5 5 4 CHAPTER 10 Monitoring Performance and Events 11. In the Subscription Properties dialog box, click OK. 12. To generate a Kernel event on Boston, log on to Boston, using the Kim_Akers account (if necessary) and change the system time. 13. Open Event Viewer and check the System log. You should see an Information event with a source of Kernel-General. 14. If necessary, log on to the Glasgow domain controller, using the Kim_Akers account. 15. Open Event Viewer and select the Forwarded Events log. The Kernel-General Informa- tion event should be stored in this log after, at most, 15 minutes. ExErcisE 4 Create a Custom View In this exercise, you specify filter conditions and save the filter as a custom view. 1. If necessary, log on to the Glasgow domain controller, using the Kim_Akers account. 2. Open Event Viewer. 3. On the Action menu, select Create Custom View. The Custom View dialog box appears. 4. To filter events based upon when they occurred, select the corresponding time period from the Logged drop-down list. You have the options of Last Hour, Last 24 Hours, Last 7 Days, Last 30 Days, or Custom Range. If you choose Custom Range, you can specify the earliest date and time from which you want to display events and the latest date and time from which you want to display events in the Custom Range dialog box. 5. Choose Last 24 Hours. 6. In Event Level, select the Critical and Error check boxes. 7. You can specify either the event logs or the event sources of the events that will appear in the custom view. Choose By Log and select Windows Logs. 8. In Event IDs, specify a range from 4624 through 4634 (type 4624-4634). If you specify Event IDs, Task Category is grayed out. 9. In Keywords, specify All Keywords. 10. In User, enter Kim_Akers. 11. In Computer(s), enter Glasgow. Your configured Custom View dialog box should look similar to Figure 10-32. Lesson 2: Monitoring Event Logs CHAPTER 10 555 FIGURE 10-32 A configured Custom View dialog box. 12. Click OK. 13. In the Save Filter To Custom View dialog box, in Name, type MyCustomView. 14. In Description, type Trial Custom View. Click OK. The Custom View you have created is now in Event Viewer, as shown in Figure 10-33. If you want to, you can export this and import it to other computers as described earlier in this lesson. Note that you can access preconfigured custom views by expanding Server Roles under Custom Views. FIGURE 10-33 A Custom View listed in Event Viewer. 5 5 6 CHAPTER 10 Monitoring Performance and Events Lesson Summary n Event forwarding transfers events that match a specifi ed fi lter from one or more source computers to a collector computer. To use event forwarding, confi gure both the col- lector and source computers. Then you can confi gure the event subscription on the collector computer. In collector-initiated subscriptions, you confi gure the computers manually. In source-initiated subscriptions, you can use Group Policy to confi gure domain-based source computers. n You can save an event fi lter as a custom view. This enables you to reuse it if you need to fi lter more events. n Applications and Services logs are a new category of event logs in Windows Server 2008. They store events from a single application or component. Lesson Review You can use the following questions to test your knowledge of the information in Lesson 2, “Monitoring Event Logs.” The questions are also available on the companion DVD if you pre- fer to review them in electronic form. NOTE ANSWERS Answers to these questions and explanations of why each answer choice is right or wrong are located in the “Answers” section at the end of the book. 1. You have confi gured a Windows Server 2008 server named Glasgow to collect events from a Windows Server 2008 server named Boston. Both computers are in the same domain. You confi gured the event subscriptions by selecting the default options for event delivery optimization and using the HTTP protocol. You are not collecting events from the Security Event log. You fi nd that the subscriptions do not work. Which of the following actions would you carry out to ensure that events on Boston are collected by Glasgow? (Choose three. Each correct answer presents part of a complete solution.) A. Enter the winrm quickconfi g command on Glasgow. B. Enter the wecutil qc command on Glasgow. C. Add the computer account for Glasgow to the local Event Log Readers group on Boston. D. Enter the winrm quickconfi g command on Boston. E. Enter the wecutil qc command on Boston. F. Add the computer account for Boston to the local Event Log Readers group on Glasgow. NOTE ANSWERS NOTE ANSWERSNOTE Answers to these questions and explanations of why each answer choice is right or wrong are located in the “Answers” section at the end of the book. Lesson 2: Monitoring Event Logs CHAPTER 10 557 2. You are configuring a Windows