By using disk quotas, you can monitor and control the amount of disk space people who access folders and disks can use. Without quota management, it is hard to monitor the amount of space used by individual users and even harder to control the total amount of space they can use. I refer to monitoring and controlling separately because there’s a very important difference between monitoring disk-space usage and controlling it—and the disk quota system enables you to perform these tasks separately or together. You can, in fact, do the following:

Your organization’s culture will probably play a major role in the disk quota technique you use. In some organizations, the culture is such that it is acceptable to monitor space usage and periodically notify users that they are over recommended limits, but it wouldn’t be well received if administrators enforced controls that limited disk-space usage to specific amounts. In other organizations, especially larger organizations in which there might be hundreds or thousands of employees on the network, it can make sense to have some controls in place and users might be more understanding of specific controls. Controls at some point become a matter of necessity to help ensure that the administrative staff can keep up with the disk-space needs of the organization.

Disk quotas are configured on a per-volume basis. When you enable disk quotas, all users who store data on a volume are affected by the quota. You can set exceptions for individual users that either set new limits or remove the limits altogether. As users create files and folders on a volume, an ownership flag is applied that says that this particular user owns the file or folder. Thus, if a user creates a file or folder on a volume that the user owns, the file or folder and the space used count toward the user’s quota limit. However, because each volume is managed separately, there is no way to set a specific limit for all volumes on a server or across the enterprise.

Ownership of files and folders can change in several scenarios. If a user creates a copy of a file someone else owns, the copy is owned by the user who created it because a file is created when the copy is made. File and folder ownership can also change when files are restored from backup. This can happen if you restore the files to a volume other than the one on which the files were created and copy the files over to the original volume. Here, during the copy operation, the administrator becomes the owner of the files. A workaround for this is to restore files and folders to a different location on the same volume and then move the files and folders rather than copying them. When you move files and folders from one location to another on the same volume, the original ownership information is retained.

Administrators can be designated as the owner of files in other ways as well, such as when they install the operating system or application software. To ensure that administrators can always install programs, restore data, and perform other administrative tasks, members of the Administrators group don’t have a quota limit as a general rule. This is true even when you enforce disk quotas for all users. In fact, for the Administrators group, the only type of quota you can set is a warning level that warns administrators when they’ve used more than a set amount of space on a volume. When you think about it, this makes a lot of sense—you don’t want to get into a situation in which administrators can’t recover the system because of space limitations.

That said, you can apply quotas to individual users—even those who are members of the Administrators group. You do this by creating a separate quota entry for each user. The only account that cannot be restricted in this way is the built-in Administrator account. If you try to set a limit on the Administrator account, the limit is not applied.

Finally, note that all space used on a volume counts toward the disk quota—even space used in the Recycle Bin. Thus, if a user who is over the limit deletes files to get under the limit, the disk quota might still give warnings or, if quotas are enforced, the user still might not be able to write files to the volume. To resolve this issue, the user would need to delete files and then empty the Recycle Bin.

By default, disk quotas are disabled. If you want to use disk quotas, you must enable quota management for each volume on which you want to use disk quotas. You can enable disk quotas on any NTFS volume that has a drive letter or a mount point. Before you configure disk quotas, think carefully about the limit and warning levels. Set values that make the most sense given the number of users who store data on the volume and the size of the volume. For optimal performance of the volume, you won’t want all or nearly all of the disk space to be allocated. For optimal user happiness, you want to ensure that the warning and limit levels are adequate so that the average user can store the necessary data to perform job duties. Quota limits and warning levels aren’t “one size fits all” solutions either. Engineers and graphic designers can have very different space needs from a typical user. In the best situations, you configure network shares so that different groups of users have access to different volumes, and these volumes are sized to meet the typical requirements of a particular group.

In some organizations, I’ve seen administrators set very low quota limits and warning levels on data shares. The idea behind this was that the administrators wanted users to save most of their data on their workstations and put only files that needed to be shared on the data shares. I discourage this approach for two reasons. First, low quota limits and warning levels frustrate users—you don’t want frustrated users; you want happy users. Second, you should be encouraging users to store more of their important files on central file servers, not fewer. Central file servers should be part of regular enterprise-wide backup routines, and backing up data safeguards it from loss. In addition, with the Volume Shadow Copy Service, shadow copies of files on shared folders can be created automatically, enabling users to perform point-in-time file recovery without needing help from administrators.

