Maintaining and Updating Windows Server 2008 Lesson 8

Skills Matrix Configuring Windows Server Update Services (WSUS) Technology Skill Objective Domain Objective # Configuring Windows Server Update Services (WSUS) Configure Windows Server Update Services (WSUS) server settings 5.1 Using the Performance Monitor Capture performance data 5.2 Using the Windows Event Viewer Monitor event logs 5.3 Using Network Monitor to Gather Network Data Gather network data 5.4

Monitoring a Windows Server 2008 There are two approaches to maintaining your network: the reactive approach and the proactive approach. After implementation of your network design is complete and you have verified that your network works properly, the reactive approach means that you will “wait and see” what problems arise.

Monitoring a Windows Server 2008 A proactive approach doesn’t wait for problems to arise. A proactive approach to network management is preventative and uses tools such as the Performance and Reliability Monitor, the Event Viewer, and Network Monitor utilities. Proactive system administrators use these tools to help spot potential and actual networking issues without wasting time guessing what the problems might be because they lack historical data. They do this by systematically monitoring, logging, and analyzing the network’s data.

Reliability and Performance Monitor Located within the Administrative Tools folder. Allows you to collect real-time information on your local computer or from a specific computer to which you have permissions. This information can be viewed in a number of different formats that include line charts and histograms.

Reliability and Performance Monitor

Reliability and Performance Monitor

Performance Monitor Probably the most frequently used view within the Reliability and Performance Monitor is the Performance Monitor. One of the simplest methods is to open the Start menu, key perfmon.exe, and then click OK. Performance Monitor provides detailed information necessary for in-depth analysis, logging capabilities, and alerts, which are useful for early warnings of possible system issues.

Performance Monitor Demonstrate how to use Performance Monitor.

Data Collector Sets One of the significant changes introduced in Windows Server 2008 performance monitoring is the Data Collector Set. Rather than manually adding individual performance counters anytime you want to monitor performance on a 2008 server, Data Collector Sets allow you to organize a set of performance counters, event traces, and system configuration data into a single “object” that you can reuse on one or more Windows Server 2008 servers. You can view the counters associated with Data Collector Sets in Performance Monitor view, use them to generate alert actions when particular performance thresholds are reached, and integrate them with the Windows Task Scheduler to collect performance data at specific times.

Data Collector Sets There are three built-in Data Collector Sets within Windows Server 2008 — LAN Diagnostics, System Diagnostics, and System Performance — or you can create your own custom sets. You also have the ability to create Data Collector Set templates that are based on the XML file format, thus allowing you to distribute templates across multiple servers for use by other administrators.

Data Collector Sets

Data Collector Sets

Data Collector Sets

Data Collector Sets

Securing Access to Performance Data A common request from network administrators in previous versions of Windows is the ability to delegate access to performance data without allowing full administrative rights to a particular server. To this end, Windows Server 2008 includes a number of built-in group objects that grant limited access to performance data.

Securing Access to Performance Data Members of the Performance Monitor Users group, by default, are delegated the following additional abilities to view performance data: Members of Performance Monitor Users can view both real-time and historical data within the Performance Monitor console and can use the Reliability Monitor. Members of Performance Monitor Users cannot create or modify Data Collector Sets or use the Resource View. Typical Test Question

Securing Access to Performance Data Members of the Performance Log Users group have all of the rights available to normal Users and Performance Monitor Users. In addition, Performance Log Users also have the ability to create and modify Data Collector Sets, but only after an administrator has assigned this group the Log on as a batch user user right on the server or servers in question.

Windows Event Viewer Windows Server 2008 uses the Windows Event Viewer to record system events that take place, such as security, application, and role-specific events.

Windows Event Viewer

Network Monitor If you receive reports that a Windows Server 2008 computer is not responding fast enough, you might want to isolate the view of the network traffic that is being sent to or from that server. You may also need to view network traffic to determine if a client application is faulting, or to determine if a malicious user or virus is attempting to access the computer over the network.

Network Monitor Windows Server 2008 does not include a built-in network monitor, but you can download and install the latest version of Network Monitor from the Microsoft Web site. This free download will allow you to view network traffic that is being sent to and from the network interface cards on a particular Windows Server 2008 computer. You can view network captures in real-time, or save the information to a file to be analyzed later.

Network Monitor Demonstrate how to capture packets with Network Monitor. Point out the four main parts of a packet and relate to the TCP/IP model/simplified OSI model.

Network Monitor When looking at packets, you need to need to use filters to limit the packets when you are analyzing.

Windows Server Update Services (WSUS) Traditionally, system administrators and users kept systems up-to-date by frequently checking the Microsoft Windows Update Web site or the Microsoft Security Web site for software updates. Administrators manually downloaded available updates, tested the updates in their environment, and then distributed the updates manually or with traditional software distribution tools.

Windows Server Update Services (WSUS) To improve the manageability of this process, Microsoft introduced Windows Server Update Services (WSUS) A Web-based tool for managing and distributing software updates that resolve known security vulnerabilities or otherwise improve performance. For Microsoft Windows XP, Windows Vista, Microsoft Windows Server 2003, and Windows Server 2008 operating systems. The latest version of WSUS (WSUS 3.0 with Service Pack 1 at the time of this writing) is a free download from the Microsoft Web site that can be installed on a Windows Server 2008 computer.

Windows Server Update Services

WSUS Distributed Infrastructure A server that runs WSUS can be synchronized from the public Windows Update servers, from another server running WSUS, or from a manually configured content distribution point. WSUS servers can download and store content locally, or they can use the content on the Windows Update Web site.

Setting WSUS Client Settings with GPOs

Setting WSUS Client Settings with GPOs

Summary When monitoring the health of Windows Server 2008, you can examine the Window Event Viewer to obtain information. By default, it logs informational events such as service start and stop messages, errors, and warnings. Additional diagnostic logging can be achieved by modifying the registry.

Summary Reliability and Performance Monitor in Windows Server 2008 allows you to collect real-time information on your local computer or from a specific computer to which you have permissions. This information can be viewed in a number of different formats that include charts, graphs, and histograms.

Summary Reliability and Performance Monitor uses performance objects, or categories, and performance counters to organize performance information. Performance counters are the specific processes to monitor. Many counters are available. WSUS is a tool used to manage and distribute software updates that fix known security vulnerabilities or otherwise improve the performance of Microsoft operating systems.

Summary Updates can include items such as security fixes, critical updates, and critical drivers. Windows Update is a Microsoft Web site that works with Automatic Updates to provide timely critical and noncritical system updates. Automatic Updates enables you to automatically interact with the Windows Update Web site.

WSUS has three main components: Summary WSUS has three main components: A content synchronization service. An internal Windows Update server. Automatic Updates on computers (desktops or servers).

Summary WSUS server management includes reviewing and changing configuration options, automatically or manually synchronizing the server, viewing update status, and backing up and restoring the server. You can configure Automatic Updates through the Automatic Updates configuration page, Group Policy, and by configuring registry entries.