WINS Server Operational guide

WINS Service Product Operations Guide

Managing the Windows Server Platform

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), but only for the purposes provided in the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred.

2003 Microsoft Corporation. All rights reserved.

Microsoft, Active Directory, Visual Basic, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

WINS Service Product Operations Guide iii

ContentsIntroduction to Product Operations Guide.......................................................................................1

Document Purpose.....................................................................................................................1Intended Audience...................................................................................................................... 1How to Use This Guide...............................................................................................................1Background................................................................................................................................. 2

High-Level Tasks for Maintaining Windows Server 2003 WINS Service.........................................5Overview..................................................................................................................................... 5Technology Required.................................................................................................................. 6Maintenance Actions Checklist...................................................................................................9

Operating Quadrant................................................................................................................. 9Supporting Quadrant.............................................................................................................11Optimizing Quadrant..............................................................................................................13Changing Quadrant...............................................................................................................14

Detailed Maintenance Actions......................................................................................................17Overview................................................................................................................................... 17Process: Data backup, restore, and recovery operations..........................................................18

Task: Pull configuration, transaction logs, and database to external storage........................18Task: Verify previous day’s backup job..................................................................................21Task: Back up WINS configuration-related registry keys.......................................................23

Process: Data backup, restore, and recovery operations..........................................................24Task: Recover WINS from total database failure...................................................................24

Process: Storage resource management..................................................................................27Task: Monitor disk space for WINS logs and database.........................................................27

Process: Managing resources and service performance...........................................................29Task: Capture service-performance statistics........................................................................29Task: Capture statistics on the usage of WINS service.........................................................30Task: Capture statistics on the system load and utilization of the WINS server....................32

Process: Managing resources and service performance...........................................................38Task: Create service performance and utilization report........................................................38

Process: Proactive analysis and review....................................................................................39Task: Monitor and diagnose WINS name registration and renewal issues............................39Task: Monitor and resolve Push and Pull replication conditions............................................41Task: Monitor event log for WINS events..............................................................................43Task: Monitor key WINS dependencies (Active Directory and network services)..................50Task: Service check—resolve alerts indicating that the WINS service is not running............51

Process: Reviewing configuration items....................................................................................52Task: Compliance check—burst-handling option settings.....................................................52Task: Compliance check—database consistency-check option settings...............................53Task: Compliance check—detailed logging option settings...................................................54Task: Compliance check—replication option settings............................................................55Task: Compliance check—WINS service autostart settings..................................................56Task: Compliance check— backup path configuration..........................................................57

Process: Proactive analysis and review....................................................................................59Task: Evaluate system statistics—CPU and memory............................................................59Task: Evaluate system statistics—logical disk.......................................................................60Task: Evaluate system statistics—server and server work queues.......................................61Task: Evaluate system statistics—system objects.................................................................62Task: Compact and defragment WINS database...................................................................62

Process: Investigation and diagnosis........................................................................................65Task: Respond to daily service request.................................................................................65

Process: Investigation and diagnosis........................................................................................67Task: Respond to weekly service request.............................................................................67

Process: Change classification and authorization.....................................................................69

iv Managing the Windows Server Platform

Task: Attend CAB meeting....................................................................................................69Task: Review emergency change request.............................................................................70

Processes by MOF Role Clusters.................................................................................................73Operations Role Cluster........................................................................................................73Support Role Cluster.............................................................................................................74Release Role Cluster.............................................................................................................74Infrastructure Role Cluster.....................................................................................................75Security Role Cluster.............................................................................................................75Partner Role Cluster..............................................................................................................76

Troubleshooting............................................................................................................................ 77Overview................................................................................................................................... 77

Problem #1: NetBIOS name not found..................................................................................77Problem #2: NetBIOS name not resolvable on different server.............................................78Problem #3: NetBIOS not reachable using LANMan.............................................................78Problem #4: WINS servers have problems replicating...........................................................79Problem #5: "Path not found".................................................................................................80Problem #6: Cannot find source of “duplicate name” messages...........................................80Problem #7: WINS database might be corrupt......................................................................81

Appendices................................................................................................................................... 85Appendix A: WINS Event Log - ID Codes.................................................................................85Appendix B: WINS Service-Performance Statistics...................................................................87Appendix C: WINS Server-Usage Statistics..............................................................................89

WINS Service Product Operations Guide v

Contributors

Program ManagerJeff Yuhas, Microsoft Corp

Lead WritersMichael Sarabosing, Covestic Inc

Akil Washington, Covestic Inc

Other ContributorsStephen Barnard, Microsoft Consulting Services

Test ManagerGreg Gicewicz, Microsoft Corporation

QA ManagerJim Ptaszynski, Microsoft Corporation

Lead Technical WriterJerry Dyer, Microsoft Corporation

Lead Technical EditorLaurie Dunham, Microsoft Corporation

EditorsSusan Joly, Volt Technical Services

Bill Karn, Volt Technical Services

Production EditorKevin Klein, Volt Technical Services

1Introduction to Product Operations Guide

Document PurposeThis guide describes processes and procedures for improving the management of Microsoft® Windows Server™ 2003 Windows Internet Name Service (WINS) service in an information technology (IT) infrastructure.

Intended AudienceThis material should be useful for anyone planning to deploy this product into an existing IT infrastructure, especially one based on the IT Infrastructure Library (ITIL)—a comprehensive set of best practices for IT service management—and Microsoft Operations Framework (MOF). It is aimed primarily at two main groups: IT managers and IT support staff (including analysts and service-desk specialists).

How to Use This GuideThis guide is divided into six main chapters. The first chapter provides basic background information. The second chapter provides a high-level checklist of the tasks required for maintaining this product. The third chapter takes a more detailed look at the tasks described in the maintenance chapter. The fourth chapter organizes tasks by the MOF role cluster responsible for each task. The fifth chapter provides information about common troubleshooting techniques for Windows Server 2003 WINS service. The sixth chapter contains appendices with information about important WINS errors to watch for, WINS service-performance statistics, and WINS server-usage statistics.

The guide may be read as a single volume, including the detailed maintenance and troubleshooting sections. Reading the document this way will provide the necessary context so that later material can be understood more readily. However, some people will prefer to use the document as a reference, only looking up information as they need it.

2 Managing the Windows Server Platform

BackgroundThis guide is based on Microsoft Solutions for Management (MSM). MSM provides a combination of best practices, best-practice implementation services, and best-practice automation, all of which help customers achieve operational excellence as demonstrated by high quality of service, industry reliability, availability, and security, and low total cost of ownership (TCO).

These MSM best practices are based on MOF, a structured, yet flexible approach centered around ITIL. MOF includes guidelines on how to plan, deploy, and maintain IT operational processes in support of mission-critical service solutions.

Central to MOF—and to understanding the structure of this guide—are the MOF Process and Team Models. The Process Model and its underlying service management functions (SMFs) are the foundation for the process-based approach that this guide recommends for maintaining a product. The Team Model and its role clusters offer guidance for ensuring the proper people are assigned to operational roles.

Figure 1 shows the MOF Process Model combined with the SMFs that make up each quadrant of the Process Model.

Figure 1MOF Process Model and SMFs

WINS Service Product Operations Guide 3

Figure 2 shows the MOF Team Model, along with some of the many functional roles or function teams that might exist in service management organizations. These roles and function teams are shown mapped to the MOF role cluster to which they would likely belong.

Security

Release

Infrastructure

Support

Operations

Partner

Change management Release/systems engineering Configuration control/asset

management Software distribution/licensing Quality assurance

Messaging operations Database operations Network administration Monitoring/metrics Availability management

Intellectual property protection Network and system security Intrusion detection Virus protection Audit and compliance admin Contingency planning

Maintenance vendors Environment support Managed services, outsourcers,

trading partners Software/hardware suppliers

Enterprise architecture Infrastructure engineering Capacity management Cost/IT budget management Resource and long-range

planning

Service desk/help desk Production/production support Problem management Service level management

Figure 2MOF Team Model and examples of functional roles or teams


The MOF Team Model is built on six quality goals, which are described and matched with the applicable team role cluster in Table 1.

Table 1. MOF Team Model Quality Goals and Role Clusters

Quality Goal Team Role Cluster

Effective release and change management. Accurate inventory tracking of all IT services and systems.

Release

Management of physical environments and infrastructure tools.

Infrastructure

Quality customer support and a service culture. Support

Predictable, repeatable, and automated system management.

Operations

Mutually beneficial relationships with service and supply partners.

Partner

Protected corporate assets, controlled authorization, and proactive security planning.

Security

Further information about MSM and MOF is available at http://www.microsoft.com/solutions/msm/techinfo/default.asp, or search for the topic on TechNet at http://www.microsoft.com/technet/default.asp. You can also contact your local Microsoft or partner representative.

http://www.microsoft.com/technet/default.asp

http://www.microsoft.com/solutions/msm/techinfo/default.asp

2High-Level Tasks for Maintaining Windows Server 2003 WINS Service

OverviewEvery company consists of employees (people), activities that those employees perform (processes), and tools that help them perform those activities (technology). Businesses typically consist of people, processes, and technology working together to achieve a common goal, as illustrated in Table 2.

Table 2. People, Processes, and Technology Working Together

Area People Process Technology

Auto repair industry

Mechanic Repair manual Socket set

Software development industry

Programmer Project plan Compiler; debugger

IT operations IT technician Microsoft Operations Framework

Windows Server 2003 WINS service

While Windows Server 2003 uses Domain Name System (DNS) as its primary method for matching a host name to its Internet Protocol (IP) address, Windows Server 2003 also supports Windows Internet Name Service (WINS) for the same purpose. WINS is the name resolution system used for Windows NT® Server 4.0 and earlier operating systems.

Windows Server 2003 DNS uses hierarchical fully qualified domain names (FQDNs) rather than the flat NetBIOS naming conventions supported by WINS. However, WINS provides an important service for network administrators with heterogeneous systems supporting clients running older operating systems, such as Windows® 95 and Windows NT 4.0. These older systems do support DNS name resolution but do not support dynamic updates to DNS records.

Technology RequiredTable 3 lists the tools or technologies used in the procedures described in this guide.

Table 3. Tools and Technologies Required to Use the Procedures in This Guide

Required Technology

Description Location

Disk Defragmenter

Used to analyze volumes for fragmentation and perform defragmentation. It is automatically installed with Windows Server 2003.

Start > All Programs > Accessories > System Tools > Disk Defragmenter

Jetpack Used as a Jet database compactor and optimizer.

\Windows\System32\Jetpack.exe

Backup Used to perform backup and restore operations. It is automatically installed with Windows Server 2003.

Start > All Programs > Accessories > System Tools > Backup

Or to open the Backup tool using the command line:

Start > Run. In the Open box, type ntbackup, and then click OK.

SrvInfo.exe Used to gather system information from servers.

Windows Server 2003 Resource Kit

Windows Management Instrumentation (WMI)

Provides management capabilities. In this product operations guide it is used specifically within Microsoft Visual Basic® scripts. WMI is automatically installed with Windows Server 2003.

Start > Run. In the Open box, type wmimgmt.msc, and then click OK.

WINS Manager

Used for modifying WINS parameters. These centralized management and monitoring tools can be found either in Administrative Tools after initial installation of the WINS service, or through Adminpak.msi.

Start > Control Panel > Administrative Tools

Or to open WINS Manager using the command line:

\Windows\System32\ WINSmgmt.msc


Required Technology


Event Viewer

Provides logs for transactional reactive reviews of system and service events. It is automatically installed with Windows Server 2003.

Start > Control Panel > Administrative Tools > Event Viewer

Or to open Event Viewer using the command line:

Start >Run. In the Open box, type eventvwr.msc, and then click OK.

System Monitor

(formerly known in Windows 2000 as Performance Monitor)

Provides detailed performance information on key metrics used to troubleshoot bottlenecks and degradation. It is automatically installed with Windows Server 2003.

Start, > Control Panel > Administrative Tools > Performance

Or to open System Monitor using the command line:

Start > Run. In the Open box, type perfmon, and then click OK

Task Manager

Offers an immediate view of system activity and performance. This technology is automatically installed with Windows Server 2003.

Right-click an empty space on the taskbar, and then click Task Manager.

Service Controller (Sc.exe)

Allows for general management of Windows services, including startup, shutdown, and status.

\windows\system32\ sc.exe

Or to open Service Controller using the command line:

Start > Run. In the Open box, type sc, and then click OK.

Netsh

(Netsh.exe)

Manages network services and configuration objects.

\windows\system32\netsh.exe

Or to open Netsh using the command line:

Start > Run. In the Open box, type netsh and then click OK.


Required Technology


Windows Server 2003 Resource Kit Tools

Provides operations tools, scripts, and shortcuts to add and automate administrative functionality for Windows Server 2003. This kit is a separate installable package.

http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en, or search for “Windows Server 2003 Resource Kit Tools” at http://www.microsoft.com.

Microsoft Word, Microsoft Excel, and Microsoft Access XP

Full-featured office desktop applications that can be used to create the reports and manage the data sets listed in this product operations guide.

Microsoft Word, Excel and Access can be found either as a standalone product or as part of Microsoft Office XP.

Microsoft SQL Server (optional)

Can be used to manage enterprise-level volumes of management log, performance, and configuration data.

http://www.microsoft.com/sql/



http://www.microsoft.com/

http://www.microsoft.com/

http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en




Maintenance Actions ChecklistThe following checklists provide a quick reference for those product maintenance processes that need to be performed on a regular basis. These task lists are a summary of the tasks described in subsequent chapters of this guide. They are limited to the tasks required for maintaining the product.

Operating QuadrantThe processes for this section are based on the SMF guides that make up the MOF Operating Quadrant. Further information on the MOF Process Model and the SMFs is available at http://www.microsoft.com/solutions/msm and http://www.microsoft.com/mof.

Storage Management

Daily Processes

Process Name Related SMFs MOF Role Cluster

Data backup, restore, and recovery operations

Operations

Weekly Processes


Storage resource management

Operations

Monthly Processes


There are no monthly processes for this SMF.

As-Needed Processes


Data backup, restore, and recovery operations

Operations

http://www.microsoft.com/mof

http://www.microsoft.com/solutions/msm


Service Monitoring and Control

Daily Processes


Proactive analysis and review

Problem Management

Infrastructure

Weekly Processes


There are no weekly processes for this SMF.

Monthly Processes



As-Needed Processes


There are no as-needed processes for this SMF.


Supporting QuadrantThe processes for this section are based on the SMF guides that make up the MOF Supporting Quadrant.

Incident Management

Daily Processes


Investigation and diagnosis

Support

Weekly Processes


Investigation and diagnosis

Support

Monthly Processes



As-Needed Processes




Problem Management

Daily Processes


Proactive analysis and review

Service Monitoring and Control

Operations

Weekly Processes



Monthly Processes



As-Needed Processes




Optimizing QuadrantThe tasks for this section are based on the SMF guides that make up the MOF Optimizing Quadrant.

Capacity Management

Daily Processes


There are no daily processes for this SMF.

Weekly Processes



Monthly Processes


Managing resources and service performance

Operations

As-Needed Processes




Changing QuadrantThe processes for this section are based on the SMF guides that make up the MOF Changing Quadrant.

Change Management

Daily Processes


Change classification and authorization

Infrastructure

Weekly Processes



Monthly Processes



As-Needed Processes




Configuration Management

Daily Processes


There are no daily processes for this SMF.

Weekly Processes



Monthly Processes


Reviewing configuration items

Operations

As-Needed Processes



3Detailed Maintenance Actions

OverviewThis chapter provides detailed information about the processes that must be performed in order to maintain Windows Server 2003 WINS service. These processes are arranged according to the MOF quadrant into which they fall and, within each quadrant, by the MOF SMF guides that make up that quadrant.

The quadrants are:

● Operating Quadrant

● Supporting Quadrant

● Optimizing Quadrant

● Changing Quadrant

Also included are the associated role cluster and the frequency with which a process must be performed—daily, weekly, monthly, or as-needed.

Further information about the MOF Process Model and the MOF SMF guides that make up each quadrant of the model is available at http://www.microsoft.com/solutions/msm. Further information about the MOF Team Model and team role clusters is available at http://www.microsoft.com/mof.

http://www.microsoft.com/mof

http://www.microsoft.com/solutions/msm

Operating Quadrant

Storage Management SMF

Operations Role Cluster

Daily

Process: Data backup, restore, and recovery operations

Description

Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that operations fulfill business requirements and service level objectives.

Task: Pull configuration, transaction logs, and database to external storagePurpose

These backups provide a readily available, externally stored restore source, in the event of local database corruption.

By default, Windows Server 2003 creates a backup of the WINS database and transaction logs every 24-27 hours when the backup path is defined (see “Task: Compliance check—backup path configuration”). A backup on shutdown option may also be enabled on all WINS servers. These two features create a backup copy of the WINS.mdb database, the transaction J*.LOG files, and WINS.pat files.

In the event of a failure, the order of restore from backup should be from replication partners, the latest automated backup, then the daily backup on external storage, and—worst case—the weekly full system. The backups created by each option cannot simply be restored on any host; it requires a host with identical configuration as the backup source.

The following are three options to achieve this.


Procedure Option 1: Manual backup to tape or external locally-attached storage (shadow copy) using Backup 1. From a Windows Server 2003 with access to a tape device, on the

Start menu click Run, type ntbackup.exe, and click OK.

2. If the Backup or Restore Wizard window is shown, click Advanced Mode.

3. Click Backup Wizard (for advanced).

4. Select Back up selected files, drives, or network data and click Next.

5. Choose the WINS backup directory, such as the default “C:\Windows\System32\wins\wins_bak” if local, or “\\hostname\ADMIN$\System32\wins\wins_bak”, if remote (appropriate administrative rights are required), and click Next.

6. Select an appropriate backup destination, such as a storage area network (SAN) connected tape drive, or choose a directory by clicking Browse. Selecting a directory will enable a shadow copy backup of the directory into a file.

7. Type in a name for the backup and click Next.

8. Make sure the appropriate media is loaded or the target directory is accessible and click Finish.

Procedure Option 2: Scriptable manual copy to remote server directory

Make sure a share with restricted access has been created for the WINS server’s backup directory. To create a share with restricted access of the WINS backup directory on the Windows Server 2003 WINS server, follow these steps:

Using Server Management:

1. Click Start, then All Programs, then Administrative Tools, and click Server Management.

2. Connect to the specific remote Windows Server 2003 WINS server and create a new share specifying the WINS backup directory, such as the default “C:\Windows\System32\wins\wins_back”. Make sure the share is restricted to allow read-only, and customize permissions to only the group or user responsible for backup and maintenance of the WINS server.


Using the command line:

1. On the Start menu, point to All Programs, point to Accessories, then Communications, and then click Remote Desktop Connection.

2. Connect to the specific remote Windows Server 2003 WINS server, and on the remote system Start menu click Run, and type cmd.

3. Run the following command:

net share winsbackup=%systemroot%\system32\wins\wins_bak /GRANT:username,READ /USERS:1 /CACHE:None

4. Execute the following command lines to mount the shares, execute a remote copy, and unmount:

net use \\WINS_Server_hostname\winsbackup

net use \\Repository_hostname\sharename

xcopy \\WINS_Server_hostname\winsbackup \\Repository_hostname\sharename /I /V /E /H /K /X /Y

net use \\WINS_Server_hostname\winsbackup /delete

net use \\Repository_hostname\sharename /delete

Procedure Option 3: Create an up-to-the-minute manual backup of the WINS database on the local system 1. On the Start menu click Run and enter “%SystemRoot%\system32\

winsmgmt.msc /s”

2. In the console tree, click the applicable WINS server.

3. On the Action menu, click Backup.

4. In the Browse for Folder dialog box, choose a local drive for the WINS database backup folder.

5. Verify that the backup location is on a different volume or drive than the WINS automated backup set. (This defaults to C:\Windows\System32\Wins\Wins_bak.)

6. Click OK.

Dependencies

None

Technology Required

Base WINS Windows Server 2003


Task: Verify previous day’s backup jobPurpose

This process gives guidance on how to verify the integrity of the daily scheduled backup job. Regardless of the utility used to provide backup service to the WINS server, the operations team should verify each backup job after it is complete. This verification allows the operations team to resolve issues with backups that may put the organization at risk of data loss.

Procedure 1: Verify the backup job is completed

You can use Event Viewer to verify whether a backup job started or completed, and if there were errors encountered during the backup operation.

1. Start Event Viewer.

2. Right-click Application Log, select Properties, highlight View, and select Filter.

3. In Event source, click the drop-down menu, select ntbackup and click OK.

4. Search for the following events:

● Event 8000. This event signals the start of a backup on a volume. You should receive this event for each volume in the backup job.

● Event 8001. This event signals the end of a backup on volume. You should receive n - 1 of this event for a backup job, where n is equal to the number of volumes in the backup job. When a volume has backed up successfully, Event 8001 will be logged as an informational event. When errors are encountered backing up a volume, Event 8001 will be logged as an error event.

● Event 8019. This event signals the end of the backup operation. You should receive one 8019 event per backup job.

Procedure 2: Review the backup log

Backup logs can be vital to troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain summary information—for example, loading a tape, starting the backup, files backed up, bytes backed up, or failing to open a file. Some operations environments require more detailed information, such as what files are being backed up for a particular backup job.

To see more detailed logging in the backup logs

1. Start the Backup utility.

2. On the Tools menu, click Options.

3. In the Options dialog box, click the Backup Log tab, select Detailed, and click the OK button.

Backup logs will now contain detailed information regarding the backup operations.


To review the backup log

1. Start the Backup utility.

2. On the Tools menu, click Report.

3. In the Backup Reports dialog box, select the previous night’s backup report and click View.

Procedure 3: Report problems in backup to Incident Management

Use the Incident Management process to record one of the following conditions in your environment. This procedure gives guidance on some of the actions that should be taken when filling out the Incident Management report.

● Event 8000 is not logged in the application log. When this occurs the WINS server is at risk of data loss. Verify the backup job has not been deleted. Review the start time for the job to verify it has not been modified.

● Event 8000 is not logged for all volumes on the server. When this occurs a volume is at risk of data loss. Review the backup configuration for the backup job and also check the configuration management database (CMDB) to see if the volume has been removed from the backup job.

● Event 8001 is logged as a warning event in the application log. Review the backup log by searching for the “Warning:” string in the body of the log. Record what the warning is and the reason for it.

● Event 8019 is not logged in the application log. This means the backup job is still running. Review the application log, and record the last volume to trigger a successful 8001 informational event. Record the last volume to trigger an 8000 event.

Dependencies

Backup jobs are logged to disk

Incident Management process

Technology Required

Backup

Third-party backup software


Task: Back up WINS configuration-related registry keysPurpose

All of the configuration data (not name data) for a WINS server is held in the local Windows Server 2003 registry tables. It is important that a reliable regular backup of these values be made, not only for the restoration or moving of the WINS service, but also for supporting the other SMFs through the CMDB.

Procedure Option 1: Extract WINS server registry information using the Windows interface1. To open the Registry Editor, click Start, click Run, type

regedt32.exe, and then click OK.

2. If connecting to a remote WINS server, in the Registry Editor dialog box, on the File menu click Connect Network Registry. In the Select Computer dialog box type the host name of the WINS server in Enter the object name to select. Click Check Names, and then click OK.

3. In the left pane, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WINS.

4. Right-click WINS, and then click Export.

5. Save the registry file in a safe and secure file system.

6. The values of this extract should be incorporated and cross-referenced as configuration items (CIs) in Configuration Management.

Procedure Option 2: Extract WINS server registry information using the command line1. To open the command-line window, click Start, click Run, type cmd,

and then click OK.

2. Type the following on the command line, where <WINSServer> is the name of your WINS server and <yyyymmdd> is the current date:

Reg QUERY \\<WINSServer>\HKLM\SYSTEM\CurrentControlSet\Services\Wins /s > WINSRegistry<yyyymmdd>.reg

Dependencies

None

Technology Required



Operating Quadrant



As Needed

Process: Data backup, restore, and recovery operations

Description

Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that operations fulfill business requirements and service level objectives.

Task: Recover WINS from total database failurePurpose

This task outlines the steps required to recover WINS after a catastrophic failure. It assumes that recovery measures are available and backups have been made.

Procedure 1: Restore database from last automated backup1. To open the WINS Management Console, click Start, click Run, type

WINSMgmt.msc, and then click OK.

2. If the appropriate WINS server is not listed:

a. Right-click the first item under WINS and select Add Server.

b. Enter the host name for the appropriate WINS server, or click Browse to review, and then click OK.

3. In the left pane, right-click the WINS Server, click All Tasks, and then click Stop.

4. In the left pane, right-click the WINS Server, click Restore Database.

5. Browse to the drive and path for the automated WINS database backup location, and then click OK. WINS automatically restores the database and restarts the service.

Procedure 2: Restore from tape backup

System backups of the entire volumes can restore a WINS environment. However, it is likely that too many records will be stale. Use this as a last resort or as a starting point for Procedure 3.


Procedure 3: Restore using replication partners

Depending upon the extent of the corruption, and whether the corrupted records are at an owner or replica WINS server, you can rebuild the local WINS database through replication with another WINS server.

To remove corrupted data at a replica (non-owner) server, use the Delete Owner command option in the WINS console. When using this feature, you can delete the owner and any of its associated records in question from local WINS data.