To enable disk quotas on an NTFS volume, follow these steps:

After you enable disk quotas, the configuration is set for and applies to all users who store data on the volume. The only exception, as noted previously, is for members of the Administrators group. The default disk quotas don’t apply to these users. If you want to set a specific quota limit or warning level for a member of the Administrators group, you can do this by creating a custom quota entry for that particular user account. You can also create custom quota entries for users who have special requirements or special limitations.

To view and work with quota entries, access Disk Management, press and hold or right-click the volume on which you enabled quotas, and then select Properties. In the Properties dialog box for the disk, tap or click the Quota tab and then tap or click Quota Entries. You then see a list of quota entries for everyone who has ever stored data on the volume, as shown in Figure 16-2. The entries show the following information:

Figure 16-2. Any existing quota entries are shown.

Quota entries get on the list in one of two ways: either automatically if a user has ever stored data on the volume or by an administrator creating a custom entry for a user. You can customize any of these entries—even the ones automatically created—by double-tapping or double-clicking them, which opens the Quota Settings dialog box shown in Figure 16-3, and selecting the appropriate options to either remove the disk quota limits or set new ones.

Figure 16-3. You can customize quota entries for individual users as necessary.

If a user doesn’t have an entry in the Quota Entries dialog box, it means that user has not yet saved files to the volume. You can still create a custom entry for the user if you want. To do this, choose Quota, New Quota Entry. This opens the Select Users dialog box shown in Figure 16-4. Use this dialog box to find the user account you want to work with. Type the name of the user account or part of the name and tap or click Check Names. If multiple names match the value you entered, you see a list of names and can choose the one you want to use. Otherwise, the name is filled in for you, and you can tap or click OK to open the Add New Quota Entry dialog box, which has the same options as the Quota Settings dialog box shown in Figure 16-3.

Figure 16-4. Type the name of the user account or part of the name and tap or click Check Names.

In the Quota Entries dialog box, you can use a couple of tricks to add or manage multiple quota entries at once. If you want to add identical quota entries for multiple users, you can do this by choosing Quota, New Quota Entry. This opens the Select Users dialog box. Tap or click Advanced to open the advanced Select Users dialog box, as shown in Figure 16-5.

Figure 16-5. The advanced Select Users dialog box has additional options.

You can now search for users by name and description or by tapping or clicking Find Now without entering any search criteria to display a list of available users from the current location. You can select any of the users listed. You can select multiple user accounts by holding down the Ctrl key and tapping or clicking each account you want to select or by holding down the Shift key, selecting the first account name, and then tapping or clicking the last account name to choose a range of accounts. Tap or click OK twice and then use the Add New Quota Entry dialog box to configure the quota options for all the selected users.

To manage multiple quota entries simultaneously, open the Quota Entries dialog box and then select the entries by holding down the Ctrl key and tapping or clicking each entry you want to select or by holding down the Shift key, selecting the first entry, and then tapping or clicking the last entry to choose a range of entries. Afterward, press and hold or right-click one of the selected entries and then choose Properties. You can then configure quota options for all the selected entries at once.

Users are notified that they have reached a warning level or quota limit when they access the volume on which you configured disk quotas. As an administrator, you want to check for quota violations periodically, and there are several ways you can do this. One way is to access Disk Management, press and hold or right-click the volume that you want to check, and then select Properties. In the Properties dialog box for the disk, tap or click the Quota tab and then tap or click the Quota Entries button. You can then check the current disk usage of users and see whether there are any quota violations. You can also copy selected entries to the Clipboard by pressing Ctrl+C and then pasting them into other applications, such as Microsoft Excel, by using Ctrl+V to help you create reports or lists of disk-space usage.

