How to Set Up iSCSI Target Server on Windows Server 2012 R2

iSCSI (Internet Small Computer Systems Interface) is a storage networking protocol that enables block-level storage access over a standard TCP/IP network. Windows Server 2012 R2 includes a built-in iSCSI Target Server role service that allows you to create and manage iSCSI targets — virtual disks that remote hosts (iSCSI initiators) can connect to and use as if they were locally attached drives. This capability is valuable for providing shared storage to physical servers, Hyper-V clusters, test labs, and disaster recovery scenarios without investing in dedicated SAN hardware.

This guide covers the complete setup of an iSCSI Target Server on Windows Server 2012 R2, from installing the role service to creating and exposing virtual disks to initiators.

Prerequisites

You need Windows Server 2012 R2 with the File and Storage Services role installed. The server should have dedicated network adapters for iSCSI traffic (1 GbE minimum, 10 GbE recommended for production). Sufficient disk space must be available for virtual disk (VHD) files. The iSCSI Target Server is not suitable for hosting the system drive. Initiator servers must have the iSCSI Initiator service configured and network connectivity to the target server. Firewall rules must allow TCP port 3260, the standard iSCSI port.

Step 1: Install the iSCSI Target Server Role

Use PowerShell to install the iSCSI Target Server role service:

Install-WindowsFeature FS-iSCSITarget-Server -IncludeManagementTools

Verify the installation completed successfully:

Get-WindowsFeature FS-iSCSITarget-Server | Select-Object Name, InstallState

Alternatively, use Server Manager: navigate to Add Roles and Features → Server Roles → File and Storage Services → File and iSCSI Services, then check iSCSI Target Server.

Step 2: Open Required Firewall Ports

Ensure TCP port 3260 is open in Windows Firewall for iSCSI traffic:

New-NetFirewallRule -DisplayName "iSCSI Target" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 3260 `
    -Action Allow `
    -Profile Domain,Private

Step 3: Create an iSCSI Virtual Disk

An iSCSI virtual disk is a VHD file stored on the target server that gets presented as a block device to initiators. Create a virtual disk using PowerShell:

New-IscsiVirtualDisk -Path "D:iSCSIDisksClusterDisk1.vhdx" `
    -SizeBytes 200GB

For a dynamically expanding virtual disk (grows as data is written):

New-IscsiVirtualDisk -Path "D:iSCSIDisksDynamicDisk1.vhdx" `
    -SizeBytes 500GB `
    -UseFixed:$false

Verify the virtual disk was created:

Get-IscsiVirtualDisk | Select-Object Path, SizeBytes, IsFixed

Step 4: Create an iSCSI Target

An iSCSI target is the logical endpoint that initiators connect to. Each target has a unique IQN (iSCSI Qualified Name) identifier. Create a target and associate it with the initiators that will be allowed to connect:

New-IscsiServerTarget -TargetName "ClusterStorage-01" `
    -InitiatorIds @("IQN:iqn.1991-05.com.microsoft:server01.contoso.com",
                    "IQN:iqn.1991-05.com.microsoft:server02.contoso.com")

If you want to allow all initiators to connect (not recommended for production):

New-IscsiServerTarget -TargetName "TestStorage-01" `
    -InitiatorIds @("IPAddress:192.168.10.0/24")

View the target’s IQN — you’ll need this on initiator systems:

Get-IscsiServerTarget -TargetName "ClusterStorage-01" | Select-Object TargetIqn, TargetName, IsEnabled

Step 5: Map the Virtual Disk to the Target

Associate the virtual disk with the iSCSI target so initiators can access it:

Add-IscsiVirtualDiskTargetMapping `
    -TargetName "ClusterStorage-01" `
    -Path "D:iSCSIDisksClusterDisk1.vhdx"

To add a second virtual disk as a second LUN on the same target:

New-IscsiVirtualDisk -Path "D:iSCSIDisksClusterDisk2.vhdx" -SizeBytes 100GB

Add-IscsiVirtualDiskTargetMapping `
    -TargetName "ClusterStorage-01" `
    -Path "D:iSCSIDisksClusterDisk2.vhdx"

Confirm the mappings:

Get-IscsiVirtualDisk | Select-Object Path, AssignedTo

Step 6: Configure CHAP Authentication (Optional but Recommended)

For production environments, configure CHAP (Challenge Handshake Authentication Protocol) to authenticate initiators before allowing connections:

Set-IscsiServerTarget -TargetName "ClusterStorage-01" `
    -EnableChap $true `
    -Chap "initiatoruser" `
    -ChapSecret "S3cur3P@ssw0rd123"

For mutual CHAP (reverse authentication, where the initiator also authenticates the target):

Set-IscsiServerTarget -TargetName "ClusterStorage-01" `
    -EnableReverseChap $true `
    -ReverseChap "targetuser" `
    -ReverseChapSecret "T@rgetS3cr3t456"

Step 7: Verify Target Configuration

Review the complete target configuration before connecting initiators:

Get-IscsiServerTarget -TargetName "ClusterStorage-01" | Format-List *

Step 8: Configure iSCSI Network Binding (Optional)

To restrict iSCSI traffic to a dedicated network interface, bind the iSCSI Target service to specific IP addresses:

Set-IscsiTargetServerSetting -IP "192.168.100.10"

If you have multiple iSCSI network adapters for multipath I/O (MPIO), add them all:

Set-IscsiTargetServerSetting -IP "192.168.100.10","192.168.101.10"

Step 9: Connect from an Initiator

On the initiator server (e.g., server01.contoso.com), start the iSCSI Initiator service and configure the connection:

Start-Service MSiSCSI
Set-Service MSiSCSI -StartupType Automatic

New-IscsiTargetPortal -TargetPortalAddress "192.168.100.10"

Get-IscsiTarget | Select-Object NodeAddress, IsConnected

Connect to the target:

Connect-IscsiTarget -NodeAddress "iqn.1991-05.com.microsoft:targetsrv-clusterstorage-01-target" `
    -TargetPortalAddress "192.168.100.10" `
    -IsPersistent $true

Step 10: Initialize and Format the Disk on the Initiator

After connecting, the iSCSI disk appears as an offline disk in Disk Management. Initialize and format it:

Get-Disk | Where-Object {$_.OperationalStatus -eq "Offline"} | Initialize-Disk -PartitionStyle GPT

New-Partition -DiskNumber 2 -UseMaximumSize -AssignDriveLetter

Format-Volume -DriveLetter F -FileSystem NTFS -NewFileSystemLabel "iSCSIStorage" -Confirm:$false

Managing the iSCSI Target Server via Server Manager

All iSCSI Target Server management tasks can also be performed through Server Manager. Navigate to File and Storage Services → iSCSI to view and manage virtual disks and targets with a graphical interface. This is useful for day-to-day management and monitoring the status of active initiator sessions.

To view active sessions from the target side:

Get-IscsiConnection

Summary

The iSCSI Target Server on Windows Server 2012 R2 provides a cost-effective way to deliver block-level shared storage over standard TCP/IP networks. By creating virtual disks and targets, then configuring appropriate initiator access controls and CHAP authentication, organizations can build reliable shared storage solutions for clusters, virtual machines, and application servers without dedicated SAN hardware. With careful network planning and the use of MPIO for redundancy, iSCSI on Windows Server 2012 R2 can serve as a production-grade storage backend.