For an owner WINS server, you can restore data integrity by starting WINS with a fresh database and then initiating replication with a configured replication partner. At the local WINS server that has ownership of corrupted records, perform the following steps:

1. Restore Replication Partnership configuration by reloading the last registry capture.

2. Stop WINS.

3. Delete all current WINS database files. These files are located at the path currently set in Database path on the Advanced tab in WINS Server Properties for the local WINS server.

4. Restart WINS.

When WINS is started with a blank database, it will replicate back all records (including those for which it is the registered owner) that are contained in data stored on other servers. This is because WINS starts with a fresh version ID that is lower than the highest version ID in use for data at any of the other WINS servers on your network.

WINS servers use record version IDs to keep track of which records are new and which need to be replicated to other WINS servers. Every record in a WINS database has an owner associated with it. This owner is generally the server with which the WINS client originally registered.

Normally, the owner (in this case, the local WINS server) does not receive its own records from its replication partners. For this reason, if records are lost from the local WINS database, it can typically be difficult to replace these records, even if they exist at other partners. In this solution, this difficulty is solved because records that exist on other WINS servers are certain to have higher version IDs than the local server after you delete the local database and restart WINS.


On a WINS network with many records, two registry entries affect the ability of WINS to perform local database replacement as described in earlier steps. The first value, InitTimeReplication, prevents the server from accepting queries or registrations until the database is reconstructed. The second, InitTimePause, causes WINS to pause while the replication takes place. The location and configurable settings for these keys are:

Location: InitTimeReplication

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WINS\Partners\

Push (or Pull).

Type: REG_DWORD

Default setting: 1

Values: 1 = The WINS server pulls replicas of new WINS database entries from its partners when the system is initialized or when a replication-related parameter changes. 0 = Replication occurs only as often as specified in the value of TimeInterval.

Location: InitTimePause

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WINS\Parameters

Type: REG_DWORD

Default setting: 0

Values: 0 = WINS Does not start in paused state. 1 = WINS starts in paused state. The value set determines whether WINS starts in a paused state and remains in that state until its first replication is completed. In the paused state, WINS does not accept any name registrations, releases, or queries. WINS remains in the paused state until it has replicated with its partners or until its first replication attempt has failed. If the value of InitTimePause is set to 1, then InitTimeReplication (in the Pull partners subkey) should either be set to 1 or deleted from the registry.

Dependencies

None

Technology Required

● Netsh, included with Windows Server 2003

● Base DHCP Windows Server 2003


Operating Quadrant



Weekly

Process: Storage resource managementDescription

Storage resource management (SRM) is a key storage management activity focused on ensuring that important storage devices, such as disks, are formatted and installed with appropriate file systems.

In addition, SRM includes using management technologies for monitoring storage resources to ensure that they meet availability, capacity, and performance requirements.

Task: Monitor disk space for WINS logs and databasePurpose

This task ensures that the WINS logging facility will have sufficient space to create new log entries, and that the WINS database can grow as appropriate.

Procedure 1: Monitor disk usage and availability using the Windows interface

Unlike Windows Server 2003 DHCP service, the WINS service does not perform disk checks for sufficient space for logs and databases. It is important to make sure that there is adequate capacity as the database, logs, and transaction-related files grow.

1. In Windows Explorer, browse to the drive where the WINS logs and databases are stored.

2. Right-click the drive, and then click Properties.

Procedure 2: Monitor disk usage and availability using WMI script

The script in this procedure illustrates the displaying of resource information similar to Procedure 1. This script does not continuously collect and store formatted performance information, but serves as a sample base for writing an operations script that may be integrated with an enterprise management package.

1. Copy and paste the script in step 3 to Notepad and save it to a file with a name like WINSChkSpace.vbs.

2. Run the script by issuing the following command:

cscript //nologo WINSChkSpace.vbs


3. Use the following script for multiple server checks:

rem – WINS Check Disk Space for Log and DB Drive ---------------------

On Error Resume Next

rem ---------------------------------------------------------------------------------rem -- List all WINS Servers in the strWINSServer array in quotesrem -- and separated by commas. use "." for localsystem. rem --rem -- Example:rem -- strWINSServer=array("WINSsvr01","dchpsvr02","192.168.23.21")rem -- arrWINSSvr = array( ".","WINSsvr01")rem ---------------------------------------------------------------------------------

For Each strComputer in arrWINSsvr

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")Set colItems = objWMIService.ExecQuery("Select * from Win32_LogicalDisk",,48)For Each objItem in colItems Wscript.Echo "DeviceID: " & objItem.DeviceID Wscript.Echo "FreeSpace: " & objItem.FreeSpace Wscript.Echo "VolumeName: " & objItem.VolumeNameNextNextrem – END OF SCRIPT --

4. Use the following script listing for a single server with a specific drive check:

rem – WINS Check Disk Space for Log and DB Drive ----------------


rem – Replace “.” with the WINS server’s hostname or IP.strComputer="."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

rem – Replace ‘c:’ with the WINS server’s appropriate log and db driverem --Set colItems = objWMIService.Get("Win32_LogicalDisk.DeviceID='c:'")

Wscript.Echo "DeviceID: " & colItems.DeviceID Wscript.Echo "FreeSpace: " & colItems.FreeSpace Wscript.Echo "VolumeName: " & colItems.VolumeNamerem – END OF SCRIPT –

Dependencies

None

Technology Required

● Base WINS Windows Server 2003

● Windows Management Instrumentation (WMI) infrastructure

● Windows Script Host


Optimizing Quadrant

Capacity Management SMF

Infrastructure Role Cluster

Daily

Process: Managing resources and service performance

Description

Capacity management is concerned with optimized use of IT resources in order to achieve the level of performance agreed upon with the client. The process of capacity management can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting are also important in the process of managing resources and service performance. The present and future capacity requirements for a service are captured in service level agreements (SLAs). These requirements are broken down into individual operating level agreements (OLAs) for each of the key IT layers in the technical infrastructure.

The tasks included in this process use comma-delimited files for storing data as a base reference. For larger environments including 10 or more servers, administrators should use Microsoft SQL Server or Microsoft Operations Manager 2000 (MOM) as an effective centralized repository for events.

Task: Capture service-performance statisticsPurpose

This activity captures empirical data on WINS service performance. This data, which is collected daily (or multiple times a day), will be reviewed weekly. It will also be used to create monthly reports reviewed quarterly for SLA compliance. Service-performance statistics are different from system-performance statistics in that they measure the characteristics of the WINS service, not the underlying infrastructure such as disk, memory, or processor.

Procedure 1: Configure WINS performance logging using Performance Logs and Alerts console1. Click Start, click Run, type perfmon.msc, and then click OK.

2. Expand Performance Logs and Alerts, and then click Counter Logs. This displays all log settings.

3. Right-click Counter Logs, and then click New Log Settings.

4. Enter a name such as “WINS Service Performance”, and then click OK.

5. Click Add Objects, make sure that Select Counter objects from computer is selected, select or enter the appropriate WINS server, and then click Add.


6. In Performance objects:, click WINS Server, click Add and then click Close. A new counter should be added to the WINS Service Performance window.

7. In Sample data every:, specify an appropriate interval such as 10 minutes.

8. On the Log Files tab, in Log file type: select Text File (Comma delimited), and then click Configure.

9. Specify the appropriate location for the log file. Ideally, this should be a remote directory on a reliable file server with ample disk space to store three to five months' worth of WINS service Perf logs.

10.In File name:, enter an appropriate name such as "WINSSvcPerf", verify that the log file size is set to Maximum limit, and then click OK.

11.Enable End File names with: and select yyyymmdd.

12.Add an appropriate comment such as “WINS Service Perf Log v1”, click Apply, and then OK.

Procedure 2: Enable WINS performance logging using Performance Logs and Alerts console

Right-click the newly created counter log from Procedure 1 and select Start.

Dependencies

None

Technology Required


● Windows Management Instrumentation (WMI) infrastructure


Task: Capture statistics on the usage of WINS service Purpose

The following activity captures empirical data on the usage of WINS service. This data, which is collected daily (or multiple times a day), should be reviewed weekly. It will also be used to create monthly reports reviewed quarterly for SLA and OLA compliance. Service-utilization statistics are different from system-performance statistics in that they measure the usage characteristics of the WINS service, not the underlying infrastructure such as disk, memory, or processor.


Procedure Option 1: Capture statistics on the usage of WINS service using WINS Management Console

This collection should be performed according to a consistent schedule, during key times of the day such as 8 A.M., 12 P.M. (noon), and 5 P.M. The information should be recorded in a log file with the date appended to the name, such as WINSScopeStats_200305.csv (”200305” indicates a comma-separated log for the month of May 2003).

1. Click Start, click Run, type winsmgmt.msc, and click OK.


a. Right-click the first item under WINS, and then click Add Server.

b. Enter the host name for the appropriate WINS server or select from the authorized list, and then click OK.

3. Right-click the appropriate WINS server, and then select Display Server Statistics.

4. Open the month’s .csv log using an editor such as Notepad, and record the data manually as follows:

“DATE TIME”,”WINSServer Name”,”Last Period Replication”,”Last Manual Replication”,”Last Net Update Replication”, “Last Address Change Replication”, “Total Queries Found”,“Total Queries Not Found”,“Unique Registrations”,“Conflicts”,“Renewals”,“Group Registrations”,“Group Regis Conflicts”,“Group Regis Renewals”,“Total Registrations Received”.

Procedure Option 2: Capture statistics on the usage of WINS service using the Netsh command-line utility

This collection should be performed according to a consistent schedule, during key times of the day such as 8 A.M., 12 P.M. (noon), and 5 P.M. The information should be recorded in a log file with the date appended to the name such as WINSScopeStats_200305.csv ("200305" indicates a comma-separated log for the month of May 2003).

1. Click Start, click Run, type cmd, and then click OK.

2. Type the following command:

netsh wins server \\<servername> show statistics

Where <servername> is the name of an authorized WINS server.

3. Open the month’s .csv log using Notepad and record the data manually as follows:

“DATE TIME”,”WINSServer Name”,”Last Period Replication”,”Last Manual Replication”,”Last Net Update Replication”, “Last Address Change Replication”, “Total Queries Found”, “Total Queries Not Found”,“Unique Registrations”, “Conflicts”, “Renewals”,“Group Registrations”,“Group Regis Conflicts”,“Group Regis Renewals”,“Total Registrations Received”.


Dependencies

None

Technology Required

Base WINS server running Windows Server 2003

Task: Capture statistics on the system load and utilization of the WINS serverPurpose

The following activity captures empirical data on the WINS server. This data, which is collected daily (or multiple times a day) should be reviewed weekly. It will also be used to create monthly reports reviewed quarterly for SLA and OLA compliance. Server-utilization statistics are different from service metrics in that they measure the usage characteristics of the underlying infrastructure of WINS server system, such as disk, memory, or processor, and not necessarily the WINS service itself.

Option 1 for Procedure 1: Configure system load and utilization logging of the WINS server using Performance Logs and Alerts console

This procedure configures the Windows Server 2003 logging facility to collect data regarding system load and use of the WINS server. Although listed as an activity that should be performed daily, this procedure needs to be executed only once because the logging facility is automated and will continue to collect until stopped.

1. Click Start, click Run, and then type perfmon.msc.

2. Expand Performance Logs and Alerts, and then click Counter Logs. This displays all log settings.

3. Right-click Counter Logs, and then click New Log Settings.

4. Type a name such as WINS Server Load and Util and then click OK.

5. Click Add Counters, and then verify that the WINS server is listed in Select counters from computer and that Select counters from list is selected.

6. In Performance Object, click LogicalDisk¸ click Free Megabytes from the counters, and then choose the appropriate drive where the WINS database is housed. The default WINS drive is the C drive.

7. Click Add and then verify that the new counter was added to the logging. (The Add Counters window may be blocking the WINS Server Load and Util window.)

8. In Performance Object, click LogicalDisk, click %Free Space, and then choose the appropriate drive where the WINS database is housed. The default WINS drive is the C drive.

9. Click Add, and then verify that the new counter was added to the logging.


10.In Performance Object, click LogicalDisk, click %Disk Time from the counters, and choose the appropriate drive where the WINS database is housed. The default WINS drive is the C drive.

11.Click Add, and then verify that the new counter was added to the logging.

12.In Performance Object, click PhysicalDisk, click Disk Reads/sec from the counters, and choose the appropriate drive where the WINS database is housed. The default WINS drive is the C drive.


14.In Performance Object, click PhysicalDisk.

15.Click Disk Writes/sec from the counters, and choose the appropriate drive where the WINS database is housed. The default WINS drive is the C drive.


17.In Performance Object, click Memory, click Available MBytes from the counters, and then click Add. Verify that the new counter was added to the logging.

