Windows Server monitoring: baselines, events and alerts

Start DC01, DC02 and SRV01. Work on SRV01 as SAATLAB\adm.rahul in PowerShell as administrator unless a step says otherwise.

1Read live performance counters

On SRV01:

$counters = '\Processor(_Total)\% Processor Time', '\Memory\Available MBytes', '\LogicalDisk(C:)\% Free Space', '\PhysicalDisk(_Total)\Avg. Disk sec/Read'
Get-Counter -Counter $counters -SampleInterval 2 -MaxSamples 1 | Select-Object -ExpandProperty CounterSamples | Select-Object Path, @{n='Value';e={[math]::Round($_.CookedValue,3)}}

You should see something like this:

Path                                             Value
----                                             -----
\\srv01\processor(_total)\% processor time       4.127
\\srv01\memory\available mbytes                    812
\\srv01\logicaldisk(c:)\% free space            61.834
\\srv01\physicaldisk(_total)\avg. disk sec/read  0.002

Avg. Disk sec/Read is in seconds, so 0.002 is 2 ms: fast. On its own, one sample tells you little.

Is 812 MB of available memory normal for SRV01? Only a baseline can say.

✅ Checkpoint: Get-Counter returns four values for SRV01.

2Record a baseline with a data collector set

On SRV01:

logman create counter SRV01-Baseline -c "\Processor(_Total)\% Processor Time" "\System\Processor Queue Length" "\Memory\Available MBytes" "\Memory\Pages/sec" "\PhysicalDisk(_Total)\Avg. Disk sec/Transfer" "\PhysicalDisk(_Total)\Current Disk Queue Length" "\Network Interface(*)\Bytes Total/sec" -si 00:00:15 -o C:\PerfLogs\SRV01-Baseline -f bincirc -max 200
logman start SRV01-Baseline
logman query SRV01-Baseline | Select-String 'Status|Output Location|Sample Interval'

You should see something like this:

The command completed successfully.
The command completed successfully.
Status:               Running
Output Location:      C:\PerfLogs\SRV01-Baseline_000001.blg
Sample Interval:      15 second(s)

-f bincirc -max 200 writes a circular binary file of at most 200 MB, so the baseline can run for weeks without filling the disk. Let it run while you do the rest of the lesson, then analyse it:

Later, on SRV01:

logman stop SRV01-Baseline
relog C:\PerfLogs\SRV01-Baseline_000001.blg -f csv -o C:\PerfLogs\baseline.csv -y | Out-Null
$rows = Import-Csv C:\PerfLogs\baseline.csv
$cpu = ($rows | Select-Object -ExpandProperty ($rows[0].PSObject.Properties.Name | Where-Object { $_ -like '*Processor Time' })) | Where-Object { $_.Trim() } | ForEach-Object { [double]$_ }
'CPU average {0:N1}%, max {1:N1}% over {2} samples' -f ($cpu | Measure-Object -Average).Average, ($cpu | Measure-Object -Maximum).Maximum, $cpu.Count
logman start SRV01-Baseline

You should see something like this:

CPU average 3.8%, max 41.2% over 240 samples

✅ Checkpoint: SRV01-Baseline is collecting every 15 seconds and you calculated SRV01’s average and peak CPU from it.

3Make SRV01 an event collector

On SRV01, configure the collector service and create a subscription for errors:

wecutil qc /q
@'
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>Server-Errors</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>Critical and error events from servers and DCs</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>Normal</ConfigurationMode>
  <Query><![CDATA[<QueryList><Query Id="0"><Select Path="System">*[System[(Level=1 or Level=2)]]</Select><Select Path="Application">*[System[(Level=1 or Level=2)]]</Select></Query></QueryList>]]></Query>
  <ReadExistingEvents>false</ReadExistingEvents>
  <TransportName>HTTP</TransportName>
  <ContentFormat>RenderedText</ContentFormat>
  <LogFile>ForwardedEvents</LogFile>
  <AllowedSourceDomainComputers>O:NSG:BAD:P(A;;GA;;;DC)(A;;GA;;;DD)S:</AllowedSourceDomainComputers>
</Subscription>
'@ | Set-Content C:\Scripts\Server-Errors.xml
wecutil cs C:\Scripts\Server-Errors.xml
wecutil gs Server-Errors | Select-String 'SubscriptionType|Enabled|AllowedSourceDomainComputers'

