Failed creating authentication policy/silo.
The user has insufficient access rights.

dsacls "CN=AuthN Policies,CN=AuthN Policy Configuration,CN=Services,<the DN of PRIV Domain’s Configuration NC>” /g <user name>:RPWPRCWD;;msDS-AuthNPolicy /i:s
dsacls "CN=AuthN Policies,CN=AuthN Policy Configuration,CN=Services,<the DN of PRIV Domain’s Configuration NC>” /g <user name>:CCDC;msDS-AuthNPolicy
dsacls "CN=AuthN Silos,CN=AuthN Policy Configuration,CN=Services,<the DN of PRIV Domain’s Configuration NC>” /g <user name>:RPWPRCWD;;msDS-AuthNPolicySilo /i:s
dsacls "CN=AuthN Silos,CN=AuthN Policy Configuration,CN=Services,<the DN of PRIV Domain’s Configuration NC>” /g <user name>:CCDC;msDS-AuthNPolicySilo

Now that I've been using these formats for a few years, there are some things that I've learned that you may find helpful.

First, one of the main reasons I've wanted to use VHDX files is due to their ability to handle the various power outages which seem to be prevalent in my area. I'm going to have to say that having experienced a few power outages since implementing this format change, I've not seen any VHDX file corruption. That's great as far as I'm concerned.

Second, though, is a disadvantage. Running VHDX files on top of ReFS poses some problems. Each system has and maintains its own integrity bit. So in order to use the VHDX format, I had to disable the integrity check on the ReFS structure which housed the VHDX file. Not only that, but also the snapshot location as well as the replica location on the replica server and its corresponding snapshot directory. I want to keep using ReFS since it can do quite a number of things as well as dealing with file integrity as well as being able to repair data corruption.

Third, the ability to upload a VHD file directly into Azure to create a VM based on a legacy application server or even domain controller requires that the file be in VHD format instead of VHDX.

All of these being the case, the reasons for using the VHDX files in my particular case are gone - I do not need the extra size of VHDX files, and the integrity bits of the ReFS serve my reliability function. True, I don't quite get the power failure protection of the VHDX file on ReFS, but with host replication to another server, that works just as well in my opinion in case of power outage corruption. Plus, the ability to upload the VHD files directly into Azure for hosting was a big plus.

Thus, I have taken steps in my home lab to convert all of my VMs to VHD format - or "back" in this case so that if need be, I can move the VHD file up into Azure and create a new VM from the file. I have done this for a few test VMs and it works quite well, both in the classic portal and the new Resource Manager model.

This might be a good decision point criteria for you use:

• Do I need ReFS?
  • Managing VHDX files on ReFS requires advanced configuration of the directories housing the VHDX files.
  • Using VHD format on ReFS provides an easier to manage solution.
• Do I need power outage protection?
  
  • This is a great point in the favor of VHDX files - especially when used on an NTFS partition instead of ReFS.
• Do I intend to use Hyper-V replication?
  
  • Using replication might eliminate the need for the power outage protection afforded by VHDX files.
• Do I foresee a need to ever move the VM up into Azure?
  • Moving the disk file to Azure requires it be converted back to a VHD file. Moving VHDX files is therefore a two step process - convert then upload, which takes quite a bit of time.

Now there are some changes coming with Server 2016, but that has not yet been released so I won't comment on them at this time. Plus I haven't had the chance to work with that yet.

In it, you can find tips & tricks, documentation, scripts and more. Check it out. I know you’ll find it very helpful if you have anything to do with FIM.

But, let me back up a bit.

A while ago, as an exercise in educating myself on Exchange, I began playing around with configuring my own email server at the house so that I could both learn Exchange and have a better place to house my personal email. I created a domain and everything necessary for it and began. At the beginning I learned very quickly about “open relays” back in the Exchange 2000 days, since that was the default setting and somehow my experiment wound up on the open-relay black list.