You can check quota entries from the command line as well. Type fsutil quota query DriveDesignator at the command prompt, where DriveDesignator is the drive letter of the volume followed by a colon, such as D:. If disk quotas are enabled on the volume, you then get a summary of the disk quota settings on the volume, as follows:

FileSystemControlFlags           =     0x00000031
   Quotas are tracked and enforced on this volume
   Logging enable for quota limits and threshold
   The quota values are up to date
Default Quota Threshold          =     0x0000000038400000
Default Quota Limit              =     0x0000000040000000
SID Name                         =     CPANDLedwardh (User)
Change time                      =     Saturday, April 26, 2014
Quota Used                       =     528164252
Quota Threshold                  =     943718400
Quota Limit                      =     1073741824
SID Name                         =     CPANDLmollyp (User)
Change time                      =     Monday, April 28, 2014
Quota Used                       =     627384965
Quota Threshold                  =     943718400
Quota Limit                      =     1073741824

In this example, disk quotas are tracked and enforced on the volume, logging is enabled for both quota limits, and the warning levels and the disk quota values are current. In addition, the default warning limit (listed as the quota threshold) is set to 900 MBs (0 × 038400000 bytes) and the default quota limit is set to 1 GB (0 × 040000000 bytes).

The disk quota summary is followed by the individual disk quota entries for each user who has stored data on the volume or has a custom entry regardless of whether the user has ever written data to the volume. The entries show the following information:

When you configure disk quotas, you also have the option to log two types of events in the system logs: one for when a user exceeds the quota limit and another for when a user exceeds the warning level. By default, quota violations are written to the system log once an hour, so if you check the logs periodically, you can see events related to any users who have disk quota violations. It’s much easier to check for quota violations from the command line, however. Just type fsutil quota violations at the command prompt, and the FSUtil Quota command checks the system and application event logs for quota violations.

If no quota violations are found, the output is similar to the following:

Searching in System Event Log...
Searching in Application Event Log...
No quota violations detected

If there are quota violations, the output shows the event information related to each violation. In the following example, a user reached the warning level (listed as the quota threshold):

Searching in System Event Log...
**** A user hit their quota threshold ! ****
   Event ID : 0x40040024
   EventType : Information
   Event Category : 2
   Source : Ntfs
   User: CPANDLharryt (User)
   Data: D:
Searching in Application Event Log...

As you can see, the output shows you the event ID, type, category, and source. It also shows the user who violated the disk quota settings and the volume on which the violation occurred.

If you want to use the same quotas on more than one NTFS volume, you can do this by exporting the quota entries from one volume and importing them on another volume. When you import quota entries, if there isn’t a quota entry for the user already, a quota entry will be created. If a user already has a quota entry on the volume, you are asked whether you want to overwrite it.

To export and import quota entries, access Disk Management, press and hold or right-click the volume on which you want to enable quotas, and then select Properties. In the Properties dialog box for the disk, tap or click the Quota tab and then tap or click the Quota Entries button. You then see the Quota Entries dialog box. Select Export from the Quota menu. This opens the Export Quota Settings dialog box.

Choose the location for the file containing the quota settings and then set a name for the file by using the File Name field. Afterward, tap or click Save.

Next, open the Quota Entries dialog box for the drive on which you want to import settings. Select Import on the Quota menu. Then, in the Import Quota Settings dialog box, select the quota settings file that you saved previously. Tap or click Open.

If prompted about whether you want to overwrite an existing entry, tap or click Yes to replace an existing entry or tap or click No to keep the existing entry. Select Do This For All Quota Entries prior to tapping or clicking Yes or No to use the same option for all existing entries.

FAT tries to prevent disk-integrity problems by maintaining a duplicate file allocation table that can be used to recover the primary file allocation table if it becomes corrupted. Beyond this, FAT doesn’t do much to ensure disk integrity. NTFS, however, has several mechanisms for preventing and correcting disk-integrity problems automatically. NTFS stores a partial duplicate of the MFT, which can be used for failure recovery. NTFS also stores a persistent history of all changes made to files on the volume in a log file, and the log file can be used to recover NTFS metadata files, regular data files, and folders. What these file-structure recovery mechanisms all have in common is that they are automatic and you, as an administrator, don’t need to do anything to ensure that these disk housekeeping tasks are performed. These mechanisms aren’t perfect, however, and errors can occur.

The most common errors relate to the following areas:

Windows Server 2012 R2 proactively scans volumes for these types of errors as part of automated maintenance. Windows does this using Check Disk. Although automated maintenance triggers the disk scan, the process of calling and managing Check Disk is handled by a separate task. In Task Scheduler, you find the ProactiveScan task in the scheduler library under MicrosoftWindowsChkdsk, and you can get detailed run information on the task’s History tab.

