How to Configure iSCSI Initiator Connections and Target Portals in Windows 11 Using PowerShell

Internet Small Computer Systems Interface (iSCSI) enables block-level storage sharing across standard IP networks by encapsulating SCSI commands within TCP packets. In virtualized enterprise environments, homelabs, and media editing workstations running Windows 11, connecting to networked storage arrays (SAN) or Network Attached Storage (NAS) devices (such as Synology, TrueNAS, or Windows Server iSCSI Targets) provides high-performance raw volumes that function identically to locally attached NVMe or SATA drives.

While Windows 11 provides a graphical control panel applet (iscsicpl.exe) for basic configuration, automating storage attachments, establishing multi-path I/O (MPIO), and configuring mutual Challenge Handshake Authentication Protocol (CHAP) is far more reliable and repeatable using PowerShell. This guide demonstrates how to configure the Microsoft iSCSI Initiator service, register target portals, authenticate against targets, and mount persistent LUNs in Windows 11 using native PowerShell cmdlets.

Enabling and Initializing the Microsoft iSCSI Initiator Service

By default in Windows 11, the Microsoft iSCSI Initiator service (MSiSCSI) is set to manual startup. Before executing iSCSI cmdlets, configure the service to start automatically and initialize its kernel drivers.

Launch an elevated PowerShell console as Administrator and execute:

# Set MSiSCSI service startup to Automatic and start the service
Set-Service -Name MSiSCSI -StartupType Automatic
Start-Service -Name MSiSCSI

# Verify the service status
Get-Service -Name MSiSCSI

Each iSCSI client is identified on the storage network by a unique iSCSI Qualified Name (IQN). You can inspect your workstation’s local IQN using Get-InitiatorPort:

(Get-InitiatorPort).NodeAddress

A typical node address appears as iqn.1991-05.com.microsoft:desktop-win11-host. Provide this initiator IQN to your SAN or NAS storage administrator so that target LUN masking and access permissions can be granted to your machine.

Registering Remote Target Portals

An iSCSI target portal represents the IP address or hostname and TCP port (default 3260) of the storage provider. To discover available storage targets, register the portal IP address with your local initiator.

To register a new target portal in PowerShell, run:

New-IscsiTargetPortal -TargetPortalAddress "192.168.10.50" -TargetPortalPortNumber 3260

To view all registered target portals on your Windows 11 system, execute:

Get-IscsiTargetPortal

Once the portal is registered, the Microsoft iSCSI Initiator automatically issues a SendTargets discovery command. To inspect the storage targets advertised by the SAN or NAS, run:

Get-IscsiTarget

This outputs the discovered target IQNs, such as iqn.2005-10.org.truenas.ctl:target-san-vol01, along with their current connection status (Connected: False).

Connecting to an iSCSI Target and Establishing Persistent Sessions

Once you identify the target IQN you wish to mount, connect to it. For production workloads and workstation reboots, ensure you mark the connection as persistent so that Windows automatically re-establishes the block storage session during system boot.

To connect to an unauthenticated iSCSI target persistently, run:

$TargetIQN = "iqn.2005-10.org.truenas.ctl:target-san-vol01"

Connect-IscsiTarget -NodeAddress $TargetIQN -IsPersistent $true

If you have multiple physical network adapters or dedicated storage VLANs, bind the connection to a specific local IP address and network interface:

Connect-IscsiTarget -NodeAddress $TargetIQN `
    -TargetPortalAddress "192.168.10.50" `
    -InitiatorPortalAddress "192.168.10.25" `
    -IsPersistent $true

Configuring CHAP and Mutual CHAP Authentication

To protect networked block storage against unauthorized mounting, enterprise storage networks frequently enforce CHAP authentication. You can specify one-way or mutual (bi-directional) CHAP secrets in PowerShell.

To configure one-way CHAP authentication where the client authenticates to the storage target:

# Set the CHAP secret for the target connection
$ChapSecret = "StorageSecretPassword123!" | ConvertTo-SecureString -AsPlainText -Force

Connect-IscsiTarget -NodeAddress $TargetIQN `
    -AuthenticationType OneWayCHAP `
    -ChapUsername "win11-initiator" `
    -ChapSecret $ChapSecret `
    -IsPersistent $true

If your environment enforces mutual CHAP (where both initiator and target verify each other’s credentials), set the local initiator secret first:

# Set the local initiator CHAP secret
Set-IscsiChapSecret -ChapSecret "InitiatorSecretPass456!"

# Connect using Mutual CHAP
Connect-IscsiTarget -NodeAddress $TargetIQN `
    -AuthenticationType MutualCHAP `
    -ChapUsername "win11-initiator" `
    -ChapSecret $ChapSecret `
    -IsPersistent $true

Verifying Active Sessions and Mounting the Storage Disk

After establishing the connection, verify that the iSCSI session is active and check the session parameters:

Get-IscsiSession | Select-Object SessionIdentifier, InitiatorNodeAddress, TargetNodeAddress, IsConnected, IsPersistent

To inspect the underlying connection properties, including negotiate maximum receive data segment length (MaxRecvDataSegmentLength), run:

Get-IscsiConnection | Format-List *

Once the block session is established, the storage target’s LUNs appear in the Windows Storage subsystem as raw uninitialized disks. To inspect newly attached raw disks in PowerShell, run:

Get-Disk | Where-Object { $_.BusType -eq "iSCSI" }

You can initialize, partition, and format the new disk directly using standard storage management cmdlets:

# Initialize raw iSCSI disk (replace Number with your target disk number)
$TargetDiskNumber = (Get-Disk | Where-Object { $_.BusType -eq "iSCSI" -and $_.OperationalStatus -eq "Offline" }).Number

# Bring disk online and initialize as GPT
Set-Disk -Number $TargetDiskNumber -IsOffline $false
Set-Disk -Number $TargetDiskNumber -IsReadOnly $false
Initialize-Disk -Number $TargetDiskNumber -PartitionStyle GPT

# Create NTFS volume and assign drive letter
$Partition = New-Partition -DiskNumber $TargetDiskNumber -UseMaximumSize -AssignDriveLetter
Format-Volume -Partition $Partition -FileSystem NTFS -NewFileSystemLabel "SAN_Storage" -Confirm:$false

Disconnecting Targets and Removing Portals

When decommissioning network storage or unmounting a volume for maintenance, safely disconnect sessions before removing target portals.

To disconnect an active iSCSI session:

# Retrieve and disconnect session
$Session = Get-IscsiSession -TargetNodeAddress $TargetIQN
Disconnect-IscsiTarget -SessionIdentifier $Session.SessionIdentifier -Confirm:$false

If the target was configured as persistent, remove it from the persistent target registry:

# Unregister persistent binding
Unregister-IscsiPersistentTarget -TargetName $TargetIQN

To remove the target portal registration completely:

Remove-IscsiTargetPortal -TargetPortalAddress "192.168.10.50" -Confirm:$false