1. Monitor Server Performance - Monitor the following performance counters
2. Run Away User Processes - Check with the task manager for run away processes.
3. Kill Process - Kill the run away process by logging of the user holding the process or by terminating the process.
4. Memory Usage / User process - Check with the task manager the memory usage and VM size per process.
5. Kill Process - Kill the process if it is consuming too many memory and causing excessive paging.
6. Memory Efficiency - Check the performance counter Cache | Copy Read Hits %. Constant values below 90% indicates a problem with kernel memory.
7. CPU Queue - With performance monitor measure System | Processor Queue Length. This counter represent the number of processes waiting to be processed. A rule of thumb is a maximum of 2 processes per processor.
8. Reduce Processes - Reduce the number of processes by stopping some services or by logging of users from the system.
9. Network Queue - Check the Output Queue Length of the network interface with the performance monitor. If the output queue length is any value above 0 it indicates a problem with the network or network interface.
10. Troubleshoot Network - Troubleshoot the network connections, network load, network interfaces or other network components.
11. Disk Queue - Check the performance counter LogicalDisk | Current Disk Queue Length.
12. Troubleshoot Disk Subsystem - Check the server for failing hard drives. Put pagefile on separate hard drive with it’s own scsi or raid controller.
13. 3rd Level Support - Escalate the problem to a 3rd level support group.
14. Restart Spooler - Restart the spooler service to free up some memory.
15. Stop Kernel Processes -Stop some kernel processes by stopping some services like NetIQ, SNMP, HP/Compaq monitoring agents. This will free up some kernel memory and creates a shorter process list.
16. Reduce Users - Logoff some of the users or add more servers. This will increase the performance.
Labels
AWStats is a free powerful and featureful tool that generates advanced web, streaming, ftp or mail server statistics, graphically. This log analyzer works as a CGI or from command line and shows you all possible information your log contains, in few graphical web pages. It uses a partial information file to be able to process large log files, often and quickly. It can analyze log files from all major server tools like Apache log files (NCSA combined/XLF/ELF log format or common/CLF log format), WebStar, IIS (W3C log format) and a lot of other web, proxy, wap, streaming servers, mail servers and some ftp servers.
Take a look at this comparison table for an idea on features and differences between most famous statistics tools (AWStats, Analog, Webalizer,...).
AWStats is a free software distributed under the GNU General Public License. You can have a look at this license chart to know what you can/can't do.
As AWStats works from the command line but also as a CGI, it can work with all web hosting providers which allow Perl, CGI and log access.
Source: http://awstats.sourceforge.net/
Enables system administrators to view and evaluate individual users' usage and experience with Microsoft Exchange Server.
Use the Microsoft Exchange Server User Monitor to gather real-time data to better understand current client usage patterns, and to plan for future work. Administrators can view several items, including IP addresses used by clients, versions and modes of Microsoft Office Outlook, and resources such as CPU usage, server-side processor latency, and total latency for network and processing. Works with Microsoft Exchange Server 2000, 2003, 2007 and 2010.
Source: http://www.microsoft.com/en-us/download/details.aspx?id=11461
Additionally exchange servers can be monitored trough built-in performance tools such as Performance Monitor and Performance Troubleshooter under EMC Toolbox.
Also PowerShell can be used to obtain e.g. top 10 users that are most actively using Exchange Server:
Get-StoreUsageStatistics -Database Database1 | Sort-Object TimeInserver -Descending | Select-Object -First 10 | ft -AutoSize
Get-StoreUsageStatistics -Server Server1 | Sort-Object TimeInserver -Descending | Select-Object -First 10 | ft -AutoSize
Zabbix is the ultimate open source availability and performance monitoring solution. Zabbix offers advanced monitoring, alerting, and visualization features today which are missing in other monitoring systems, even some of the best commercial ones. Below is a short list of features available in Zabbix:
- auto-discovery of servers and network devices
- low-level discovery
- distributed monitoring with centralized web administration
- support for both polling and trapping mechanisms
- server software for Linux, Solaris, HP-UX, AIX, FreeBSD, OpenBSD, OS X
- native high performance agents (client software for Linux, Solaris, HP-UX, AIX, FreeBSD, OpenBSD, OS X, Tru64/OSF1, Windows NT4.0, Windows 2000, Windows 2003, Windows XP, Windows Vista)
- agent-less monitoring
- secure user authentication
- flexible user permissions
- web-based interface
- flexible e-mail notification of predefined events
- high-level (business) view of monitored resources
- audit log
Source: http://www.zabbix.com/index.php
RBAC Manager R2 for Exchange 2010 SP2, Exchange 2013 Preview and Office 365
RBAC Manager puts all efforts to simplify the RBAC administration. Basically it provides the missing GUI to edit RBAC settings on Exchange 2010 systems; including adding/removing cmdlets, cmdlet properties, assignments etc. RBAC tool is written in C# and using Powershell behind the scenes
Source: http://rbac.codeplex.com/
Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.
