Section 3.5. The File Server Resource Manager

3.5. The File Server Resource Manager

Windows Server 2003 R2 includes the File Server Resource Manager, an integrated console that contains various tools and reporting functions so that you can determine, control, and administer the amount and kind of data stored on your file servers. FSRM provides a single and convenient place for you to configure quotas on folders and volumes, screen for unacceptable types of files, and generate comprehensive reports on exactly where your disk space is going.

Figure 3-13. Entering a new disk quota entry

To install the FSRM , you'll need to install the R2 components on the accompanying product disc. Then, from Control Panel, use the Add/Remove Programs applet, choose Windows Components, and under Management and Monitoring Tools, choose the File Server Resource Manager. Click Next and then Finish, and Windows will install the tool for you.

You can only manage resources on servers with the FSRM installed, which means that you're limited to servers running R2.

To launch the FSRM, simply choose it from the Administrative Tools menu. The default console looks like Figure 3-14.

Figure 3-14. The File Server Resource Manager console

3.5.1. Configuring the FSRM

The first step in using the FSRM is configuring some options that will be used by the console. In the Actions pane, click the Configure Options link, and you'll see a screen like Figure 3-15.

Figure 3-15. Configuring FSRM options

The FSRM is designed to send email alerts and reports via email; on the Email Notifications tab, enter the outgoing SMTP server (either through an installed SMTP service on the local machine or another mail server provided either by your organization or your ISP), and the To and

Figure 3-16 shows the Storage Reports tab.

Figure 3-16. The Storage Reports tab

On this tab, you can specify your preferences for each report that can be generated by the FSRM. For example, if you highlight the File Screening Audit report and click the Edit Parameters button, you'll be able to select which users are included in the report. To take a look at all of the parameters for the reports, click the Review Reports button. The defaults work pretty well here, but as you'll see as we dig further into the FSRM, you may want to alter these slightly to customize the reports for your environment.

Figure 3-17 shows the Report Locations tab .

On this screen, choose where to save each type of report that the FSRM can generate. You can store them either on the local drive or on a network volume.

Figure 3-18 shows the File Screen Audit tab .

Figure 3-17. The Report Locations tab

Figure 3-18. The File Screen Audit tab

Here, you can tell the FSRM whether or not to log screening activity in the auditing database. If you don't intend to use file screening reports, then clearing this checkbox will give you a slight performance improvement since the extra logging isn't required.

3.5.2. Configuring Quotas with the FSRM

It's more straightforward to configure quotas using the FSRM, as the interface is cleaner and the rules a bit more flexible. Using the FSRM, you can create quotas for specific folders or volumes and configure the notifications generated by Windows when those quotas are exceeded. I've covered that scenario in the previous section in this chapter on quotas. But FSRM takes it a couple of steps further by allowing you to customize "auto quotas" that automatically apply to both existing and future folders, and define quota templates that can be used anywhere in an organization's IT infrastructure.

Let's start off with simply applying a quota to a single folder. To do so, within the FSRM, double-click the Quota Management item in the middle pane, and then double-click on Quotas. From the right pane, click the Create Quota link. You'll see a screen much like Figure 3-19.

Figure 3-19. The Create Quota screen

Enter the path to the folder in the top box, or click Browse to find it graphically. Select Create quota on path, and then choose either a preexisting template, which offers some preconfigured limits, or choose the Define custom quota properties option and click the Custom Properties button. If you select the latter option, you'll be prompted with the Quota Properties screen, where you can enter the space limit, define whether the quota is hard or soft, and add different notification thresholds. Click OK when you're done, and the summary window on the Create Quota screen will show your selections. If all looks well, then click Create, and the quota placement is complete.

That process works well for one-off quota needs, but suppose that you want to centralize quota management across all folders and volumes. The best way to do that is to use the quota template facility with FSRM. By applying quota templates to folders, you can simply make one change to the template's configuration, and all folders to which that template has been applied will reflect the change. Think of it as having a "group" of quotas to make administration simpler.

