Windows Server storage: iSCSI, MPIO and Storage Spaces

Servers need disks that are bigger, faster and more reliable than the ones inside them. Windows Server storage covers the tools Windows gives you for that: iSCSI to share disks over the network, MPIO for more than one path, and Storage Spaces to combine disks with mirroring.

In this lesson you’ll build an iSCSI target on SRV01, connect a new server, NODE1, to it over two networks with MPIO, create a mirrored Storage Spaces disk from three small disks, and survive a disk failure. You’ll also meet S2D, Storage Replica and SMB over QUIC.

TimeYou needBy the end you can
About 2 hoursDC01 and SRV01, plus a new Server Core VM NODE1 (2 GB RAM, 40 GB disk); NODE1 is reused in Lesson 37Configure an iSCSI target and initiator, set up MPIO, create Storage Spaces pools and mirrored disks, handle disk failures, and choose between S2D, Storage Replica and SMB options

What it is, in one line

Windows Server storage is the set of built-in features that provide, pool and protect disks for servers, from iSCSI and MPIO to Storage Spaces, Storage Spaces Direct and Storage Replica.

In Simple Words

Water tanks and pipes

A building gets water from a big tank on the roof instead of a bucket in each flat. Pipes carry it down, and good buildings have two pipes, so one leak doesn’t leave anyone dry.

iSCSI is the pipe that brings a disk from a storage server to another server. MPIO is the second pipe. Storage Spaces is like joining several small tanks into one big one, with a copy of the water in two of them, so one cracked tank loses nothing.

Thin provisioning is promising every flat a full tank while the real tanks are smaller. Fine, until everyone fills their bath at once.

Engineer's View

iSCSI, MPIO, Storage Spaces and friends

iSCSI carries SCSI commands over TCP 3260. A target (here the iSCSI Target Server role, using VHDX files as LUNs) presents disks; an initiator connects to them. Targets allow initiators by IQN, IP or DNS name, and can require CHAP.

MPIO (Multipath I/O) combines several paths to the same LUN into one disk, with failover or round-robin load balancing. Without MPIO, two sessions to one LUN would show the disk twice and risk corruption.

Storage Spaces pools physical disks and creates virtual disks with simple (no protection), mirror (two or three copies) or parity resiliency, fixed or thin provisioned. Storage Spaces Direct (S2D) does the same across the local disks of 2 to 16 clustered servers, the base of hyperconverged setups.

Also good to know: Storage Replica replicates volumes block by block, synchronously or asynchronously, between servers or clusters (Standard edition is limited to one partnership and a 2 TB volume). SMB over QUIC lets clients reach file shares securely over the internet on UDP 443 without a VPN, and Server 2025 offers it in Standard and Datacenter.

How it works, step by step

How NODE1 reaches its disk on SRV01 over two paths:

Windows Server storage: iSCSI over two paths with MPIO from NODE1 to SRV01

NODE1 sees one disk, even though two sessions carry its traffic. If one network fails, MPIO moves I/O to the other path and the disk stays online.

The storage you’ll build:

Windows Server storage lab: iSCSI target, MPIO, Storage Spaces mirror and other features
  1. Networks: a second NAT network, LabNet2 (10.0.1.0/24), for the second storage path.
  2. NODE1: a new Server Core member server with two NICs.
  3. iSCSI: a 10 GB LUN on SRV01, allowed only for NODE1, reached over both networks with MPIO.
  4. Storage Spaces: three 4 GB disks on SRV01 pooled into a two-way mirror.

Hands-on Lab: Windows Server storage with iSCSI and Storage Spaces

Start DC01. Shut down SRV01 for now. Work on your laptop first, then on SRV01 and NODE1 in PowerShell as administrator.

1Add a second network and disks

On your laptop, create LabNet2, give SRV01 a second NIC and three small disks:

VBoxManage natnetwork add --netname LabNet2 --network "10.0.1.0/24" --enable --dhcp off
VBoxManage modifyvm SRV01 --nic2 natnetwork --nat-network2 LabNet2
VBoxManage storagectl SRV01 --name SATA --portcount 8
3..5 | ForEach-Object {
    VBoxManage createmedium disk --filename "C:\Lab\VMs\SRV01\SRV01-pool$_.vdi" --size 4096
    VBoxManage storageattach SRV01 --storagectl SATA --port $_ --device 0 --type hdd --medium "C:\Lab\VMs\SRV01\SRV01-pool$_.vdi"
}
VBoxManage startvm SRV01

Create NODE1 with two NICs, then install Server Core on it as in Lesson 33:

