The key tool you use to manage system processes and applications is Task Manager. You can use any of the following techniques to display Task Manager:

The following sections cover techniques you use to work with Task Manager.

Task Manager has two general views:

If you are in summary view, you can switch to expanded view by tapping or clicking More Details. If you are in the expanded view, you can switch to summary view by tapping or clicking Fewer Details. When you close and reopen Task Manager, the view that you last used is displayed.

Generally, as an administrator, you’ll work with the expanded view. As shown in Figure 4-1, the expanded view has multiple tabs you can select to work with running processes, system performance, connected users, and configured services. The Processes tab, also shown in Figure 4-1, shows the general status of processes. Processes are grouped by type and listed alphabetically within each type by default. There are three general types:

Figure 4-1. View the status of processes currently running on the server.

The Status column tells you whether an application is running normally or has stopped responding. A blank status is normal and indicates the process is running normally. Any other status indicates a problem, such as when an application might be frozen and you might want to end the task related to it. However, some applications might not respond to the operating system during certain process-intensive tasks. Because of this, you should be certain the application is really not responding before you end its related task.

You can stop a process by selecting the process and then tapping or clicking End Task. You shouldn’t try to stop Windows processes by using this technique. If you try to stop a Windows process or a group of Windows processes, Task Manager displays a warning prompt similar to the one shown in Figure 4-2. This warning states that ending this process will cause Windows to become unusable or to shut down. To proceed, you must select Abandon Unsaved Data And Shut Down, and then tap or click Shut Down. Windows then displays a blue screen with an error code. After collecting error information, Windows will restart.

Figure 4-2. Stopping processes for essential Windows services causes Windows to become unusable or to shut down.

Other columns on the Processes tab provide a lot of information about running processes. You can use this information to determine which processes are over-consuming system resources, such as CPU time and memory. Although only CPU and Memory columns are displayed by default, other columns can be added by pressing and holding or right-clicking any column header and then selecting check boxes for the additional columns to display. In addition to name and status, the other available columns include the following:

Pressing and holding or right-clicking an application’s listing in Task Manager displays a shortcut menu that you can use to do the following:

Task Manager’s Details tab is shown in Figure 4-3. This tab provides detailed information about the processes that are running. The columns displayed by default on the Details tab are similar to those provided on the Processes tab:

Figure 4-3. The Details tab provides detailed information about running processes.

Other columns can be added by pressing and holding or right-clicking any column header and then tapping or clicking Select Columns. When you’re trying to troubleshoot system problems by using process information, you might want to add the following columns to the view:

If you examine processes running in Task Manager, you’ll notice a process called System Idle Process. You can’t set the priority of this process. Unlike processes that track resource usage, System Idle Process tracks the percentage of system resources that aren’t used. Thus, a 99 in the CPU column of the System Idle Process means that 99 percent of system resources currently aren’t being used.

Processes that are waiting to use a resource that is locked by another process are in a wait state and can continue only when the locked resource is released. As part of normal operations, resources are locked for one process or another and then released to be used by another process. Sometimes, though, with poorly architected programs, a process can get stuck waiting for a resource that never gets released.

You can view the wait chain for processes by pressing and holding or right-clicking the process and then tapping or clicking Analyze Wait Chain. If the process is waiting for a resource to be released, the wait chain is displayed for that process (as shown in Figure 4-4). The root node in the wait tree is the process using, or waiting to use, the required resource. A process waiting on another process for a resource might explain why a process doesn’t seem as responsive as you might expect.

If you suspect there’s a locking problem, you can select one or more processes in the wait chain and then tap or click End Process. Task Manager then stops the processes, which should free the locked resource. However, keep in mind that it is routine and normal for processes to lock resources while those resources are being used and then to free the resources when they are no longer being used. A problem occurs when a process fails to release a resource, as can happen with a poorly architected program.

Figure 4-4. Analyzing wait chains to identify threads waiting to finish.

As you examine processes, keep in mind that a single application might start multiple processes. Generally, these processes are dependent on a central process. From this main process, a process tree containing dependent processes is formed. You can find the main process for an application by pressing and holding or right-clicking the application on the Processes tab and selecting Go To Details. When you terminate processes, you’ll usually want to target the main application process or the application itself rather than dependent processes. This ensures that the application is stopped cleanly.