To make a quota template, double-click the Quota Management item in the middle pane of the FSRM and then double-click on Quota Templates. From the right pane, click the Create Quota Template link. You'll see a screen much like Figure 3-20.

In the top drop-down box, you can select an existing template and copy the settings from it into the new template you're creating, which is a great timesaver when you need to make just a few minor changes. Otherwise, enter the template name, a friendly name if you wish, and then select the space limit and the severity of the limit. You can also configure the specific thresholds for notification when users hit a quota. Click Add to define a new notification; you will see the Add Threshold screen appear, as shown in Figure 3-21.

Note the first box, called "Generate notifications when usage reaches (%)." In this box, specify the actual threshold at which the action you're going to define on these screens will take place. Now, the most common notification administrators send is an email message, both to the user who exceeded the limit and to the administrator himself. On the E-mail Message tab, you can check to whom to send such messages, and also change the text of the message. On the Event Log tab, you can customize the text of a warning event that will be sent to the Event Log, and on the Command tab you can define a script or program that will be run when a user exceeds the threshold you set. Finally, on the Report tab, you can tell the FSRM to automatically generate a storage report (covered a bit later in this section) when the quota is exceeded. Each of these tabs has a straightforward interface. Click OK when you've finished, and then OK again to finish creating the template.

Once the template is in place, you can use it to apply quotas to specific folders. Then when you need to increase the quota on all folders using a given template, for example, you can simply edit the space limit field within the template definition, and all folders will then reflect the new limit.

Figure 3-20. The Create Quota Template screen

3.5.3. Screening for File Types

Another useful capability of the FSRM is the ability to screen for certain file types and prevent them from being stored on your file servers. If your storage resources are limited and space is at a premium, there probably isn't a legitimate reason to store tons of MP3 and WMA files within your user's home directories. Even if you have plenty of "first line" space, these files are probably part of your backup set, and if they are you're likely needlessly wasting precious backup media storing the latest Mariah Carey CD in an off-site location in case disaster strikes. File screening can help keep this type of waste to a minimum.

Figure 3-21. The Add Threshold screen

FSRM is pretty flexible. For example, it allows for the following scenarios:

• You can prevent all music files from being stored on a server, except for those files with specific file names (your marketing theme, or a media file relating to an upcoming commercial) or files placed on the server by a certain person or group within your company.

• You can get a pre-warning emailed to you whenever a suspicious script or EXE file is stored on a shared volume, thus alerting you to a possible security breach or virus infestation.

• You can write notifications of screening alerts to the event log, so if you have an event log consolidation program running on all of your servers, you can see the screening reports directly from them.

Like quotas, the file-screening feature offers the capability to create file groups, which are simply collections of file extensions with like characteristics (for example, a media file group would contain MP3, WMA, OGG, and others) that can be used to specify included or excluded files in a particular screen, and file screening templates, which are ready-to-use rules for screening different types of files. Again, by using templates extensively, you can make changes to all servers using file screening with just one or two modifications to the template.

3.5.3.1. Defining a File Group

You can define a file group within the FSRM. To do so:

1. In File Screen Management, right-click File Groups, and then click Create file group.

2. Type a name for the file group.

3. In the Files to include box, enter a file name pattern (such as *.exe) for files you'd like to include in the group, and click Add. In the Files to exclude box, enter a pattern for files you'd like to exclude.

4. Click OK.

3.5.3.2. Creating a File Screen

To create a single file screen:

1. In File Screening Management, right-click File Screens, and then click Create file screen.

2. The Create File Screen box appears. Figure 3-22 shows this. Enter the path to which the file screen will apply (this includes subfolders of the specified folder by default).

3. Select the Define custom file screen properties option, and then click Custom Properties.

4. The File Screen Properties screen appears. You can elect to use an existing template, or create a custom screen.

5. Under Screening type, select whether to apply active screening, which prevents users from saving files that are members of blocked file groups and generates notifications of such actions, or passive screening, which sends notifications but does not prevent users from saving blocked files.

