How to Configure Windows Server 2016 iSCSI Target

iSCSI (Internet Small Computer Systems Interface) allows servers to present block storage over a standard TCP/IP network, enabling shared storage for Hyper-V clusters, file servers, and other workloads without expensive dedicated SAN hardware. Windows Server 2016 includes a built-in iSCSI Target Server role that allows any server to act as a storage provider for iSCSI initiators.

Understanding iSCSI Components

  • iSCSI Target: The storage server that presents virtual disks to the network.
  • iSCSI Initiator: The client that connects to and uses the storage.
  • IQN: iSCSI Qualified Name — unique identifier for targets and initiators (format: iqn.yyyy-mm.domain:name).
  • Virtual Disk (VHD): A file on the target server that represents a logical disk to initiators.

Step 1: Install the iSCSI Target Server Role

Install-WindowsFeature -Name FS-iSCSITarget-Server -IncludeManagementTools

Verify installation:

Get-WindowsFeature -Name FS-iSCSITarget-Server

Step 2: Create a Virtual Disk for the iSCSI Target

Create a VHDX file that will be presented as a block device to initiators:

New-IscsiVirtualDisk -Path "D:iSCSISharedStorage.vhdx" -SizeBytes 500GB

For a dynamically expanding disk:

New-IscsiVirtualDisk -Path "D:iSCSIDynDisk.vhdx" -SizeBytes 1TB -DynamicAllocation

Step 3: Create the iSCSI Target

Create a target and specify which initiators are allowed to connect using their IQN:

New-IscsiServerTarget -TargetName "SharedStorage-Target" `
  -InitiatorIds @("IQN:iqn.1991-05.com.microsoft:hyperv-host1", "IQN:iqn.1991-05.com.microsoft:hyperv-host2")

To allow all initiators (not recommended for production):

New-IscsiServerTarget -TargetName "OpenTarget"

Step 4: Connect the Virtual Disk to the Target

Add-IscsiVirtualDiskTargetMapping -TargetName "SharedStorage-Target" -Path "D:iSCSISharedStorage.vhdx"

Verify the mapping:

Get-IscsiServerTarget -TargetName "SharedStorage-Target" | Select-Object TargetName, LunMappings

Step 5: Configure Windows Firewall for iSCSI

iSCSI uses TCP port 3260. Allow inbound connections:

New-NetFirewallRule -DisplayName "iSCSI Target (TCP-In)" -Direction Inbound -Protocol TCP -LocalPort 3260 -Action Allow

Step 6: Configure the iSCSI Initiator on the Client

On each Hyper-V host or server that needs to connect, open the iSCSI Initiator or use PowerShell. First, get the initiator’s IQN:

(Get-InitiatorPort).NodeAddress

Start the iSCSI initiator service:

Set-Service -Name MSiSCSI -StartupType Automatic
Start-Service -Name MSiSCSI

Connect to the iSCSI target:

New-IscsiTargetPortal -TargetPortalAddress "192.168.10.50"
Connect-IscsiTarget -NodeAddress "iqn.1991-05.com.microsoft:StorageServer-SharedStorage-Target-target" -TargetPortalAddress "192.168.10.50" -IsPersistent $true

Step 7: Initialize and Format the iSCSI Disk on the Initiator

After connecting, the iSCSI LUN appears as a new disk in Disk Management or via Get-Disk:

Get-Disk | Where-Object {$_.BusType -eq "iSCSI"}
Initialize-Disk -Number 2 -PartitionStyle GPT
New-Partition -DiskNumber 2 -UseMaximumSize -AssignDriveLetter | Format-Volume -FileSystem NTFS -NewFileSystemLabel "iSCSI-Storage" -Confirm:$false

Step 8: Configure CHAP Authentication

For production environments, enable CHAP (Challenge Handshake Authentication Protocol) to authenticate initiators:

Set-IscsiServerTarget -TargetName "SharedStorage-Target" `
  -EnableChap $true `
  -Chap @{UserName = "initiator_user"; Password = "P@ssw0rd123456"}

Configure CHAP on the initiator side:

Set-IscsiChapSecret -ChapSecret "P@ssw0rd123456"

Step 9: Monitor iSCSI Sessions

Get-IscsiSession
Get-IscsiConnection
Get-IscsiServerTarget | Select-Object TargetName, Status, Sessions

Step 10: Configure iSCSI Multipathing (MPIO)

For high availability and performance, configure Multipath I/O (MPIO) to use multiple network paths to the iSCSI target:

Install-WindowsFeature -Name Multipath-IO -IncludeManagementTools
Enable-MSDSMAutomaticClaim -BusType iSCSI

Configure the MPIO load balancing policy:

Set-MSDSMGlobalDefaultLoadBalancePolicy -Policy RR

After adding a second network path to the target, verify multipath is active:

Get-Disk | Where-Object {$_.BusType -eq "iSCSI"} | Get-PhysicalDisk

Summary

Configuring iSCSI Target Server on Windows Server 2016 provides a cost-effective shared storage solution for small to mid-sized environments. By creating virtual disks, defining targets with allowed initiator lists, and securing connections with CHAP authentication, you can build a reliable iSCSI SAN using commodity hardware and Windows Server’s built-in capabilities.