You should see something like this:

SubscriptionType: SourceInitiated
Enabled: true
AllowedSourceDomainComputers: O:NSG:BAD:P(A;;GA;;;DC)(A;;GA;;;DD)S:

The SDDL allows Domain Computers (DC) and Domain Controllers (DD) to send events. Level 1 is Critical and 2 is Error. Source-initiated means each server finds the collector by Group Policy, so new servers join automatically.

✅ Checkpoint: The Server-Errors subscription exists on SRV01 and is enabled.

4Point the DCs at the collector with Group Policy

On DC01:

New-GPO -Name 'C-Event-Forwarding' | New-GPLink -Target 'OU=Domain Controllers,DC=saatlab,DC=internal' | Out-Null
Set-GPRegistryValue -Name 'C-Event-Forwarding' -Key 'HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager' -ValueName 1 -Type String -Value 'Server=http://SRV01.saatlab.internal:5985/wsman/SubscriptionManager/WEC,Refresh=60' | Out-Null
Invoke-Command -ComputerName DC01, DC02 -ScriptBlock { gpupdate /force | Out-Null }

That’s the setting Computer Configuration, Administrative Templates, Windows Components, Event Forwarding, Configure target Subscription Manager. Link the same GPO to the Servers OU to include member servers.

Create a test error on DC02, then check the collector:

Invoke-Command -ComputerName DC02 -ScriptBlock { eventcreate /T ERROR /ID 999 /L APPLICATION /SO SaatLabTest /D "Test error for event forwarding" }
Start-Sleep -Seconds 90
wecutil gr Server-Errors | Select-String 'saatlab.internal|RunTimeStatus'
Get-WinEvent -LogName ForwardedEvents -MaxEvents 1 | Select-Object MachineName, Id, ProviderName, Message

You should see something like this:

        DC01.saatlab.internal
            RunTimeStatus: Active
        DC02.saatlab.internal
            RunTimeStatus: Active

MachineName           Id ProviderName Message
-----------           -- ------------ -------
DC02.saatlab.internal 999 SaatLabTest  Test error for event forwarding

✅ Checkpoint: Both DCs show Active in the subscription, and DC02’s test error is in SRV01’s ForwardedEvents log.

5Turn an event into an alert

On SRV01, create a task that fires whenever a forwarded event 999 arrives:

$q = "<QueryList><Query Id='0' Path='ForwardedEvents'><Select Path='ForwardedEvents'>*[System[EventID=999]]</Select></Query></QueryList>"
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -Command Add-Content C:\Scripts\alerts.log ('{0} ALERT event 999 received' -f (Get-Date))"
$trigger = New-CimInstance -CimClass (Get-CimClass -Namespace ROOT\Microsoft\Windows\TaskScheduler -ClassName MSFT_TaskEventTrigger) -ClientOnly -Property @{ Enabled = $true; Subscription = $q }
Register-ScheduledTask -TaskName 'Alert on event 999' -Action $action -Trigger $trigger -User SYSTEM | Out-Null
Invoke-Command -ComputerName DC02 -ScriptBlock { eventcreate /T ERROR /ID 999 /L APPLICATION /SO SaatLabTest /D "Second test" }
Start-Sleep -Seconds 90; Get-Content C:\Scripts\alerts.log

You should see something like this:

20/10/2026 02:14:37 ALERT event 999 received

In real life the action sends an email, posts to Teams or opens a ticket. Pick a few events that really matter (a failed backup, a cluster node leaving, a disk filling up) rather than every error.

✅ Checkpoint: The second test event reached SRV01 and the task wrote an alert line to C:\Scripts\alerts.log.