VBoxManage createvm --name NODE1 --ostype Windows2025_64 --basefolder C:\Lab\VMs --register --default
VBoxManage modifyvm NODE1 --memory 2048 --cpus 2 --nic1 natnetwork --nat-network1 LabNet --nic2 natnetwork --nat-network2 LabNet2
VBoxManage createmedium disk --filename C:\Lab\VMs\NODE1\NODE1.vdi --size 40960
VBoxManage storageattach NODE1 --storagectl SATA --port 0 --device 0 --type hdd --medium C:\Lab\VMs\NODE1\NODE1.vdi
VBoxManage storageattach NODE1 --storagectl SATA --port 1 --device 0 --type dvddrive --medium C:\Lab\ISO\server2025.iso
VBoxManage startvm NODE1

On SRV01, give the new NIC an address:

Get-NetAdapter | Select-Object Name, InterfaceDescription, Status
New-NetIPAddress -InterfaceAlias 'Ethernet 2' -IPAddress 10.0.1.20 -PrefixLength 24 | Out-Null

On NODE1 (after installing Server Core and choosing 15 in sconfig):

New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 10.0.0.41 -PrefixLength 24 -DefaultGateway 10.0.0.1 | Out-Null
New-NetIPAddress -InterfaceAlias 'Ethernet 2' -IPAddress 10.0.1.41 -PrefixLength 24 | Out-Null
Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 10.0.0.10, 10.0.0.11
Add-Computer -DomainName saatlab.internal -NewName NODE1 -OUPath 'OU=Servers,OU=SAATLAB,DC=saatlab,DC=internal' -Credential SAATLAB\adm.rahul -Restart

The storage network has no gateway or DNS server on purpose: it carries only iSCSI traffic between the two servers.

✅ Checkpoint: SRV01 has 10.0.1.20 on Ethernet 2, and NODE1 is joined with 10.0.0.41 and 10.0.1.41.

2Build the iSCSI target on SRV01

On SRV01:

Install-WindowsFeature FS-iSCSITarget-Server -IncludeManagementTools | Out-Null
New-Item -ItemType Directory D:\iSCSI -Force | Out-Null
New-IscsiVirtualDisk -Path D:\iSCSI\Node1-Data.vhdx -SizeBytes 10GB | Out-Null
New-IscsiServerTarget -TargetName NodeTarget -InitiatorIds 'IQN:iqn.1991-05.com.microsoft:node1.saatlab.internal' | Out-Null
Add-IscsiVirtualDiskTargetMapping -TargetName NodeTarget -Path D:\iSCSI\Node1-Data.vhdx
Get-IscsiServerTarget | Select-Object TargetName, TargetIqn, @{n='Initiators';e={$_.InitiatorIds -join ', '}}

You should see something like this:

TargetName TargetIqn                                         Initiators
---------- ---------                                         ----------
NodeTarget iqn.1991-05.com.microsoft:srv01-nodetarget-target IQN:iqn.1991-05.com.microsoft:node1.saatlab.internal

The LUN is just a VHDX file on D:. Only NODE1’s IQN is allowed; Windows initiators use iqn.1991-05.com.microsoft: plus the computer’s FQDN by default.

✅ Checkpoint: NodeTarget exists, maps Node1-Data.vhdx, and allows only NODE1’s IQN.

3Connect NODE1 over two paths with MPIO

On NODE1, start the initiator, install MPIO and let it claim iSCSI disks:

Set-Service MSiSCSI -StartupType Automatic; Start-Service MSiSCSI
(Get-InitiatorPort).NodeAddress
Install-WindowsFeature Multipath-IO | Out-Null
Enable-MSDSMAutomaticClaim -BusType iSCSI
Restart-Computer

After the restart, connect through both networks:

New-IscsiTargetPortal -TargetPortalAddress 10.0.0.20 -InitiatorPortalAddress 10.0.0.41 | Out-Null
New-IscsiTargetPortal -TargetPortalAddress 10.0.1.20 -InitiatorPortalAddress 10.0.1.41 | Out-Null
$iqn = (Get-IscsiTarget).NodeAddress
Connect-IscsiTarget -NodeAddress $iqn -TargetPortalAddress 10.0.0.20 -InitiatorPortalAddress 10.0.0.41 -IsPersistent $true -IsMultipathEnabled $true | Out-Null
Connect-IscsiTarget -NodeAddress $iqn -TargetPortalAddress 10.0.1.20 -InitiatorPortalAddress 10.0.1.41 -IsPersistent $true -IsMultipathEnabled $true | Out-Null
Get-IscsiSession | Select-Object InitiatorPortalAddress, TargetNodeAddress, IsConnected
mpclaim -s -d

You should see something like this:

InitiatorPortalAddress TargetNodeAddress                                    IsConnected
---------------------- -----------------                                    -----------
10.0.0.41              iqn.1991-05.com.microsoft:srv01-nodetarget-target           True
10.0.1.41              iqn.1991-05.com.microsoft:srv01-nodetarget-target           True

For more information about a particular disk, use 'mpclaim -s -d #' where # is the MPIO disk number.

