If you missed the first part in this article series please read:
So far in this article series, I have focused most of my attention on areas in which you could use various group policy settings to improve security. Although a group policy’s primary job is to enforce security, it can also be used to manage a workstation’s hardware configuration. In this article, I will continue my discussion by showing you some ways that you can use some of the new group policy settings to manage a workstation’s hard disk.
Disk Failure Diagnostic
Someone once said that there are two kinds of hard drives; ones that have failed, and ones that are going to. These failures used to be completely unpredictable, but S.M.A.R.T. technology allows hard drives to detect an impending failure, and notify the operating system before the crash actually occurs.
As great as S.M.A.R.T. failure notifications sound, there is one problem with them. By default, S.M.A.R.T. failure messages are logged to the system’s event log. If the event was recorded on a workstation, then it will likely go completely unnoticed. The vast majority of companies simply do not have the resources to consistently monitor each workstation’s event logs.
Fortunately, there are a couple of new group policy settings that can help with this problem. Both policies are located at Computer Configuration | Administrative Templates | System | Troubleshooting and Diagnostics | Disk Diagnostic.
The first setting that I want to tell you about is the Disk Diagnostic Configure Execution Level setting. If you choose to enable this group policy setting, then Windows will still log S.M.A.R.T failures to the system log, but it will also alert the user, and will guide them through the backup and recovery processes, so as to avoid or minimize data loss.
I highly recommend enabling the Disk Diagnostic: Configure Execution Level group policy setting. Even so, I realize that in many organizations, having a user attempt a backup and recovery operation would be considered to be a bad thing. Fortunately, you don’t have to let Windows tell the end user how to run a backup. There is another group policy setting that you can use to customize the message that an end user sees when a S.M.A.R.T. failure occurs. For example, you might replace the default message with a message telling the user to call the help desk.
The name of the group policy setting that allows you to create a customized S.M.A.R.T. failure message is Disk Diagnostic: Configure Custom Alert Text. To use this setting, simply enable it and enter the text that you want for your users to see. Windows limits this text to 512 characters.
Hybrid Hard Drives
Windows Vista and Windows Server 2008 also allow you to regulate the use of hybrid hard drives through group policy settings. In case you are not familiar with hybrid hard drives, they are hard drives that contain an extremely large cache made up of non-volatile flash memory. This cache is typically around 1 GB in size, and uses memory similar to that which is used in USB flash drives.
The reason behind this design is that the drive’s non-volatile cache is so large that the drive’s platters are almost never spinning, as opposed to a traditional hard drive in which the platters spin nearly all of the time. This decreases wear and tear on the drive, and also reduces the drive’s power consumption and the amount of heat that is given off by the drive. The biggest benefit though, is speed. A computer can read data from the hard drive’s non-volatile cache at a much faster rate than if data were being read from the disk platters.
Windows Vista and Windows Server 2008 offer four group policy settings that are aimed at helping you to control the way that Windows uses hybrid hard drives. Each of these four settings can be found at Computer Configuration | Administrative Templates | System | Disk NV Cache
The first setting is the Turn Off Boot and Resume Operations setting. The basic idea is that if you enable this policy setting, then Windows will not use the disk’s non-volatile cache to optimize the boot process. Otherwise, the system will use place files used during the boot sequence into the non-volatile cache, as a way of helping the system to boot more quickly.
Normally, if a computer is placed in hibernation, the data that is needed to resume operations is copied to the non-volatile cache. This helps a computer wake up from hibernation much more quickly. Enabling this group policy setting forces hibernation data to be written to the disk platters rather than to the non-volatile cache.
A second group policy setting related to hybrid hard drives is the Turn Off Cache Power Mode policy. Under normal circumstances, Windows aggressively attempts to reduce the system’s power consumption by spinning down the hard drive platters whenever possible. Although this technique does conserve power, and reduces heat, it can diminish performance as well. This is because Windows must spin the hard drive platters back up any time that it needs to read a file that is not cached in non-volatile memory.
The third group policy setting related to hybrid hard drives is the Turn Off Non Volatile Cache Feature setting. This is one of those group policy settings whose name can be a little bit misleading. If you look at the policy’s name, it appears as though the policy is used to completely disable the drive’s non volatile cache. There is a setting for disabling the drive’s non volatile cache, but this isn’t it.
The idea behind the Turn off Non Volatile Cache Feature setting is that if you enable this setting then Windows will act as if it does not support hybrid hard drives. This doesn’t mean that nothing will be cached, it simply means that the caching process will not be managed by Windows. In most cases your system will achieve far better performance if you allow Windows to manage the non volatile cache.
The last setting related to hybrid hard drives is the Turn Off Solid State Mode setting. When this group policy setting is enabled, Windows treats hybrid hard drives as normal hard drives. This means that the non volatile cache is completely disabled. As such, there is no power consumption speed related benefit associated with using the drive. The drive acts exactly like any other normal hard drive.
In this article, I have explained that while most group policy settings are security related, some group policy settings can be used to enforce a standard hardware configuration instead. I then went on to discuss some various settings that are related to the performance and failure diagnostics of workstation hard drives. In Part 6, I will continue the discussion by talking about some group policy settings that are related to troubleshooting and diagnosing applications and resource allocations.
If you missed the first part in this article series please read: