TOPIC 2:

DEVICE TOOLS COLLECTION

In a Windows server environment, device collection involves gathering data on hardware, software, and
performance, while monitoring tools analyze that data to ensure system health and security

1. Devices

These are hardware resources that enable the server to collect, store, and process data in
different roles and features:

1. Server Computer
o Hosts Windows Server operating system and roles (e.g., AD DS, DNS, DHCP).
o Collects authentication requests, DNS queries, and configuration data.
2. Network Interface Card (NIC)
o Provides connectivity to networks.
o Collects packets, traffic statistics, and bandwidth usage for monitoring.
3. Storage Devices (HDDs, SSDs, SAN/NAS)
o Store collected server logs, backups, and monitoring reports.
o Used by File Server role to manage and collect user data.
4. Client Computers/Workstations
o Used by administrators to collect reports, logs, and performance data from the
server.
5. Backup Devices (External drives, tape drives, cloud storage)
o Collect system state data and server backups for disaster recovery.

2. Tools

These are software utilities and features built into or added onto Windows Server for data
collection:

1. Event Viewer
o Collects and displays logs about applications, security, setup, and system events.
o Useful for troubleshooting failures in Active Directory, DNS, or DHCP.
2. Performance Monitor (PerfMon)
o Collects real-time statistics on CPU, memory, disk I/O, and network usage.
o Helps administrators detect bottlenecks.
3. Server Manager
o Collects configuration details of roles and features.
o Provides a centralized dashboard to monitor role health and performance.
4. Windows PowerShell
o Collects detailed information using cmdlets such as:
 Get-Service → running services
 Get-Process → active processes
 Get-EventLog → recent logs
 5. Task Manager
o Collects running process details and real-time resource consumption.
6. Windows Admin Center (WAC)
o Web-based tool that collects performance data and manages roles remotely.
7. Network Monitor / Wireshark (add-on)
o Collects network packets for analyzing communication between roles like DNS
and DHCP.
8. System Center Operations Manager (SCOM) (enterprise use)
o Collects, analyzes, and reports on the health of multiple servers.

In a Windows server environment,. The tools used for these functions range from native Windows
utilities to comprehensive third-party solutions.

Native Windows tools

Microsoft includes several built-in tools for monitoring server performance and hardware, which are
essential for basic administration.

 Device Manager: Provides a centralized view of all recognized hardware components on the
server. Administrators can use it to view device drivers, check the status of devices, and resolve
device conflicts.

 Performance Monitor ([Link]): Collects and displays real-time and historical

performance data from various counters. It is used to monitor resource usage, track
performance trends, and diagnose issues.

 Event Viewer ([Link]): Centralizes and displays logs from applications, security, and the
operating system. It provides critical insights for troubleshooting and security auditing.

 Resource Monitor ([Link]): Gives a detailed, real-time overview of the server's CPU, disk,
network, and memory usage by process. It is useful for a quick analysis of resource bottlenecks.

 Server Manager: A central console for managing local and remote servers. It can be used to
manage roles, features, and various tools, including Device Manager and Computer
Management.

 Remote Server Administration Tools (RSAT): A collection of tools that allow administrators to
remotely manage Windows Server roles and features from a client PC. This includes tools for
managing Active Directory, DHCP, and DNS.

Comprehensive third-party tools

For more robust and scalable device and performance collection, many organizations use third-party
solutions that offer more extensive features than native tools.

 SolarWinds Server & Application Monitor (SAM): Provides comprehensive performance,

availability, and hardware monitoring for multi-vendor server environments. It uses both agent-
based and agentless monitoring to collect metrics.
  ManageEngine OpManager: A network monitoring solution with robust capabilities for
Windows servers. It uses Windows Management Instrumentation (WMI) to collect server
performance data and can monitor services, URLs, and event logs.

 Paessler PRTG Network Monitor: Offers an all-in-one monitoring solution for IT infrastructure,
including Windows servers. It can collect data using multiple protocols like WMI and SNMP and
provides pre-configured templates for Windows sensors.

 Zabbix: An open-source, enterprise-level monitoring solution that can track server performance,
availability, and network health. It can be configured with an agent to monitor a wide range of
metrics on Windows machines.

 Datadog: A cloud-based monitoring service that provides full visibility across on-prem and cloud
networks. It collects and correlates metrics, traces, and logs from Windows servers and
integrates with over 500 technologies.

 Splunk: A platform used for collecting, searching, and analyzing machine-generated data,
including logs and metrics from Windows servers. It uses a universal forwarder agent to collect
data and send it to the Splunk platform.

 Microsoft Intune and Configuration Manager: For managing device configurations, inventory,
and policy enforcement across an organization. Intune is a cloud-based service for mobile and
endpoint management, while Configuration Manager handles on-premises deployments and can
be "cloud-attached" for hybrid management

Network Device Preparations in Windows Server

Before deploying Windows Server roles and features, network devices must be properly
prepared. This ensures reliability, security, and performance of services such as AD DS, DNS,
DHCP, and File Services.