MPIO Disk    System Disk  LB Policy    DSM Name
-------------------------------------------------------------------------------
MPIO Disk0   Disk 1       RR           Microsoft DSM

Bring the disk online and format it:

Get-Disk | Where-Object BusType -eq 'iSCSI' | Select-Object Number, Size, PartitionStyle
Get-Disk -Number 1 | Initialize-Disk -PartitionStyle GPT -PassThru | New-Partition -DriveLetter S -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel Shared -Confirm:$false | Out-Null

Two sessions, one disk: MPIO merged the paths, with round-robin (RR) load balancing. Without MPIO, Disk 1 and Disk 2 would appear as two separate disks pointing at the same LUN, a recipe for corruption.

✅ Checkpoint: NODE1 has two connected sessions, mpclaim shows one MPIO disk, and drive S: is formatted.

Windows Server storage lab: two iSCSI sessions and one MPIO disk on NODE1
Two connected sessions, but MPIO presents a single disk to NODE1.

4Create a mirrored Storage Spaces disk on SRV01

On SRV01:

Get-PhysicalDisk -CanPool $true | Select-Object FriendlyName, Size, MediaType
New-StoragePool -FriendlyName Pool1 -StorageSubSystemFriendlyName 'Windows Storage*' -PhysicalDisks (Get-PhysicalDisk -CanPool $true) | Out-Null
New-VirtualDisk -StoragePoolFriendlyName Pool1 -FriendlyName Mirror1 -ResiliencySettingName Mirror -NumberOfDataCopies 2 -Size 4GB -ProvisioningType Fixed |
    Initialize-Disk -PartitionStyle GPT -PassThru | New-Partition -DriveLetter F -UseMaximumSize | Format-Volume -FileSystem ReFS -NewFileSystemLabel Mirror1 -Confirm:$false | Out-Null
Get-VirtualDisk | Select-Object FriendlyName, ResiliencySettingName, NumberOfDataCopies, HealthStatus, OperationalStatus

You should see something like this:

FriendlyName            Size MediaType
------------            ---- ---------
ATA VBOX HARDDISK 4294967296 Unspecified
ATA VBOX HARDDISK 4294967296 Unspecified
ATA VBOX HARDDISK 4294967296 Unspecified

FriendlyName ResiliencySettingName NumberOfDataCopies HealthStatus OperationalStatus
------------ --------------------- ------------------ ------------ -----------------
Mirror1      Mirror                                 2 Healthy      OK

Every block written to F: is stored on two of the three disks. ReFS adds checksums, so Storage Spaces can repair a bad copy from the good one. Copy a few files to F: now; you’ll check they survive a failed disk.

✅ Checkpoint: Pool1 contains three disks and Mirror1 (F:) is Healthy with two data copies.

Break It, Then Fix It

Two storage problems: a target that hides itself from the wrong initiator, and a disk that dies under a mirror.

1Break it: the target only accepts a different initiator

On SRV01, change the allowed initiator to a typo:

Set-IscsiServerTarget -TargetName NodeTarget -InitiatorIds 'IQN:iqn.1991-05.com.microsoft:node01.saatlab.internal'

On NODE1, disconnect and try to discover the target again:

Get-IscsiSession | Unregister-IscsiSession -ErrorAction SilentlyContinue
Get-IscsiTarget | Disconnect-IscsiTarget -Confirm:$false -ErrorAction SilentlyContinue
Update-IscsiTargetPortal -TargetPortalAddress 10.0.0.20 | Out-Null
Get-IscsiTarget

You’ll see this, which is nothing at all:

(no output)

The Windows iSCSI target only reveals targets an initiator is allowed to use, so NODE1 sees an empty list instead of an error. If S: belonged to a cluster or a database, it would now be gone. A one-letter typo in an IQN is a classic cause.

Fix it: allow NODE1’s real IQN and reconnect both paths:

Set-IscsiServerTarget -TargetName NodeTarget -InitiatorIds 'IQN:iqn.1991-05.com.microsoft:node1.saatlab.internal'   # on SRV01
Update-IscsiTargetPortal -TargetPortalAddress 10.0.0.20 | Out-Null                                                          # on NODE1
$iqn = (Get-IscsiTarget).NodeAddress
Connect-IscsiTarget -NodeAddress $iqn -TargetPortalAddress 10.0.0.20 -InitiatorPortalAddress 10.0.0.41 -IsPersistent $true -IsMultipathEnabled $true | Out-Null
Connect-IscsiTarget -NodeAddress $iqn -TargetPortalAddress 10.0.1.20 -InitiatorPortalAddress 10.0.1.41 -IsPersistent $true -IsMultipathEnabled $true | Out-Null

✅ Checkpoint: NODE1 saw no targets with the wrong IQN allowed, and reconnects both paths after the fix.

2Break it: a failed disk under the mirror

Shut down SRV01. On your laptop, detach one pool disk, then start SRV01:

VBoxManage storageattach SRV01 --storagectl SATA --port 4 --device 0 --medium none
VBoxManage startvm SRV01

On SRV01:

Get-VirtualDisk Mirror1 | Select-Object FriendlyName, HealthStatus, OperationalStatus
Get-PhysicalDisk | Where-Object OperationalStatus -ne 'OK' | Select-Object FriendlyName, OperationalStatus
Get-ChildItem F:\ | Select-Object -First 3 Name

You’ll see something like this:

FriendlyName HealthStatus OperationalStatus
------------ ------------ -----------------
Mirror1      Warning      Degraded

FriendlyName      OperationalStatus
------------      -----------------
ATA VBOX HARDDISK Lost Communication

Name
----
...your files are still here...

The mirror is Degraded but your data is still there, because every block had a second copy. The pool now has no spare copy for some data, so a second failure would lose it. Replace the disk quickly.

Fix it: add a new disk, retire the lost one and repair:

# on your laptop, with SRV01 shut down:
VBoxManage createmedium disk --filename C:\Lab\VMs\SRV01\SRV01-pool6.vdi --size 4096
VBoxManage storageattach SRV01 --storagectl SATA --port 6 --device 0 --type hdd --medium C:\Lab\VMs\SRV01\SRV01-pool6.vdi
# on SRV01, after starting it:
Add-PhysicalDisk -StoragePoolFriendlyName Pool1 -PhysicalDisks (Get-PhysicalDisk -CanPool $true)
$lost = Get-PhysicalDisk | Where-Object OperationalStatus -eq 'Lost Communication'
$lost | Set-PhysicalDisk -Usage Retired
Repair-VirtualDisk -FriendlyName Mirror1
Remove-PhysicalDisk -StoragePoolFriendlyName Pool1 -PhysicalDisks $lost -Confirm:$false
Get-VirtualDisk Mirror1 | Select-Object HealthStatus, OperationalStatus

You should see this when the repair finishes:

HealthStatus OperationalStatus
------------ -----------------
Healthy      OK

✅ Checkpoint: Mirror1 went Degraded with the disk missing, the files stayed readable, and it’s Healthy again after the repair.

Windows Server storage lab: mirrored virtual disk degraded after a disk is lost
One disk lost: the mirror is Degraded, but every file is still readable.

This happened at work

The thin pool that ran dry

A team built a Storage Spaces pool of 20 TB and created thin-provisioned virtual disks totalling 45 TB for their Hyper-V hosts. Thin disks only use what’s written, and for two years usage stayed under 12 TB, so nobody worried.

Then a new backup product started writing full copies of every VM to one of those disks. Within a weekend the pool filled up. Storage Spaces protected the data by taking the full virtual disks offline, and every VM stored on them paused.

The team freed space by deleting the new backup copies, added disks to the pool, and brought the virtual disks back online. It took most of Monday.

The fix: overcommitment limited to 1.5 times the real capacity, alerts when the pool passes 70% used, and backup targets moved to separate fixed storage.

The lesson: thin provisioning lets you promise more than you have. Watch real usage, and alert long before it runs out.

Common mistakes and troubleshooting

Mistake or symptomWhat happensWhat to do instead
iSCSI target not visible to an initiatorThe IQN, IP or name isn’t on the allowed listCheck InitiatorIds on the target; copy the IQN exactly
Two sessions without MPIOThe same LUN appears twice; corruption riskInstall MPIO and claim iSCSI before connecting the second path
iSCSI on the user networkStorage traffic competes with users; less secureDedicated storage networks, no gateway
No CHAP on iSCSIAny allowed-looking initiator can connectUse CHAP or mutual CHAP in production
Ignoring a Degraded virtual diskA second failure loses dataReplace the failed disk and repair right away
Thin pools without monitoringThe pool fills and virtual disks go offlineAlerts on pool usage; limit overcommitment
Simple (no resiliency) spaces for important dataOne disk failure loses everythingMirror or parity
Storage Replica as backupCorruption and deletions replicateBackups as well (Lesson 38)
Exposing SMB 445 to the internetAttacks on file serversSMB over QUIC or VPN for remote access

Interview questions

Click a question to open it. Under each one you’ll find what the interviewer is really looking for, and one good way to answer.