18.In Performance Object, click Memory, click Page Faults/sec from the counters, click Add, and then verify that the new counter was added to the logging.

19.In Performance Object, click Paging File, click %Usage from the counters, click _Total under Select instances from list, click Add, and then verify that the new counter was added to the logging.

20.In Performance Object, click Processor, click %DPC Time from the counters, click _Total under Select instances from list, click Add, and then verify that the new counter was added to the logging.

21.In Performance Object, click Processor, click %Processor Time from the counters, click _Total under Select instances from list, click Add, and then verify that the new counter was added to the logging.

22.In Performance Object, click Processor, click Interrupts/sec from the counters, click _Total under Select instances from list, click Add, and then verify that the new counter was added to the logging.

23.In Performance Object, click Server, click Bytes Total/sec from the counters, click Add, and then verify that the new counter was added to the logging.

24.In Performance Object, click Server, click Work Item Shortages from the counters, click Add, and then verify that the new counter was added to the logging.

25.In Performance Object, click System, click Context Switches/sec from the counters, click Add, and then verify that the new counter was added to the logging.


26.In Performance Object, click System¸ click Processor Queue Length from the counters, click Add, and then verify that the new counter was added to the logging.

27.In Performance Object, click System, click System Up Time from the counters, click Add, and then verify that the new counter was added to the logging.

28.In Sample data every, specify an appropriate interval such as 10 minutes.

29.On the Log Files tab, in Log file type¸ click Text File (Comma delimited), click Configure, and then specify the appropriate location for the log file. Ideally, this should be a remote directory on a reliable file server with ample disk space to store three to five months’ worth of WINS server system load and Util logs.

30.In File name, enter an appropriate name such as "WINSSysUtil", verify that the log file size is set to Maximum limit, and then click OK.

31.Enable End File names with, select yyyymmdd, add an appropriate comment such as “WINS System Perf and Util Log v1”, click Apply, then click OK.

Procedure 2: Enable system load and utilization logging of the WINS server using Performance Logs and Alerts console Right-click the newly created Counter Log from Procedure 1 and select

Start.

Option 2 for Procedure 1: Capture system load and utilization logging of the WINS server using a custom WMI VBScript

The script in this option illustrates the collection of data regarding system load and use of the server similar to Option 1 for Procedure 1 earlier. This script does not continuously collect and store formatted performance information, but it serves as a sample base for writing an operations script that may be integrated with an enterprise management package.

1. Copy and paste the script below to an editor such as Notepad, and save it using a file name such as WINSSysUtil.vbs.

2. Run the script by issuing the following command:cscript //nologo WINSSysUtil.vbs

Script listing:

rem – WINS Server System Load and Utilization Basic Collector ---------------------


rem ---------------------------------------------------------------------------------rem -- List all WINS Servers in the strWINSServer array in quotesrem -- and separated by commas. use "." for localsystem. rem --rem -- Example:rem -- strWINSServer=array("WINSsvr01","dchpsvr02","192.168.23.21")rem --


arrWINSSvr = array( ".","WINSsvr01")

rem ---------------------------------------------------------------------------------For Each strComputer in arrWINSsvr

Wscript.Echo “—“ & strComputer & “------------------------------“

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")Set colItems = objWMIService.ExecQuery("Select * from Win32_PerfRawData_PerfDisk_LogicalDisk",,48)For Each objItem in colItemsWscript.Echo "CurrentDiskQueueLength: " & objItem.CurrentDiskQueueLengthWscript.Echo "DiskReadsPersec: " & objItem.DiskReadsPersecWscript.Echo "DiskWritesPersec: " & objItem.DiskWritesPersecWscript.Echo "FreeMegabytes: " & objItem.FreeMegabytesWscript.Echo "PercentDiskTime: " & objItem.PercentDiskTimeWscript.Echo "PercentFreeSpace: " & objItem.PercentFreeSpaceNext

Set colItems = objWMIService.ExecQuery("Select * from Win32_PerfRawData_PerfOS_Memory",,48)For Each objItem in colItemsWscript.Echo "AvailableMBytes: " & objItem.AvailableMBytesWscript.Echo "PageFaultsPersec: " & objItem.PageFaultsPersecNext

Set colItems = objWMIService.ExecQuery("Select * from Win32_PerfRawData_PerfOS_PagingFile",,48)For Each objItem in colItemsWscript.Echo "PercentUsage: " & objItem.PercentUsageNext

Set colItems = objWMIService.ExecQuery("Select * from Win32_PerfRawData_PerfOS_Processor",,48)For Each objItem in colItemsWscript.Echo "InterruptsPersec: " & objItem.InterruptsPersecWscript.Echo "PercentDPCTime: " & objItem.PercentDPCTimeWscript.Echo "PercentProcessorTime: " & objItem.PercentProcessorTimeNext

Set colItems = objWMIService.ExecQuery("Select * from Win32_PerfRawData_PerfNet_Server",,48)For Each objItem in colItemsWscript.Echo "BytesTotalPersec: " & objItem.BytesTotalPersecWscript.Echo "WorkItemShortages: " & objItem.WorkItemShortagesNext

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")Set colItems = objWMIService.ExecQuery("Select * from Win32_PerfRawData_PerfNet_ServerWorkQueues",,48)For Each objItem in colItemsWscript.Echo "QueueLength: " & objItem.QueueLengthNext

Set colItems = objWMIService.ExecQuery("Select * from Win32_PerfRawData_PerfOS_System",,48)For Each objItem in colItemsWscript.Echo "ContextSwitchesPersec: " & objItem.ContextSwitchesPersecWscript.Echo "ProcessorQueueLength: " & objItem.ProcessorQueueLengthWscript.Echo "SystemUpTime: " & objItem.SystemUpTimeNextNextrem – END OF SCRIPT --


3. To format the script similar to the format of System Monitor, at the top of the script add the following lines:

m=Month(Now)d=Day(Now)s=Second(Now)If (m<10) Then m="0" & mEnd IfIf (d<10) Then d="0" & dEnd IfIf (s<10) Thens="0" & sEnd IfstrFormattedDate = chr(34) & m & "/" & d & "/" & Year(Now) & " " & Hour(Now) & ":" & Minute(Now) & ":" & s & ".000" & chr(34)

Between the lines “For Each objItem in colItems” and “Next” are the output commands to echo the results to screen. Select the objects you want to log, and replace the “Wscript.Echo …” lines with one concatenated and formatted output including formatting such as “ (quotation marks) represented by chr(34) and , (commas).

For example, to create an output similar to the format of System Monitor for WINS Nacks/sec, Offers/sec, and Requests/sec, the result would be:…For Each objItem in colItemsWscript.Echo strFormattedDate & “,” & chr(34) & objItem.NacksPersec & chr(34) & “,” & chr(34) & objItem.OffersPersec & chr(34) & “,” & chr(34) & objItem.RequestsPersec & chr(34)Next…

Because multiple queries are required to fetch information from different criteria (such as Memory, Disk, and Processor), this sample script shows multiple “For Each” loops. To capture all of the various metrics into one log line similar to the style of System Monitor, the script may require additional tuning such as assigning the result into a variable and printing the final line at the end. For example:…For Each obj Item in colItems

valNetwk01= chr(34) & objItem.NacksPersec & chr(34)valNetwk02= chr(34) & objItem.OffersPersec & chr(34)…

Next…For Each obj Item in colItems

valSvc01= chr(34) & RequestsPersec & chr(34)…

Next…

Wscript.Echo strFormattedDate & “,” & valNetwk01 & “,” & valNetwk02 & “,” & valSvc01


Dependencies

None

Technology Required

● Windows Management Instrumentation(WMI) infrastructure




Optimizing Quadrant

Capacity Management SMF


Monthly

Process: Managing resources and service performance

Description

Capacity management is concerned with optimized use of IT resources in order to achieve the level of performance agreed to with the client. These resources are supplied by the supporting organization to ensure the requirements of the business are met. The process of capacity management can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting are also important in the process of managing resources and service performance. The type of data for each differs. For example, the level of utilization of individual components in the infrastructure is of interest to management of IT resources, while the transaction throughput rates and response time is of interest in managing service performance.

Task: Create service performance and utilization reportPurpose

Include service-performance data that can be used to support decision making.

Procedure 1: Calculate daily statistics 1. Import performance logs into Microsoft Excel.

2. Calculate the daily average for each counter collected in the log.

3. In a new worksheet, record the daily average of the counters for each day of the month.

4. Use the graphing feature within Excel to create visuals that illustrate trends in performance.

For clarity it may be easier to calculate the daily statistics based on the performance of each object. You should also consider that these reports will be used to determine whether SLAs, operating level agreements (OLAs), and underpinning contracts (UCs) are being met.

Procedure 2: Store data and reports1. Store each month’s data in a single workbook for future reference.

2. Save the workbook to a file share on a file server that is under regular backup maintenance.

Dependencies

Performance logs being captured on the service

Technology Required

Microsoft Excel or third-party spreadsheet application


Supporting Quadrant

Problem Management SMF

Operations and Infrastructure Role

Cluster

Daily

Process: Proactive analysis and reviewDescription

Proactive analysis activities are concerned with identifying and resolving problems and known errors before incidents occur, thus minimizing the adverse impact on the service and business as a whole. A review of all the events and actions that took place should be conducted after a major incident or a major problem. This review will provide a means of gathering useful data for future analysis and will ensure that all important lessons are identified and recorded.

The task below uses a manual method for tracking and analyzing events and is usable for all operations. However, larger environments with 10 or more servers would be better served by a centralized event management system such as Microsoft Operations Manager 2000 (MOM).

Task: Monitor and diagnose WINS name registration and renewal issuesPurpose

WINS clients and servers communicate and negotiate with each other, ensuring that the names registered in the WINS server match those of WINS clients running in the environment. It is important to keep track of and monitor errors associated with registration and renewal to identify erroneous records and service difficulties within the WINS service.

Procedure 1: Monitor Event Viewer for WINS registration and renewal events1. Click Start, click Run, in the Open box, type eventvwr.msc, and

then click OK.

2. In the Event Viewer dialog box, connect to the appropriate WINS server by right-clicking Event Viewer, and then clicking Connect to another computer.

3. In the Select Computer dialog box, click Another computer, and then type the path to the appropriate WINS server that is to be monitored, or browse to it.

4. Click System Log and Analyze Events of Source: WINS or NetBT (NBT).

Table 4 describes the WINS registration and renewal events.


Table 4. WINS Registration and Renewal Events

WINS Event ID

Description

4155 (Warning)

A replica clashed with the static record, %1, in the WINS database. The replica was rejected.

This is fairly common in many environments as part of daily operations. If this occurs more than a few times a day, however, it should be investigated immediately.

4168 The name challenge thread is shutting down due to an error. Restart WINS.

This event record indicates that one of the replication subkeys in the WINS registry subkey could not be created or opened. The WINS replication configuration is stored in the registry in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Services\WINS subkey.

4175 The name challenge request thread could not be created.

There is a shortage of a resource such as the computer’s memory. Use tools such as Task Manager to identify processes that are hoarding memory and CPU cycles.

Click Start, click Run, in the Open box, type taskmgr, click OK, and then click the Processes tab.

4188 The name release response could not be sent due to an error.

This event record usually results in WINS shutting down abruptly. There might also be problems with a resource on the computer or with its protocol stack.

4189 The name query response could not be sent due to an error.

This event record usually results in WINS shutting down abruptly. There might also be problems with a resource on the computer or with its protocol stack.

4193 WINS could not create the notification socket. Make sure the TCP/IP driver is installed and running properly.

4194 WINS could not create the User Datagram Protocol (UDP) socket to listen for connection notification.

Further information on the WINS events in Table 4 is available in Knowledge Base article 316835, ”Windows Server WINS Event Log Messages, Part 1: Event ID 4096 to 4209,” at http://support.microsoft.com/default.aspx?scid=kb;en-us;316835&sd=ee.

http://support.microsoft.com/default.aspx?scid=kb;en-us;316835&sd=ee


Dependencies

None

Technology Required

● Event Viewer (EventVwr.msc)

● Task Manager (TaskMgr.exe)

● Base Dynamic Host Configuration Protocol (DHCP) Windows Server 2003

Task: Monitor and resolve Push and Pull replication conditions Purpose

Proactive monitoring and rapid correction of replication errors ensures availability and consistency for the WINS environment, especially for large multisite installations.

Procedure 1: Review and resolve event log conditions

Proactively monitor the logs to determine what corrective actions, if any, are necessary to ensure that no layered problems will occur.

1. Click Start, click Run, in the Open box, type eventvwr.msc, and then click OK.

2. In the Event Viewer dialog box, connect to the appropriate WINS server by right-clicking Event Viewer and then clicking Connect to another computer.

3. In the Select Computer dialog box, click Another computer, and then type the path to the other computer, or browse to it.



