Wednesday, July 2, 2025

Building Windows 11 Server

Wednesday, July 02, 2025  ,  No comments

With my 10-year-old Windows 10 Intel Core i7-4790K server nearing the end of its life, I decided to build a new Windows 11 Server for media storage and occasional gaming.



I purchased the mid-tower Fractal Design Define R7 case to accommodate 4 hard drives. Most newer computer cases lack sufficient space for hard drives, and this one is one of the few that has space for six drives. It also has the newer USB-C ports on the front panel. The case is acceptable; I would have preferred more screws so it doesn't fall apart when moved.

There was a special AMD bundle available at my local Micro Center in Santa Clara, where I selected the following AMD bundle: 

  • AMD Ryzen 7 9800X3D
  • MSI Pro X870E-P Wifi motherboard
  • Corsair 64GB 2x32GB DDR5-6000 CL30

For the graphics card, I ordered the following from my company store:

  • Nvidia Founder's Edition RTX5070 with 12GB GDDR6

I planned to configure four 20TB Toshiba MG10 Hard Drives in a RAID-5 volume using the LSI MegaRAID 9361-8i disk controller, but encountered multiple problems. The one I ordered from Amazon turned out to have been flashed as a Host Controller and not a RAID controller. I was unable to flash it to RAID mode. I decided to use Windows Storage Spaces (with Parity for extra protection) instead.

To optimize my Storage Space in Windows, I installed PrimoCache software, which utilizes NVMe and System Memory to cache disk reads/writes.

The three Samsung 990 Pro NVMe drives are to be arranged as follows:

  • M2_1 Slot (Samsung 990 Pro 2TB): Windows 11 
    • Plugged into a dedicated motherboard M2 slot (x4 PCIe Gen5)
  • M2_2 (Samsung 990 Pro 1TB): L2Cache_for_Primo)
    • SSD for PrimoCache (to accelerate writes to Parity Volume)
  • M2_3 (Samsung 990 Pro 2TB): Scratch (Lightroom Cache)
    • Plugged into a dedicated motherboard M2 slot (x4 PCIe Gen4)
  • Note: on the AMD x870e chipset, the M2_2 and M2_3 slots share PCIe lanes with the GPU. If an NVMe is installed in either M2_2 or M2_3, the GPU will switch from x16 to x8 mode. 
For cooling, I added an extra case fan to the top of my Fractal Design Define R7 case:
For sound, I plan to use B&W Px7 S2 headphones, which connect using USB-C to the PC.
  • B&W Px7 S2 Headphones with noise reduction and USB-C plug (Costco.com)
However, I am also exploring using an external USB-DAC for my Sony Headphones:
For my monitor, I looked at the following models and selected the Alienware AW3225QF due to great reviews and an ongoing Dell sale:

To replace the 13-year-old Fujitsu ScanSnap S1300i document scanner, I ordered the following scanner:

Build Problems
  1. The additional Fractal Design case fan was too small (120mm). I needed to use 140mm instead.
  2. The LSI 9361-8i disk controller card was not booting into RAID-5 mode and required using CSM in BIOS to boot. The boot became unbearably slow as well.
  3. After removing the LSI 9361-8i from its PCIe slot, the AMD video driver began to complain.
  4. The USB 2.0 ports on the front panel of the case are not working. Fixed (incorrect connection on the motherboard).
  5. The USB-C port on my case is not working. Fixed (incorrect connection of USB-C cable, polarity was difficult to determine).
  6. The M2 to PCIe x16 converter proved to be quite thick, and I had difficulty installing it in the PCIe slot.
Customization
  1. Added heatsink to M2_3 (Samsung 990 Pro NVMe)
  2. Added StarTech.com 4 Port USB A Female Slot Plate Adapter, to add 4 more USB 2.0 ports
Observations
  1. The Samsung 990 Pro NVMe 1TB, running below the GTX 5070, is running warmer than the others
  2. The Dell Alienware AW3225QF monitor features a downstream USB-C port, which cannot be used to connect to a MacBook.
Software
  • Windows 11 Activation - done (required help from Microsoft to activate)
  • Google Drive - installed
  • Cryptomator - installed
  • Plex - installed (scanning Media is taking a long time)
  • Brave Browser - installed
  • Bitwarden - installed
  • Grammarly plug-in installed
  • Assign a Static IP Address to PC (Neutron) on TP-Link Router

