlternateServiceAccountPassword.ps1 script. From: http://technet.microsoft.com/en-us/library/ff808311.aspx

If the script runs as a scheduled task, its results are logged to the Exchange server Logging folder in a subfolder called RollAlternateServiceAccountPassword.

You can use the log to confirm that the task has been running successfully.

1. References

The following references were used in the creation of this document:

• Using Kerberos with a Client Access Server Array or a Load-Balancing Solution
• Enabling Kerberos Authentication for MAPI Clients Connecting to Exchange 2010 SP1
• Recommendation: Enabling Kerberos Authentication for MAPI Clients
• Using the RollAlternateserviceAccountPassword.ps1 Script in the Shell

Hope this helps!