AD Explorer also includes the ability to save snapshots of an AD database for off-line viewing and comparisons. When you load a saved snapshot, you can navigate and explorer it as you would a live database. If you have two snapshots of an AD database you can use AD Explorer's comparison functionality to see what objects, attributes and security permissions changed between them.
Source: http://technet.microsoft.com/en-us/sysinternals/bb963907
PST Capture is used to discover and import Outlook Personal Folder (.pst) File Format files into Exchange Server and Exchange Online.
PST Capture helps an organization that wishes to gain more control over their email data repositories by placing them into Exchange. By optionally installing PST Capture Agents on target machines, administrators can determine where .pst files are located and who their file owner is via the PST Capture Console. Administrators can import .pst files via Import Lists to Exchange Server or Exchange Online. Data can be directly imported into the primary mailbox or associated archive mailbox.
Source: http://www.microsoft.com/en-us/download/details.aspx?id=28767
Makes reading log files a breeze
If you're a system administrator of Windows 2000 or 2003 Server, you know how difficult it can be to decipher a Remote Access Service log. Now Ezee RAS Log Reader can make that task so much easier for you. It's as easy as opening a file!
To read a log, just browse to it and open as a file. The reader will analayse the file and display it in two grids - one showing the essential data from every entry, the other showing that from completed sessions only. Both IAS and Database formats are handled.You can export the grid data in CSV form, then open it in Excel or OpenOffice Calc for printing and further analysis. No installation required.
Source: http://heightssoftware.com/ezrasreader/ezrasreader.html
FreeNAS™ is an Open Source Storage Platform based on FreeBSD and supports sharing across Windows, Apple, and UNIX-like systems. FreeNAS™ 8 includes ZFS, which supports high storage capacities and integrates file systems and volume management into a single piece of software.
http://www.freenas.org/
MagicDisc is freeware.
It is very helpful utility designed for creating and managing virtual CD drives and CD/DVD discs.
Source: http://www.magiciso.com/tutorials/miso-magicdisc-overview.htm
Windows Credentials Editor (WCE) is a tool that allows to list Windows logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes, Kerberos tickets and cleartext passwords).
The tool allows users to:
Perform Pass-the-Hash on Windows
'Steal' NTLM credentials from memory (with and without code injection)
'Steal' Kerberos Tickets from Windows machines
Use the 'stolen' kerberos Tickets on other Windows or Unix machines
Dump cleartext passwords stored by Windows authentication packages
http://www.ampliasecurity.com/research/wcefaq.html
http://www.ampliasecurity.com/research/wce_v1_3beta.tgz
Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the attack much faster compared to other WEP cracking tools.
In fact, Aircrack-ng is a set of tools for auditing wireless networks.
Source: http://www.aircrack-ng.org/
XAMPP is an easy to install Apache distribution containing MySQL, PHP and Perl. XAMPP is really very easy to install and to use - just download, extract and start.
Source: http://www.apachefriends.org/en/xampp.html
mimikatz # privilege::debug
mimikatz # inject::process lsass.exe sekurlsa.dll
mimikatz # @getLogonPasswords
http://blog.gentilkiwi.com/mimikatz
Windows Credentials Editor
http://devteev.blogspot.com/2012/02/0day-lsa.html
What is FreeOTFE? FreeOTFE is a free, open source, "on-the-fly" transparent disk encryption program for PCs and PDAs
With this software, you can create one or more "virtual disks" on your PC/PDA. These disks operate exactly like a normal disk, with the exception that anything written to one of them is transparently, and securely, encrypted before being stored on your computer's hard drive.
Features include:
- Highly portable - Not only does FreeOTFE offer "portable mode", eliminating the need for it to be installed before use, it also offers FreeOTFE Explorer - a system which allows FreeOTFE volumes to be accessed not only without installing any software, but also on PCs where no administrator rights are available. This makes it ideal for use (for example) with USB flash drives, and when visiting Internet Cafés (AKA Cybercafés), where PCs are available for use, but only as a "standard" user.
