70-698 Chp 12
WinRM quickconfig
-Applies the default configuration of WinRM and allows it to accept WS-Management requests from other remote machines. - Which command is used to Start the Windows Remote Management service from a command prompt -Configures the Windows Remote Management HTTP listener -It additionally creates a Windows Firewall exception
Event viewer - Custom view
-Includes Administrative Events -Allows you to create custom views of events
Event Viewer Logs File Levels
-Information - Indicates that a change in an application or component has occurred -Warning - Indicates that an issue has occurred that can impact service for result in a more serious problem if action is not taken -Error - Indicates that a problem has occurred that might impact functionality that is external to the application or component that triggered the event -Critical - Indicates that a failure has occurred from which the application or component that triggered the event cannot automatically recover -Success Audit - Indicates that the exercise of a user right was successful -Failure Audit - Indicates that the exercise of a user right has failed
Reliability Monitor
A Control Panel/Action Panel tool that measures hardware and software problems and other changes to your computer that could affect the reliability of the computer -1 (the least stable) 10(the most stable)
Event Viewer (Eventvwr.msc)
A Windows tool useful for troubleshooting problems with Windows, applications, and hardware. It displays logs of significant events such as a hardware or network failure, OS failure, OS error messages, a device or service that has failed to start, or General Protection Faults. -an MMC snap-in that enables you to browse and manage event logs.
Level
A classification of the event severity: Information, Warning, Error, Critical, Success Audit, Failure Audit
Processor, memory, disk, and network
A computer is composed of four primary systems
Paging file
A file used by Windows for virtual memory. Also called the swap file. The actual filename in Windows is PAGEFILE.SYS. (9) (75%)
XML (Extensible Markup Language)
A markup language that is designed to carry data, in contrast to HTML, which indicates how to display data.
Performance alert
A notification or task that is executed when a performance value is reached.
Event ID
A number identifying the particular event type
Resource monitor (resmon.exe)
A system tool that allows you to view information about the use of hardware (CPU, memory, disk, and network) and software resources (file handlers and modules) in real time.
Performance monitor user groups
Administrators, Performance Monitor Users, Performance Log Users
Data Collector Sets (DCS)
Allows you to organize a set of performance counters, event trace data, and system configuration data into a single object that can be reused as needed.
Performance Monitor (perfmon)
An MMC snap-in that provides tools for analyzing system performance.
Page fault
An event that occurs when an accessed page is not present in main memory. -if pages/sec is 1,000 or higher you should increase the memory
Process
An instance of a program that is being executed
Microsoft Active Protection Service (MAPS)
An online community that can help you decide how to respond to certain threat types and it serves as a resource to help stop the spread of new viruses and malware.
Configuration information
Collected from key values in the Windows Registry
Event trace data
Collected from trace providers, which are components of the OS or of individual applications that report actions or events.
Net Local Group "administrators" <collecting_computer_name>$@<domain_name> /add
Command to Add the collecting computer name to the Administrators group
Process Identification (PID)
Composed of unique numbers that identify a process while it is running.
wecutil qc
Configures a receiving computer to receive events.
Event viewer - Windows Logs - System
Contains events logged by Windows system components, including errors displayed by Windows during boot and errors with services.
Event viewer - Windows Logs - Application
Contains events logged by applications or programs
Event viewer - Windows Logs - Setup
Contains events related to applications setup
Event viewer - Windows Logs - Security
Contains events such as valid and invalid logon attempts and access to designated objects such as files and folders, printers, and Active Directory objects. Security log is empty until you enabling auditing.
Windows Defender
Designed to protect your computer against viruses, spyware, and other types of malware. Real-time protection.
Event viewer - Application and Services Logs
Displays a set of events related to an application or service. E.g. DHCP, DNS, & Active Directory
Event Viewer - Applications and Services Logs
Displays a set of events related to an application or service. E.g. DHCP, DNS, and Active Directory
Which of the following is used to view the Windows logs?
Event Viewer
Task manager
Gives you a quick glance at performance and provides information about programs and processes running on your computer.
Event viewer - Windows Logs
Includes logs that were available in previous versions of windows: Application, Security, Setup, System, Forwarded Events
Performance monitor graph types
Line (default), Histogram (bar graph), Report (written)
Performance counters
Measurements of system state or activity
%Processor Time
Measures how busy the processor is (80%)
Event subscription
Microsoft's new Event Viewer allows you to collect events from remote computers and store them locally. By what name is this collection of events known?
Working set delta (memory)
Shows the amount of change in working set memory used by the process
Paged pool
Shows the amount of committed virtual memory for a process that can be written to another storage medium, such as the hard disk
NP Pool (non-paged)
Shows the amount of committed virtual memory for a process that can't be written to another storage medium.
Working set (memory)
Shows the amount of memory in the private working set plus the amount of memory the process is using that can be shared by other processes.
Commit Size
Shows the amount of virtual memory that is reserved for use by a process
Peak working set (memory)
Shows the maximum amount of working set memory used by the process
Event viewer - Windows Logs - Forwarded Events
Stores events collected from remote computers. Must create an event subscription. Does not work with pre-Windows 7 and WinServer 2008.
Taskschd.msc
Task Scheduler command
Disk queue length
The number of read and write requests that are waiting to be processed. (Sustained average higher than 2 times the number of spindles)
Source
The software that logged the event
Real-time protection
Uses signature detection methodology and heuristics to monitor and catch malware behavior.
When troubleshooting a problem and using Event Viewer, which of the following should be used to help focus on a reduced set of events?
filters
Which of the following allows viewing events from multiple computers using Event Viewer?
subscriptions