MCTS Guide to Configuring

Microsoft Windows Server 2008

Active Directory

Chapter 13: Server Management and

Monitoring
Objectives
Perform Active Directory maintenance tasks
Monitor an Active Directory environment
Use several command-line tools to manage a
Windows Server 2008 environment

2 2
Windows Server Backup and Restore
Windows Server Backup is new in Windows Server 2008
and replaces NTBackup.exe
Must be installed with Server Manager
Some features and limitations
Backups can be run manually or scheduled with Task Scheduler
Separate files or folders cant be backed up, you can only choose
which volumes to backup
Scheduled backups require a dedicated fixed or removable disk as the
backup destination when youre using Windows Server Backup.
Select one of the following options:
Always perform full backup
Always perform incremental backup
Custom

3
Windows Server Backup and Restore
(cont.)

4
Creating Scheduled Backups
Scheduled backups give you the flexibility to run a
backup at a particular time of the day, once per
day, or multiple times per day
Before using the Backup Schedule Wizard, you
need to know:
What do you want to backup?
When and how often should the backup occur?
Where will backups be stored?

Activity 13-1: Installing Windows Server Backup, pg. 517

Activity 13-2: Performing a One-Time Backup, pg. 518-519
5
Data Recovery
You can recover files and folders, the system state,
Active Directory, or the entire server from a backup
Windows Server Backup can recover only files,
folders, and volumes
Command-line utilities used for more complete
recovery
To start the recovery process, click recover in the
Actions pane of Windows Server Backup.

Activity 13-3: Recovering a File from Backup, pg. 521-523

6
Data Recovery (cont.)

7
Backup and Restore from the Command Line
Windows Server Backup has less flexibility than its command line
equivalent utilities
Wbadmin.exe can perform all tasks available in Windows Server
Backup, and more:
Perform a system state backup: Use the command Wbadmin
start systemstatebackup
Recover the system state: Use the command Wbadmin start
systemstaterecovery
Delete a system state backup: Use the command Wbadmin
delete systemstatebackup
Restore or delete a backup catalog: A backup catalog is
generated each time a backup is performed which has details
about each backup. To restore a catalog backup use the
command Wbadmin restore catalog.
Most tasks with Wbadmin require you to be a member of the Backup
Operators or Administrators group.
8
Perform a System Recovery
If full recovery is necessary of the OS because of a
disk crash, you need the Windows Server 2008
installation disk or access to Windows Recovery
Environment (WinRE).
WinRe must first be installed on the servers hard
drive then you may access it by pressing F8 when
the boot process starts.
Can also be accessed from the Windows Server
2008 installation DVD and selecting the option
Repair Your Computer
You can restore a complete backup from a local or
removable disk or a network location
9
Active Directory Backup and Restoration

Active Directory is backed up when you perform a full backup

of a domain controller or when you back up the volumes
containing system recovery information.
The Active Directory database is also backed up when we
perform a system state backup with Wbadmin.
An AD restoration can be authoritative or nonauthoritative.
Nonauthoritative restore: restores the Active Directory
database, or portions of it, and allows it to be updated through
replication.
Authoritative restore: ensures that restored objects arent
overwritten by changes from other domain controllers through
replication.
Activity 13-4: Backing Up the System State with Wbadmin, pg. 525
10
Active Directory Backup and Restoration

11
Active Directory Defragmentation
Active Directory database requires periodic maintenance in the
form of defragmentation and compaction. There are 2 methods
of AD defragmentation: Online and Offline.
Online defragmentation occurs automatically when AD
performs garbage collection.
Garbage collection runs every 12 hours on a DC and removes
objects that have been deleted for more than 180 days
Objects marked for removal after a period of time are referred
to as tombstoned.
Online defragmentation removes deleted objects but doesnt
compact the database
Offline defragmentation compacts the database
Compaction is performed with the Ntdsutil program.

