Lab: Monitor a server with scheduled tasks and logs with correction

What you will learn in this TP

• Write to an event log
• Schedule a PowerShell script
• Filter logs and configure service recovery

Introduction #

What you will learn in this section

• Write to an event log
• Schedule a PowerShell script
• Filter logs and configure service recovery

Context. A server’s print service stops regularly and the disk fills up without warning. Before installing a monitoring tool, you set up native monitoring.

Prerequisites: a disposable Windows Server 2025 virtual machine (free evaluation) with an administrator account, and PowerShell open as administrator  ·  Estimated duration: 45 min

A scheduled task that writes events, Get-WinEvent queries and a service that restarts by itself.

Setup #

Guided steps, with their solution.

1. 1. Create an event source

   Why? A script that writes to Windows logs is visible to every monitoring tool.

   Create the ControleServeur source in the Application log and write a test event (ID 1000).
   See the correction

   New-EventLog -LogName Application -Source ControleServeur
   Write-EventLog -LogName Application -Source ControleServeur -EventId 1000 -EntryType Information -Message 'Test de la source'
   Get-WinEvent -FilterHashtable @{ LogName = 'Application'; ProviderName = 'ControleServeur' } -MaxEvents 1 | Format-List TimeCreated, Id, Message

2. 2. Write the check script

   Why? A simple, reliable check beats a badly configured tool.

   Write C:\TP\Scripts\Controle.ps1: warning (ID 2001) if a volume has less than 15% free, error (ID 2002) for each stopped automatic service, otherwise an event 1000.
   See the correction

   @'
   $src = 'ControleServeur' ; $alertes = 0
   Get-Volume | Where-Object { $_.DriveLetter -and $_.Size -gt 0 } | ForEach-Object {
       $pct = [math]::Round(100 * $_.SizeRemaining / $_.Size, 1)
       if ($pct -lt 15) { $alertes++; Write-EventLog -LogName Application -Source $src -EventId 2001 -EntryType Warning -Message "Volume $($_.DriveLetter): $pct % libre" }
   }
   Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' } | ForEach-Object {
       $alertes++; Write-EventLog -LogName Application -Source $src -EventId 2002 -EntryType Error -Message "Service arrêté : $($_.Name)"
   }
   if (-not $alertes) { Write-EventLog -LogName Application -Source $src -EventId 1000 -EntryType Information -Message 'Contrôle OK' }
   '@ | Set-Content C:\TP\Scripts\Controle.ps1 -Encoding UTF8
   & C:\TP\Scripts\Controle.ps1

3. 3. Schedule the check

   Why? Task Scheduler runs the script without a logged-on session, as SYSTEM.

   Create the task \Exploitation\Controle serveur every 15 minutes, start it and check its result.
   See the correction

   $a = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -ExecutionPolicy Bypass -File C:\TP\Scripts\Controle.ps1'
   $t = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 15)
   $p = New-ScheduledTaskPrincipal -UserId SYSTEM -LogonType ServiceAccount -RunLevel Highest
   Register-ScheduledTask -TaskName 'Controle serveur' -TaskPath '\Exploitation\' -Action $a -Trigger $t -Principal $p
   Start-ScheduledTask -TaskName 'Controle serveur' -TaskPath '\Exploitation\'
   Get-ScheduledTaskInfo -TaskName 'Controle serveur' -TaskPath '\Exploitation\' | Select-Object LastRunTime, LastTaskResult, NextRunTime

4. 4. Cause and detect an incident

   Why? You check that an alert actually fires.

   Stop the Spooler service, run the task again, then find event 2002 and the service stop in the System log (ID 7036).
   See the correction

   Stop-Service Spooler -Force
   Start-ScheduledTask -TaskName 'Controle serveur' -TaskPath '\Exploitation\' ; Start-Sleep 10
   Get-WinEvent -FilterHashtable @{ LogName = 'Application'; ProviderName = 'ControleServeur'; Id = 2002 } -MaxEvents 3 | Select-Object TimeCreated, Message
   Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 7036; StartTime = (Get-Date).AddMinutes(-10) } | Select-Object TimeCreated, Message

5. 5. Automatic recovery

   Why? The service control manager can restart a failed service without intervention.

   Configure Spooler to restart after 1 minute on the first two failures, then simulate a crash by killing its process.
   See the correction

   Start-Service Spooler
   sc.exe failure Spooler reset= 86400 actions= restart/60000/restart/60000/none/0
   sc.exe qfailure Spooler
   Stop-Process -Name spoolsv -Force        # plantage simulé (un arrêt propre ne déclenche pas la récupération)
   Start-Sleep 75 ; Get-Service Spooler
   Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 7031, 7034; StartTime = (Get-Date).AddMinutes(-5) } | Select-Object TimeCreated, Id, Message

6. 6. Analyze the logs

   Why? A few queries answer the most common incident questions.

   Display System errors of the last 24 hours grouped by source, the latest restarts (1074, 6008) and failed logons (4625) of the last hour.
   See the correction

   Get-WinEvent -FilterHashtable @{ LogName = 'System'; Level = 2; StartTime = (Get-Date).AddDays(-1) } -ErrorAction SilentlyContinue |
       Group-Object ProviderName | Sort-Object Count -Descending | Select-Object Count, Name
   Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 1074, 6008 } -MaxEvents 5 | Select-Object TimeCreated, Id, Message
   Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625; StartTime = (Get-Date).AddHours(-1) } -ErrorAction SilentlyContinue | Measure-Object

Difficulty level : ●●○○○ (2/5)