Lab: Monitor a server with scheduled tasks and logs

What you will learn in this TP

• Write to an event log
• Schedule a PowerShell script
• Filter logs and configure service recovery

Introduction #

What you will learn in this section

• Write to an event log
• Schedule a PowerShell script
• Filter logs and configure service recovery

Context. A server’s print service stops regularly and the disk fills up without warning. Before installing a monitoring tool, you set up native monitoring.

Prerequisites: a disposable Windows Server 2025 virtual machine (free evaluation) with an administrator account, and PowerShell open as administrator  ·  Estimated duration: 45 min

A scheduled task that writes events, Get-WinEvent queries and a service that restarts by itself.

Setup #

Guided steps, with their solution.

1. 1. Create an event source

   Why? A script that writes to Windows logs is visible to every monitoring tool.

   Create the ControleServeur source in the Application log and write a test event (ID 1000).

2. 2. Write the check script

   Why? A simple, reliable check beats a badly configured tool.

   Write C:\TP\Scripts\Controle.ps1: warning (ID 2001) if a volume has less than 15% free, error (ID 2002) for each stopped automatic service, otherwise an event 1000.

3. 3. Schedule the check

   Why? Task Scheduler runs the script without a logged-on session, as SYSTEM.

   Create the task \Exploitation\Controle serveur every 15 minutes, start it and check its result.

4. 4. Cause and detect an incident

   Why? You check that an alert actually fires.

   Stop the Spooler service, run the task again, then find event 2002 and the service stop in the System log (ID 7036).

5. 5. Automatic recovery

   Why? The service control manager can restart a failed service without intervention.

   Configure Spooler to restart after 1 minute on the first two failures, then simulate a crash by killing its process.

6. 6. Analyze the logs

   Why? A few queries answer the most common incident questions.

   Display System errors of the last 24 hours grouped by source, the latest restarts (1074, 6008) and failed logons (4625) of the last hour.

Difficulty level : ●●○○○ (2/5)