Check Disk works on FAT, FAT32, and NTFS volumes and primarily looks for inconsistencies in the file system and its related metadata. It locates errors by comparing the volume bitmap to the disk sectors assigned to files. For files, Check Disk looks at structural integrity, but it won’t check for or attempt to repair corrupted data within files that appear to be structurally intact.

However, the way Check Disk performs scan, analysis, and repair has changed. With Windows Server 2012 R2, Check Disk performs either enhanced scan and repair automatically or the scan and repair available with earlier releases of Windows. Whether an enhanced scan and repair or a standard scan and repair is used depends on the type of volume:

Because the enhanced approach is new, that’s what I’ll focus on. When you use Check Disk with NTFS volumes, Check Disk performs an online scan and analysis of the volumes. Check Disk writes information about any detected corruptions in the $corrupt system file. When the scan and analysis process is complete, Check Disk can repair detected corruptions by taking the volume offline temporarily and fixing them.

Storing the corruption information and then repairing the volume while it is dismounted enables Windows to repair volumes rapidly. It also enables users to keep using the disk while a scan is being performed. Typically, offline repair takes only a few seconds, compared to what would have been hours for very large volumes using the standard scan and repair technique.

Keep in mind that unmounting a volume for repair invalidates all open file handles. With the boot/system volume, the repairs are performed the next time you start the computer. As with other volumes, Check Disk uses the detected corruptions, already stored in the $corrupt system file, to repair the boot/system volume rapidly during startup.

Because ReFS is self-correcting, Check Disk isn’t needed on ReFS volumes (and won’t run on ReFS volumes either). However, it’s important to point out that ReFS as originally released did not efficiently correct corruption on parity spaces. With Windows Server 2012 R2, this deficiency has been corrected. ReFS automatically corrects corruption on parity spaces when integrity streams are enabled to detect corrupt data. When corruption is detected, ReFS examines the data copies that the parity spaces contain and then uses the correct version of the data to correct the problem. Because ReFS now supports concurrent I/O requests to the same file, the performance of integrity streams also has been improved.

You can run Check Disk interactively as well. With NTFS volumes, one way to do this is to use Server Manager. In Server Manager, select the File And Storage Services node and then select the related Volumes subnode. As shown in Figure 16-6, you then see the available volumes for each server added for management. Next, press and hold or right-click a volume and then select Scan File System For Errors. In the Scan File System For Errors dialog box, tap or click Scan Now. Server Manager displays the percentage of scanning completed. If errors are found, you’re notified and can press and hold or right-click the volume and then select Repair File System Errors to resolve them. As discussed earlier, the way the repair process works depends on whether you are working with a boot/system volume or a nonsystem volume.

Figure 16-6. Scan a volume for errors in Server Manager.

Another way to check NTFS volumes is to start Check Disk by using either File Explorer or Disk Management. Press and hold or right-click the volume and choose Properties. On the Tools tab of the Properties dialog box, tap or click Check to open the Error Checking dialog box. When you tap or click Scan Drive, the Error Checking dialog box displays the approximate scan and analysis time remaining, as shown in Figure 16-7. If errors are found, you’re notified with additional options for repairing them.

Figure 16-7. Check a disk for errors.

With FAT, FAT32, and exFAT volumes, Windows uses the standard Check Disk, which might require offline scan and repair. Start Check Disk by using either File Explorer or Disk Management. Press and hold or right-click the volume and choose Properties. On the Tools tab of the Properties dialog box, tap or click Check to open the Error Checking dialog box. When you tap or click Scan And Repair Drive, Check Disk begins scanning the volume.

Check Disk can also be run at the command line by using ChkDsk (Chkdsk.exe). The key advantage of using the command-line version is that you get a detailed report of the analysis and repair operations as detailed in “Analyzing FAT volumes by using ChkDsk” and “Analyzing NTFS volumes by using ChkDsk” later in this chapter.

You can run ChkDsk in analysis mode at the command line by typing chkdsk /scan followed by the drive designator. For example, if you want to analyze the D drive, you type chkdsk /scan d:. Check Disk then performs an analysis of the disk and returns a status message regarding any problems it encounters. Unless you specify further options, Check Disk won’t repair problems, however. To repair errors on drive D, you type chkdsk /spotfix d:.