    • Log into http://192.168.0.1 or http://192.168.1.1

      • Advanced > Network > LAN Settings
      • DHCP > Address Reservation (for Archer routers)
  • Windows 11 Optimization/Privacy Tweaks:
    • See: https://chatgpt.com/c/68701e49-8908-800c-8b94-5763122e9cbd 
  • PrimoCache - using 1TB Samsung 990 Pro NVMe for L2 Cache with these settings:
    • ✅ Level-1 Cache (RAM)

      • Fastest cache layer

      • Allocate 4 GB if the system has ≥32GB of RAM

      • Enables near-zero latency reads

      ✅ Level-2 Cache (NVMe SSD)

      • Use 128 GB of your NVMe SSD

      • Format as NTFS or Raw — PrimoCache will manage it

      • Don’t use the entire SSD if you also need it for OS/apps

      🟡 Defer-Write (Write-Back) Cache

      • Temporarily holds writes before flushing to the HDD

      • Great for export batches or large imports

      • Use only with a UPS to prevent data loss on a power failure

      • Recommended delay: 10–30 seconds

        • Shorter (10s) = safer

        • Longer (30–60s) = better performance, more risk

      ✅ Read Mode

      • Use Intelligent (default) or Forward

        • "Intelligent" learns your access patterns

        • "Forward" always caches sequential blocks, good for large files (RAWs, videos)

      ✅ Block Size

      • Set to 64KB

        • Ideal for large files (RAWs, TIFFs, JPEGs, video)

        • Smaller blocks (4KB/16KB) are better for small files, but increase overhead.

  • Adobe Lightroom Classic - installed 
  • Bulk File Rename - installed
  • Steam - installed
    • Hogwarts Legacy installed
  • Scansnap Home (Fujitsu ScanSnap iX1300 scanner) - installed
  • Turbotax 2024
  • EmuDeck - installed
  • Sony Vegas v24 - installed ($175 one-time purchase)
  • Utilities - installed
    • HWMonitor
    • HWiNFO
    • CPU-Z
    • GPU-Z
    • Samsung Magician (flash health monitor)
  • Brother Printer Driver installed (Windows 8)
    • The built-in Windows 11 driver did not support duplex printing
  • With CyberPower UPS shared between the NAS and the PC, distribute the UPS status to the PC:
    1. Set up UPS Server on Synology NAS
    2. Set up WinNUT (to poll for the NAS being online and shut down if not)
      1. Releases, see: https://github.com/gawindx/WinNUT-Client/releases
      2. WinNUT-setup.msi
    3. Configure:
        4. UPS name: ups (This is the default name used by Synology)
        UPS type: netserver
        Host: 192.168.0.103 (IP address of your Synology NAS)
    4. Set "Poll Interval" to 30 seconds
    5. Save and start the WinNUT service

Windows 11 Hardening

1. Keep Windows and Software Updated <- done

Always install the latest Windows updates promptly.
Update all installed software (browsers, plugins, apps) regularly to patch vulnerabilities.

2. Use a Standard User Account <- done

Avoid daily use of an administrator account.
Use a standard user account for everyday tasks to limit damage if compromised.

3. Enable Windows Firewall <- done

Ensure Windows Defender Firewall is enabled.
Configure rules only to allow trusted apps and ports.

4. Enable BitLocker Drive Encryption <- done

Encrypt your system and data drives with BitLocker (built into Windows 11 Pro and above).
Protects your data if your device is lost or stolen.

5. Enable Controlled Folder Access

Part of Windows Security.
Protects important folders from unauthorized changes and ransomware.

