> Being able to keep several 10GB++ VHD file off of your SBS box has lots of
> attractive and obvious benefits. Despite my best efforts I can't get this
> to
> work. I have learned how to edit AD using the adsiedit MMC snap-in though
> so
> maybe it isn't all bad.
>
> The topology is VS2005R2 is running and installed fully on a Win2k3
> (SBS2k3
> Prem) machine. A host in the domain, WinXPSP2, is the target destination
> for
> storage of VHD files. This is a UNC/"constrained delegations" issue.
> --------------------------------------------------------------------------------
> Having reviewed the documentation and reread the instructions, having
> implemented all recommended accommodations, I have been unable to produce
> a
> successful UNC path to a share on which VHD files sit.
>
> The host OS is Windows Server 2003 (Small Business Server 2003 Prem). ISA
> 2004 is running; however, there should be no filter affecting the internal
> networking as I understand it (not to say that there may be more to this
> that
> is yet discovered). The UNC path works and can open and be written to
> through ordinary browsing methods. The Share permissions and NTFS
> security
> are now open full and wide to Everyone to eliminate those issues entirely
> (for the time being and later to be locked down). The remote storage is
> located on a WinXP Pro SP2 (fully patched) machine that is a member of the
> SBS domain. The standard SBS GPO's dictate the configuration of the XP
> firewall.
>
> Initially I installed Virtual Server 2005 following along the prompts to
> get
> a feel for how it would be configured by default. Later realizing that
> constrained delegation (hereafter called "CD") needed to be implemented, I
> followed the instructions to "uninstall" and then reinstall the program
> but
> this time selecting the designated choices for implementing CD.
> Afterwords
> the Virtual Server service property sheet shows a Log On credential of the
> Network Service account. The Virtual Server IIS application pool property
> sheet show the identity as "predefined" and "Local System"; this would
> seem
> to be the validation of the instructions for CD that the Administration
> Website must "always run as the Local System account". I am not sure if
> that
> is the proper way to validate that condition but it is my best guess.
> Additionally the cifs service change was added to allow for the Virtual
> Server machine to delegate credentials to the target resource file storage
> WinXP machine. The domain functional level has been raised to the
> instructed
> Windows Server 2003 level. SPN changes have been implemented following
> advanced instructions using both the SETSPN tool as well as the
> adsiedit.msc
> MMC tool.
>
> The remote path (\\dmw-s1\vsfiles$) is not recognize is the VS
> administration website GUI. A red text message appears above the path
> entry
> form reading "The search path settings could not be saved. The item
> "\\dmw-s1\vsfiles$" cannot be used because you do not have sufficient
> access
> rights."
>
> Perhaps there is some oversight on my part but I haven't found it though
> I've looked high and low and retraced my steps several times. Any help
> out
> there?
>
> BTW - IMHO there has to be a better way to do this and I would hope a GUI
> driven script could be added later to make remote pathing very simple to
> implement.
>