To stop the main application process and dependent processes, you have several choices:

Task Manager’s Services tab provides an overview of system services. This tab displays services by name, process ID, description, status, and group. As shown in Figure 4-5, multiple services typically run under the same process ID. You can quickly sort services by their process ID by tapping or clicking the related column heading. You can tap or click the Status column heading to sort services according to their status, Running or Stopped.

The Group column provides additional options about related identities or service host contexts under which a service runs:

Figure 4-5. The Services tab provides a quick overview of the status of system services.

Pressing and holding or right-clicking a service’s listing in Task Manager displays a shortcut menu that allows you to do the following:

The Performance tab in Task Manager provides an overview of CPU and memory usage. As shown in Figure 4-6, the tab displays graphs and statistics. This information gives you a quick check of system resource usage. For more detailed information, use Performance Monitor, as explained later in this chapter.

The graphs on the Performance tab provide the following information:

Figure 4-6. The Performance tab provides a quick check of system resource usage.

Tap or click a summary graph in the left pane to view detailed information for that graph in the right pane. To view a close-up of any graph, double-tap or double-click the graph. Double-tapping or double-clicking again returns you to normal viewing mode.

The Update Speed option on the View menu allows you to change the speed of graph updating and to pause the graph. Updates occur once every four seconds for Low, once every two seconds for Normal, and twice per second for High.

Remote users can use Remote Desktop to connect to remote systems. Remote Desktop allows you to manage systems remotely, as if you were sitting at the console. Windows Server 2012 R2 allows up to two active console sessions at a time.

One way to view and manage remote desktop connections is to use Task Manager. To do this, start Task Manager, and then tap or click the Users tab, shown in Figure 4-7. The Users tab shows interactive user sessions for both local and remote users.

Figure 4-7. The Users tab allows you to view and manage user sessions.

Each user connection is listed with user name, status, CPU utilization, and memory usage by default. Other columns can be added by pressing and holding or right-clicking any column header and then tapping or clicking the columns to add. Available columns include:

CPU and memory utilization details are convenient for troubleshooting performance issues related to logged-on users. The combined utilization value is listed above the column heading, and individual utilization values for each logged-on user are listed below it.

In the example shown in Figure 4-7, the server’s CPU is 95% utilized by the logged-on users. This high usage level could affect the overall performance of the server, and the server might not be as responsive when performing other tasks.

If you press and hold or right-click a user session, you have the following options:

Also new for Windows Server 2012 R2 is the user’s name is followed by the number of processes that user is running. If you double-tap or double-click the user’s name, an entry for each running process is displayed. Processes are listed by name, CPU usage, and memory usage.

When you are working with Server Manager and select the Local Server node, the All Servers node, or a server group node, the right pane will have a Services panel, like the one shown in Figure 4-8. If you select the server you want to work with in the Servers panel, its services are listed in the Services panel. You can use this panel as follows:

Figure 4-8. Use the Services panels in Server Manager to manage services on local and remote servers.

The columns on the Services panel can be adjusted by pressing and holding or right-clicking any column header and then tapping or clicking the columns to add or remove. The columns you can use include the following:

For quick and easy management of any service on a remote server, you can use the Services node in Computer Management. You can open Computer Management and automatically connect to a remote server from Server Manager. To do this, follow these steps:

When you are working with Computer Management, you view and work with services by expanding the Services And Applications node and then selecting the Services node, as shown in Figure 4-9. The columns in the Services pane are slightly different from those shown when you are working with the Services node in Computer Management:

Figure 4-9. Use the Services pane to manage services on local and remote computers.

The Services pane has two views: Extended and Standard. To change the view, use the tabs at the bottom of the Services pane. In Extended view, quick links are provided for managing services. Tap or click Start to start a stopped service. Tap or click Restart to stop and then start a service—essentially resetting that service. If you select a service when the Services pane is in Extended view, a description that details the service’s purpose is displayed.