Because fixing the volume requires exclusive access to it, you can’t repair an active volume. For system volumes, you see a prompt asking whether you would like to schedule the volume for the repair the next time the computer is started. Type Y to schedule the repair or N to cancel the repair.

For nonsystem volumes, you see a prompt asking whether you would like to force a dismount of the volume for the repair. Type Y to proceed or N to cancel the dismount. If you cancel the dismount, the prompt asks whether you would like to schedule the repair the next time the computer is started. Here, type Y to schedule the repair or N to cancel the repair.

You can’t run Check Disk with both the /scan and /spotfix options. The reason for this is that the scan and repair tasks are now independent of each other.

The complete syntax for ChkDsk is as follows:

CHKDSK [volume[[path]filename]] [/F] [/V] [/R] [/X] [/I] [/C] [/B]
  [/L[:size]] [/scan] [/forceofflinefix] [/perf] [/spotfix]
  [/sdcleanup] [/offlinescanandfix]

Table 16-1 summarizes the available options and parameters and their uses.

When you run ChkDsk, you can get an analysis report. For FAT volumes, a disk analysis report looks like this:

The type of the file system is FAT32.
Volume NEW VOLUME created 9/24/2014 9:10 PM
Volume Serial Number is AAAD-2188
Windows is verifying files and folders...
File and folder verification is complete.
Windows has scanned the file system and found no problems.
No further action is required.
    5,107,712 KB total disk space.
           64 KB in 16 hidden files.
          168 KB in 42 folders.
    1,026,340 KB in 145 files.
    4,081,136 KB are available.
        4,096 bytes in each allocation unit.
    1,276,928 total allocation units on disk.
    1,020,284 allocation units available on disk.

Here, ChkDsk examines each record in the file allocation table for consistency. It lists all the file and folder records in use and determines the starting cluster for each, using the file allocation table. It checks each file and notes any discrepancies in the output. Any clusters that were marked as in use by files or folders but weren’t actually in use are noted, and during repair, the clusters can be marked as available. Other discrepancies noted in the output can be fixed during repair as well.

Disk analysis for NTFS volumes is performed in three stages, and ChkDsk reports its progress during each stage as shown in this sample report:

The type of the file system is NTFS.
Stage 1: Examining basic file system structure ...
Stage 2: Examining file name linkage ...
Stage 3: Examining security descriptors ...
Windows has scanned the file system and found no problems.
No further action is required.

During the first stage of analysis, ChkDsk verifies file structures. This means ChkDsk examines each file’s record in the MFT for consistency. It examines all the file records in use and determines which clusters the file records are stored in, and then it compares this with the volume’s cluster bitmap stored in the $Bitmap metadata file. Any discrepancies are tracked. For example, any clusters that were marked as in use by files but weren’t actually in use are tracked, and during repair, the clusters can be marked as available.

During the second stage of analysis, ChkDsk verifies directory structure by examining file-name linking, starting with the volume’s root directory index, which is stored in the $Metadata file. ChkDsk examines index records, making sure that each index record corresponds to an actual directory on the disk and that each file that is supposed to be in a directory is in the directory. It also checks whether there are files that have an MFT record but don’t actually exist in any directory, and during repair, these lost files can be recovered.

During the third stage of the analysis, ChkDsk verifies the consistency of security descriptors for each file and directory object on the volume by using the $Secure metadata file. It does this by validating that the security descriptors work. It doesn’t actually check whether the users or groups assigned in the security descriptors exist.

Running ChkDsk with the /scan option performs an analysis of the volume only. If problems are found, ChkDsk repairs them only if you run ChkDsk again, this time using /spotfix.

That said, you can scan a volume and force offline repair by using /scan and /forceofflinefix, as shown in this example:

chkdsk /scan /forceofflinefix

You can use /perf with /scan to perform a scan faster. The /perf option allocates more system resources to the scan, which could possibly affect server performance but allows a scan to be completed more quickly.

Standard repair options remain available as well, but they might require offline scan and offline repair in some instances. You can use the /X parameter to force a volume to dismount if necessary or the /R parameter to locate bad sectors; each implies the /F parameter. If you use the /R parameter, ChkDsk performs an additional step in the analysis and repair that involves checking each sector on the disk to make sure it can be read from and written to correctly. If it finds a bad sector, ChkDsk marks it so that data won’t be written to that sector. If the sector was part of a cluster that was in use, ChkDsk moves the good data in that cluster to a new cluster.