Table 5 lists the most common or most relevant Push and Pull replication events encountered within Windows Server 2003.

Table 5. Common Push and Pull Replication Events in Windows Server 2003

WINS Event ID

Description

4166 The replication Pull thread is shutting down due to an error. Restart WINS.

To check and correct WINS registry settings

1. In Control Panel, click Administrative Tools, and then open WINS.

2. On the server in question, expand the server information.

3. Right-click Registration Partners, and then click Properties.

4. Verify that the settings are correct.

5. Make any necessary corrections. For assistance, contact the person with administrative rights on this computer.

4167 The replication Push thread is shutting down due to an error. Restart WINS.




3. Right-click Registration Partners, and then click Properties.



4178 The WINS Pull configuration key could not be created or opened. Check to see if the permissions on the key are set properly, system resources are low, or the registry is having a problem.







WINS Event ID

Description

4256 WINS was unable to propagate the Push trigger.

You might want to initiate a Push manually with the replication partner.

To initiate a Push manually


2. Select the server and click Action on the Menu Bar.

3. Click Start Push Replication.

4. Follow the instructions in the Start Replication dialog box, and then click OK. For assistance, contact the person with administrative rights on this computer.

For a complete list of WINS event IDs, see Knowledge Base articles 316835,

“Windows Server WINS Event Log Messages, Part 1: 4096 to 4209,” at http://support.microsoft.com/default.aspx?scid=kb;EN-US;316835, and 316836,

“Windows Server WINS Event Log Messages, Part 2: 4210 to 5300,” at http://support.microsoft.com/default.aspx?scid=kb;EN-US;316836.

Dependencies

None

Technology

Core Windows Server 2003

Task: Monitor event log for WINS eventsPurpose

This task reviews WINS service logs and event logging facilities within Windows Server 2003 to proactively identify and correct any escalating issues.

Procedure 1: Review event log

Proactively monitor the event logs to determine what corrective actions, if any, are necessary to ensure that no layered problems will occur. For large enterprise environments consisting of 10 or more servers, using Microsoft Operations Manager 2000 (MOM) is highly recommended.

1. Click Start click Run, in the Open box, type eventvwr.msc, and then click OK.

2. In the Event Viewer dialog box, connect to the appropriate WINS server by right-clicking and then clicking Connect to another computer.

3. In the Select Computer dialog box, click Another computer, and then type the path to the other computer, or browse to it.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;316836






Table 6 lists some of the most common or relevant WINS events encountered within Windows Server 2003.

Table 6. Common Windows Server 2003 WINS Events

WINS Event ID

Description/User Action

4155 A replica clashed with the static record, %1, in the WINS database. The replica was rejected. There are two choices for correcting this situation:

● Check the WINS databases of other WINS servers and eliminate the duplications of this address.

● Check the static record. You might choose to delete it instead.

4163 WINS adjusted the maximum records at a time parameter of the ConsistencyCheck key.

You can prevent this message from appearing by changing the maximum number of records that WINS will verify each period.

To change this value


2. Select the server and then right-click it.

3. Click Properties, and then click the Database Verification tab.

4. Increase the value of the Maximum number of records verified each period entry to greater than 1,000.

4174 An event could not be created. Create additional disk space and then restart the computer.

4176 A registry key could not be created or opened.






4177 The WINS configuration key could not be created or opened. To check and correct WINS registry settings



WINS Event ID





4180 The WINS\Parameters key could not be created or opened. To check and correct WINS registry settings





4182 The registry change notification event could not be created. Check the amount of available disk space. Increase the disk space, as needed.

4183 The correct time format is hh:mm:ss. Check the value of SpTime in the registry. Check carefully for an incorrectly typed value, and then reenter the time setting. If this message appears again, ask the person with administrative rights on the computer to check the registry to see whether the value of the SpTime entry specifies the format as hh:mm:ss.

4188 The name release response could not be sent due to an error. Restart the WINS service. If you continue to receive this message, check the binding of the WINS protocol stack to the network adapter.

4191 WINS could not create a heap because of a resource shortage.

To check and change the size of the virtual memory paging file

1. In Control Panel, click System.

2. In the System Properties dialog box, click the Advanced tab, and under Performance, click Settings.

3. In the Performance Options dialog box, click the Advanced tab, and under Virtual memory, click Change.

4. In the Drive list, click the drive letter that contains the paging file you want to change.

5. Under Paging file size for selected drive, type a


WINS Event ID


new paging file size in megabytes in the Initial size (MB) or Maximum size (MB) box, and then click Set. If you decrease the size of either the minimum or maximum page file settings, you must restart your computer to see the effects of those changes. Increases typically do not require a restart.

4198 WINS could not listen on the Winsock socket. Restart the WINS service. If you continue to receive this message, check the binding of the WINS protocol stack to the network adapter.

4200 ***%1 returned with an error code of %2. Make sure the Push partners, Pull partners, and router are all running. Then try again.

4203 WINS could not accept on a socket.

To correct this problem1. Stop the WINS service.

2. Click Start, point to Settings, and then click Network and Dial-up Connections.

3. Right-click Local Area Connection, and then click Properties.

4. Check to see that the Internet Protocol (TCP/IP) component is being used. If not, install the Internet Protocol (TCP/IP) component.

5. Restart the WINS service.

4204 WINS could not read from the User Datagram Protocol (UDP) socket.






4205 WINS could not read from NetBIOS over TCP/IP (NetBT). To correct this problem1. Stop the WINS service.



4. Check to see that the Internet Protocol (TCP/IP)


WINS Event ID


component is being used. If not, install the Internet Protocol (TCP/IP) component.


4206 WINS could not close a socket.





5. Restart WINS.

4301 Unable to open the registry parameters to read configuration information. Verify the configuration parameters.

4302 The backup WINS server address is not configured in the registry. The format of this entry should be changed using Network and Dial-up Connections in Control Panel.

4303 The primary WINS server address is not configured in the registry. The format of this entry should be changed using Network and Dial-up Connections in Control Panel.

4304 The backup WINS server address is not formatted correctly in the registry. The format of this entry should be changed using Network and Dial-up Connections in Control Panel.

4305 The primary WINS server address is not formatted correctly in the registry. The format of this entry should be changed using Network and Dial-up Connections in Control Panel.

4306 Unable to configure the addresses of the WINS servers. You will not be able to use the WINS service because the addresses of the WINS servers could not be added to your configuration.

4307 Initialization failed because the transport refused to open initial addresses.

To correct this problem

1. In the Show Bindings For list box, click WINS Client(TCP/IP).

2. Select the WINS binding shown, and then click


WINS Event ID


Enable.

3. Click OK twice. If enabling the bindings does not correct the problem, remove the TCP/IP protocol completely, and then reinstall it.

4309 Data structure initialization failed. Verify the configuration parameters.

4310 Initialization failed because the timers could not be started. Ask the person with administrative rights on your computer to reinstall the registry from the Emergency Repair Disk that was made when Windows 2003 was installed.

4311 Initialization failed because the driver device could not be created.

To correct this problem

1. In the Show Bindings For list box, click WINS Client(TCP/IP).

2. Select the WINS binding shown, and then click Enable.

3. Click OK twice. If enabling the bindings does not correct the problem, remove the TCP/IP protocol completely, and then reinstall it.

4313 Unable to open the registry linkage to read configuration information. Ask the person with administrative rights on your computer to reinstall the registry from the Emergency Repair Disk that was made when Windows 2003 was installed.

4314 Unable to read the driver’s bindings to the transport from the registry. Ask the person with administrative rights on your computer to reinstall the registry from the Emergency Repair Disk that was made when Windows 2003 was installed.

4315 Unable to read the driver’s exported linkage configuration information. Ask the person with administrative rights on your computer to reinstall the registry from the Emergency Repair Disk that was made when Windows 2003 was installed.

4316 Unable to open the registry to read the WINS server addresses. Ask the person with administrative rights on your computer to reinstall the registry from the Emergency Repair Disk that was created when Windows 2003 was installed.

4317 The NetBIOS name scope has a component longer than 63 characters. Enter a valid parameter in the Scope ID field.


WINS Event ID


For a complete list of WINS event IDs, see Knowledge Base articles 316835,

“Windows Server WINS Event Log Messages, Part 1: 4096 to 4209,” at (http://support.microsoft.com/default.aspx?scid=kb;EN-US;316835) and 316836,

“Windows Server WINS Event Log Messages, Part 2: 4210 to 5300,” at (http://support.microsoft.com/default.aspx?scid=kb;EN-US;316836)






WINS Event Errors 4224

Event 4224 - WINS encountered a database error.

This may or may not be a serious error. WINS will try to recover from it. You can check the database error events under the Application Log category of Event Viewer for the Exchange Component, ESENT, source to see more details about database errors. If you continue to see a large number of these errors consistently over a span of a few hours, you may want to restore the WINS database from a backup. The error number is in the second DWORD of the data section.

To restore the WINS database

1. Verify the error message in Event Viewer again, and check the state of the faulty server’s query partner to verify that the partner is functioning normally.

2. Stop WINS on the affected server by issuing the following Service Controller command:

sc “\\<AffectedWINSServer_Name>” stop WINS

3. Attempt to use the Jetpack utility of the WINS database on the affected server by issuing the following Jetpack command on the command line:

cd \windows\system32\wins <default directory>

jetpack wins.mdb wins_temp

4. If Jetpack is successful, delete all .chk and .log files in the \Windows\System32\Wins Wins-Db and Winnt\System32\Wins folders.

5. Restart WINS by issuing the Service Controller command:

Sc \\<”AffectedWINSServer_Name”> start WINS

6. Restart WINS.

7. Check Event Viewer to ensure the service has properly initiated.

8. Use the WINS Manager program to check server statistics for proper operation.

Dependencies

None

Required Technology

Core Windows Server 2003


Task: Monitor key WINS dependencies (Active Directory and network services)Purpose

This task monitors key WINS dependencies, including Microsoft Active Directory® directory service and network services. If this infrastructure becomes unavailable, WINS is also adversely affected.

Procedure 1: Monitor Active Directory

Active Directory service monitoring can be found in the Active Directory Service Product Operations Guide.

Procedure 2: Monitor network infrastructure

Network infrastructure is typically managed using tools compatible with the infrastructure vendor—for example, CiscoWorks for Cisco-brand network infrastructure. Simple Network Management Protocol (SNMP) v1-3 protocols are commonly used to monitor and tune these devices.

The netsh and pathping commands can be used for a quick check of connectivity to local WINS servers.

1. Open a command-prompt window (Start > Run, type cmd, and click OK) or make a batch-file script.

2. Run netsh:

netsh diag ping WINS

3. Verify that the desired WINS server is in the list and is accessible within appropriate performance levels.

4. For larger environments which require resolutions to traverse multiple networks, a check of each hop should be performed using the Pathping utility:

pathping <WINSserver_hostname>

5. Verify that the specified WINS server is accessible within appropriate performance and reliability levels, especially packet loss.

Dependencies

None.

Technology Required

Netsh and Pathping are included with Windows Server 2003 and Windows XP.


Task: Service check—resolve alerts indicating that the WINS service is not runningPurpose

This task starts the core component for the WINS server.

Procedure 1: Verify WINS service is running

If the WINS service is not running, WINS-based resolution cannot be dispensed.

To check for the status of the WINS server using the Windows interface

1. Click Start, click Control Panel, click Administrative Tools, and then click Services.

2. In the Services window, scroll down to WINS Server and verify that its status is Started.

To check for the status of the WINS server using the command line

1. Open a command-prompt window (Start > Run, type cmd, and click OK).

2. Enter the Service Controller command:

sc.exe “\\<WINSServerName>” query WINS

3. Service Controller should return a State indicating "4 Running".

Procedure 2: Start the WINS service

If the WINS service is not running, WINS-based resolution cannot be dispensed. Investigate why the service is stopped and log a service ticket as appropriate.

To start the service using the Windows interface

1. Click Start, click Control Panel, click Administrative Tools, and then click Services.

2. Find WINS Server, right-click the service, and then click Start.

3. Verify that the status of the WINS server is Started.

To start the service using the command line

1. Open a command-prompt window (Start > Run, type cmd, and click OK).

2. Enter the Service Controller command replacing WINSServerName with the name of the WINS server:

sc.exe “\\<WINSServerName>” start WINS

sc.exe “\\<WINSServerName>” query WINS

3. Service Controller should return a State indicating ”4 Running”.

Dependencies

None


Technology Required



Changing Quadrant Configuration Management SMF


Monthly

Process: Reviewing configuration itemsDescription

Because the accuracy of the information stored in the configuration management database (CMDB) is crucial to the success of Change Management, Incident Management, and other SMFs, a review process should be set up to ensure that the database accurately reflects the live IT environment.

