JSI Tip 5454. How do I monitor performance in Active Directory?

Microsoft TechNet article Monitoring Performance in Active Directory contains:

Chapter 8 - Monitoring Performance in Active Directory

Monitoring Active Directory performance is vital to making sure that Active Directory^™ is meeting your business and networking goals. For example, one aspect of ensuring optimal performance is to verify that all network servers are getting directory replication updates and applying them in a timely manner. To monitor replication, as well as other activities, you have available to you Microsoft Management Console (MMC) snap-ins, Microsoft® Windows® 2000 Server Resource Kit command-line tools, and Microsoft® Visual Basic® scripts.

By using a combination of MMC snap-ins and Performance Monitoring tools, such as command-line tools and Visual Basic scripts, you can monitor many activities in Active Directory, the Windows 2000 directory service. For example, activities such as monitoring replication topology, Domain Name System (DNS) functionality, latency, connection times, and allocation of relative identifiers (RIDs) can each be monitored by using these tools.

MMC Snap-ins

The Windows 2000 MMC provides several snap-ins that are available from the Administrative Tools menu. The Active Directory Sites and Services snap-in enables you to view information that is related to sites and replication topology. The Performance snap-in provides a graphical way to view performance of Active Directory according to measurements, or counters, that you select. Also, you can log activity according to those counters and print them or view them online. Finally, Event Viewer enables you to view log files and error messages sent by applications.

Performance

The Performance snap-in enables you to monitor the performance of local and remote computers anywhere in your network and summarize the performance at selected intervals. The Performance snap-in uses a range of counters for monitoring real-time resource usage. The Performance snap-in can log results to a file so that you can analyze the performance history of a computer. You can monitor resource usage of other Windows 2000 servers on the network providing you have the right permission. You can also use the Performance snap-in to collect baseline performance data and send alerts to the event log about exceptions to the baseline that you configure.

The Performance snap-in is a command on the Administrative Tools menu, and it has two tools: System Monitor and Performance Logs and Alerts.

For more information about performance monitoring tools, see "Overview of Performance Monitoring" in the Microsoft Windows 2000 Server Resource Kit Server Operations Guide.

System Monitor

The System Monitor tool enables you to display performance data in real-time charts and reports, collect data in files, and generate alerts that warn you when critical events occur. This information is classified as a performance object by the component (whether it is a service, computer, or mechanism) that generates the data. Examples of performance objects include Processor, Print Queue, and SMTP service. To monitor Active Directory, you monitor the activity reported by the NTDS performance object.

By using System Monitor, you can track the activity of performance objects through the use of counters. Performance counters measure the parameters that apply to a performance object. For example, if you need to discover whether a server is receiving directory replication updates and applying the updates in a timely fashion, you can select one or more counters from the NTDS object and then view the current activity by using System Monitor. For more information about using System Monitor, see System Monitor Help.

For example, to ensure a timely replication of all network servers, you can use the DRA Pending Replication Synchronizations counter from the NTDS object to check the number of directory synchronizations that are queued for a server but not yet processed. This counter provides a visual representation of how quickly objects are being applied to the server, which helps you to determine whether a server is replicating normally.

Performance Logs and Alerts

The Performance Logs and Alerts tool enables you to log performance counters and system alerts. You can optionally collect data using the Windows Management Instrumentation (WMI) interface for hardware resources installed on the system. WMI can trace data available in Active Directory for core directory service Lightweight Directory Access Protocol (LDAP), Key Distribution Center (KDC), Security Accounts Manager (SAM), Local Security Authority (LSA), and Net Logon service. When enabled, trace logging continuously captures key events such as network logons, authentications, LDAP operations, and SAM operations, and it also records the CPU time, timestamp, and thread identifier. You can enable or disable trace logging by using the Performance Logs and Alerts tool. To produce transaction-level costing information trace data, you must use the trace application programming interfaces (APIs). For more information about trace APIs for third-party systems management vendors, see the Microsoft Platform SDK link on the Web Resources page at http://windows.microsoft.com/windows2000/reskit/webresources.

Similar to the System Monitor tool, the Performance tool enables you to select performance counters in a performance object, such as NTDS, for purposes of tracking certain types of activity. Furthermore, you can select the time intervals during which to log the activity, and you can print the logs or view them online by using System Monitor.

For more information about using the Performance snap-in, see Windows 2000 Server Help.

Event Viewer

Windows 2000 provides the Event Viewer snap-in as a way to monitor system events, such as application or system errors and the successful starting of services. These events are recorded in event logs. For example, if you need detailed information about when directory partitions are replicated, you would use Event Viewer to study the event log.

Also, if you suspect any problem with the directory operation, such as information not being replicated, it is recommended that you first investigate the event logs to determine the cause of the problem. By using information from the event logs, you can better understand the sequence and types of events that led to the performance problem. For more information about how to use the Event Viewer snap-in, see Windows 2000 Server Help.

Active Directory Performance Tools

This section describes the command-line tools and Visual Basic scripts, provided on the Windows 2000 Resource Kit companion CD, that enable you to monitor performance of Active Directory, including monitoring differences between directory partitions, replication schedules and topology, networking, channels, and local and remote computer performance, and the allocation of RID pools. They are located in the directory <Root Directory of the CD-ROM>SupportReskit. The performance monitor (Pmon) tool and two Visual Basic (VBS) scripts, DisplayRID and DisplayOld, are furthered described in this chapter.