As an administrator, you often have to start, stop, or pause services. To start, stop, or pause a service, press and hold or right-click the service you want to manage and then select Start, Stop, or Pause as appropriate. You can also choose Restart to have Windows stop and then start the service after a brief pause. Additionally, if you pause a service, you can use the Resume option to resume normal operation.

You can set services to start manually or automatically. You can also turn them off permanently by disabling them. You configure service startup in Computer Management by following these steps:

Figure 4-10. Configure service startup options by using the General tab’s Startup Type list.

You can configure services to log on as a system account or as a specific user. To do either, follow these steps:

Figure 4-11. Use the Log On tab to configure the service logon account.

You can configure services to take specific actions when a service fails. For example, you can attempt to restart the service or run an application. To configure recovery options for a service, follow these steps:

As an administrator, you need to ensure that servers and the network are secure, and unnecessary services are a potential source of security problems. For example, in many organizations that I’ve reviewed for security problems, I’ve found servers running Worldwide Web Publishing Service, Simple Mail Transfer Protocol (SMTP), and File Transfer Protocol (FTP) Publishing Service when these services weren’t needed. Unfortunately, these services can make it possible for anonymous users to access servers and can also open the server to attack if not properly configured.

If you find unnecessary services, you have several options. With services installed through roles, role services, or features, you can remove the related role, role service, or feature to remove the unnecessary component and its related services. Or you can simply disable the services that aren’t being used. Typically, you’ll want to start by disabling services rather than uninstalling components. This way, if you disable a service and another administrator or a user says he or she can’t perform a particular task anymore, you can enable the related service again if necessary.

To disable a service, follow these steps:

When you think a computer has a problem related to services—their status or configuration, for example—one of the fastest ways to troubleshoot is to use Windows PowerShell. Windows PowerShell provides several cmdlets for working with system services, including:

To get a list of all services configured on a system, type get-service at the command prompt. Optionally, use the –ComputerName parameter to specify a remote computer to work with, as shown in this example:

Get-Service –ComputerName CorpServer18

If you want to check multiple computers, simply enter the computer name in a comma-separated list:

Get-Service –ComputerName Server18, Server24, Server30

Regardless of whether you check the local computer or remote computers, the standard output shows the status, name, and display name of each configured service, as shown in the following example:

Status   Name               DisplayName
------   ----               -----------
Running  ADWS               Active Directory Web Services
Stopped  AeLookupSvc        Application Experience
Stopped  ALG                Application Layer Gateway Service
Stopped  AllUserInstallA... Windows All-User Install Agent
Stopped  AppIDSvc           Application Identity
Running  Appinfo            Application Information

Knowing this, you can display information about a specific service by using its name or display name, such as the following:

Get-Service –DisplayName "Application Experience" –ComputerName CorpServer18

To match partial names, you can use wildcard characters. In this example, you want to check the status of key services used by Hyper-V:

Get-Service –DisplayName Hyper* –ComputerName CorpServer18

As part of troubleshooting, you might also want to locate all services that are disabled or stopped on a computer. To find disabled services, you can enter the following:

Get-Service | where {$_.status -eq 'disabled'}

To find stopped services, you can enter the following:

Get-Service | where {$_.status -eq 'stopped'}

A service can start only if the services it depends on also are started. You can use the –RequiredServices parameter to confirm the status of the services that are required for a particular service to start. Alternatively, you can check the status of services that depend on a particular service by using the –DependentServices parameter.

As part of troubleshooting, you might need to determine the start mode of services. If a service isn’t configured to start automatically, that would explain why it isn’t running. Although Get-Service doesn’t display the StartMode of services, you can use Get-WMIObject Win32_Service to get extended information about services, including their start mode.

The syntax for displaying detailed information about a particular service follows:

Get-WMIObject Win32_Service -Filter "name='serviceName'" | Select *

Or you could use the following:

Get-WMIObject Win32_Service -Filter "displayname='DisplayName'" | Select *

In these examples, you use Get-WMIObject Win32_Service to examine all services on a computer and filter the results by either the name or display name of the service. You then use Select-Object (which has Select as an alias) to list all associated properties.