Fresher level

1. What is iSCSI?

What they’re really checking: Do you know the basics?

How you could answer: A protocol that carries SCSI disk commands over TCP/IP (port 3260), letting servers use disks from a storage server over the network.

2. What do target and initiator mean?

What they’re really checking: Do you know the roles?

How you could answer: The target presents the disks (LUNs); the initiator is the server that connects to them and uses them.

3. What is Storage Spaces?

What they’re really checking: Do you know Windows storage pooling?

How you could answer: A feature that pools physical disks and creates virtual disks with simple, mirror or parity resiliency, fixed or thin provisioned.

2–5 years experience

4. Why do you need MPIO with two iSCSI paths?

What they’re really checking: Do you understand multipath?

How you could answer: Without it, each path shows the LUN as a separate disk. MPIO merges the paths into one disk and handles failover and load balancing.

5. A mirrored virtual disk shows Degraded. What do you do?

What they’re really checking: Have you handled disk failures?

How you could answer: Find the failed physical disk, add a replacement to the pool, retire the failed one, run Repair-VirtualDisk, remove the old disk, and check HealthStatus returns to Healthy.

6. What is the difference between Storage Spaces and Storage Spaces Direct?

What they’re really checking: Do you know the variants?

How you could answer: Storage Spaces pools disks attached to one server (or shared JBODs); S2D pools local disks across clustered servers over the network for hyperconverged storage.

Senior level

7. Design storage for a two-node Hyper-V cluster in a small office.

What they’re really checking: Do you think about cost and resilience?

How you could answer: Either a two-node S2D cluster with a witness, mirrored volumes and RDMA if possible, or shared iSCSI storage with redundant paths and MPIO. Size for growth, monitor capacity, and back up separately.

8. When would you use Storage Replica?

What they’re really checking: Do you know DR options?

How you could answer: To replicate volumes block-level between servers or clusters, synchronously for zero data loss across short distances, or asynchronously over longer links, for disaster recovery or stretched clusters.

9. How would you give remote users access to file shares without a VPN?

What they’re really checking: Are you current?

How you could answer: SMB over QUIC on Windows Server 2025, using TLS 1.3 over UDP 443 with a trusted certificate and client access control, instead of exposing SMB 445.

Quick quiz

Q1. Which port does iSCSI use?

  1. 445
  2. 3260
  3. 3389
Show answer

B — TCP 3260.

Q2. What does MPIO do with two paths to one LUN?

  1. Shows two disks
  2. Combines them into one disk with failover
  3. Disables one path
Show answer

B — That’s why it must be in place first.

Q3. Why did NODE1 see no targets in Break It step 1?

  1. SRV01 was off
  2. Its IQN wasn’t on the allowed list
  3. MPIO was missing
Show answer

B — The target hides itself from other initiators.

Q4. What happened to Mirror1 when a disk was removed?

  1. All data lost
  2. Degraded, but data still readable
  3. Nothing
Show answer

B — Two copies kept the data safe.

Q5. In the work story, why did VMs pause?

  1. A virus
  2. A thin-provisioned pool filled up
  3. A failed NIC
Show answer

B — Monitor pool usage.

Quick recap

  • Windows Server storage gives you iSCSI, MPIO, Storage Spaces, S2D and Storage Replica.
  • iSCSI targets allow initiators by IQN; the wrong IQN hides the target.
  • Install MPIO before connecting a second path, so one LUN stays one disk.
  • Mirror or parity Storage Spaces survive disk failures; repair degraded disks fast.
  • Watch thin-provisioned pools closely.
  • SMB over QUIC replaces VPNs for remote file access on Server 2025.

Next lesson

Lesson 37: Failover clustering → You’ll add NODE2, validate and build a two-node failover cluster on the iSCSI storage, configure a witness, make a file server highly available and test failover.

Further reading: Windows Server storage

Want to go deeper into Windows Server storage? Microsoft’s iSCSI Target Server overview explains the target role, and the Manage Storage and File Services training path covers Storage Spaces, S2D and Storage Replica. You can also see the full plan for this course on the Windows Server Administration course page.

Scroll to Top