In this demonstration,
we're going to do a tour of several of the built‑in
Windows Server troubleshooting tools.
First, we can right‑click the taskbar and invoke good old Task Manager,
most everybody's first line of defense in terms of
troubleshooting system performance.
We've got our Process list.
We can end those tasks.
We've got our Performance, which shares some similarities.
See the link down here to Resource Monitor?
Let's give that a click.
Resource Monitor truly is an expanded version of Task Manager,
give you a very nice view.
I find that when I present on this live,
many students think, wow, I totally forgot that these tools existed,
so I hope that you have an "aha" moment along those lines.
It is easy to forget they exist.
CPU, we can look at Services and their relative CPU.
All these columns are sortable.
Let's see, I'm looking for exports.
I'm not seeing any export capability here unfortunately.
Let me bring this over here, Large, no those are just the running graph views.
Okay, so that's that.
Let's see, Task manager has our user and their Memory and CPU.
Details gives you more process‑related information.
Then we have our Services list.
By the way, I probably should have said this.
I'm on one of my Windows Server 2022 domain member servers.
Alright, so how about Reliability Monitor.
That can be found in good,
old‑fashioned Control Panel under the Security and Maintenance umbrella.
And I like it, as I had mentioned before,
that you can see a longer picture of historical reliability,
and we can look at it by days or by weeks.
And we can see here in this case,
I actually created this machine not too long ago,
so all of this graph data you see to the left it doesn't even start until
this date because the VM never existed before that point,
you see.
Let's go back to Days,
and then we can drill in on particular days where we
had things like application failures, DHCP Server stopped working.
And you can double left‑click these events and you can get some
pretty detailed exception data that you may find helpful to work
with a Microsoft support engineer, for example.
What I like about this is that there's a Copy to
clipboard so you can gather this out, put it in a document,
share it with a support engineer, etc.
Let's see, anything else that's interesting?
Well, it looks like I need to look at my DHCP Server, number one.
And then we've got something with a Security Intelligence Update,
just that it was successfully installed.
Okay, so that's Reliability Monitor.
Next let's take a look at Performance Monitor.
I've got another instance of Resource Monitor, let me close that.
Here's good old perfmon.
Now what we've got here, let me collapse these sections, three main sections.
We've got the Performance Monitor itself,
which is our live view, and it loads in the % Processor Time counter,
and you can change its behavior in the Properties sheet here,
including its appearance, the graph, how it's charting on the graph,
and so on, and so forth.
But let me artificially create a spike in CPU.
Yeah, so we can see this live.
None of this is being logged or saved.
It gives you a live picture.
And we can control, we can add additional counters in.
And I had mentioned that when you're monitoring,
it's best to monitor remotely, so we could,
for instance, instead of looking at the local computer,
let's say we wanted to look at the CPU of our domain controller,
dc1.
I can click Browse to browse the network,
or I may be able to use a universal naming convention path here.
Let me see if I can resolve dc1, yeah.
And we can look here, we've got our objects,
remember the object is at the top of the hierarchy.
So instead of Processor, let's look at PhysicalDisk.
And we can look at input/output statistics here.
Avg.
Disk Queue Length is important.
And so the object would be PhysicalDisk,
LogicalDisk, whatever, there's objects for both.
Then you've got your instances.
In this case, we've got volumes, basically,
so we could look at Read Queue Length just for our C drive by adding that in.
And so now we're superimposing, if we look down below,
we've got two counters loaded in, one on MEM1,
the other on dc1,
and this allows you to do some comparison and contrast on multiple machines.
Now you may want to change the way that the graph appears.
This is useful for me.
As a color blind person,
you can do a Histogram bar and you also can do a Report view,
which just gives you every second when it creates a new reading,
it gives you a new value there.
Okay, so that's Performance Monitor.
The data collector set allows you to actually record and save this kind of data,
and we have some built‑in System DCSs,
and then you have the capacity to create your own user‑defined DCSs.
Let's take a look.
I've been running the System Performance one quite a bit.