Activity 13-6: Performing AD maintenance, pg. 527-528

12
Active Directory Monitoring
Windows Server 2008 provides tools to manage
and monitor server operation and resources,
including the following:
Event Viewer
Task Manager
Reliability and Performance Monitor
Windows Server Resource Manager

13
Event Viewer
Used to examine event log entries generated by system services and
applications
Events categorized by levels:
Information: Is indicated by blue i in a white circle
Warning: Is indicated by a black ! inside a yellow triangle
Error: Is indicated by a white ! inside a red circle
Selecting an event shows more detailed information

14
Task Manager
Provides a simple interface for viewing the performance of a
Windows computer
Started by pressing Ctrl + alt + delete and then clicking Task
Manager, by right-clicking the taskbar and clicking Task
manager, or by typing Taskmgr into a command prompt
Windows Server 2008 adds the Services and Resource
Monitor tabs
Shows real-time graphical display of:
CPU utilization
Disk utilization
Network utilization
Memory utilization

Activity 13-7: Exploring Task Manager, pg. 531

15
Task Manager (cont.)

16
Reliability and Performance Monitor
Consists of a collection of tools
Can be opened from Administrative tools folder or
the Diagnostics node in Server Manager
Contains the following folders:
Monitoring Tools
Data Collector sets
Reports

17
Performance Monitor
Uses counters to track performance of a variety of objects
A counter is a value representing some aspect of an objects performance
Counters exist for virtually every hardware and OS component on a server
Performance monitor can track counters with a line graph, histogram, or as
raw data saved to a report
Can display counters in real time or from a saved log file

18
Collecting Baseline Performance Data
Using real-time monitoring can be difficult since
there is no starting point for comparing data
To create a starting point, you create a data
collector set that specifies the performance
counters you want to collect
Performance monitoring uses system resources.

Activity 13-8: Viewing Real-Time Performance Data, pg. 533-535

19
Collecting Baseline Performance Data
(cont.)

20
Data Collector Sets
A data collector set can contain a variety of types of
information:
Performance counters: Are used to view real time data
Counter alerts: Are events generated when a counter falls
below or exceeds a specified acceptable point.
Event traces: Logs information based on system or application
events.
System configuration: Monitors and records changes to
Registry keys.
Common use is to create a starting point.

21
Reports
Reports folder contains reports generated from
data collector sets
User Defined subfolder contains reports generated
by user-defined data collector sets
System subfolder contains folders for each system
data collector set
After a data collector set runs, a report is generated
automatically and placed in a folder with the name
of the data collector set.

Activity 13-9: Creating a Data Collector Set, pg. 536-538

Activity 13-10: Comparing Two Log Files, pg. 538
22
Reports (cont.)

23
 Reliability Monitor
Tracks system changes and logs a variety of hardware and
software failures
Changes are indicated on a
timeline graph
Can track how stable/reliable
your system has been over a
period of time.
Icons that indicate failure, or
warning are the same as
those in Event Viewer.
Reliability monitor tracks five
event types:
Software (Un)Install
Application failures
Hardware failures
Windows failures
Miscellaneous failures

24
Windows System Resource Manager
Helps you manage processor and memory
resource on heavily used systems.
Can fine tune resource use so that each process
has an equal share of resources
WSRM includes the following features:
Preconfigured and custom policies: that allocate resources on
per user bases.
Policies based on calendar rules: to allow fine-tuning system
resource use according to time of day.
Automatic policy application: based on server events or
changes in memory or CPU.
Resource monitoring data: that are stored in Windows internal
database.
25
Windows System Resource Manager
(cont.)

26
WSRM Management Policies
WSRM is designed to be used on multipurpose
servers with high CPU utilization
WSRM doesnt apply CPU use policies until total
utilization reaches 70%
Preconfigured WSRM policies:
Equal_Per_Process: All running processers can consume an
equal amount of resources.
Equal_Per_User: each user will consume the same amount of
resources when using applications.
Equal_Per_Session: Useful for servers running Terminal
Services where each terminal session has equal access to
resources.
Can use custom policies as well
27
Chapter Summary
Active Directory maintenance involves backup and restore of
the server and the Active Directory database as well as offline
maintenance tasks
Windows Server Backup enables you to back up entire servers,
volumes, and the system state
The Active Directory database becomes fragmented over time.
To ensure performance, use online defragmentation and offline
defragmentation
Four tools are commonly used to monitor and fine-tune the
performance and reliability of Active Directory and the server:
Event Viewer, Task Manager, Reliability and Performance
Monitor, and Windows Server Resource Manager.
Task Manager and Resource Monitor provide a real-time look at
key performance indicators, such as CPU, disk, network, and
memory utilization
Reliability Monitor tracks several different system failures and
includes a numeric indicator of your servers reliability
28