- Source code freely available
- Easy to use; full wizard included for creating new volumes
- Both PC and PDA versions are available; data encrypted on your PC can be read/written on your PDA, and vice versa. Supports all versions of MS Windows from Windows 2000 onwards (including Windows 7), and Windows Mobile 2003 and later (including Windows Mobile v6.5)
- No need to install it; making it ideal for use on USB memory drives, etc
- Support for encrypted Linux volumes (Cryptoloop "losetup", dm-crypt and LUKS)
- Available in English, Spanish, German, Italian, French, Czech, Japanese, Croatian, Greek and Russian - with support for other language translations
- Optional support for smartcards and security tokens
- It's powerful: Supporting numerous hash (including SHA-512, RIPEMD-320, Tiger) and encryption algorithms (including AES, Twofish and Serpent) in several modes (CBC, LRW and XTS) - providing a much greater level of flexibility than a number of other (including commercial!) OTFE systems
- Encrypted volumes may either be file, partition, or even disk based
- Much more!
http://www.freeotfe.org/
Iperf
http://iperf.sourceforge.net/
Windows Iperf Installation - http://www.noc.ucf.edu/Tools/Iperf/
C:\iperf.exe -help
Usage: iperf [-s|-c host] [options]
iperf [-h|--help] [-v|--version]
Client/Server:
-f, --format [kmKM] format to report: Kbits, Mbits, KBytes, MBytes
-i, --interval # seconds between periodic bandwidth reports
-l, --len #[KM] length of buffer to read or write (default 8 KB)
-m, --print_mss print TCP maximum segment size (MTU - TCP/IP header)
-o, --output output the report or error message to this specifie
d file
-p, --port # server port to listen on/connect to
-u, --udp use UDP rather than TCP
-w, --window #[KM] TCP window size (socket buffer size)
-B, --bind bind to , an interface or multicast address
-C, --compatibility for use with older versions does not sent extra msgs
-M, --mss # set TCP maximum segment size (MTU - 40 bytes)
-N, --nodelay set TCP no delay, disabling Nagle's Algorithm
-V, --IPv6Version Set the domain to IPv6
Server specific:
-s, --server run in server mode
-D, --daemon run the server as a daemon
-R, --remove remove service in win32
Client specific:
-b, --bandwidth #[KM] for UDP, bandwidth to send at in bits/sec
(default 1 Mbit/sec, implies -u)
-c, --client run in client mode, connecting to
-d, --dualtest Do a bidirectional test simultaneously
-n, --num #[KM] number of bytes to transmit (instead of -t)
-r, --tradeoff Do a bidirectional test individually
-t, --time # time in seconds to transmit for (default 10 secs)
-F, --fileinput input the data to be transmitted from a file
-I, --stdin input the data to be transmitted from stdin
-L, --listenport # port to recieve bidirectional tests back on
-P, --parallel # number of parallel client threads to run
-T, --ttl # time-to-live, for multicast (default 1)
Miscellaneous:
-h, --help print this message and quit
-v, --version print version information and quit
[KM] Indicates options that support a K or M suffix for kilo- or mega-
The TCP window size option can be set by the environment variable
TCP_WINDOW_SIZE. Most other options can be set by an environment variable
IPERF_, such as IPERF_BANDWIDTH.
Network Speed
http://www.optimumx.com/downloads.html
C:\netspeed.exe /?
Network Speed [Version 1.40]
Calculates the network speed (transfer rate) between two winsock hosts.
The syntax of this command is:
netspeed.exe /H:host|/S[:n] [/P:n] [/M:n] [/C:y|n]
/H:host : Client mode, host=name/address of a machine waiting in server mode.
/S:n : Server mode, n=# of times to answer before exiting, default is 9999
/P:n : n=Port number, default is 7777. (Both client & server must match)
/M:n : n=Megabytes to transfer, default is 10. (Only valid in client mode)
/C:y,/C:n: y=The data sent will be compressible; n=Not compressible (default).
Jperf 2.0.0
Графическая оболочка удобна при настройке всех параметров. Рисует наглядный график пропускной способности. 
Download Jperf 2.0.0
Over the life of an operating system install, configuration changes can occur that prevent the operating system or applications from functioning correctly.
When a formerly working installation suddenly fails, a natural troubleshooting step is to return to the last working configuration that existed when the operating system, service or application last worked, or in an extreme case, return the operating system to its out-of-the-box configuration.
This article describes supported and unsupported methods to undo or rollback changes to the following elements:
· Permissions in the Registry, File System and Services.
· User rights assignments
· Security policy
· Group membership
For windows vista : secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose
For windows 2000/2003 server : secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose
For more information: http://support.microsoft.com/kb/313222