The data in the bad sector can be recovered only if there’s redundant data from which to copy it. The bad sector won’t be used again, so at least it won’t cause problems in the future. Checking each sector on a disk is a time-intensive process—and one that you won’t perform often. More typically, you’ll use ChkDsk /F to check for and repair common errors.

Windows Server 2012 R2 analyzes fragmentation and optimizes volumes as part of automated maintenance. Windows does this by using the Optimize Drives utility. Although automated maintenance triggers the disk analysis, the process of calling and managing Optimize Drives is handled by a separate task. In Task Scheduler, you find the ScheduledDefrag task in the scheduler library under MicrosoftWindowsDefrag, and you can get detailed run information on the task’s History tab.

Automatic analysis and optimization of disks can occur while the disks are online so long as the computer is on AC power and the operating system is running but otherwise idle. By default, disk optimization is a weekly task rather than a daily task—and there’s a good reason for this. Normally, you need to optimize a server’s disks only periodically, and optimization once a week is sufficient in most cases. That said, the more frequently data is updated on drives, the more often disks should be optimized.

Windows automatically performs cyclic pickup defragmentation. With this feature, when a scheduled defragmentation pass is stopped and rerun, the computer automatically picks up the next unfinished volume in line to be defragmented. Although nonsystem disks can be rapidly analyzed and optimized, it can take significantly longer to optimize system disks online.

You can control the approximate start time for the analysis and optimization of disks by changing the automated maintenance start time. Windows Server also notifies you if three consecutive runs are missed. All internal drives and certain external drives are optimized automatically as part of the regular schedule, as are new drives you connect to the server.

With manual optimization, Optimize Drives performs an online analysis of volumes and then reports the percentage of fragmentation. If defragmentation is needed, you can then elect to perform online defragmentation. System and boot volumes can be defragmented online as well, and Optimize Drives can be used with FAT, FAT32, exFAT, NTFS, and ReFS volumes.

You can configure and manage automated defragmentation by following these steps:

By using Optimize Drives, you can check for and correct volume fragmentation problems on FAT, FAT32, and NTFS volumes. The areas checked for fragmentation include the volume, files, folders, page file (if one exists on the volume), and the MFT. You also can defragment volumes with cluster sizes greater than 4 KBs.

You can run the graphical version of Optimize Drives by using either File Explorer or Computer Management. In File Explorer, press and hold or right-click the volume and choose Properties. On the Tools tab of the Properties dialog box, tap or click Optimize to open the Optimize Drives dialog box. In Computer Management, select the Storage node and then the Disk Management node. Press and hold or right-click a drive and then select Properties. On the Tools tab, tap or click Optimize.

In the Optimize Drives dialog box, select a disk and then tap or click Analyze. Optimize Drives then analyzes the disk to determine whether it needs to be defragmented. If so, it recommends that you defragment at this point. If a disk needs to be defragmented, select the disk and then tap or click Optimize. Depending on the size of the disk, defragmentation can take several hours. You can tap or click Stop at any time to stop defragmentation.

Optimize Drives can also be run at the command line by using Defrag (Defrag.exe). You can run Optimize Drives in analysis mode at the command line by typing defrag /a followed by the drive designator. For example, if you want to analyze the fragmentation of the D drive, you type defrag /a d:. To analyze and then defragment a volume if defragmentation is necessary, type defrag followed by the drive designator, such as defrag d:. No parameters are necessary (because the /d parameter is implied, which performs a traditional defrag).

You defrag multiple drives by providing the designator of each drive you want to defrag, such as:

defrag /a c: d: g:

This specifies that you want to defrag the C, D, and G drives. By default, Defrag runs with low priority and defrags each volume in turn. Here, that would mean the utility would defrag the C drive, then the D drive, and finally the G drive.

