# How to monitor Windows Server: WMI, Services, Event Log, and Key Metrics

By: Monicaa · 8 minutes · Last updated: July 20, 2026

## What does Windows server monitoring cover?

A complete Windows server monitoring setup typically covers four key areas:

- **Resource usage**: Monitor CPU, memory, disk, and network utilization over time.
- **Services and processes:** Check whether critical Windows services are running and identify abnormal resource usage.
- **Event Logs**: Track important Event IDs to detect failures, security events, and hardware-related issues.
- **Hardware health:** For physical Windows servers, monitor components such as temperature, fans, power supplies, disks, and RAID status to detect hardware problems before they cause server failures.

## How does Windows server monitoring collect data?

Windows server exposes monitoring data through several native mechanisms:

- **WMI**: Provides detailed access to Windows services, processes, performance data, and Event Logs. However, frequent polling can add CPU overhead.
- **Performance Counters:** Offer a lighter way to collect CPU, memory, disk, and network metrics, similar to the data shown in Windows Task Manager.

Modern monitoring setups can use Performance Counters for frequent metric collection and WMI where deeper access to services, processes, and Event Logs is required.

**Performance Counters** (Processor, Memory, PhysicalDisk, and Network Interface) are the preferred source for CPU, memory, disk I/O, and network metrics. They are lightweight and suitable for frequent polling. WMI provides deeper OS-level data, including service status, processes, Event Logs, and hardware health (areas Performance Counters don't cover). In practice, use Performance Counters for high-frequency metrics and WMI when you need deeper system-level visibility.

*OpManager uses WMI for agentless Windows Server monitoring, collecting performance metrics, service status, and Event Log data through Windows credentials without installing an agent on the server.*

## What are the key metrics to monitor on Windows Server?

The right metrics help you spot resource bottlenecks before they affect applications and users. The table below maps each key Windows Server metric to its native performance counter and tells why it matters.

| Metric | Windows data source | Why it matters |
|---|---|---|
| CPU utilization (%) | Processor(_Total)% Processor Time | Sustained high CPU can slow applications and overall server performance. |
| Available memory (MB) | Memory\\Available MBytes | Shows how much memory is actually available, making it a useful measure of remaining headroom. |
| Page file usage (%) | Paging File(_Total)% Usage | Sustained paging can indicate insufficient physical memory. |
| Disk queue length(#) | PhysicalDisk\\Avg. Disk Queue Length | A sustained queue above 2 can indicate a disk I/O bottleneck. |
| Disk read/write latency (ms) | PhysicalDisk\\Avg. Disk sec/Read and Write | High latency can directly affect database and application response times. |
| Processor Queue Length* | System\\Processor Queue Length | A sustained value above 2 per CPU core can indicate CPU contention. |

* **Note**: Processor Queue Length is often more diagnostic than CPU% alone. CPU at 85% with a queue of 1 means the server is busy but not overloaded and all threads are getting CPU time. CPU at 85% with a sustained queue of 8 means threads are waiting, and users will feel it. The threshold of 2 per CPU core means: for a 4-core server, alert when queue length is sustained above 8, and for a 16-core server, it is sustained above 32. Unlike CPU%, Processor Queue Length directly measures contention, not just workload.

#-**Note**: Monitor PhysicalDisk counters (not LogicalDisk) to identify true I/O bottlenecks. When multiple logical volumes map to the same physical disk or RAID group, LogicalDisk reports per-volume queue depth which can understate actual physical bottleneck severity. PhysicalDisk aggregates correctly across all volumes sharing that physical storage. Exception: LogicalDisk % Free Space is the correct counter for disk space capacity because PhysicalDisk doesn't expose free space.