Server 2008 server named Glasgow to retrieve events from a computer, running Microsoft Vista, named Melbourne. Both computers are in the contoso.internal domain. Which of the following commands would you run on the collector computer to configure the Event Collector service? A. wecutil qc B. winrm quickconfig C. net localgroup “Event Log Readers” Glasgow$@contoso.internal /add D. %SYSTEMROOT%\System32\gpedit.msc 3. You have created a subscription called Disk Problems. You need to configure this sub- scription to update every five minutes. Which commands should you enter? (Choose two. Each correct answer presents part of a complete solution.) A. wecutil gs “Disk Problems” /hi:300 B. wecutil gs “Disk Problems” /hi:300000 C. wecutil gs “Disk Problems” /cm:custom D. wecutil ss “Disk Problems” /cm:custom E. wecutil ss “Application Failures” /hi:300 F. wecutil ss “Application Failures” /hi:300000 4. Your network is experiencing problems when you install or remove printers. You open Event Viewer and access the Applications and Services logs. You need to determine when printers were installed or removed and diagnose any problems that occurred. You also need to know whether applications failed to connect to printers. What event types should you search for? (Choose two. Each correct answer presents part of a com- plete solution.) A. Admin B. Operational C. Analytic D. Debug 5 5 8 CHAPTER 10 Monitoring Performance and Events Chapter Review To further practice and reinforce the skills you learned in this chapter, you can perform the following tasks: n Review the chapter summary. n Complete the case scenarios. These scenarios set up real-world situations involving the topics of this chapter and ask you to create solutions. n Complete the suggested practices. n Take a practice test. Chapter Summary n Performance Monitor displays performance counters in real time or log files, created when you run a data collector set, that enable you to gather information about a com- puter’s current state for later analysis. Reliability Monitor gives an indication of system stability and records application installations and failures. n You can use Event Forwarding and event subscriptions to gather event information from a number of source computers and view this information on one collector com- puter. You can save event filters as custom views and access Applications and Services logs that store events from a single application or component. Case Scenarios In the following case scenarios, you apply what you’ve learned about monitoring perfor- mance and events. You can find answers to these questions in the “Answers” section at the end of this book. Case Scenario 1: Troubleshooting a Performance Problem You are a network administrator at Tailspin Toys. Recently, users have been experiencing intermittent performance problems when accessing a file server. You check resource usage on the file server by using Task Manager and Resource View, but you see no indication of excessive processor, memory, disk, or network resource usage. You need to monitor these resources over a period of time rather than look at a real-time snapshot. You need to monitor resources both when the performance problems are occurring and when they are not. Answer the following questions: 1. How can you generate performance logs that help you analyze disk, network, pro- cessor, and memory resource usage both when the problem is occurring and when performance is normal? 2. You suspect memory could be coming under stress due to a leaky application. What performance counters should you include in a data collector set to record memory usage specifically? Suggested Practices CHAPTER 10 559 3. You know roughly when problems started to occur. How do you check what applica- tions were installed or upgraded at that time? Case Scenario 2: Monitoring Computers for Low Disk Space You are a domain administrator employed by Northwind Traders. Recently, a number of your users have had problems downloading files and e-mail because the space on their local disks had reached a critical limit. You want to create a proactive method of identifying low disk space problems on client computers on your network so you can ask your desktop support technicians to free disk space on client computers before critical limits are reached. Answer the following questions: 1. How do you monitor client computers for low disk space events? 2. Which client operating systems can you monitor? Case Scenario 3: Setting Up a Source-Initiated Subscription You are an administrator at Blue Sky Airlines. Blue Sky has recently upgraded all its servers and domain controllers to Windows Server 2008. Blue Sky has made extensive use of virtual servers, Server Core installations, and RODCs whenever appropriate but has retained its single Active Directory domain structure. You want to configure a server with Server Core installation to act as an event collec- tor computer, but you still do not know exactly which computers will be event sources. You therefore need to set up a source-initiated subscription on that server. You log on at the server and open an elevated command prompt. Answer the following questions: 1. What command do you enter to configure Windows Remote Management? 