In your troubleshooting, you might want to list the start mode of all enabled services on a computer. The following example shows one way to do this:

get-wmiobject win32_service -filter "StartMode <>'disabled'" | 
sort StartMode | format-table -GroupBy StartMode 
-Property Name,State

Here, you list all enabled services on a computer, sorting the output by the start mode, and then alphabetically list services in each group by name and state. The output is similar to the following:

  StartMode: Auto

Name                                                     State
----                                                        -----
Netlogon                                                  Running
NlaSvc                                                     Running
MpsSvc                                                    Running
… 
   StartMode: Manual

Name                                                    State
----                                                       -----
AppReadiness                                             Stopped
vmicguestinterface                                        Stopped
UmRdpService                                            Running
…

Rather than list all services, you might instead want to quickly identify services that should be running but aren’t. To do this, you can use the following command:

get-wmiobject win32_service -filter "startmode='auto' AND state<> 'Running'" | Select Name,State

Here, you use Get-WMIObject Win32_Service to examine all services that have the Auto start mode (which includes services that have a delayed automatic start) but aren’t running. You look for services that have a state other than ‘Running’ to ensure services with any state other than ‘Running’ are included in the results, as shown in this sample output:

name                                                        state
----                                                        -----
RemoteRegistry                                              Stopped
sppsvc                                                      Stopped
workfolderssvc                                              Stopped

To determine whether a service that should have started automatically but didn’t start because a required service isn’t running, you can enter the following command:

get-wmiobject win32_service -filter "startmode='auto' AND state<> 'Running'"
| get-service -RequiredServices

Here, you use Get-WMIObject Win32_Service to examine all services that have the Auto start mode but aren’t running. You then display the details regarding services that are required for the stopped service to start. If a required service is stopped, that could explain why a service was stopped. You then typically would begin deeper troubleshooting by trying to determine why the required service didn’t start. Otherwise, if required services are running or if there are no required services, you would begin deeper troubleshooting by trying to determining why the original service didn’t start.

When you are working with Server Manager and select the Local Server node, the All Servers node, or a server group node, the right pane will have an Events panel, like the one shown in Figure 4-13. When you select the server you want to work with in the Servers panel, its events are listed in the Events panel. You can use this panel as follows:

Figure 4-13. Use the Events panels in Server Manager to track errors and warnings.

The columns on the Events panel can be adjusted by pressing and holding or right-clicking any column header and then tapping or clicking the columns to add or remove. The columns you can use include:

To work with event logs on remote servers, remote management and inbound exceptions for Remote Event Log Management must be enabled. For more information, see the section “Managing your servers remotely” in Chapter 3.

You access the event logs by following these steps:

As shown in Figure 4-14, entries in the main pane of Event Viewer provide a quick overview of when, where, and how an event occurred. To obtain detailed information about an event, review the details provided on the General tab in the lower portion of the main pane. The event level or keyword precedes the date and time of the event. Event levels include the following:

In addition to level, date, and time logged, the summary and detailed event entries provide the following information:

Event Viewer creates several filtered views of the event logs for you automatically. Filtered views are listed under the Custom Views node. When you select the Administrative Events node, a list of all errors and warnings for all logs is displayed. When you expand the Server Roles node and then select a role-specific view, a list of all events for the selected role is displayed.

If you want to create a custom view of your own, you can do so in Computer Management by following these steps:

If you want to review a particular type of event, you can filter the log in Computer Management by following these steps:

Log options allow you to control the size of event logs and also how logging is handled. By default, event logs are set with a maximum file size. When a log reaches this limit, events are overwritten to prevent the log from exceeding the maximum file size.

To set log options in Computer Management, follow these steps:

When an event log is full, you need to clear it. To do that in Computer Management, follow these steps:

On key systems such as domain controllers and application servers, you’ll want to keep several months’ worth of logs. However, it usually isn’t practical to set the maximum log size to accommodate this. Instead, you should allow Windows to periodically archive the event logs, or you should manually archive the event logs.

Information,07/21/14 3:43:24 PM,DNS Server,2,None,The DNS server has
started.
Error,07/21/14 3:40:04 PM,DNS Server,4015,None,The DNS server has 
encountered a critical error from the Directory Service (DS). The data is 
the error code.

Level,Date and Time,Source,Event ID,Task Category,Description