Task: Compliance check—burst-handling option settingsPurpose

This task reviews burst-handling option settings to verify that after a month of daily operations, the configuration still matches the original architectural intent, given the configuration of the environment.

Procedure Option 1: Audit WINS server configuration for burst handling using the Windows interface 1. To open the WINS Management Console, click Start, click Run, type

WINSmgmt.msc, and then click OK.



b. Enter the host name for the appropriate WINS server or select from the authorized list and click OK.

3. Right-click the appropriate WINS server, and then click Display Server Statistics.

4. On the Advanced tab, verify that the settings for burst handling are the default settings.

The default settings are:

● Enable burst handling—YES.

● Number of requests that the server can handle at one time before clients have to retry registration or renewal—Medium.


Procedure Option 2: Audit WINS server configuration for burst handling using the command line1. To open the command-line window, click Start, click Run, type cmd,

and then click OK

2. Type the netsh command:

Netsh wins server \\<servername> show info


3. Verify that the settings for burst handling are the default settings.


● Enable burst handling – YES

● Burst handling queue size – 500

Dependencies

None

Technology Required



Task: Compliance check—database consistency-check option settingsPurpose

This task reviews database consistency-check option settings to verify that, after a month of daily operations, the configuration still matches the original architectural intent, given the configuration of the environment.

Procedure Option 1: Audit WINS server configuration for database consistency check using the Windows interface 1. To open the WINS Management Console, click Start, click Run, type



a. Right-click the first item under WINS, and then select Add Server.

b. Type the host name for the appropriate WINS server, or select from the authorized list, and then click OK.


3. Right-click the appropriate WINS server, and then click Display Server Statistics.

4. On the Database Verification tab, verify that the setting for database consistency checking is the default setting.

The default setting is:

Verify database consistency every—DISABLED.

Because consistency checking might affect WINS server performance, the periodic database consistency check feature is not enabled by default.

Procedure Option 2: Audit WINS server configuration for database consistency check using the command line1. To open the command-line window, click Start, click Run, type cmd,

and then click OK.

2. Enter the netsh command:

netsh wins server \\<servername> show info

Where <servername> is an authorized WINS server.

3. Verify that the setting for database consistency checking is the default setting.


Database consistency checking parameters: periodic checking—DISABLED.

Because consistency checking might affect WINS server performance, the periodic database consistency-check feature is not enabled by default.

Dependencies

None

Technology Required

Netsh, included with Windows Server 2003

Base DHCP Windows Server 2003

Task: Compliance check—detailed logging option settingsPurpose

This task reviews detailed logging option settings to verify that, after a month of daily operations, the configuration still matches the original architectural intent, given the configuration of the environment.


Procedure 1: Audit WINS server detailed logging options using the Windows interface1. To open the WINS Management Console, click Start, click Run, type



a. Right-click the first item under WINS, and then select Add Server.

b. Enter the host name for the appropriate WINS server, or select from the authorized list, and then click OK.

3. Right-click the appropriate WINS server, and then click Properties.

4. On the Advanced Tab, check the configuration.


Log detailed events to Windows Event Log—DISABLED

Detailed logging should be disabled for service startup, shutdown, and forced termination. Events 4096-4147 have historically occurred when the detailed logging option was enabled for service startup, shutdown, and forced termination.

5. Click Close.

Dependencies

None

Technology Required



Task: Compliance check—replication option settingsPurpose

This task reviews replication option settings to verify that after a month of daily operations, the configuration still matches the original architectural intent, given the configuration of the environment.

Procedure 1: Audit WINS server configuration for replication options using the Windows interface1. To open the WINS Management Console, click Start, click Run, type




b. Type the host name for the appropriate WINS server, or select from the authorized list, and then click OK.

3. Double-click the appropriate WINS Server.

4. Right-click the Replication Partners option, and then click Properties.

5. On the General Tab, check the configuration.



● Replicate only with partners – Enabled

● Overwrite unique static mappings at this server – Disabled

6. On the Push Replication tab, check the configuration.


● Start replication at startup – Disabled

● Start replication when address changes – Disabled

● Number of changes in version ID before replication – 0

● Use permanent connections for Push replication partners – Enabled

7. On the Pull Replication tab, check the configuration.


● Start Time – 0:0:0

● Replication Interval – 0:0:30 (minutes)

● Number of Retries – 3

● Start Pull replication at service startup – Enabled

● Use persistent connections for Pull replication partners – Enabled

8. On the Advanced Tab, check the configuration.


● Accept records only for these owners – Disabled

● Block records for these owners – Enabled

● Enable automatic partner configuration – Disabled

9. Click Close.

Dependencies

None

Technology Required



Task: Compliance check—WINS service autostart settingsPurpose

This task reviews detailed logging option settings to verify that after a month of daily operations, the configuration still matches the original architectural intent, given the configuration of the environment.

Procedure 1: Audit WINS service autostart settings using the Windows interface 1. To open the Services management console. click Start click Run, type

Services.msc, and then click OK.


a. Right-click Services, and then click Connect to another computer.


b. Enter the host name for the appropriate WINS server, or select Browse to review, and then click OK.

3. In the right pane, right-click the service Windows Internet Name Service (WINS,) and then click Properties.

4. Verify that the startup type is automatic, and the path to the executable is accurate (the default is C:\Windows\System32\Wins.exe).

Dependencies

None

Technology Required



Task: Compliance check— backup path configurationPurpose

This task reviews default backup path settings to verify that the configuration item is set correctly. This setting is additionally important because it also enables the daily database backup that is run every 24-27 hours.

Procedure Option 1: Audit WINS server configuration for Default backup path using the Windows interface1. To open the WINS Management Console, click Start, click Run, type




b. Enter the host name for the appropriate WINS server, or select from the authorized list and click OK.

3. Right-click the appropriate WINS server, and then click Properties.

4. Verify that the Database backup- Default backup path is configured appropriately. The default for this setting is C:\Windows\System32\Wins (same as the default for the WINS server database location).


Procedure Option 2: Audit WINS server configuration for Default backup path using the command line1. To open the command-line window, click Start, click Run, type cmd,

and then click OK

2. Type the netsh command:

netsh wins server \\<servername> show info


3. Verify that the settings for “Backup Dir” are correct. The default for this setting is C:\Windows\System32\Wins

Dependencies

None

Technology Required




Operating Quadrant

Problem Management SMF


Weekly

Process: Proactive analysis and reviewDescription

Proactive analysis activities are concerned with identifying and resolving problems and known errors before incidents occur, thus minimizing the adverse impact on the service and business as a whole. A review of all the events and actions that took place should be conducted after a major incident or a major problem. This review provides a means of gathering useful data for future analysis and ensures that all important lessons are identified and recorded.

Task: Evaluate system statistics—CPU and memoryPurpose

The following activity evaluates and executes corrective action based on the collected information on system load and use. The goal is to make sure that appropriate resources are made available to the processes in order to keep the service functioning effectively, efficiently, and without interruption.

Procedure 1: Review and correct issues regarding CPU resources1. Open the logs created by the task ”Capture statistics on the system

load and utilization of the WINS server.” This file should be called WINSSysUtil.yyyymmdd.csv.

2. Determine the field that represents the percent of processor time.

Processor time is expressed as a percentage of the elapsed time that a processor is busy executing a nonidle thread. It can be viewed as the fraction of the time spent doing useful work. Generally, sustained values over 80 percent are indicative of a processor bottleneck.

3. Determine the field that represents percent of deferred procedure calls (DPCs) time.

This figure indicates work that was deferred because the server was too busy, which could mean possible processor congestion.

4. Determine the field that represents interrupts per second.

A dramatic increase in this counter value without a corresponding increase in system activity may indicate a hardware problem. Identify the network adapter or disk controller card causing the interrupts field.

5. Correct the situations by allowing more CPU time for WINS processing. Solutions include using a faster CPU. If you are running a multipurpose server, consider running a standalone WINS server. An additional network card may be needed for interrupts per second.


Procedure 2: Review and correct issues regarding memory resources1. Open the logs created by the task ”Capture statistics on the system


2. Determine the field that represents available bytes.

Available bytes indicate the size of the virtual memory currently on the zeroed, free, and standby lists. Zeroed and free memory is ready for use, with zeroed memory cleared to zeros. Standby memory is memory removed from a process’s working set, but still available. This is an instantaneous count, not an average over the time interval. Generally, sustained values of less than 5 megabytes (MB) indicate a shortage of physical memory.

3. Determine the field that represents page faults per second.

A high rate of this metric may indicate a deficiency of physical memory.

4. Correct the situations by allotting more memory for the WINS service and the system as a whole. Solutions may include adding more physical memory to a server. If you are running a multipurpose server, consider running a standalone WINS server. Consider disabling applications and services that are unnecessary.

Dependencies

None

Technology Required


Task: Evaluate system statistics—logical diskPurpose

The following activity evaluates and considers corrective action based on the collected information on system load and use. The goal is to make sure that appropriate resources are made available to the processes in order to keep the service functioning effectively, efficiently, and without interruption.

Procedure 1: Review information collected on free megabytes and percentage of free space1. Open the logs created by the task ”Capture statistics on the system


2. Determine the field that represents free megabytes and the percentage of free space.

The fields show the unallocated space, in megabytes, on the disk drive. One megabyte is equal to 1,048,576 bytes. If the predetermined threshold (depending on the system, generally 10 percent of logical disk size) is met, the system may be running out of free space on the drive being monitored. At low percentages, different applications may


start competing for the space, and the services will be at risk of usage spikes.

Jetpack (defragmentation) of the WINS database creates temporary files that are at least the same size as the current WINS database. Although a percentage threshold is set for monitoring, the available space must not drop below the size of the current database in order for Jetpack to occur.

Correct the situation by increasing the size of the logical disk, volume, or physical drive. Consider moving the WINS database to its own disk potentially increasing space and performance.

Dependencies

None

Technology Required


Task: Evaluate system statistics—server and server work queuesPurpose

This activity evaluates and considers corrective action based on the collected information on system load and use. The goal is to make sure that appropriate resources are made available to the processes in order to keep the service functioning effectively, efficiently, and without interruption.

Procedure 1: Review information collected on server and server work queues 1. Open the logs created by the task ”Capture statistics on the system


2. Determine the field that represents total bytes per second.

If the sum of bytes total per second for all servers is roughly equal to the maximum transfer rates of your network, you might have to segment the network.

3. Determine the field that represents work item shortages.

If the value reaches a determined threshold (depending on the system, generally a value of 3), consider tuning the InitWorkItems or MaxWorkItems entries in the registry.

4. Determine the field that represents queue length (blocking queue).

If the value reaches a determined threshold (depending on the system, generally a value of 4), there might be a processor bottleneck. This is an instantaneous counter; observe its value over several intervals.

Dependencies

None

Technology Required



Task: Evaluate system statistics—system objectsPurpose

The following activity evaluates and considers corrective action based on the collected information on system load and use. The goal is to make sure that appropriate resources are made available to the processes in order to keep the service functioning effectively, efficiently, and without interruption.

Procedure 1: Review information collected on system objects1. Open the logs created by the task ”Capture statistics on the system


2. Determine the field that represents context switches per second.

If this value exceeds a determined threshold (depending on the system, generally a value of 70,000), this indicates excessive transitions. There may be too many applications or services running, or their load on the system may be too high. Consider offloading this demand onto another system or transforming this server into a standalone WINS server.

3. Determine the field that represents processor queue length.

If this value exceeds a determined threshold (depending on the system, generally a value of 6 over 5 sampling intervals) this indicates that the CPU is not fast enough to process requests as they occur. For domain controllers, if the replication topology is correct and the condition is not caused by failover from another domain controller, consider upgrading the CPU.

4. Determine the field that represents system uptime.

This value is essential in order to determine reliability.

Dependencies

None

Technology Required


Task: Compact and defragment WINS databasePurpose

The WINS database should be compacted and defragmented using the Jetpack utility to remove errors, and data inconsistencies within the database file. This task, however, does not specifically correct data discrepancies from the WINS environment.


Procedure 1: Determine record life cycle rate

Compacting and defragmenting should not be performed more frequently than the full life cycle of a WINS record. (The default is 24 days.) If compacting and defragmenting are executed too often, records will not have the chance to fully complete the life cycle, specifically the expiration and extinction actions.

Using the Windows interface

1. To open the WINS Management Console, click Start, click Run, type WINSmgmt.msc, and then click OK.



b. Enter the host name for the appropriate WINS server or select from the authorized list, and then click OK.

3. Right-click the appropriate WINS Server in the left pane, and then select Properties.

4. On the Intervals tab, note the renew, extinction interval, extinction timeout totals, and the verification interval.

Using the command line

1. To open the command-line window, click Start, click Run, type Cmd, and then click OK.

2. Enter the netsh command:

Netsh wins server \\<servername> show info


3. Note the renew, extinction interval, extinction timeout totals, and the verification interval.

Procedure 2: Jetpack WINS database (noncluster)1. Ensure that a recent working backup of the WINS database is

available.


