One of a systems administrator’s most important responsibilities is to improve the efficiency of information technology systems, and one of the best ways to improve efficiency is by using automation. Automatically responding to common problems with straightforward solutions may reduce help desk calls and allow the IT department to focus on other tasks.
Take a look through your help desk ticket logs — if you receive more than a handful of calls for a problem that is solved in a consistent methodical way, you might be able to automate the response and eliminate those calls to the help desk. Windows Vista can automatically respond to any event being added to the event log by displaying a message to the user, sending an e-mail, or running a program or script. Therefore, if you can find an event that coincides with one of your common problems, you can use that event to trigger an automated response.
For example, Event ID 7 in the System event log with a source of “disk” indicates that a hard disk has a bad block. Typically, this can be fixed by running the CheckDisk utility the next time the computer is restarted. Combine this with the Shutdown command-line tool that can notify the user of the problem and restart the computer, and you can automatically repair disk problems before they cause data loss. The following batch file demonstrates how to do this:
REM Configure CheckDisk to attempt a disk repair after the computer is restarted.
ChkDsk C: /f /r
REM Shutdown the computer after five minutes (including a warning to the user).
Shutdown /g /t 300 /d p:1:1 /c “A disk error was detected. To help prevent data loss, your computer needs to be restarted so that repairs can be attempted. Please close all programs and restart your computer as soon as possible. Your computer will be automatically restarted in five minutes.”
When the batch file is run, the Shutdown tool will immediately display the comment you provided in the script, as shown in figure 1.
Users will then receive a two-minute warning, as shown in figure 2. After the computer is restarted, Windows Vista will restart registered programs that the user left open, such as Microsoft Office 2007.
With the batch file written, you just need to schedule it to run when an event occurs by following these steps:
By default, the task will run with the privileges of the user account you used to create the event. The account used must have privileges to run the task and any programs launched by the task, as scheduled tasks cannot use User Account Control to prompt the user for elevated privileges. To specify a different account, open Task Scheduler, right-click the task in the Task Scheduler Library, and click Properties. On the General tab, click the Change User Or Group button to specify the account.
The Create Basic Task Wizard is sufficient for responding to an event with a single action. However, you might want to respond with multiple actions. For example, if you saw an event indicating that Windows firewall was disabled, you could display a message to the user that Windows Firewall must remain enabled, run a command that re-enables the firewall, and then send an e-mail notification to your internal systems administration list about the problem.
After creating a task, follow these steps to add additional actions:
Similarly, you can use the Triggers tab of the task properties dialog to configure the same task to run when any of several different events is added to the event log.
In larger organizations, event management systems, such as Microsoft Operations Manager , IBM Tivoli  or BMC Event Manager  , provide robust event management and response. However, having basic event response built into Windows Vista can be extremely useful in smaller organizations or for lab environments with specialized computer configurations.
If you manage internal applications, have a discussion with the developers and encourage them to add events to the application event log or a custom application-specific event log any time something occurs that might be an indication of a problem. By using the Windows event logs, you can automatically respond to events — something that’s not easy to do if the application records events in a text file.