WSA M07: Monitoring & Management

Slide 1 of 12 ← Course Home

Module 07: Server Monitoring & Updates

You can't fix what you can't see — logs, counters, the unified pane, and patching.

What you'll learn

  • Event Viewer — classic, application, custom views
  • Performance Monitor — counters + collector sets + baselines
  • Windows Admin Center ★ — unified browser pane
  • WSUS — on-prem patch distribution + workflow
  • Azure Arc + cmdlets — cloud-native ops + Get-WinEvent
Where this fits: Foundation #7 — visibility. CTS1328C Objective #5. AZ-800 domain: Manage Windows Servers. Windows Admin Center (★) is the unified pane for everything you'll watch.
Module 07 — your journey 1Event Viewer 2Perf Monitor 3WAC ★ 4WSUS Roles 5WSUS Workflow 6Azure Arc 7Get-WinEvent 8Get-Counter 9Get-EventLog → next: M08 — DNS

Event Viewer

Event Viewer (eventvwr.msc) is where every system + app event lands. The right-side mock shows the structured view: level, time, source, event ID, message.

Severity levels

Critical · Error · Warning · Information · Success Audit — filter by level to cut a 10,000-row log down to the 5 that matter.

Where to look

  • Windows Logs — Application, Security, System, Setup, Forwarded Events
  • Applications and Services — DNS Server, Directory Service, PowerShell, etc. (per-feature)
# Last 50 System events, errors only PS> Get-WinEvent -LogName System -MaxEvents 50 | Where-Object Level -eq 2
Event Viewer: structured event recordsEvent Viewer, system + app + security logsWindows LogsSystemApplicationSecuritySetupForwarded EventsLevel   Date/Time    Source      Event ID   MessageInfo   10:15:00    Svc Ctrl Mgr   7036      Service startedWarn   10:12:33    Win32k       263      Display driver faultInfo   09:58:10    EventLog     6013      System uptimeError   08:30:45    NETLOGON     5719      No domain controllerError   07:10:00    Disk         11       Driver detected errorInfo   06:00:01    Kernel-Power   1      System resumeInfo   05:45:30    DHCP         1024     Lease renewedWarn   05:18:00    Time-Service   134     Time skewFilter by level (Error / Warning), source, or event ID

Performance Monitor

perfmon.msc samples live counters per second and saves them for later analysis.

Four tools inside perfmon

  • Performance Monitor — real-time graphs
  • Data Collector Sets — scheduled capture
  • Reports + Alerts — analysis + threshold triggers

Health-line counters

  • \Processor\% Processor Time — healthy <80%
  • \Memory\Available MBytes — healthy >10%
  • \PhysicalDisk\Avg. Disk Queue — healthy <2
# Sample live CPU % PS> Get-Counter '\Processor(_Total)\% Processor Time'
Live counters, sampled per secondperfmon, real-time counter graph0255075100%▬ %ProcessorTime▬ Disk Queue▬ NIC Bytes/s60s window

Windows Admin Center (WAC)

Browser-based management for Windows Server, clusters, Hyper-V, HCI, Win 10/11.

Why it matters

  • Single pane of glass · no agents on servers
  • RBAC · PowerShell integration · Azure attachable

Deployment options

  • Local client — admin workstation
  • Gateway server — team access (recommended)
  • Failover cluster — HA for enterprise
# Silent gateway install on port 443 PS> msiexec /i WindowsAdminCenter.msi /qn SME_PORT=443 SSL_CERTIFICATE_OPTION=generate
WAC: modern web dashboard for servershttps://wac.corp.localServersDC01FS01SQL01ToolsEventsServicesUpdatesDC01 Performance● OnlineCPU 28%RAM 62%Services: 142 runningLast patched: 2 d agoRecent activity10:15, Service started: Windows Update09:58, System boot complete

Windows Server Update Services (WSUS) — Roles

WSUS centralizes Windows Update: one server downloads from Microsoft, you approve, clients pull from your server.

WSUS does three things

  • Download from Microsoft over the internet
  • Approve — admin gates before deployment
  • Deploy — clients pull from local WSUS

Why use WSUS

  • One download per update, not per client
  • Approval gate — pilot ring before fleet
  • Compliance reports + disconnected-network support
WSUS: download once, deploy to manyMicrosoft Updateinternet, mass downloadsWSUS Serverapproves + serves updatesDC + FS serversWorkstationsHyper-V hostsCritical groupTest groupPilot group

WSUS — Approval Workflow & Client Side

Updates flow Sync → Awaiting approval → Pilot ring → All. Right panel shows the lifecycle.

