Getting Started with the Windows Server On-Demand Assessment (Server, Security, Hyper-V, Failover Cluster, IIS)
The Windows Server Assessment assesses the Server environment in the following areas: Server Baselines, Server Security, Hyper-V, Failover Cluster and IIS. It also collects and analyzes server data that generates a list of issues to address with remediation guidance and best practices to improve the performance of your server infrastructure and features such as deploying applications, software updates, and operating systems. Assessments are available through the Services Hub to help you optimize the availability, security, and performance of your Microsoft technology investments. These assessments use Microsoft Azure Log Analytics, which is designed to give you simplified IT and security management across your environment.
Running the Windows Server Assessment
Prerequisites
In order to take full advantage of the On-Demand Assessments available through Services Hub, you must:
Have linked an active Azure Subscription to Services Hub and added the Windows Server Assessment. For more information please see: Getting Started with On-Demand Assessments or watch the how to link video.
A domain account (User or Managed Service Account) with the following rights: a. Member of the local Administrators group on all servers in the environment b. Member of the local Administrators group of the tools machine c. Unrestricted network access from the Tools machine to all servers. d. Powershell Remoting (Enable-PSRemoting on all machines or configure using GPO on all domain controllers) e. Windows Update Agent must be running on all in-scope servers for the security update scan
On the data collection machine: a. Windows PowerShell 3.0 or later installed b. IIS Management Console Installed c. Log Parser 2.2 installed d. PowerShell Execution policy set to RemoteSigned.
On the data collection machine, change the following setting in the group policy editor (gpedit.msc) from "not configured" to "enabled": Computer Configuration->Administrative Templates->System-> User Profiles 'Do not forcefully unload the user registry at user logoff’.
Enable Remote Event Log Management through GPO.
Review the Pre-Requisites document for the Windows Server Assessment. This document explains the detailed technical documentation of the Windows Server Assessment and the server preparation needed to run the assessment. It also documents the different types of data collected by the assessment.
Note
On average, it takes two hours to initially configure your environment to run an On-Demand Assessment. After you run an assessment you can review the data in Azure Log Analytics. This will provide you with a prioritized list of recommendations, categorized across six focus areas. This allows you and your team to quickly understand risk levels, the health of your environments, act to decrease risk, and improve your overall IT health.
Setup the Windows Server Assessment on the data collection machine
Note
You will only be able to successfully setup the assessment once you have linked your Azure Subscription to Services Hub and added the Windows Server Assessment from Health -> Assessments in Services Hub.
On the data collection machine, create the following folder: C:\OMS\WinSrv (or any other folder besides C:\ODA which is reserved by the system).
Open regular Powershell (not ISE) in Administrator mode and run the below cmdlet:
Add-WindowsServerAssessmentTask -ServerName <YourServerName> -WorkingDirectory <Directory>
command where YourServerName is the semi-colon separated FQDN or NetBIOS name of the Servers that need to be assessed and <Directory> is the path to an existing directory used to store the files created while collecting and analyzing the data from the environment.
<WorkspaceId> – provide id for the Log Analytics workspace that will be used to store the uploaded data
Provide the required user account credentials that satisfy the requirements mentioned in this article earlier.
Data collection is triggered by the scheduled task named WindowsServerAssessment within an hour of running the previous script and then every 7 days. The task can be modified to run on a different date/time or even forced to run immediately from the task scheduler library -> Microsoft -> Operations Management Suite -> AOI*** -> Assessments -> WindowsServerAssessment
During collection and analysis, data is temporarily stored under the Working Directory folder that was configured during setup.
After a few hours, your assessment results will be available on your Log Analytics and Services Hub Dashboard. You can navigate to see the results by going into Services Hub -> IT Health -> On-Demand Assessments and then clicking on "View all recommendations" against the active assessment
If you wish to get a Microsoft Accredited Engineer to go over the issues about your Windows Server Environment with you, you can contact your Microsoft Representative and ask them about the Remote or Onsite CSA Led Delivery
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for