Well several labs and upgrades later, I was fed up with, well, upgrading and losing power in my lab, frequently causing me to lose the whole server and having to rebuild several times. That was most inconvenient. So, I decided to ditch the local copy of Exchange and move to the Cloud.

Enter Outlook.com. This is great for people who want to use either a predetermined domain name (like the old @live.com or @msn.com even) as well as those who own their own domain, like I do, and want to have a place that won’t melt down with every local power outage. So, off of the old Exchange server I went and using Outlook, I connected to both mailboxes and moved mail by hand from the Exchange mailbox to the Outlook.com mailbox. Once complete, I was free to destroy the old Exchange server, which I did once I was satisfied all the email was in the Cloud.

And it worked.

But…

I had become accustomed to a certain level of email flexibility that the Outlook.com environment didn’t afford me. Even using the linked mailboxes on Outlook.com, I could not manage my multiple email aliases properly. You can set up as many users names as you want on Outlook.com using the custom domains.live.com site and even forward your email to, say, one central mailbox. However, if any of that email is determined to be junk, it stays in the original mailbox and does not forward. That’s just one example of why it was inconvenient. Setting up rules and “not junk” was also more difficult than in regular Exchange.

Enter Office 365. I have been given, through work, an instance of Office 365. I decided to give it a whirl. I have to say I am impressed. I started the activation process, and stepping through the DNS configuration is easy. You can configure it so many ways, but I chose to have Microsoft host my DNS and since I only have a couple of external DNS records, adding one for my personal web sites was easy. Once DNS was configured for my domain, I created my mailbox and connected Outlook. I moved my email up to Office 365 the same way I moved it to Outlook.com, and then I began to use it. I used the web site, I used Outlook, and I like it. I like it a lot. I then used a few of my licenses for my family moving their mail in to the Cloud. Now, we are ALL happy.

With the greater flexibility and the ability to use shared calendaring, shared mailboxes, and PowerShell commands (Yes, I’ve even done this to set up auto-forwarding on a shared mailbox, like what I wanted to do on Outlook.com but couldn’t) I am quite satisfied. It’s fast, it’s solid, and it behaves the way I’m used to email behaving since I’m spoiled on Exchange.

All in all, I am impressed.

Yay, Cloud!

Now, the 2TB drive that failed (mentioned in my last post) as covered with a warranty and I now have it’s replacement. I wanted to add the drive to my new storage space and grow the partition to take advantage of the extra capacity. This, however, is harder than it seems at first. Since the volume built on the storage space is based on a number of factors such as data columns that, once created, cannot be modified, I really needed to create a new volume using all four disks in the storage space. I had intended to simply add the disk and expand the volume, but this cannot be done apparently. I also thought that maybe I could shrink the volume and make a new one using the remainder, moving the data, and repeating the process until all the data was moved. However, it seems that at the present time, you cannot shrink an ReFS volume. I cannot find a link yet to support that, but as I’m unable to do it, I must simply do the brute-force approach: move the data off and rebuild the volume.

I can easily change the size of the pool, but the volume had a fixed number of parity columns that couldn’t be changed. So, the data is now being moved and once it’s done, I’ll create a new volume with more space. That should last me a little while.

Afterwards, I know that the best way to increase my storage would be to simply buy larger drives and replace the smaller ones. If, for example, I replaced the two 1.5TB drives (one at a time, of course, letting the array “service” itself each time) with 3TB drives, I could then likely grow the volume that the partition sits on from 4x1.5TB stripes to 4x2TB stripes (the other two disks are only 2TB). I could replace them as well, and then there would be 4x3TB stripes in total growing the pool and increasing the volume capacity from 4.5TB to 6TB with parity. But, that would assume that in the future, ReFS formatted volumes could be resized.

Let’s hope they can.

