Maintaining and Updating Maintaining and Updating Windows Server 2008Windows Server 2008

Lesson 8

Skills MatrixSkills Matrix

Technology Skill Objective Domain Objective #

Configuring Windows Server Update Services (WSUS)

Configure Windows Server Update Services (WSUS) server settings

5.1

Using the Performance Monitor

Capture performance data

5.2

Using the Windows Event Viewer

Monitor event logs 5.3

Using Network Monitor to Gather Network Data

Gather network data 5.4

Monitoring a Windows Server 2008Monitoring a Windows Server 2008

• There are two approaches to maintaining your network: the reactive approach and the proactive approach.

• After implementation of your network design is complete and you have verified that your network works properly, the reactive approach means that you will “wait and see” what problems arise.

Monitoring a Windows Server 2008Monitoring a Windows Server 2008• A proactive approach doesn’t wait for

problems to arise. – A proactive approach to network management is

preventative and uses tools such as the Performance and Reliability Monitor, the Event Viewer, and Network Monitor utilities.

– Proactive system administrators use these tools to help spot potential and actual networking issues without wasting time guessing what the problems might be because they lack historical data.

– They do this by systematically monitoring, logging, and analyzing the network’s data.

Reliability and Performance MonitorReliability and Performance Monitor

• Located within the Administrative Tools folder.

• Allows you to collect real-time information on your local computer or from a specific computer to which you have permissions.

• This information can be viewed in a number of different formats that include line charts and histograms.

Reliability and Performance MonitorReliability and Performance Monitor

Reliability and Performance MonitorReliability and Performance Monitor

Performance MonitorPerformance Monitor• Probably the most frequently used view

within the Reliability and Performance Monitor is the Performance Monitor.

• One of the simplest methods is to open the Start menu, key perfmon.exe, and then click OK.

• Performance Monitor provides detailed information necessary for in-depth analysis, logging capabilities, and alerts, which are useful for early warnings of possible system issues.

Performance MonitorPerformance Monitor

Data Collector SetsData Collector Sets• One of the significant changes introduced in Windows

Server 2008 performance monitoring is the Data Collector Set.

• Rather than manually adding individual performance counters anytime you want to monitor performance on a 2008 server, Data Collector Sets allow you to organize a set of performance counters, event traces, and system configuration data into a single “object” that you can reuse on one or more Windows Server 2008 servers.

• You can view the counters associated with Data Collector Sets in Performance Monitor view, use them to generate alert actions when particular performance thresholds are reached, and integrate them with the Windows Task Scheduler to collect performance data at specific times.

Data Collector SetsData Collector Sets• There are three built-in Data Collector

Sets within Windows Server 2008 — LAN Diagnostics, System Diagnostics, and System Performance — or you can create your own custom sets.

• You also have the ability to create Data Collector Set templates that are based on the XML file format, thus allowing you to distribute templates across multiple servers for use by other administrators.

Data Collector SetsData Collector Sets

Data Collector SetsData Collector Sets

Data Collector SetsData Collector Sets

Data Collector SetsData Collector Sets

Securing Access to Performance DataSecuring Access to Performance Data

• A common request from network administrators in previous versions of Windows is the ability to delegate access to performance data without allowing full administrative rights to a particular server.

• To this end, Windows Server 2008 includes a number of built-in group objects that grant limited access to performance data.

Securing Access to Performance DataSecuring Access to Performance Data• Members of the Performance

Monitor Users group, by default, are delegated the following additional abilities to view performance data:– Members of Performance Monitor Users

can view both real-time and historical data within the Performance Monitor console and can use the Reliability Monitor.

– Members of Performance Monitor Users cannot create or modify Data Collector Sets or use the Resource View.

Securing Access to Performance DataSecuring Access to Performance Data• Members of the Performance Log

Users group have all of the rights available to normal Users and Performance Monitor Users.