6. Under File Groups, select each file group that you want to include in the screen. To select the checkbox for the file group, click the file group label twice.

7. To configure email notifications for the file screen, set the following options on the E-mail Message tab:

   • Select Send email to the following administrators in order to notify said persons when an attempt is made to save an unauthorized file, and enter the administrative accounts that will receive notifications. To enter multiple accounts, separate them with semi-colons.

   • Select Send email to the user who attempted to save an unauthorized file if you want to alert the user that he or she almost breached policy.

   • You can also edit the subject line and message body. To insert additional variables in the text, click Insert Variable and then choose the appropriate variable as listed on the screen.

8. On the Event Log tab, select the Send warning to event log checkbox, and edit the default log entry. Both of these tasks are optional. In addition, on the Command tab, you can tell Windows to run a program or script when a violation occurs, and on the Report tab, you can elect to automatically generate a report upon a violation.

9. Click Create to save the file screen.

   Figure 3-22. The Create File Screen dialog box

   

Note that when you're creating a "one-off" file screen, you have the option to save it as a file screen template, meaning that (a) it can be reused later if you need to apply the same settings to a different target and (b) FSRM remembers the link between the target of your one-off screen and the newly created templatein essence, it creates the template and then applies the screen, so you get the advantages of template use.

3.5.3.3. Creating an exception to a screen

A file screen exception essentially overrides any screening that would otherwise apply to a folder and its subfoldersit basically blocks rules derived from a parent folder. You can't, however, apply an exception to a folder that already has a file screen applied: you need to either apply the exception to a subfolder or make changes to the existing screen.

To create an exception to a screen:

1. In File Screening Management, right-click File Screens, and then click Create file screen exception.

2. This opens the Create File Screen Exception dialog box. Enter the path to which the exception will apply.

3. Under File groups, select each file group that you want to include in the exception.

4. Click OK.

3.5.4. Generating Storage Reports

The FSRM includes a great facility to get a picture of exactly how your storage is behaving. You can look at trends in how your disk space is being occupied and see alerts and notifications of users who are going over quota or attempting to save files that are in violation of your file screening policies. You can schedule these reports to be generated automatically on a time rotation that you specify, or you can create ad hoc reports as you see fit.

The following reports are available out of the box:

• Duplicate files

• File screening audit

• Files by file group

• Files by owner

• Large files

• Least recently accessed files

• Most recently accessed files

• Quota usage

To generate an ad hoc report:

1. Right-click the Scheduled Report Tasks node, and click Generate reports now.

2. The Storage Reports Task Properties dialog box appears as shown in Figure 3-23. Add each volume or folder that you want to report on to the Scope box, and in Report data, select and format each report that you want to include. To edit the parameters of any particular report, highlight the report label and click the Edit Parameters button. When you finish editing the parameters, click OK.

3. Back on the Storage Reports Task Properties screen, select each file format that you want to save the report in.

4. The Delivery tab allows you to elect to have the report emailed to administrators once it has been generated. To enable this, check the E-mail report to the following administrators box and then enter each email address that you want the report delivered to. To enter multiple accounts, separate each with semicolons.

5. Click OK when you're finished, and then choose whether to open the reports when they're finished or to look at them later.

Figure 3-23. The Storage Reports Task Properties screen

You can also schedule reports to be created, which allows you to monitor your storage resources on a regular schedule. To create a scheduled report:

1. Right-click the Scheduled Report Tasks node, and click Schedule a new report task.

2. Follow steps two through four above to define the properties of the report.

3. Click the Schedule tab, and then click the New button to define a schedule. This is shown in Figure 3-24.

4. Select the interval at which to generate the report (daily, weekly, monthly, and one-time reports are supported).

5. The options below the interval box morph themselves depending on your selected interval. Enter this information as necessary.

6. Enter the time of day to generate the report under Start time.

7. Click OK to save the schedule.

8. Click OK to save the task.

   Figure 3-24. Creating a scheduled report task