[2013-07-25 UPDATE]: So I've done some more experimenting, and my last paragraph is inaccurate. I had a storage space of two 1TB disks and a mirror volume configured on it, taking all the space, with an ReFS formatted partition on the volume. I added two additional drives (thus exhausting the capacity for internal drives on this particular server) and wanted to add these drives to the pool and stretch the volume and partition out to match. Adding the new disks to the pool is easy. Based on my previous writing, I thought it would be impossible to grow the volume out to fit the new pool size, BUT it seems that if you have a matching number of data columns (since I had 2 previously, adding 2 more worked like a champ), you actually can extend your volume easily. I now have grown my volume to encompass 4 disks in a mirrored configuration. Then, it was left to me to grow the partition on the newly larger value to match the complete size. It was formatted ReFS, so I wasn't sure it could be done, but wonderfully, it was possible. I have now doubled my available VM storage capacity and increased my performance without destroying the volume and rebuilding!

Excellent work, Windows team!

In the defense of good, old-fashioned RAID, generally it works very well at what it does. The traditional argument for it (the offloading of processing power to deal with parity to a hardware device) is, in my opinion, not valid these days with multi-core, high-frequency processors. Now, it’s all about feature set and manageability. That’s where Storage Spaces shines.

I had a power failure a while back in my home lab and it revealed a few things to me. Two things happened to two servers. Well, more like one thing happened to each of the servers: the power failure left the data partitions (where I house my Hyper-V VMs) in a state needing to be rebuilt. One machine had a regular Windows Server mirror of two drives on NTFS. The other had a RAID card with a similar set up. On reboot, the Windows RAID array just started rebuilding automatically. The hardware RAID required some input in order for it to begin rebuilding. Then, suddenly, in the middle of the rebuild, there was an “aftershock” power outage again. The first machine came back just fine and picked up where it left off with Windows RAID doing the re-synch just fine. The hardware device, however, was not so lucky. I was able to mount the drive but unable to get it to a state where it would begin rebuilding on the parity/mirror drives. Even though I was able to mount it, several VHD files were left in an unrecoverable state. I was able to recover the data off of the partitions, but not to start the virtual machines. It took over a week to rebuild the machines in question to restore my lab to what it was.

Fast forward to today.

I have fully implemented Windows Server 2012 in my lab on all of my host servers. Suddenly, I have two large hard drive failures, fortunately on separate machines. Now, I also in the mean time have purchased an external hard drive storage array. It presently contains 4 2TB drives configured in a RAID 10 array yielding about 4TB of total storage. It’s cheap, but does what it’s supposed to. However, one of those drives showed a failure. Here is the one problem I have with this setup: I don’t know what KIND of failure. Was it a bad sector? Several bad sectors? Did it just need a re-initialization and re-synch? Uncertain. My only option was to buy another drive to replace this 3 month old one. I did that, put it in the enclosure in place of the old one, turned everything back on and the rebuild happened smoothly and automatically. Not bad, and it behaved as expected.

Now my other host with an internal RAID card had a disk fail in my VM storage partition of 4 1TB drives, also configured as RAID 10 with about 2TB of storage. The problem I had here, is that once I had replaced the drive in the slot (and with this one I know what went bad – the whole controller failed and the drive just “disappeared” from the card. At least this drive was a little older… ) and issued the rebuild command, it went on for several hours and then failed on what looked to be several bad sectors on the surviving mirror of that segment. I could still access the data and run the VMs, but it was now apparent that I should do something different with the underlying architecture since what I was using didn’t work for me.

What I came up with was using the RAID card as a SATA port “extender” and publishing each individual drive as it’s own physical disk with no RAID and configuring them as a Windows Storage Space configured for mirroring.