2. What command do you enter to configure the Event Collector service? 3. What type of file do you need to create to hold the subscription configuration? 4. What command do you enter to create the source-initiated subscription? Suggested Practices To master the Monitoring and Managing a Network Infrastructure exam objective success- fully, complete the following tasks. Capture Performance Data Complete all practices in this section. n Practice 1 A very large number of performance counters exist, and you are unlikely to be familiar with them all. However, you should investigate the more commonly used counters, and the best way of doing so is to use the Performance Monitor tool. A good starting point is the article at http://technet.microsoft.com/en-us/magazine/cc718984 .aspx. 5 6 0 CHAPTER 10 Monitoring Performance and Events n Practice 2 Run each standard data collector set and analyze the report each one generates. n Practice 3 If you have access to any computers that have been running for some time (for example, more than a month), run Reliability Monitor on these computers and assess their stability indices. Try to identify the causes of any stability problems. n Practice 4 Create a data collector set that logs counter values that can identify memory problems. Monitor Event Logs Complete Practices 1 and 2. Practice 3 is optional. n Practice 1 Confi gure a source computer to transfer events to a collector computer. Practice using all three bandwidth optimization techniques. Use wecutil to customize the event forwarding confi guration and reduce the time required to forward events. n Practice 2 If you have access to a production network, examine the event logs on several client computers and identify events that could indicate problems. Confi gure the client computers to forward events to a central server and monitor the central event log. In this case, use a source-initiated subscription and confi gure the source computers by using Group Policy. n Practice 3 Confi gure event fi lters and save them as custom views. Experiment with Applications and Services logs and look at the four types of events these can hold. Deliberately induce faults on your test network (for example, switch off a printer) and determine which events are recorded. Take a Practice Test The practice tests on this book’s companion DVD offer many options. For example, you can test yourself on just one exam objective, or you can test yourself on all the upgrade exami- nation content. You can set up the test so that it closely simulates the experience of taking a certifi cation exam, or you can set it up in study mode so that you can look at the correct answers and explanations after you answer each question. MORE INFO PRACTICE TESTS For details about all the practice test options available, see the “How to Use the Practice Tests” section in this book’s Introduction. MORE INFO PRACTICE TESTS For details about all the practice test options available, see the “How to Use the Practice Tests” section in this book’s Introduction. CHAPTER 11 561 CHAPTER 11 Server Deployment and Activation T here is a growing trend away from using physical media to install operating systems. Just over a decade ago, it was normal to install a server’s operating system from dis- kette. Today, it is increasingly common for server operating system deployment to occur automatically over the network. This is possible because most network adapters support Preboot Execution Environment (PXE), a technology that enables a computer to receive a network address and retrieve a stripped-down operating system that it can load from a server located on the network. This stripped-down operating system environment, in turn, works as a platform to begin the installation of a more fully featured operating system such as Windows Server 2008. In this chapter, you learn how to set up Windows Server 2008 so that you can deploy future servers remotely over the network. You also learn how to use volume license keys to simplify the process of activating large numbers of computers. Exam objectives in this chapter n Deploy images by using Windows Deployment Services. n Configure Microsoft Windows activation. Lessons in this chapter: n Deploying and Activating Windows Server 2008 563 562 CHAPTER 11 Server Deployment and Activation Before You Begin To complete the lessons in this chapter, you must have done the following: n Installed and confi gured the evaluation edition of Windows Server 