Defrag has several syntaxes. The syntax for analyzing volumes without defragmentation is:

defrag volume(s) /a [/h] [/m] | [/u] [/v]

Here, when you use /h, /m, or both, you cannot use /u, /v, or both. The /h parameter enables you to run the defrag with normal priority, which gives the defrag task the same priority as most other processes and should speed up the defrag. The /m parameter enables Windows to defrag multiple volumes at the same time, in parallel rather than in a series. The /u parameter displays the defrag progress, and the /v parameter displays verbose output, which includes fragmentation statistics. Following this, you could defrag the C, D, and G drives in parallel at normal priority by typing:

defrag c: d: g: /a /h /m

Analyze (/a) is one of several independent tasks that you can perform. Other independent tasks you can perform include traditional defrag (/d), optimization (/o), and free-space consolidation (/x). The syntax for all three variations is the same except for the primary task being performed. As an example, if defrag specifies that drives need to be optimized to reduce fragmentation, you use /o to do this. The syntax for optimizing fragmented drives is:

defrag volume(s) /o [/h] [/m] | [/u] [/v]

The optimization process focuses on reduced file fragmentation. Over time, free space on a drive also can become fragmented. You can use the /x parameter to consolidate the free-space fragments, and the syntax is:

defrag volume(s) /x [/h] [/m] | [/u] [/v]

Rather than trying to remember all these syntaxes separately, I recommend focusing on the primary tasks you can perform: analysis (/a), traditional defrag (/d), optimization (/o), and free-space consolidation (/x). Then consider the additional options you might want to use, including either higher priority (/h) and multitasking (/m) or progress updates (/u) and verbose output (/v).

defrag volume(s) /k [/h] [/m] | [/u] [/v]

defrag volume(s) /l [/h] [/m] | [/u] [/v]

Table 16-2 summarizes available Defrag options and parameters and their uses. Note the /C and /E parameters. You use the /C parameter when you want to defrag all available volumes (and don’t want to specify the volumes individually by drive designator). You use the /E parameter when you want to defrag all available volumes except those specified after the /E parameter. For example, if you wanted to defrag all available volumes except the D and G drives, you enter:

defrag /d /e d: g:

You can perform fragmentation analysis at the command line by using the /a and /v parameters. The command-line report shows the summary of fragmentation. The summary looks like this:

Invoking analysis on (C:)...
Post Defragmentation Report:
        Volume Information:
                Volume size                 = 183.99 GB
                Cluster size                = 4 KB
                Used space                  = 146.14 GB
                Free space                  = 37.85 GB
        Fragmentation:
                Total fragmented space      = 7%
                Average fragments per file  = 1.09
                Movable files and folders   = 716750
                Unmovable files and folders = 20
        Files:
                Fragmented files            = 8265
                Total file fragments        = 61643
        Folders:
                Total folders               = 32654
                Fragmented folders          = 2274
                Total folder fragments      = 9690
        Free space:
                Free space count            = 2470
                Average free space size     = 15.64 MB
                Largest free space size     = 7.24 GB
        Master File Table (MFT):
                MFT size                    = 921.25 MB
                MFT record count            = 943359
                MFT usage                   = 100%
                Total MFT fragments         = 7
        Note: File fragments larger than 64MB are not included in the
fragmentation statistics.
        You do not need to defragment this volume.

The summary of the volume’s configuration and space usage reports on the following areas:

If you run Defrag again, using /o, Optimize Drives sets about cleaning up the drive to give optimal space usage. This won’t clear up all fragmentation, but it will help so that disk space is used more efficiently. On a volume like the one shown with very little fragmentation, you won’t really see performance improvements after defragmentation. However, if the fragmentation percentage were higher, performance improvements could be considerable.

With virtual disks, slab consolidation and retrim are used to optimize external structures. You can perform these tasks at the command line by using the /k and /v parameters. The command-line report shows the summary of optimization. The summary looks like this:

Invoking slab consolidation on New Volume (I:)...
        Retrim:  100% complete.
        Slab consolidation: 100% complete.
The operation completed successfully.
Post Defragmentation Report:
        Volume Information:
                Volume size                 = 126.99 GB
                Cluster size                = 4 KB
                Used space                  = 102.06 GB
                Free space                  = 24.93 GB
        Allocation Units:
                Slab count                  = 4063
                Slab size                   = 32 MB
                Slab alignment              = 31.00 MB
                In-use slabs                = 3266
        Slab Consolidation:
                Space efficiency            = 92%
                Potential purgable slabs    = 48
                Slabs pinned unmovable      = 704
                Successfully purged slabs   = 36
                Recovered space             = 1152 MB
        Retrim:
                Backed allocations          = 68
                Allocations trimmed         = 18
                Total space trimmed         = 539.82 MB

The summary reports on the following areas: