Vol. 17, #33 - August 13, 2012 - Issue #892

Profiling Performance

  1. Editor's Corner
    • From the Mailbag
    • Profiling Performance
    • Tip of the Week
    • Recommended for Learning
    • Quote of the Week
  2. Admin Toolbox
    • Admin Tools We Think You Shouldn't Be Without
  3. Events Calendar
    • TechMentor Conference Redmond, Aug 20-24, 2012
    • Americas
    • Europe
    • Asia/Pacific
  4. Webcast Calendar
    • Register for Webcasts
  5. Tech Briefing
    • Seven new Microsoft Virtual Academy courses covering Private Cloud technologies
    • Backing Up 100 Plus Terabyte of Data Cheaply
    • Building a Knowledge Blogging System in SharePoint
    • Smart Screen? Smart!
    • Understanding User-Driven Installation (UDI) in MDT 2012
    • A Response to VMware's 'Get the Facts' page comparing vSphere to Hyper-V & System Center
    • Attack Surface Analyzer 1.0 Released
  6. Windows Server News
    • Three hurdles of data portability with multiple cloud providers
    • The complete guide to VDI storage management
    • The future of virtualization: Areas for growth and concern
    • VMware storage options: Finding affordable shared storage
  7. WServerNews FAVE Links
    • This Week's Links We Like. Fun Stuff.
  8. WServerNews - Product of the Week
    • New Free Tool - Real-time Bandwidth Monitor for Sub Second Device Polling and Interface Monitoring


New Free Tool - Real-time Bandwidth Monitor for Sub Second Device Polling and Interface Monitoring

Real-Time Bandwidth Monitor, SolarWinds’ latest and greatest free tool, allows you to monitor interfaces on your network, see how much bandwidth is in use, or how much is traffic is currently on the interfaces. Now you can poll your interface as frequently as every half second. Set critical and warning thresholds to instantly see when usage is out of bounds. Monitoring a troublesome interface has never been so easy!

Download Real-Time Bandwidth Monitor


Editor's Corner

SAVE THIS NEWSLETTER so you can refer back to it later for tips, tools and other resources you might need to do your job or troubleshoot some problem you're dealing with. And please feel free to FORWARD IT TO A COLLEAGUE who you think might find it useful. Thanks!

From the Mailbag

This week's newsletter is about profiling the performance of Windows servers. Ensuring optimal server performance is essential if you don't want angry users breathing down your neck! But before we examine this subject, let's take a quick peek in our Mailbag.

Snapshot Snags (Issue #891)

In the previous issue we included a request for assistance from a reader named Alain in South Africa:

I have a question that you might be able to assist with:

We received the following responses from our newsletter readers:

Mike from Salt Lake City, USA - If the server in question is connected to a network switch, most switches keep track of the amount of data that traverses each port. These statistics can be cleared and set to zero at will. You can also monitor or mirror a port and then capture the data with a PC running Wireshark. This will give lots of information about the data on that port, including the amount that has passed. You can also set triggers on different parameters that can alert you to any type of condition you might see.

Stefan from Germany - Have a look at NetSpeedMonitor:

NetSpeedMonitor is a lightweight Network Monitoring Toolbar for your Windows Taskbar designed to be used on computers that run Windows XP, Windows Server 2003, Windows Vista or Windows 7. With NetSpeedMonitor you can monitor the current speed (up- and downstream) of your Network Interfaces and the amount of data transferred. In addition to the Connection Table with all TCP/UDP endpoints and the Toolbar Tooltip with a quick and short traffic overview, you can also see detailed daily and monthly Traffic Statistics. NetSpeedMonitor toolbar requires no additional drivers like other Network Monitoring tools do!

Ricardo from B.C. Canada - Regarding the question from Alain in South Africa he might want to take a look at PRTG:

The freeware version lets you monitor up to 10 "sensors". I have used it in the past and there is no need to be logged in for it to monitor. It runs as a service and keeps different kinds of graphs.

Frank from the USA - I use a standard firewall (PFSENSE) that monitors network transfer levels. I can look at several different time frames for transfer (hour graph up to 6 months graph).  This user should already have a firewall in place and this option is often included in them. He needs to look at his firewall manual again.

Hopefully one of these solutions proposed by our readers can meet the needs of Alain's particular scenario. And thanks to everyone who offered advice on this matter.

Building Images (Issue #890)

A reader named Steven described how he used to avoid running Sysprep multiple times when he built Windows reference images in the old days:

Thanks for the great work you do with WServerNews. In my system administrator days when we used imaging to deploy software to our desktop machines we always used image sets. In each set, we had a reference image and a sysprep image. Whenever we needed to update an image set, we would update the reference image, save it, and then run sysprep on it to create the sysprep image. This allowed us to maintain a base image that had never been "syspreped" thus preventing the problems associated with running sysprep multiple times. Of course the downside was the disk space needed to store the extra image for each set but given that our images were about 1 GB each and we only needed two image sets for all our machines, this was a small price to pay for the ease of using DriveImage and a simple DOS boot disk.

Another reader named Don pointed us to the following post on the Ask The Core Team blog that explains where to find the MDT log files when your deployment fails and how you can obtain a tool for reading these log files so you can try to troubleshoot what went wrong:

Be sure also to check out the Tech Briefing section of this newsletter for some links to explanations of how the new User-Driven Installation (UDI) scenario option in Microsoft Deployment Toolkit 2012 can make your life easier as an administrator.

Now on to this issue's main topic.

Profiling Performance

Critical factors relating to the operation of Windows servers include their availability, reliability, elasticity and performance. Performance is something we often take for granted however. For example, when provisioning a new server we might begin by looking at how much money we can allocate, review the system requirements for the workload we plan to run on the server, and then simply buy a system that has as much memory, processor power, and storage capabilities as our business can afford. Then we keep our fingers crossed and hope for the best in terms of performance. Not very scientific, I know, but who has time nowadays to create performance baselines based on our own testing?

And besides, who knows what strange actions MIGHT CAUSE UNEXPECTED SLOWDOWNS?

Using Perfmon - How much, how often?

The standard tool for profiling server performance is the Performance console (Perfmon.exe or Perfmon.msc /s), which is included in-box on all current versions of Windows and can be used to collect performance data in the form of data collector sets, display real-time and saved performance data, and generate various kinds of reports.

If you need to profile the performance of a server, how much performance data should you collect? The recommendations I've seen suggest that you aim for collecting between 1,000 and 5,000 data points where each data point typically represents a collection of different performance counters for processor, memory, disk, and other system resources. You should also make sure you don't collect data more often than once every 15 seconds, otherwise the overhead incurred by the perfmon data collection process may be excessive and impact the server's performance. So if you want to monitor your server's performance over an 8 hour period, you could collect perfmon data every 30 seconds and end up with about 1,000 data points.

How to baseline server performance

For a high-level look at some best practices concerning how to baseline server performance, check out this post from awhile back on the Ask The Performance Team Blog:

Some specific scenarios

Learning how to effectively use Perfmon can often seem more like an art than a science. Fortunately, Microsoft has provided some specific guidance for doing this, but their guidance is scattered all over the place. Here are some you should know about:

General - "Windows Performance Monitor" (good overview of Windows Server 2008 R2 performance monitoring):

AD DS - "Monitoring Your Branch Office Environment" (guidelines for monitoring read-only domain controllers deployed at branch offices):

Hyper-V - "Monitoring Hyper-V Performance" (based on Windows Server 2008 but much of this still applies to the latest version of Hyper-V):

Exchange - "Performance and Scalability Counters and Thresholds" (describes the performance counters you can use to monitor Exchange 2010):

SharePoint - "Monitoring and maintaining SharePoint Server 2010" (performance counters for SharePoint 2010 farms):

SQL Server - "Monitoring Report Server Performance" (monitor resource usage on SQL Server 2012 Reporting Services Report Server):

Counter confusion

Performance counters can sometimes be confusing, for example differentiating between Physical Disk counters and Logical Disk counters. For a good explanation of the difference, see this recent post on the Ask The Core Team blog:

This knowledge is useful for example if you want to measure the IO latency of your server's storage system:

Share your expertise!

Help other readers of WServerNews grow their expertise! If you have any other Perfmon tips or resources to recommend, email me at [email protected]

Stepping up to Resmon

Another helpful tool for profiling Windows server performance is Resource Monitor (Resmon.exe) which combines data collected by Perfmon.exe with Windows Event Tracing (WET) data. For an excellent introduction to using Resource Monitor to troubleshoot Windows performance issues, see the following couple of posts on the Ask The Performance Team Blog:


Troubleshooting performance problems

While Perfmon is good for baselining and monitoring server performance, what if you have some specific performance problem you need to troubleshoot? I'm thinking for example of a system that takes a long time to boot, maxes out CPU cycles for extended periods, constantly experiences disk drive thrashing, and similar stuff.

In these kinds of scenarios, Xperf is your friend. Xperf is part of the Windows Performance Toolkit (WPT) and uses Event Tracing for Windows (ETW) to capture kernel and application events and display them as graphs, tables and data summaries that are easy to view and understand. Here's a quick introduction to Xperf from a post on the Ask The Performance Team Blog:

See also this post from the MSDN blog titled Pigs Can Fly:

Also check out these two YouTube videos created by an Escalation Engineer at Microsoft:


The NTDebugging blog on MSDN also has a good walkthrough on how to get started using Xperf:

So what do you do with an .etl file you've collected using Xperf? These posts by Jeff Stokes in his blog Dude Where's My PFE? demonstrate the next steps:


And here's Jeff's most recent experience using Xperf to solve a customer problem:

To get started with Xperf, check out this Detailed Walkthrough in the Windows Dev Center on MSDN:

To obtain the latest version of Xperf, go to the Windows Performance Analysis Developer Center:

What about PC performance?

End-users are also concerned about the performance of their PCs because it impacts their job. A common complaint from users is, "Why is my work PC so much slower than my home PC?" The implication of course is that the IT staff doesn't know what they're doing...which unfortunately may be true sometimes. However, the following brief explanation (which is based on some actual performance analysis results I've seen) may help mollify them:

  1. Your work PC is domain-joined. You're home PC isn't. A domain-joined PC is centrally managed and so has additional software running on it that consumes resources and may sometimes impact system performance.
  2. Your work PC has to be secure, so it's got all kinds of security products installed on it. There's some overhead associated with running all this stuff, but we've got to protect your PC from malware because our business depends on it. As for your home PC, we don't care what you do with it as long as you don't bring it into work.

Exploring Explorer's performance

Speaking of end-users, have you ever heard someone complain about Windows Explorer being slow when you open a folder that contains thousands of files in it? That's actually a limitation of how Windows Explorer works, as Raymond Chen explains in the following TechNet Magazine article:

The bottom line is that Windows Explorer is not a document management system, and if you need to be able to manage thousands of documents efficiently you should use SharePoint or something similar.

By the way, readers who have a geeky bent of mind should also check out Raymond's long-running blog on MSDN titled The Old New Thing:

More tools

Finally, be sure to check out this helpful list of troubleshooting tools recommended by Jeff Stokes, a Premier Field Engineer (PFE) at Microsoft:

Be sure to check out the Admin Toolbox section of this newsletter as well.

Tip of the Week

Speaking again of Windows Explorer funniness, last week I tried to use Explorer copy some large PowerPoint presentations from a remote WebDAV share on an IIS webserver over a VPN connection. Some of the presentations were big (larger than 50 MB in size) and Explorer didn't want to copy them. So I tried using Robocopy to copy them from the command line, but I kept getting Error 0x800700DF as Robocopy didn't want to copy the large files either.

After a little searching online, I stumbled across the following thread in the Microsoft Answers forum that explained the situation and how to resolve it:

So I opened Regedit.exe, browsed to HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Parameters, and changed the FileSizeLimitInBytes value from decimal 5000000 to decimal 10000000. I was then able to successfully copy the files to my local machine.

While Microsoft Answers targets the ordinary end-user, some of the help you can find there can be useful to IT pros as well. The next time one of your friends or family members asks you for free help with their computer, consider suggesting to them that they post their question to one of the forums on Microsoft Answers:

That way not only will they get help with their problem but others will be helped too. Either that or just charge them your usual rate for billable hours ;-)

Got any tips of your own to share with our readers? Email me at [email protected]

Recommended for Learning

This week we have three new books on SQL Server 2012 from Microsoft Press:

Introducing Microsoft SQL Server 2012 from Microsoft Press provides a quick in-depth overview of many of the new features and capabilities in the latest version of SQL Server:

Microsoft SQL Server 2012 T-SQL Fundamentals from Microsoft Press explains how to use T-SQL to query and modify data stored in SQL Server databases. Although intended for beginners, the treatment is rigorous and can get quite deep at times, and database developers with a couple of years' experience can also benefit from reading it through:

Microsoft SQL Server 2012 High-Performance T-SQL Using Windows Functions from Microsoft Press shows you how to use Windows functions in Transact-SQL to optimize your SQL Server database queries:

Quote of the Week

"The path to wealth is not to chase money for its own sake, but to understand and develop your own intrinsic talents and inclinations. You must seek a livelihood that allows you to do what you were intended to do and one that brings you joy. If you do, the money will take care of itself."

--Chin-Ning Chu in her book "Thick Face, Black Heart: The Warrior Philosophy for Conquering the Challenges of Business and Life"

While reality would seem to suggest that we should just hunker down and work hard at our lousy job if we want to pay our bills and keep the creditors from harassing us, the larger picture that Chin-Ning speaks of here is actually the truer reality if we will only believe and pursue it. I can testify to this from my own life after having changed careers several times until I finally realized what I was capable of and began enjoying my talents instead of squandering them.

Until next week,

Cheers, Mitch Tulloch


Admin Toolbox

Admin Tools We Think You Shouldn't Be Without

Prepare your organization for the surprises in Exchange 2010 with Metalogix.

Download a free, fully functioning 30-day trial of Patch Manager from SolarWinds and get visibility into patch compliance with an extensive collection of simple, built-in reports.

Using Microsoft Hyper-V? Altaro Hyper-V Backup Freeware Edition is an easy to use Hyper-V aware backup solution. Watch YouTube Video.

Get centralized backup and rapid recovery from bare metal including virtual environments with StorageCraft ShadowProtect:

Virtual CloneDrive is a free tool from SlySoft that lets you mount ISO image files as if they were inserted into your PC's CD/DVD drive:


Events Calendar

TechMentor Conference Redmond, Aug. 20-24, 2012

TechMentor, the top conference for IT professionals, is coming to the Microsoft campus! Register with code TMRTU for a $300 discount:




Add your event

Contact Michael Vella at [email protected] to get your conference or other event listed in our Events Calendar.


Webcast Calendar

Register for Webcasts

 Add your Webcast

Contact Michael Vella at [email protected] to get your webcast listed in our Webcasts Calendar.


Tech Briefing

Seven new Microsoft Virtual Academy courses covering Private Cloud technologies

Microsoft Virtual Academy (MVA) is a free training portal that lets you learn about the latest Microsoft technologies at your own pace:

Backing Up 100 Plus Terabyte of Data Cheaply

From the Working Hard In IT blog comes a new series of posts on using disk-to-disk backup with Windows Server 2012 to back up large amounts of data without going broke:

Building a Knowledge Blogging System in SharePoint

From the Canadian IT Professionals blog comes this post that explains how to set up a "Knowledge Blogging System" using SharePoint:

Smart Screen? Smart!