2008 Enterprise Edition in accordance with the instructions listed in the Introduction. REAL WORLD Orin Thomas T he fi rst class I took when I was learning to administer Microsoft Windows NT 4.0 involved a section on remotely deploying servers that my instructor, no matter how hard he tried, was completely unable to get working (which, as an aside, is why, when I talk at events such as Tech.ED, I like to use full screen recordings). Like many systems administrators, I was initially a little uncomfortable with remotely imag- ing servers. Client computers? Sure. A pack-’em and stack-’em approach seemed fi ne. However, servers are mission critical, and some part of me always felt that an administrator should be as hands-on as possible, not just performing the installation but crafting it, attempting to attain the best result possible. If a client goes down, it inconveniences one person. If a server goes down, it inconveniences everyone. The argument about crafting a server install today is a little harder to make, though, because even if you are sitting in front of the server console during the entire Windows Server 2008 installation routine, the amount of direct interaction required is minimal. Unattended installation fi les work a lot better and provide a consistent result. I am glad that I will never again have to swap driver diskettes for operating systems diskettes or try to get the driver for some unusual 10Base2 Ethernet card working from a boot disk. REAL WORLD Orin Thomas T he fi rst class I took when I was learning to administer Microsoft Windows NT 4.0 involved a section on remotely deploying servers that my instructor, no matter how hard he tried, was completely unable to get working (which, as an aside, is why, when I talk at events such as Tech.ED, I like to use full screen recordings). Like many systems administrators, I was initially a little uncomfortable with remotely imag- ing servers. Client computers? Sure. A pack-’em and stack-’em approach seemed fi ne. However, servers are mission critical, and some part of me always felt that an administrator should be as hands-on as possible, not just performing the installation but crafting it, attempting to attain the best result possible. If a client goes down, it inconveniences one person. If a server goes down, it inconveniences everyone. The argument about crafting a server install today is a little harder to make, though, because even if you are sitting in front of the server console during the entire Windows Server 2008 installation routine, the amount of direct interaction required is minimal. Unattended installation fi les work a lot better and provide a consistent result. I am glad that I will never again have to swap driver diskettes for operating systems diskettes or try to get the driver for some unusual 10Base2 Ethernet card working from a boot disk. Lesson 1: Deploying and Activating Windows Server 2008 CHAPTER 11 563 Lesson 1: Deploying and Activating Windows Server 2008 Windows Deployment Services (WDS) enables you to deploy operating systems to client com- puters without performing a traditional install from media (IFM) such as from a DVD-ROM. With Windows Deployment Services, you can automate the installation process fully, so that all you need to do with the server hardware is switch it on. You can confi gure everything cen- trally, from the setup of a server’s disk drives to the installation of custom hardware drivers. You can use volume activation keys to simplify the process of activating computers in your environment. Rather than using a unique key for each computer, you can use a single key to activate all computers. In this lesson, you learn how to confi gure both these technologies to simplify the deployment of Windows Server 2008 in your own organization’s environment. After this lesson, you will be able to: n Confi gure WDS. n Capture WDS images. n Confi gure activation keys. Estimated lesson time: 40 minutes Unattended Installations Answer fi les are XML-based fi les that enable you to answer setup questions such as how to confi gure network adapters, how hard disk drives are to be partitioned, what product key to use, and the location of the Windows Server 2008 installation fi les. You can create answer fi les by using Windows System Image Manager (Windows SIM). Windows SIM is included with the Windows Automated Installation Kit (Windows AIK or WAIK), which you can download from the Microsoft Web site. Figure 11-1 shows how you can use Windows System Image Manager to add a section to the autounattend.xml answer fi le that automatically joins the computer to a domain with a specifi c set of credentials. Note that any credentials you provide for the answer fi le are not encrypted, so when deploying in a production environment, use an account that has been delegated only the necessary rights. After this lesson, you will be able to: n Confi gure WDS. n Capture WDS images. n Confi gure activation keys. Estimated lesson time: 40 minutes [...]