First, I needed to get the virtual machines off of the main partition. Enter Hyper-V replication. I had already replicated most of the machines to the server with the 4TB partition, so it was a simple matter of doing a planned failover, reversing the direction of replication, removing the replication from those machines and deleting the VM from the affected machine. I did this until they were all moved over and gone. Once gone, I destroyed the array on the card and hosted the drives as individual disks. I created a new Storage Space with all 4 disks using the simple wizard, which then popped up another wizard which stepped me through creating a disk. I chose to have it configured as a “mirror” volume, which amazingly without me having to specify, Windows just knew that I wanted a RAID 10 mirror/stripe set. It then gave me a new wizard to create the logical partition, which I named the same as the old one and formatted it this time with ReFS. This was critical since what I really want is the server to be able to repair damaged sectors instead of just flagging them as unusable and ignoring them. I might even be able to salvage the 2TB drive that “failed” in my enclosure above with these tools and add it to a new data array.

I’m very pleased about the performance of the volume as well and haven’t noticed any downside performance hit due to Windows doing the parity calculations (which is minimal at this point since it’s a stripe/mirror set). Plus, it’s so much more manageable now due to the ability I have with the native tools to manage the disks. The old RAID configuration tool is now only used to mount the physical disks and thus not needed in case of any rebuild.

Next time the power fails, Windows will just know what to do if there’s any array maintenance to be done.

Well, that’s what it seems like.

Blank disks are called “Primordial” in this console. I find it very funny, but appropriate as well. For, rising out of the primordial hard-drive goo, we have a new underlying storage architecture that can really make a difference in your data center – especially if that data center is a broom closet. In other words, this technology is intended to help administrators manage their storage devices regardless of the underlying architecture – and even make it affordable for small companies to have large amounts of redundant storage.

Storage Spaces can take a large array of disks with no SAN switch or anything other than some drive controllers and ports (more is faster) and create “spaces” which can have parity, mirroring, or maximum space. It can help those of us who have a small “data center” (my actual server closet has a few host machines, but randomly assigned storage) truly be in control of how we use our disk space.

Here is a very good story about Storage Spaces while running an old version of the Windows 8 Server preview:

https://blogs.msdn.com/b/b8/archive/2012/01/05/virtualizing-storage-for-scale-resiliency-and-efficiency.aspx

On top of this, this particular machine is going to host some Hyper-V VMs. The new Storage Space that rose from the primordial disk (I just love writing that!) was used to create a new volume that was formatted with the new file system: ReFS. Also known as the Resilient File System, it is the next generation in file systems and is now included with Windows Server 2012.

I am especially interested in this as it is supposed to be able to deal with the large files that are inherent with virtualization, as well as dealing with “old” hard drives and the ability to recover bad sectors on the fly.

This is an excellent explanation of the new file system:

https://blogs.msdn.com/b/b8/archive/2012/01/16/building-the-next-generation-file-system-for-windows-refs.aspx

On top of THIS, I’m going to convert my virtual machine files (VHDs) to the new VHDX format, which will make dealing with unexpected power outages much easier – I needed that a few weeks ago!

Here is some more detail about the new format:

https://technet.microsoft.com/en-us/library/hh831446.aspx

Now, I must get back to playing with (learning) the new stuff.

https://windowsteamblog.com/windows/b/bloggingwindows/archive/2012/08/01/windows-8-has-reached-the-rtm-milestone.aspx

This is exciting news, of course. But, I haven’t used 8 much yet. I don’t have a touch capable device to take full advantage of the new style interface. That will change, of course. I’m definitely going to get on the wait list for the new Microsoft Surface when it comes out (probably the “Pro” version).

While it is somewhat stressful to learn a new interface, I think that after the initial growing pains that users will have, this will be a much better experience than they’ve had before – especially those using touch devices.

I now look forward to the new release of Windows Server 2012 and its exciting new capabilities, especially in the virtualization space where we STOMP the competition. No longer behind, we are now the technology leader.

Again.

UPDATE: Windows Server 2012 is now RTM: https://blogs.technet.com/b/windowsserver/archive/2012/08/01/windows-server-2012-released-to-manufacturing.aspx