Windows Server: Chapter 14 - Performance Monitoring

Chapter 14: Performance Bottlenecks and Monitoring Tools

• Performance Bottlenecks: A bottleneck is a component impacting server performance. Common bottlenecks include the processor, disk subsystem, memory, and network subsystem. The specific bottlenecks can vary depending on the server's role (e.g., file server vs. application server). File servers often rely on fast disks and networks, while application servers might require a fast CPU.

Monitoring Tools in Windows Server

• Task Manager: This tool displays real-time usage of processor, memory, disk, and network resources. It also identifies processors with high resource consumption.

Event Viewer

• Functionality: Shows logs that can affect performance. Users can create custom views, set triggers for alerts, and review event details.
• Major Event Viewer Logs: Includes application logs, security logs, setup logs, system logs, forwarded events, and other logs. These logs provide detailed information relevant to server performance.

Performance Monitor

• Functionality: Supports monitoring performance in real-time, both locally and remotely, through logged performance counters.
• Data Collection: Data is collected and stored in log files, which can act as baselines for future comparisons. The tool can be used to spot trends over time.
• Views: Performance Monitor displays real-time data in various views, including line charts, histograms, and reports.

Monitoring AD Performance

• Domain Controllers: Domain controllers provide services for authentication, directory search, and replication.
• NTDS Object Counters: Tools can track performance with NTDS (NT Domain Security) object counters such as directory read/sec, search/sec, and write/sec. In addition, inbound/outbound bytes per second (total) can be monitored.
• Security System Counters: Wide-ranging performance counters for the security system are tracked.

Other Handy Tools

• MSConfig: A utility for configuring system settings.
• MSinfo: Provides system information.

Backing Up and Restoring Active Directory

• Backup Importance: Backups copy data for restoration after data loss.
• Active Directory Database: Backing up the AD Database is critical, as AD often contains large amounts of information.
• Backup Methods: Backups can restore an entire system, specific files, or objects. Backups are useful in various scenarios, including corruption and recovery from large scale outages.
• Backup Media: Backup media includes magnetic tapes, hard disks, DVDs, and cloud storage options.

Types of System Data to Backup

• AD Database: Critically important to back up to prevent corruption
• Size Support: AD supports up to over 2 billion objects and 16 terabytes of size.
• NTDS: Files are stored in C:\Windows\NTDS.
• Transaction Logs: edb.log is a transaction log; a crucial file for keeping track of system changes.
• System State: A collection of components not in a single file, backed up easily.
• SYSVOL: A shared directory, storing login scripts, and group policies. It is crucial to back up for stability and security.
• DFS: The distributed file system (DFS) staging folder and corresponding files help synchronize data between domain controllers.

Performing Active Directory Restore

• Restoration Types: Active Directory restores have "non-authoritative" and "authoritative" restoration types.
• Non-Authoritative: Used when corruption impacts only a single domain controller (DC) and not replicated across other DCs. Restore requires booting into directory service repair mode.
• Authoritative: Overriding any existing information when the restore needs to propagate across other domain controllers. Starting the backup program begins the recovery process.

Active Directory Recycle Bin

• Enabling: There are several ways to enable the recycle bin feature. One method involves the Active Directory Administrative Center. Another method uses PowerShell commands.
• Restoration and Removal: Items deleted must be restored from the bin before removal is fully processed.

Chapter 14 discusses performance bottlenecks in Windows Server, such as processor, disk, memory, and network. It also introduces key monitoring tools like Task Manager and Event Viewer. Event Viewer tracks application, security, and system logs to identify issues.