3. At the command prompt, change to the directory that contains the WINS database.

For the default location, type cd %systemroot%\system32\wins and then press Enter.

4. Enter the following commands on the command prompt:

● net stop wins

● jetpack wins.mdb tmp.mdb

● net start wins



Procedure 3: Jetpack WINS database (clustered systems)1. Ensure that a recent working backup of the WINS database is

available.

2. Open the Cluster Administrator program (Start, Run, type cluster, and then click OK), and ensure that the group containing the WINS service resource is currently owned by the cluster node on which the Jetpack utility is intended to run.

(Cluster Administrator is an application that is used to configure a cluster and its nodes, groups, and resources. It can run on any member of the trusted domain regardless of whether the computer is a cluster node.)

3. In Cluster Administrator, right-click WINS service resource and then click Take Offline. If the resource is not taken offline, the following error message will likely be displayed:

Jetpack failed with error = -1032


a. At the command prompt, change to the directory which contains the WINS database.

b. For the default location, type cd %systemroot%\system32\wins, and then press Enter.

5. Enter the following commands on the command prompt:

● net stop wins

● jetpack wins.mdb tmp.mdb

● net start wins

6. A message similar to the following should be displayed:

Compacted database wins.mdb in 1.469 seconds. Moving temp.mdb => wins.mdb Jetpack completed successfully.

7. After the Jetpack utility has run, right-click WINS service resource in the Cluster Administrator program, and then select Bring Online.


Dependencies

None

Technology Required



Supporting Quadrant

Incident Management SMF

Support Role Cluster

Daily

Process: Investigation and diagnosisDescription

This process deals with the investigation of incidents and the gathering of diagnostic data. The aim of the process is to identify how the incident can be resolved as quickly as possible.

The process allows for management escalation or functional escalation if either becomes necessary in order to meet SLA targets.

Task: Respond to daily service requestPurpose

This task ensures that all incidents are answered and that there is an incident owner responsible for the incident life cycle. This serves the organization in two ways:

● The customer understands that, when an incident is reported, there will be confirmation that someone from the incident management team has reviewed the request. This ensures that customers will continue to use the incident-support channel setup in the organization.

● Each incident will have an owner responsible for collecting background information and doing preliminary troubleshooting. The owner is responsible for contacting other technical specialists to assist the customer in resolving the incident, documenting the incident, and making sure contributing technicians add their comments to the incident request. The act of designating an owner ensures that there is a single point of contact (SPOC) for the incident from the customer’s and from the organization's perspective.

Procedure 1: Acknowledge receipt of service request1. Give customer an incident case number prior to collecting data and

troubleshooting the incident.

2. Send customer an e-mail message confirming receipt of incident request.

Procedure 2: Document incident

Document the issue, the system affected, any actions taken to troubleshoot the problem, and plans to resolve the incident. The following are systems that can be affected in a WINS server environment:

● WINS server

● Static entries/maps

● Replication partners

● IP/config/options


Procedure 3: Update customer on status of incident

Send the customer e-mail confirming the problems, system affected, actions taken to troubleshoot, and the current plan to resolve the incident. If another technician is involved in troubleshooting, make sure that technician’s notes are part of the case documentation.

Procedure 4: Close incident

If the incident is not resolved on the customer’s initial request for incident management, follow up with the customer and other technicians until the incident is resolved.

Dependencies

● Incident ticketing system

● An SLA on how customers can request incident management—for example, through e-mail or with a service phone number

Technology Required

● There are third-party tools that provide incident management ticketing functionality.

● A Microsoft Access or SQL Server database can also be used to create incident tickets.


Supporting Quadrant

Incident Management SMF

Support Role Cluster

Weekly

Process: Investigation and diagnosisDescription

This process deals with the investigation of incidents and the gathering of diagnostic data. The aim of the process is to identify how the incident can be resolved as quickly as possible.

The process allows for management escalation or functional escalation if either becomes necessary in order to meet service level agreement (SLA) targets.

Task: Respond to weekly service requestPurpose

This task ensures that all incidents are answered and that there is an incident owner responsible for the incident life cycle. This serves the organization in two ways:

● The customer understands, when an incident is reported, that there will be confirmation that someone from the incident management team has reviewed the request. This ensures that customers will continue to use the incident-support channel setup in the organization.

● Each incident will have an owner responsible for collecting background information and doing preliminary troubleshooting. The owner is responsible for contacting other technical specialists to assist the customer in resolving the incident, documenting the incident, and making sure contributing technicians add their comments to the incident request. The act of designating an owner ensures there is a single point of contact (SPOC) for the incident from the customer’s and from the organization’s perspective.

Procedure 1: Acknowledge receipt of service request1. Give customer an incident case number prior to collecting data and

troubleshooting the incident.

2. Send customer an e-mail message confirming receipt of incident request.


Procedure 2: Document incident

Document the issue, the system affected, any actions taken to troubleshoot the problem, and plans to resolve the incident. The following are systems that can be affected in a WINS server environment:

● WINS server

● Names/resolvers

● Permissions

● Reservations

● Size and scope

Procedure 3: Update customer on status of incident

Send customer e-mail, confirming the problem, system affected, actions taken to troubleshoot, and the current plan to resolve the incident. If another technician is involved in troubleshooting, make sure that technician’s notes are part of the case documentation.

Procedure 4: Close incident● If the incident is not resolved on the customer’s initial request for

incident management, follow up with the customer and other technicians until the incident is resolved.

Dependencies

● Incident ticketing system

● An SLA on how customers request incident management—for example, by e-mail or with a service phone number

Technology Required

● There are third-party tools that provide incident management ticketing functionality.

● A Microsoft Access or SQL Server database can also be used to create incident tickets.


Changing Quadrant Change Management SMF

Infrastructure Role Cluster

Daily

Process: Change classification and authorizationDescription

After a request for change (RFC) has passed the initial screening, the change manager must classify and authorize the request for change. The category assigned to the RFC is a reflection of the impact the change is likely to have on the IT environment. The priority level set for an RFC is a reflection of its urgency, and it determines how quickly the change advisory board (CAB) will review it.

There are four change categories: minor, standard, significant, and major. There are also four levels of priority: low, medium, high, and emergency.

Once an RFC has been classified, it must be authorized. The process of authorizing a change request depends on the category and priority of the change:

● Emergency priority changes are escalated to the CAB/EC for fast-track approval.

● Standard changes are approved automatically and progress directly to the change development and release phases.

● Minor changes can be approved by the change manager without reference to the CAB.

● All other changes must be approved by the CAB.

The two tasks that follow—attending a CAB meeting and reviewing an emergency change request—are among several tasks that would be associated with classification and authorization. Attending a CAB meeting is singled out because it is common to much of the change process. Reviewing an emergency change request is singled out because emergency changes typically involve high risk and require a great outlay of time and resources.

More information about the other tasks, and about the Change Management process in general, is available at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/msm/smf/smfchgmg.asp, or search for “Change Management SMF” on TechNet at http://www.microsoft.com/technet/default.asp.

Task: Attend CAB meetingPurpose

The CAB meets to review significant and major changes to the operations environment. From a WINS server perspective, change requests involving WINS records, networking, replication, and registry modifications, as well as updating antivirus software or adding a new WINS server to the environment, can be evaluated at this weekly meeting.

http://www.microsoft.com/technet/default.asp

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/msm/smf/smfchgmg.asp

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/msm/smf/smfchgmg.asp


It's important for a representative of the Infrastructure Role Cluster to attend the meeting in order to participate in the Change Management process. Participating in the process could include providing additional data regarding a particular WINS service RFC that members of the CAB may not have available to them. Additionally, it is important to be informed about other RFCs that may have an indirect effect on the delivery of the WINS service and to consider these effects when approving an RFC for change development.

Procedure 1: Attend change review board meeting1. Regularly attend the CAB meeting.

2. Consider the effect that any RFC may have on WINS.

Dependencies

● A process must be established to initiate a change request in the operations environment.

● CAB members must have already been chosen.

Technology Required

Operations team educated about MOF/ITIL.

Task: Review emergency change requestPurpose

Provide guidance to the change advisory board emergency committee (CAB/EC) on processing an emergency request for change. The number of emergency change requests should be kept to a minimum because they typically involve high risk and require a great outlay of time and resources.

Emergency changes to the WINS service can have a great impact on a large number of users and they can affect business processes that depend on the WINS service. For this reason it is very important to create a change request process that emphasizes prioritizing and attending to urgent problems associated with the WINS service. The Infrastructure Role Cluster is responsible for this task, but the request for emergency change can be initiated by any of the six Team Model role clusters. An emergency change request could involve the release of updates to the operating system, third-party applications, or configuration changes.

Procedure 1: Contact CAB/EC1. Before contacting the CAB/EC members, make sure that the system

has a successful server backup.

2. Select CAB/EC members. This should include standing members of the change board as well as those members who can give the greatest guidance regarding the WINS service.


3. Notify the CAB/EC of the emergency change request. Each member of the CAB/EC who was identified in step 2 must be notified of the emergency change request through e-mail, mobile devices, and other communication methods. The member should be given an agreed-upon time to respond to a request for a meeting regarding an emergency change and a general sense of the change request.

4. Review the request for change. Collect all information pertaining to changes to the WINS service, including asking additional questions of the change initiator. The CAB should consider the impact the change has on the WINS service and should weigh any risks associated with making an emergency change to the WINS system against making a standard change. Possible changes include:

● Applying service packs or hotfixes

● Adding a new WINS server

● Adjusting thresholds and scope settings above policy

● Changing backup and restore procedures

● Modifying and applying policies

● Changing a process or script used to administer servers

5. Along with change type, collect the configuration item (CI) that will be affected by the change. (Configuration items, which are any objects that are subject to change, fall under Change Management.) For WINS servers these items include:

● WINS server hardware

● Active Directory hardware and domain controller hardware

● Hardware vendor

● Server role

● Windows Server 2003 software

● Service packs

● Hotfixes

● Monitoring software

● Backup software

● Processes and procedures

● Documentation

● RFCs


Dependencies

● A process must be established to initiate a change request in the operational environment.

● An identified CAB/EC roster and individuals who are contacted for emergency changes as they relate to WINS service.

● An operations team with knowledge about MOF/ITIL

Technology Required


4Processes by MOF Role Clusters

This chapter collects all processes for a single role cluster in one place. The information is the same as that in the previous two chapters. The only difference is that the processes are ordered by MOF role cluster. For a description of a particular process, as well as related tasks and procedures, click the link corresponding to the individual process.

Operations Role ClusterDaily Processes

Process 1: Data backup, restore, and recovery operations

Task 1: Backup—Pull WINS configuration, transaction logs, and database to external storage

Task 2: Verify previous day's backup

Process 2: Proactive analysis and review

Task 1: Monitor and diagnose WINS name registration and renewal issues

Task 2: Monitor and resolve push and pull replication conditions

Task 3: Monitor event log for WINS events

Task 4: Monitor key WINS dependencies (Active Directory and network services)

Task 5: Service check—resolve alerts indicating that the WINS service is not running

Weekly Processes

Process 1: Storage Resource Management

Task 1: Monitor disk space for WINS logs and database

Monthly Processes

There are no monthly processes for this role cluster.

As-Needed Processes

Process 1: Data backup, restore, and recovery operations

Task 1: Recover WINS from total database failure

Support Role ClusterDaily Processes

Process 1: Investigation and diagnosis

Task 1: Respond to daily service request

Weekly Processes

Process 1: Investigation and diagnosis

Task 1: Respond to weekly service request

Monthly Processes


As-Needed Processes

There are no as-needed processes for this role cluster.

Release Role ClusterDaily Processes

There are no daily processes for this role cluster.

Weekly Processes

There are no weekly processes for this role cluster.

Monthly Processes


As-Needed Processes



Infrastructure Role ClusterDaily Processes

Process 1: Proactive analysis and review

Task 1: Monitor and diagnose WINS name registration and renewal issues

Task 2: Monitor and resolve push and pull replication conditions

Task 3: Monitor event log for WINS events

Task 4: Monitor key WINS dependencies (Active Directory and network services)

Task 5: Service check—resolve alerts indicating that the WINS service is not running

Process 2: Change classification and authorization

Task 1: Attend CAB meeting

Task 2: Review emergency change request

Weekly Processes

There are no weekly processes for this role cluster

Monthly Processes

There are no monthly processes for this role cluster

As-Needed Processes

There are no as-needed processes for this role cluster

Security Role ClusterDaily Processes


Weekly Processes


Monthly Processes


As-Needed Processes



Partner Role ClusterDaily Processes


Weekly Processes


Monthly Processes


As-Needed Processes


5Troubleshooting

OverviewThe following tables list troubleshooting tips that should be useful in maintaining this product. The tips are based on known issues. They follow the best practices for troubleshooting and problem management outlined by the Incident Management SMF and the Problem Management SMF, both found in the MOF Supporting Quadrant.