If I right‑click and go to its properties,
this just gives you the ability to control the
behavior in terms of scheduling Start, scheduling Stop,
when the Stop Condition is,
and if you want to do automation when the data collector set stops,
maybe export the data to a network share location,
whatever.
If we take a look at the components of the DCS,
you can see in this case we've got a Performance Counter
category that brings in a whole lot of objects.
Look at all those stars.
The star is a wild card, you probably know this,
that denotes all of the child objects underneath that level.
So this is actually gathering a whole lot of Performance Counter data across,
it looks like CPU, memory, disk, and network.
And then we have a trace for looking at Windows kernel events.
So the way this looks is if you're going to do a
user‑defined data collector set,
you either start with a template or you could start Advanced.
I'll call this az801, click Next.
What is the template you want to start with?
I'll just do Basic, click Next.
Choose where you want the data saved, under what credential you want to use,
and then now that you've got an empty one that's got just buckets for,
in this case it looks like there's a Trace,
Configuration, and Performance Counter.
The Configuration, like I said before,
is where you can follow registry keys; The Kernel,
again,
is going to be particular event providers; and Performance
Counter allows you to get back to this dialog to look at
local or remote performance counters.
And then, again, you can manually start and stop these by right‑clicking.
Otherwise, you can run them on a schedule.
You can templatize these and export them and import them.
Notice that there's a Latest Report option. So I can right‑click
System Performance and go to Latest Report,
and it will come down into the third section of Performance
Monitor and it will show one of the report files.
And it's a static picture that includes important summary
data up on top in terms of average utilization over the
sample time that that report ran.
These are just very short 60‑second, 77‑second snapshots here in this list,
but these reports can be awfully useful in terms of
getting a more holistic picture.
You want to capture what's called a baseline of your
Windows Server system performance.
That make sense?
Alright, good.
Lastly, let's go to Event Viewer and let's take a look at this.
I wanted to show you how to set up event subscriptions
in case that shows up on your exam.
Now first of all, like I said, you've got your traditional Windows Logs,
Application, Security, Setup, System,
and then depending upon all the roles and features and
third‑party software you have installed on that server,
you will have a number of additional logs.
Again, all of them have the same user interface,
so you can use your search, and create custom views,
and so on within here.
You can connect to remote machines.
I'm just looking at the local machine here,
but I can definitely make a connection across my local area
network to another machine if I want to.
As far as configuring subscriptions, so if I wanted to,
for example, gather event log data from my domain controller,
dc1, I like to use PowerShell for this, so let me show you my PowerShell.
Let me zoom in here in VS Code.
Here is a link to a nice tutorial that I found that gave me this code.
Here we're using a combination of PowerShell and just old‑fashioned executables.
So the collector machine is the machine that you're going
to use to view the collected files,
and that would be in my case this machine that I'm on right now,
mem1.
I think that's what its title is.
And wecutil qc configures ports and protocols to support that collection.
And then on the target monitored system,
you can verify whether Server Manager remoting is enabled with line 9,
and you can enable it by running Configure‑SMRemoting.exe ‑ENABLE,
so that's what's called Server Manager remoting.
And then lastly, we've got adding the client to the
server's Event Log Readers group.
Do you have to use PowerShell?
No, but it's convenient.
And so what line 13 is doing is ensuring that my mem1 computer,
my collector, the one I'm on right now,
is a member of the local Event Log Readers group on my
target machine that I'm monitoring,
dc1. And I ran that in the context of
Invoke‑Command. I did an Invoke‑Command dc1,
and then for my script block I sent it over line 13,
okay?
That's the setup.
Then you create your subscription.
So we can go to Subscriptions here in Event Viewer, create a subscription.
Give it a name, I'll call this dc1‑system‑log.
The destination log by default is Forwarded Events.
That's one of the basic prebuilt windows logs, but you can change that.
This is going to be a Collector initiated, when this
machine will query the machine and say, hey,
you got any events for me? So I'll Select and Add Domain Computers.