... installation media You can use an evaluation version of Windows Server 2008 to create this custom image n Practice 2  Use Windows System Image Manager, included within the WAIK, to create an answer file to assist in the automated deployment of Windows Server 2008 Configure Microsoft Windows Activation To get a thorough understanding of Microsoft Windows activation, complete both practices in this section... autounattend.xml automatically to computers installed over the network Windows Deployment Services Windows Deployment Services (WDS) is a server role you can add to computers running Windows Server 2008 that enables you to perform network deployments of Windows Server 2008, and other operating systems such as Windows Vista, to computers that have PXEcompliant network cards WDS is able to use multicast... KMS server through any intervening firewalls KMS clients can use two methods to locate a KMS host When you configure a KMS host, it will automatically attempt to update DNS with a service (SRV) record named _vlmcs._TCP that points to the KMS host Microsoft Windows 2000 Server, Microsoft Windows Server 2003, and Windows Server 2008 DNS servers support these SRV records If the KMS client is unable to. .. answer file to join the computer to a domain MORE INFO DOWNLOAD WAiK you can download Windows Automated Installation Kit for Windows Vista SP1 and Windows Server 2008 from the following address on the Microsoft Web site: http://go .microsoft. com/fwlink/?LinkId =79 385 The Windows Server 2008 installation routine automatically checks all of a computer’s local volumes, including any connected USB storage devices,... Windows Deployment Services To get a thorough understanding of Windows Deployment Services, complete both practices in this section n Practice 1  Download and install the Windows Automated Installation Kit (WAIK) from the Microsoft Web site Use Windows System Image Manager, which is included within the Windows Automated Installation Kit, to create your own custom image based on the Windows Server 2008. .. to create a solution n Complete the suggested practices n Take a practice test Chapter Summary n Windows Deployment Services is a Windows Server 2008 server role that enables you to deploy Windows Server 2008 and Windows Vista operating systems over the network to PXE-compliant computers n Volume activation keys enable you to manage more easily the activation of multiple computers running Windows Server. .. Server 2008 servers and 300 client computers running Windows Vista at the head office location All will be located on a network that is connected to the Internet but protected by firewalls Each branch office has four Windows Server 2008 servers located on a network that is completely isolated from the Internet These servers manage industrial equipment Branch offices have three Windows Server 2008 servers... 1: Deploying and Activating Windows Server 2008 CHAPTER 11 579 Lesson Summary n Windows Server 2008 uses an XML-based answer file named autounattend.xml that you can create using Windows System Image Manager n WDS enables the deployment of Windows Server 2008 to computers that have PXEcompliant network adapters n WDS uses four types of images Boot images enable computers to boot over the network Install... components are included automatically Transport servers do not include the management tools that WDS deployment servers include and are managed using wdsutil.exe MORE INFO TRANSPORT SERVERS To learn more about WDS transport servers, see the following TechNet document: http://technet .microsoft. com/en-us/library/cc 771 645.aspx http://technet .microsoft. com/en-us/library/cc 771 645.aspx NOTE SERVER CORE AND WDS... Activating Windows Server 2008 570 CHAPTER 11 Server Deployment and Activation You activate Server Core installations of Windows Server 2008 by using the slmgr.vbs command-line utility You can also use this utility to activate a traditional installation of Windows Server 2008 You can use slmgr.vbs to manage license keys on remote computers running Windows Server 2008 Slmgr.vbs works in the following way: . http://technet .microsoft. com/en-us/library/cc 771 645.aspx . http://technet .microsoft. com/en-us/library/cc 771 645.aspx.http://technet .microsoft. com/en-us/library/cc 771 645.aspx NOTE SERVER CORE AND WDS NOTE SERVER. that points to the KMS host. Microsoft Windows 2000 Server, Microsoft Windows Server 2003, and Windows Server 2008 DNS serv- ers support these SRV records. If the KMS client is unable to obtain. end of the book. 1. You have confi gured a Windows Server 2008 server named Glasgow to collect events from a Windows Server 2008 server named Boston. Both computers are in the same domain.