• In addition, Performance Log Users also have the ability to create and modify Data Collector Sets, but only after an administrator has assigned this group the Log on as a batch user user right on the server or servers in question.

Windows Event ViewerWindows Event Viewer

• Windows Server 2008 uses the Windows Event Viewer to record system events that take place, such as security, application, and role-specific events.

Windows Event ViewerWindows Event Viewer

Network MonitorNetwork Monitor• If you receive reports that a Windows

Server 2008 computer is not responding fast enough, you might want to isolate the view of the network traffic that is being sent to or from that server.

• You may also need to view network traffic to determine if a client application is faulting, or to determine if a malicious user or virus is attempting to access the computer over the network.

Network MonitorNetwork Monitor• Windows Server 2008 does not include a

built-in network monitor, but you can download and install the latest version of Network Monitor from the Microsoft Web site.

• This free download will allow you to view network traffic that is being sent to and from the network interface cards on a particular Windows Server 2008 computer.

• You can view network captures in real-time, or save the information to a file to be analyzed later.

Network MonitorNetwork Monitor

Network MonitorNetwork Monitor

Windows Server Update Services Windows Server Update Services (WSUS)(WSUS)• Traditionally, system administrators

and users kept systems up-to-date by frequently checking the Microsoft Windows Update Web site or the Microsoft Security Web site for software updates.

• Administrators manually downloaded available updates, tested the updates in their environment, and then distributed the updates manually or with traditional software distribution tools.

Windows Server Update Services Windows Server Update Services (WSUS)(WSUS)• To improve the manageability of this

process, Microsoft introduced Windows Server Update Services (WSUS)– A Web-based tool for managing and

distributing software updates that resolve known security vulnerabilities or otherwise improve performance.

– For Microsoft Windows XP, Windows Vista, Microsoft Windows Server 2003, and Windows Server 2008 operating systems.

– The latest version of WSUS (WSUS 3.0 with Service Pack 1 at the time of this writing) is a free download from the Microsoft Web site that can be installed on a Windows Server 2008 computer.

Windows Server Update ServicesWindows Server Update Services

WSUS Distributed WSUS Distributed InfrastructureInfrastructure• A server that runs

WSUS can be synchronized from the public Windows Update servers, from another server running WSUS, or from a manually configured content distribution point.

• WSUS servers can download and store content locally, or they can use the content on the Windows Update Web site.

Setting WSUS Client Settings with Setting WSUS Client Settings with GPOsGPOs

Setting WSUS Client Settings with Setting WSUS Client Settings with GPOsGPOs

SummarySummary

• When monitoring the health of Windows Server 2008, you can examine the Window Event Viewer to obtain information.

• By default, it logs informational events such as service start and stop messages, errors, and warnings.

• Additional diagnostic logging can be achieved by modifying the registry.

SummarySummary

• Reliability and Performance Monitor in Windows Server 2008 allows you to collect real-time information on your local computer or from a specific computer to which you have permissions.

• This information can be viewed in a number of different formats that include charts, graphs, and histograms.

SummarySummary• Reliability and Performance Monitor uses

performance objects, or categories, and performance counters to organize performance information. – Performance counters are the specific

processes to monitor. – Many counters are available.

• WSUS is a tool used to manage and distribute software updates that fix known security vulnerabilities or otherwise improve the performance of Microsoft operating systems.

SummarySummary

• Updates can include items such as security fixes, critical updates, and critical drivers.

• Windows Update is a Microsoft Web site that works with Automatic Updates to provide timely critical and noncritical system updates.

• Automatic Updates enables you to automatically interact with the Windows Update Web site.

SummarySummary

• WSUS has three main components:– A content synchronization service.– An internal Windows Update server.– Automatic Updates on computers

(desktops or servers).

SummarySummary• WSUS server management includes

reviewing and changing configuration options, automatically or manually synchronizing the server, viewing update status, and backing up and restoring the server.

• You can configure Automatic Updates through the Automatic Updates configuration page, Group Policy, and by configuring registry entries.