Manage approvals with

  • Computer Groups — Servers, Workstations, Test
  • Auto-Approvals + Deadlines
  • Supersedence — newer replaces older

Client-side commands

# Force the WSUS client to detect available updates now PS> wuauclt /detectnow
# Remote install all approved updates on Server01 PS> Invoke-WUJob -ComputerName "Server01" -Script { Install-WindowsUpdate -AcceptAll }
Approval lifecycle of an updateSynchronizedAwaiting approvalApproved for PilotApproved for AllReports tab shows:Installed: 142 hostsNeeded: 8 hostsFailed: 2 hostsapproved 3 d agopending next reboot windowdisk space, network, etc.

Azure Arc for Servers

Extend Azure management to on-prem and multi-cloud servers. Right panel shows DCs, EC2, edge VMs in one Azure portal.

What you get

  • Azure Policy + Monitor + Log Analytics anywhere
  • Defender for Cloud + Azure Automation
  • Azure RBAC outside the cloud boundary

How it works

Install Connected Machine agent → registers with Azure → server appears in portal. No VPN needed.

# Onboard this server to Azure Arc PS> azcmagent connect --resource-group "HexworthRG" --location "eastus"
Azure Arc: cloud control plane for any serverAzureOn-prem DCArc agentAWS EC2Arc agentEdge VMArc agentAll servers visible in the same Azure portal

PowerShell Monitoring Commands (1/4)

Retrieve the most recent 100 entries from the System event log.

# Pull the latest 100 System log events PS C:\\> Get-WinEvent -LogName System -MaxEvents 100

Use a hashtable filter to find specific Security events like successful logons (Event ID 4624).

# Filter Security log for successful logon events only PS C:\\> Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624}
Get-WinEvent: query the event logrecent + filtered queriesPS> Get-WinEvent -LogName System -MaxEvents 100PS> Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624;StartTime=(Get-Date).AddHours(-1)}PS> Get-EventLog -LogName Application-EntryType Error -Newest 20PS> _

PowerShell Monitoring Commands (2/4)

Query the Application log using the older Get-EventLog cmdlet to find recent errors.

# Get the 20 most recent Application error entries PS C:\\> Get-EventLog -LogName Application -EntryType Error -Newest 20

Sample the current available memory in megabytes from the performance counter system.

# Check how much free RAM is available right now PS C:\\> Get-Counter '\\Memory\\Available MBytes'
Get-Counter: sample performance counterslive sampling, scripted alertsPS> Get-Counter -Counter '\Memory\Available MBytes'PS> Get-Counter -Counter '\Processor(_Total)\% Processor Time'-SampleInterval 1 -MaxSamples 5PS> Get-Counter -ListSet *memory* discover available counter setsPS> Export-Counter -Path C:\Logs\perf.blg-Counter @('\Processor(*)\% Processor Time')PS> _

PowerShell Monitoring Commands (3/4)

Discover which performance counter sets are available for monitoring on this server.

# List every available performance counter set by name PS C:\\> Get-Counter -ListSet * | Select-Object CounterSetName

Find the top 10 processes consuming the most CPU time on this server.

# Rank processes by CPU consumption, top 10 PS C:\\> Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Services + Processes monitoringfind what is running and consumingPS> Get-Service | Where Status -eq Stopped surface things that should be up but are notPS> Get-Process | Sort CPU -Descending | Select -First 10PS> Get-Process | Where WorkingSet -gt 500MB memory hogsPS> Get-CimInstance Win32_LogicalDisk| Format-Table DeviceID, FreeSpace, SizePS> Get-NetTCPConnection -State EstablishedPS> _

PowerShell Monitoring Commands (4/4)

List every service on the server that is currently stopped to find potential issues.

# Show all services with a Stopped status PS C:\\> Get-Service | Where-Object Status -eq 'Stopped'

Run a performance counter query against multiple remote servers simultaneously.

# Collect CPU usage from two remote servers at once PS C:\\> Invoke-Command -ComputerName Server01,Server02 -ScriptBlock { Get-Counter '\\Processor(_Total)\\% Processor Time' }
Update + uptime queriespatch state and uptime checkPS> Get-HotFix | Sort InstalledOn -Descending | Select -First 5PS> Get-WUList # PSWindowsUpdate module list pending updates from MS Update or WSUSPS> (Get-CimInstance Win32_OperatingSystem).LastBootUpTime uptime checkPS> New-EventSubscription -SourceComputer DC02-Query *[System[Level=2]] -LogName ForwardedEventsPS> Get-Help about_EventlogsPS> _

Module Summary

  • Event Viewer — system/security/app logs
  • PerfMon — real-time metrics + data collector sets
  • WAC — browser-based, agent-less management
  • WSUS — centralized Windows Update + approvals
  • Azure Arc + PowerShell — cloud control plane + scripting

Ready to practice?

GUI Lab PowerShell Lab Take Quiz
Module 7 takeawaysEvent Viewerfilter, subscribePerfMonlive countersWACbrowser-basedWSUSstaged updatesAzure Arccloud control planePowerShellGet-WinEvent + CounterReady for Monitoring labs and quiz
GUI Lab PS Lab Quiz