1. Hardware Preparations

1. Network Interface Card (NIC) Configuration

o Ensure NICs are properly installed and drivers updated.
o Assign static IP addresses for servers providing roles (DNS, DHCP, AD DS).
2. Switches and Routers Setup
o Configure VLANs if segmentation is needed.
o Ensure routing protocols allow server communication.
 3. Cabling and Physical Connections
o Use structured cabling (Cat6 or higher for gigabit).
o Verify redundancy using multiple connections if possible.
4. Storage Devices (if needed)
o Prepare SAN/NAS for file servers or Hyper-V clusters.

2. Logical Preparations

1. IP Addressing Scheme
o Plan IPv4/IPv6 addresses for servers, clients, and devices.
o Reserve addresses for static assignments (e.g., domain controllers, DNS, DHCP).
2. DNS Configuration
o Ensure forward and reverse lookup zones are planned.
o Register server hostnames in DNS for role resolution.
3. DHCP Scopes and Reservations
o Prepare IP address ranges, exclusions, and reservations.
o Configure default gateway and DNS options.
4. Firewall and Security Settings
o Open required ports for server roles (e.g., port 53 for DNS, 67/68 for DHCP, 389
for AD DS LDAP).
o Disable unused services and block unnecessary ports.

3. Server Role-Specific Preparations

 Active Directory Domain Services (AD DS):

o Assign static IP and configure DNS first.
o Ensure time synchronization with NTP servers.
 DNS Server:
o Verify IP address and hostname are correctly registered.
o Configure forwarders for internet name resolution.
 DHCP Server:
o Ensure only one authorized DHCP server per subnet.
o Pre-plan address pools and scope options.
 File and Print Services:
o Prepare shared folders and permissions.
o Ensure printers are connected and drivers available.

4. Monitoring and Testing Preparations

 Use ping to verify connectivity.

 Use ipconfig /all to confirm IP, DNS, and gateway setup.
 Use Performance Monitor to baseline network traffic.
 Use Event Viewer to check for hardware or driver issues.

 Query successful
Try again without apps

Proper preparation of your network devices is a critical step before deploying any Windows
Server, especially when configuring server roles like Active Directory Domain Services (AD
DS), DHCP, or Hyper-V.

Preparation involves ensuring the network fabric is ready to support the server's function,
connectivity, and security.

Essential Network Device Preparations

1. IP Addressing and DNS Preparation

This is the most crucial step for the Windows Server itself.

 Static IP Reservation/Assignment: The Windows Server must use a static IP address.

If your network uses a DHCP server, you must either manually configure the static IP on
the server or create a DHCP reservation for the server's MAC address to ensure its IP
never changes.
 DNS Planning: Ensure your DNS infrastructure is ready. If the new server is to be a
Domain Controller (running AD DS and DNS), its primary DNS setting should
eventually point to itself ([Link]) or another Domain Controller. If it's a member
server, its DNS settings must point to your internal DNS servers (Domain Controllers).
 Host Records: For critical roles, ensure the DNS host record (A or AAAA) for the new
server is correctly registered on your DNS server before or immediately after the server is
configured.

2. Switch and Router Configuration

The switches and routers managing the network segments must be configured to support the
server's requirements.

 VLAN Assignment: The server's port on the switch must be correctly configured for the
appropriate VLAN (Virtual Local Area Network). Servers should be on a segregated or
dedicated VLAN to logically isolate them from client traffic for security and
performance.
 Port Speed and Duplex: Verify that the switch port is configured to match the server's
network adapter speed and duplex settings (e.g., 1 Gbps Full Duplex). Ideally, use auto-
negotiation unless issues arise.
 Port Security: Implement port security to limit or control which MAC addresses can
communicate on the server's port.
 Jumbo Frames: If the server is using iSCSI or Hyper-V Live Migration, you must
configure both the server's NIC and the corresponding switch ports to support Jumbo
Frames (typically 9000 bytes) for increased throughput and reduced CPU overhead.
  NIC Teaming (If Applicable): If you plan to use Windows Server NIC Teaming (load
balancing and failover) or Hyper-V Switch Embedded Teaming (SET), ensure the
switch supports the required aggregation protocol (LACP or static teaming).

3. Firewall and Security Devices

Your external (edge) firewall and internal network security devices must have rules in place for
the server's intended role.

 Port Opening: Review the specific network ports required by the Windows Server role
and ensure they are open between the server and its clients on both the network firewalls
and the Windows Firewall.
o Example: Domain Controllers require TCP/UDP 389 (LDAP), TCP/UDP 53
(DNS), TCP/UDP 88 (Kerberos), etc.
 Network Isolation: Use firewall rules, Access Control Lists (ACLs), or Network
Security Groups (NSGs) to limit inbound RDP (TCP 3389) access to only
administrative jump boxes or specific management subnets, a key security best practice.
 Security Baselines: Ensure the network segments comply with your security baselines,
especially for segmentation policies that prevent a compromised client from easily
reaching all servers.