## Which Windows services should you monitor?

A Windows Server can show healthy CPU, memory, and disk metrics while a critical service has stopped. Service monitoring helps catch these issues before they affect users.

| Service | Impact if it stops |
|---|---|
| Windows Event Log | Event history and audit data may no longer be recorded, affecting troubleshooting and compliance. |
| Server (LanmanServer) | Shared drives and printers become inaccessible. |
| DNS Client | Applications may experience connectivity issues due to DNS resolution failures. |
| Remote Desktop Services | Remote administration access is lost. |
| Task Scheduler | Scheduled backups, scripts, and batch jobs may stop running. |
| Windows Firewall | Host-level firewall policies may no longer be enforced. |

**Monitor role-specific services too:** For example, use Active Directory Domain Services and Netlogon for domain controllers, W3SVC for web servers, MSSQLSERVER for SQL Server hosts, and Microsoft Exchange Transport for mail servers.

For service status, configure alerts to trigger after a single failed poll. Unlike CPU or memory, a stopped critical service isn't a temporary spike; it requires attention.

For physical Windows servers, hardware health adds another important layer of monitoring. It tracks disk S.M.A.R.T. attributes, RAID controller and array status, temperature, and fan health. For example, a degraded RAID array may continue running normally after one disk fails, without triggering any performance alerts. Hardware monitoring catches the problem through the array's health status. Depending on the server hardware, this data can be collected through vendor-specific WMI providers or IPMI. [Learn more on hardware health metrics and monitoring here.](https://www.manageengine.com/network-monitoring/hardware-monitoring.html)

## Which Windows Event IDs should you monitor automatically?

Manually checking Event Viewer across multiple servers is time-consuming and easy to miss. Automated Event Log monitoring can detect important Event IDs and alert your team as soon as they occur.

| Event ID | Source | What it signals | Alert when |
|---|---|---|---|
| 7034 | Service Control Manager | A service terminated unexpectedly. | Every occurrence |
| 7036 | Service Control Manager | A service entered a stopped state. | Every unexpected occurrence |
| 41 | Kernel-Power | The system restarted unexpectedly. | Every occurrence |
| 6008 | EventLog | The previous shutdown was unexpected. | Every occurrence |
| 1001 | BugCheck | A system crash or blue screen occurred. | Every occurrence |
| 55 | NTFS | File system corruption was detected. | Every occurrence |
| 4625 | Security | A logon attempt failed. | Set a threshold, such as >5 in 2 minutes |
| 4740 | Security | A user account was locked out. | Every occurrence |

***Tip**: Not every Event ID needs the same alerting strategy. Alert immediately on critical system failures, while using thresholds for events like failed logons to avoid unnecessary noise.*

## How does OpManager monitor Windows servers?

OpManager provides both agent-based agentless Windows server monitoring from a single console, giving IT teams visibility into performance, availability, services, and system events without installing agents on every server.

- **Monitor without agents:** Collect Windows Server data through WMI, including performance metrics, service status, hardware health, and Event Log events.
- **Track key resources:** Monitor CPU, memory, disk, network, and other performance metrics to identify bottlenecks before they affect applications.
- **Keep critical services healthy:** Track essential Windows services and receive alerts when they stop or behave unexpectedly.
- **Stay ahead of system issues:** Monitor Windows Event Logs and get alerted to important failures, crashes, security events, and other issues.
- **Deploy faster with templates:** Choose from built-in Windows Server templates with preconfigured monitors and thresholds to simplify monitoring across large environments.
- **Reduce alert noise with AIOps:** OpManager’s adaptive thresholds learn each server’s normal behavior and dynamically adjust alert levels, helping distinguish genuine anomalies from expected workload variations.
- **Monitor from one console:** Bring performance, service, hardware, and event data together in centralized dashboards, reports, and alerts for faster troubleshooting.

## FAQs on Windows server monitoring

### How do I monitor a Windows Server?

Windows Server monitoring uses WMI to collect CPU, memory, disk, and network metrics alongside service status and Event Log events, agentlessly, using a monitoring service account. A platform like OpManager discovers Windows servers, applies a role-based template with pre-configured monitors and thresholds, and begins monitoring all three layers without installing software on the monitored server.