Mitch Garvis explains why SmartScreen, a new security features in Windows 8, is a really smart feature:

Understanding User-Driven Installation (UDI) in MDT 2012

UDI lets administrators create a Replace Computer scenario experience that end-users can interact with. These two blog posts by Chris, a Senior Program Manager at Microsoft, explain how to get started with UDI:


A Response to VMware's 'Get the Facts' page comparing vSphere to Hyper-V & System Center

Read this detailed and fairly balanced comparison of the Microsoft Hyper-V + System Center virtual platform vs. VMware's ESX + vSphere by a Microsoft MVP:

Attack Surface Analyzer 1.0 Released

Microsoft has just released a free Attack Surface Analyzer tool that can be used by software developers, Independent Software Vendors (ISVs) and IT Professionals to better understand changes in Windows systems' attack surface resulting from the installation of new applications:


Windows Server News

Three hurdles of data portability with multiple cloud providers

When it comes to application migration, you're likely to face various challenges when moving virtual machines, migrating data and/or configuring networks. Learn key tips and tricks that can simplify each of these three phases so you can minimize issues and accelerate the process.

The complete guide to VDI storage management

If you want to ensure optimal virtual desktop performance, the first – and most important – step is implementing the right storage system. Check out this resource to review tips for mastering VDI storage selection, configuration and allocation.

The future of virtualization: Areas for growth and concern

While virtualization's rate of adoption is rising across the IT industry, there are various issues with the technology that may eventually cause deployments to decrease. Access this resource to explore expert insights on the areas of growth and concern for this popular trend.

VMware storage options: Finding affordable shared storage

Looking to take advantage of all that shared storage has to offer, but not sure if your limited IT budget can accommodate it? Discover three VMware storage options that can enable you to create a shared storage infrastructure at a price your organization can afford.


WServerNews FAVE Links

This Week's Links We Like. Tips, Hints And Fun Stuff

Jesse, the Jack Russell Terrier, is back and he's got a brand new useful set of skills to show off:

A camera crew captures Great White Sharks jumping out of the water in stunning slow motion HD:

Ramesh Raskar and his team at MIT have invented a camera that can photograph light itself in slow motion.

10 quick and simple life hacks that can save a lot of time and frustration:

Check out this photo of a "steampunk" Windows PC on the Official Facebook page of Microsoft Windows:

For more examples of Victorian-era fantasy design meeting Windows PC technology, see this TechRadar article from awhile back:


WServerNews - Product of the Week

New Free Tool - Real-time Bandwidth Monitor for Sub Second Device Polling and Interface Monitoring

Real-Time Bandwidth Monitor, SolarWinds’ latest and greatest free tool, allows you to monitor interfaces on your network, see how much bandwidth is in use, or how much is traffic is currently on the interfaces. Now you can poll your interface as frequently as every half second. Set critical and warning thresholds to instantly see when usage is out of bounds. Monitoring a troublesome interface has never been so easy!

Download Real-Time Bandwidth Monitor


WServerNews - Editors

Mitch Tulloch is Senior Editor of WServerNews and is a widely recognized expert on Windows administration, deployment and virtualization. Mitch was lead author of the bestselling Windows 7 Resource Kit from Microsoft Press and has published hundreds of articles for IT pros. Mitch is also a seven-time recipient of Microsoft's Most Valuable Professional (MVP) award for his outstanding contributions in support of the global IT pro community. Mitch owns and runs an information technology content development business based in Winnipeg, Canada. For more information see www.mtit.com

Ingrid Tulloch is Associate Editor of WServerNews and was co-author of the Microsoft Encyclopedia of Networking from Microsoft Press. Ingrid is also Head of Research for our content development business and has co-developed university-level courses in Information Security Management for a Masters of Business Administration program.