Pmon

You can use the Process Monitor (Pmon.exe) command-line tool to monitor process resource usage by tracking CPU and memory usage for each running process. Pmon.exe also measures paged and nonpaged pool usage, and identifies kernel-mode memory leaks. For Active Directory purposes, you can use Pmon.exe to monitor the memory usage of the Local Security Authority by viewing the Lsass.exe process.

The Process Monitor tool provides a keyboard interface, so you can use the UP ARROW and DOWN ARROW to scroll up and down the list of currently running processes. To quit Pmon.exe, press ESC or type q. Use any other key to refresh the Pmon.exe display.

For more information about paged and nonpaged pool usage, see "Evaluating Memory and Cache Usage" in the Microsoft Windows 2000 Server Resource Kit Server Operations Guide.

DisplayRID

You use the Visual Basic script DisplayRID to monitor the allocation and use of RID pools by domain controllers. For example, to monitor the ResKit domain's allocation and use of its RID pool, type:

cscript displayrid.vbs /D:ResKit /U:SalesAdministrator /W:mypass1

The general syntax of the command is as follows:

Cscript displayrid.vbs [/U:Username] [/W:Password] [/D:Domain] [/S:Server] [/Q]

DisplayOld

You use the Visual Basic script DisplayOld to query Active Directory to find computer or user accounts that have not logged on for a specified period of time. The output can be optionally archived to a file in LDAP Data Interchange Format (LDIF) so that you can delete those objects from Active Directory. For example, to find all user accounts that have not logged on for the past 60 days in the Sales organizational unit (OU) within the Reskit.com domain, type the following command:

cscript displayold.vbs /N:60 /C:user /D:ResKit /U:SalesAdministrator /W:mypass1

The general syntax of the command is as follows:

Cscript displayold.vbs /N:Number_of_days [/U:User_name] [/W:Password] [/D:Domain] [/S:Server] [/C:Computer|User] [/F:File_name] [/Q]

Note that only one parameter, /N:Number_of_days, is required.

Trace Logging

Trace logging enables you to measure the performance cost of an operation. Active Directory provides instrumentation to trace the operations of directory services, such as LDAP Primitives, Kerberos, SAM, LSA, and Net Logon. When enabled, tracing captures key events such as logons, authentications, LDAP operations, and SAM operations. It also records parameters such as CPU time, timestamps, and thread identifiers. By using the event logging services of the Performance Logs and Alerts service, you can enable or disable trace logging. To produce transaction-level costing information trace data, you must use the trace APIs. For more information about trace APIs, see the Microsoft Platform SDK link on the Web Resources page at http://windows.microsoft.com/windows2000/reskit/webresources. The Microsoft Platform SDK and Resource Kit also includes sample programs and tools to post-process trace data.

When the Active Directory Installation Wizard installs Active Directory, the wizard configures performance counters in the NTDS object that provide statistics about directory activity. These counters apply to the entire directory, including global catalogs. By using the Performance snap-in, you can graphically view current activity, and also send the activity to a log file.

NTDS Object

The NTDS object contains performance counters that provide statistics about Active Directory performance. For example, there are several counters associated with the directory replication agent (DRA), which monitors replication activity. Because there are many performance counters from which to choose, you first need to determine the statistics you want to monitor and then find the matching performance counter.

These counters can also help during capacity planning by providing some baseline analysis. For example, you can create events that run whenever performance exceeds your baseline criteria. Typically, counters that are suited for capacity planning contain the word "Total" in their name, and come in three types:

Each counter has its own guidelines and limits. The counters listed in Table 8.1 are important to performance monitoring for the reasons described.

Table 8.1 Active Directory System Monitor Counters on the NTDS Object

Manually Loading and Unloading NTDS Counters

In rare cases, the NTDS object can fail to load. If this happens, the NTDS object is not available when you open System Monitor.

To load the NTDS object manually

After these steps are finished, you can use the System Monitor tool to view the counters for the NTDS object.

To unload the NTDS object manually

Database Object

The Database object relates to the Extensible Storage Engine (ESENT), the transacted database system that stores all Active Directory objects. This performance object is not installed by default. The counters on the Database object enable you to perform advanced tuning of Active Directory. You can also use some of the counters to help determine whether you need more disk drives for storage of logs or database.

Currently, there is no automated way to install the performance dynamic-link library (DLL), Esentprf.dll, in Windows 2000.

Caution Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

To load the Database object

To view the counters for the Database object, restart System Monitor.

Table 8.2 lists the performance counters for the Database object.

Table 8.2 Additional Active Directory System Monitor Counters Under the Database Object

Note When the description of a counter indicates that the number counted is "too high" or "too low," it is an indication of how to adjust the system configuration. For example, if you make a change that increases the rate of page faults for a cache, you know that you have made an incorrect adjustment, and you must change the settings in the opposite direction. Please note that you cannot adjust settings that cause the counter behavior to change in System Monitor. Settings are configured elsewhere, such as in the registry or in startup .inf files.

Using System Monitor to Select Performance Counters

You can select the performance counters that you want to monitor in System Monitor. You can view a graphical representation of the counters by selecting a type of display: chart, histogram, or log file data. Also, when you have a counter selected, you can view a description of that counter and tips on how to improve system performance by clicking the Explain button.

To select Active Directory performance counters to monitor

When you are finished, click Close. The counters that you selected appear in the lower part of the screen. System Monitor displays each counter in a unique color.

Note When creating a monitoring console for export, make sure to select Use local computer counters. Otherwise, System Monitor obtains data from the computer named in the text box, regardless of where the console file is installed. For more information about creating consoles, see the Microsoft Platform SDK link on the Web Resources page at http://windows.microsoft.com/windows2000/reskit/webresources.