Problem #1: NetBIOS name not foundDescription of Problem

NetBIOS name not found on standard query

Cause of Problem

The client might not be registered on the WINS server.

Resolution of Problem

1. Using the WINS Manager program, connect to the Wins server and determine if the computer name is registered in the WINS database.

2. If the name is not registered, perform the following commands on the client:

nbtstat –RR

ipconfig /release

ipconfig /renew3. Wait for 15 minutes, and then check again for name registration.

4. If the client computer is running Windows NT 4.0 SP4 or later, restart the computer.

If the preceding steps do not cause the computer name to be registered, it is likely that a replication issue is causing the problem.

Problem #2: NetBIOS name not resolvable on different server

Description of Problem

The NetBIOS name cannot be resolved on a different server after being added to the database of a WINS server.

Cause of Problem

Replication issues may be causing this problem.


1. Open Event Viewer on the affected WINS server, and then check the systems log for errors indicating possible replication problems (4096 through 4147).

Note If multiple errors are noted, log the errors.

2. Run ipconfig /all to determine which WINS servers the server is resolving to.

3. Confirm that either or both of these servers are online without operational issues.

For additional diagnostics, see the task “Monitor and resolve Push and Pull replication conditions.”

Problem #3: NetBIOS not reachable using LANManDescription of Problem

NetBIOS name is reachable using PING but not reachable using LANMan functions.

Cause of Problem

It is likely that the client is not registered with the WINS server.


1. Use the WINS Manager program to connect to the WINS server and determine if the NetBIOS [20h] name is registered in WINS.

2. If the name isn’t registered, perform the following commands on the client:

nbtstat -RR

ipconfig /release

ipconfig /renew

(If the computer is running Windows NT 4.0 SP3 or earlier, restart the computer as well.)


Problem #4: WINS servers have problems replicatingDescription of Problem

The WINS servers are experiencing intermittent problems replicating.

Cause of Problem

The replication pattern in use on your network might not be correct or appropriate to use.


In general, deployments of more than 20 WINS servers are strongly discouraged. Also, for best results and simpler administration, follow a hub-and-spoke replication topology when designing your replicated WINS network that uses Push/Pull partnerships between each WINS hub server and its member spoke servers.

If a single hub-and-spoke exceeds the recommended total of 20 WINS servers for a single enterprise, you should contact Microsoft Worldwide Services or Microsoft Product Support Services (PSS) about how to revise or reduce your current WINS installation. For larger or enterprise installations, multiple hub-and-spoke designs are acceptable.

In rare cases, the limited use of Push-only and Pull-only partner relationships might be needed. You should, however, carefully review added WINS administration issues when these configurations are deployed. At a minimum, establish reliable support procedures for occasions when you might need to manually trigger replication between WINS servers configured to operate using these types of limited replication partnering.


Problem #5: "Path not found"Description of Problem

The WINS client is displaying "Path not found" error messages.

Causes and Resolutions of Problem

Possible Cause of Problem (1)

The network path might contain the name of a server computer configured as a p-node, m-node, or h-node and its IP address is different from the one in the WINS database. In this case, the IP address for this computer might have changed recently and the new address has not yet replicated to the local server.

Resolution of Problem (1)

Check the WINS database for the name and IP address mapping information. If they are not current, you can start replication at the WINS server that owns the name record requiring an update at other servers.

Possible Cause of Problem (2)

If the computer name is configured as b-node, its name might be missing in the WINS database.

Resolution of Problem (2)

Check the WINS database for the name. If the name is not present in WINS and clients on other subnets must locate the b-node computer by name, you can add a static mapping in WINS for the computer name and IP address.

Problem #6: Cannot find source of “duplicate name” messages

Description of Problem

Unable to find the source of “duplicate name” error messages

Cause of Problem

You might need to remove static records manually, or enable static mappings to be overwritten during replication.


If the duplicate name already exists as a static mapping, you can tombstone or delete the entry. If possible, this should be done at the WINS server that owns the static mapping for the duplicate name record. As a preventive measure, in cases where a static mapping must be replaced and updated by a dynamic mapping, you can also enable Overwrite unique static mappings at this server in the replication partners properties page.


Problem #7: WINS database might be corruptDescription of Problem

There is a possibility that the WINS database is corrupt.

Cause of Problem

The WINS database might need to be deleted, either fully or partially, so its contents can be replaced from another WINS server to restore consistency and data integrity between WINS servers on your network.


First, compact and defragment the database with Jetpack. See the task “Compact and defragment WINS database.”

If the task fails, likely from severe corruption, research the Microsoft Knowledge Base regarding the error code provided to see if there are options to salvage the database.

If no additional salvage options are provided via Microsoft Knowledge Base, adhere to the following guidelines:

Depending on the extent of the corruption, and whether the corrupted records are at an owner or replica WINS server, you can rebuild the local WINS database through replication with another WINS server.

To remove corrupted data at a replica (non-owner) server, use the Delete Owner command option in the WINS console. When using this feature, you can delete the owner and any of its associated records in question from local WINS data.

For an owner WINS server, you can restore data integrity by starting WINS with a fresh database and then initiating replication with a configured replication partner. At the local WINS server that has ownership of corrupted records, perform the following steps:

1. Stop WINS.

2. Delete all current WINS database files.

These files are located at the path currently set in the Database path on the Advanced tab in the WINS Server Properties dialog box for the local WINS server.

3. Restart WINS.

When WINS is started with a blank database, it will replicate back all records (including those for which it is the registered owner) that are contained in data stored at other servers. This is because it starts with a fresh version ID that is lower than the highest version ID in use for data at any of the other WINS servers on your network.

WINS servers use record version IDs to keep track of which records are new and which need to be replicated to other WINS servers. Every record in a WINS database has an owner associated with it. This owner is generally the server with which the WINS client originally registered.


Normally, the owner (in this case, the local WINS server) does not receive its own records from its replication partners. For this reason, if


records are lost from the local WINS database, it can typically be difficult to replace these records, even if they exist at other partners. In this solution, this difficulty is solved because records that exist on other WINS servers are certain to have higher version IDs than the local server after you delete the local database and restart WINS.

On a WINS network with many records, two registry entries affect the ability of WINS to perform local database replacement as described in steps 1-3 in this solution. The first value, InitTimeReplication, keeps the server from accepting queries or registrations until the database is reconstructed. The second, InitTimePause, causes WINS to pause while the replication takes place.

Caution Incorrectly editing the registry may severely damage your system. Before making changes to the registry, back up any valued data.

The location and configurable settings for these keys are:

InitTimeReplication

Location:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WINS\PartnersPush (or Pull)

Type: REG_DWORD

Default: 1

Values: 1 = The WINS server pulls replicas of new WINS database entries from its partners when the system is initialized or when a replication-related parameter changes.

0 = Replication occurs only as often as specified in the value of TimeInterval.



InitTimePause

Location:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WINS\Parameters

Type: REG_DWORD

Default: 0

Values: 0 = WINS does not start in paused state.

1 = WINS starts in paused state.

The value set determines whether WINS starts in a paused state and remains in that state until its first replication is completed. In the paused state, WINS does not accept any name registrations, releases, or queries. WINS remains in the paused state until it has replicated with its partners or until its first replication attempt has failed.

If the value of InitTimePause is set to 1, then InitTimeReplication (in the Pull partners subkey) should either be set to 1 or deleted from the registry.

6Appendices

Appendix A: WINS Event Log - ID CodesThe audit logging behavior discussed in this section applies only to the WINS service provided with Windows Sever 2003 and replaces the previous WINS logging behavior used in earlier versions of Windows NT Server.

This section does not include all events that can be monitored; any event logged on a WINS server could be of merit. Be extremely careful in determining if the event warrants any further action.

Table 1 lists the most important WINS errors to watch for.

Table 1. Important WINS Errors

Event ID

Description

4224

WINS encountered a database error. This may or may not be a serious error; WINS will try to recover from it. Check the database error events under the Application Log category of Event Viewer for the Extensible Storage Engine (ESE) source to see more details about database errors. If a large number of these errors occur consistently over the span of a few hours, consider restoring the database from a backup. The error number is in the second DWORD of the data section: Source=WINS

Event Log=System

Event ID=4224

Event Type=Error

Wins System 4224 Error

This database error is registered in the Application Log as an Extensible Storage Engine (ESENT) database event 404, 405, or 406.

4187

The name registration response could not be sent because of an error. This error was encountered by the name challenge thread.

4243

The WINS Pull thread encountered an exception during the process of sending a Push notification to another WINS server.

Event ID

Description

4260

WINS received an error while registering replicas. It will not register any additional replicas of this WINS at this time (the address is in the data section fourth-eighth byte). Check a previous log entry to determine the reason for this. If you get the same error during subsequent replication with the preceding partner WINS, you may want to restore the WINS database from the backup.

4261

WINS received an error while trying to register a group’s replica with name %1. The replica is owned by the WINS with the address given in the data section.

4262

WINS received an error while trying to register a unique replica with name %1. The replica is owned by WINS with address given in the data section.

4302

WINS encountered an error doing backup of the database to the directory.


Appendix B: WINS Service-Performance StatisticsWINS servers are of critical importance in most environments. Monitoring the performance of the WINS service can help when troubleshooting cases where related service performance degradation is occurring.

For Windows Server 2003, the WINS service includes a set of performance counters that can be used to monitor various types of server activity. By default, these counters are available after the WINS service is installed. To access these counters, use System Monitor.

Table 1. WINS Performance Counters

WINS Objects and Counters

Description

Failed queries/sec The total number of failed queries per second.

Failed releases/sec The total number of failed releases per second.

Group conflicts/sec The rate at which group registration received by the WINS server resulted in conflicts with records in the database.

Group registrations/sec

The rate at which group registrations are received by the WINS server.

Group renewals/sec The rate at which group renewals are received by the WINS server.

Queries/sec The rate at which queries are received by the WINS server.

Releases/sec The rate at which releases are received by the WINS server.

Successful queries/sec

The total number of successful queries per second.

Successful releases/sec

The total number of successful releases per second.

Total number of conflicts/sec

The sum of the unique and group conflicts per second. Conflicts were seen by the WINS server at this total rate.

Total number of registrations/sec

The sum of the unique and group registrations per second. This is the total rate at which registrations are received by the WINS server.

Total number of renewals/sec

The sum of the unique and group renewals per second. Renewals are received by the WINS server at this total rate.

Unique conflicts/sec The rate at which unique registrations/renewals received by the WINS server resulted in conflicts with records in the database.


WINS Objects and Counters

Description

Unique registrations/sec

The rate at which unique registrations are received by the WINS server.

Unique renewals/sec The rate at which unique renewals are received by the WINS server.


Appendix C: WINS Server-Usage StatisticsWINS servers give an immediate view of the performance and general health of the service. These statistics are accessible in the Action menu of the WINS server console.

Table 1. WINS Server-Usage Statistics

WINS Statistic Description

Database initialized The last time static mappings were imported into the WINS database.

Statistics last cleared

The last time the administrator cleared statistics for the WINS server with the Clear Statistics command on the View menu.

Last replication times

The times at which the WINS database was last replicated.

Periodic The last time the WINS database was replicated based on the replication interval specified in the Preferences dialog box.

Admin triggered The last time the WINS database was replicated because the administrator clicked Replicate Now in the Replication Partners dialog box.

Net updated The last time the WINS database was replicated as a result of a network request, which is a Push notification message that requests propagation.

Total queries The number of name query request messages received by this WINS server. ”Record found” indicates the number of names that were successfully matched in the database, and ”Record not found” indicates the number of names the server could not resolve.

Total releases The number of messages received that indicate a NetBIOS program has stopped. ”Record found” indicates the number of names that were successfully released, and ”Record not found” indicates the number of names that this WINS server could not release.

Total registrations The number of name registration messages received from clients.

Last address change replication

When the last WINS database change was replicated.

Last scavenging times

The last times the database was cleaned for specific types of entries.

Periodic When the database was cleaned based on the renewal interval specified in the WINS Server Properties dialog box on the Name Record tab.


WINS Statistic Description

Admin trigger When the database was last cleaned because the administrator chose Initiate Scavenging.

Extinction When the database was last cleaned based on the extinction interval.

Verification When the database was last cleaned based on the verification interval.

Unique registrations

The number of name registration requests accepted by this WINS server.

Unique conflicts The number of conflicts encountered during registration of unique names owned by this WINS server.

Unique renewals The number of renewals received for unique names.

Group registrations The number of registration requests for groups that have been accepted by this WINS server.

Documents

WINS Server Operational guide