6. Use Strong, Unique Passwords & Enable MFA

Use complex, unique passwords for all accounts.
Use Windows Hello (PIN, fingerprint, or facial recognition) for local sign-in.
Enable Multi-Factor Authentication (MFA) wherever possible (especially for Microsoft account).

7. Configure User Account Control (UAC)

Keep UAC enabled to prompt when apps try to make changes.
Don’t disable or lower UAC settings.

8. Turn Off Unnecessary Services and Features <- done

Disable unused services, especially remote access (Remote Desktop, SMB if not needed).
Disable telemetry or data sharing if you want to minimize exposure.

9. Secure Network & Browsing

Use a trusted VPN when on public Wi-Fi.
Use privacy-focused browsers and install ad-blockers and anti-tracking extensions.
Avoid clicking unknown links or downloading from untrusted sites.

10. Backup Regularly

Keep offline or cloud backups of important files.
Use File History or third-party backup software.
Backup protects against ransomware or data loss.

11. Use Application Whitelisting / Controlled Access

Tools like Windows Defender Application Control or AppLocker restrict which apps can run.
Great for preventing unknown or malicious software execution.

12. Use Anti-Phishing Tools

Use Microsoft Defender SmartScreen.
Consider additional browser anti-phishing extensions.

13. Monitor System Activity

Use tools like Windows Event Viewer and HWiNFO for suspicious activity.

    • Set up alerts for unusual logins or system changes.



Links



PCPartPicker Part List
Type Item Price
CPU AMD Ryzen 7 9800X3D 4.7 GHz 8-Core Processor Purchased for $430.29
CPU Cooler Thermalright Peerless Assassin 120 SE 66.17 CFM CPU Cooler Purchased for $34.49
Motherboard MSI PRO X870E-P WIFI ATX AM5 Motherboard Purchased for $186.47
Memory Corsair Vengeance RGB 64 GB (2 x 32 GB) DDR5-6000 CL30 Memory Purchased for $223.23
Storage Samsung 990 Pro 1 TB M.2-2280 PCIe 4.0 X4 NVME Solid State Drive Purchased for $99.99
Storage Samsung 990 Pro 2 TB M.2-2280 PCIe 4.0 X4 NVME Solid State Drive Purchased for $149.99
Storage Samsung 990 Pro 2 TB M.2-2280 PCIe 4.0 X4 NVME Solid State Drive Purchased for $149.99
Storage Toshiba MG10 512e 20 TB 3.5" 7200 RPM Internal Hard Drive Purchased for $329.26
Storage Toshiba MG10 512e 20 TB 3.5" 7200 RPM Internal Hard Drive Purchased for $329.26
Storage Toshiba MG10 512e 20 TB 3.5" 7200 RPM Internal Hard Drive Purchased for $329.26
Storage Toshiba MG10 512e 20 TB 3.5" 7200 RPM Internal Hard Drive Purchased for $329.26
Video Card NVIDIA Founders Edition GeForce RTX 5070 12 GB Video Card Purchased for $0.00
Case Fractal Design Define 7 ATX Mid Tower Case Purchased for $179.99
Power Supply MSI MAG A850GL PCIE5 850 W 80+ Gold Certified Fully Modular ATX Power Supply Purchased for $129.99
Operating System Microsoft Windows 11 Pro Retail - Download 64-bit Purchased for $37.18
Case Fan Noctua P14s redux-1200 64.92 CFM 140 mm Fan Purchased for $17.00
Monitor Dell Alienware AW3225QF 31.6" 3840 x 2160 240 Hz Curved Monitor Purchased for $808.00
Keyboard Cherry STREAM Wired Slim Keyboard Purchased for $25.99
Headphones Sony MDR-7506 Headphones Purchased for $0.00
Prices include shipping, taxes, rebates, and discounts
Total $3789.64
Generated by PCPartPicker 2025-07-17 12:03 EDT-0400

0 comments:

Post a Comment