Every night before you sign off, there’s a question no administrator wants to ask themselves the next morning: Did anything break? You don’t have to answer that with a phone call at 2 a.m. on a Friday. But if you’ve been running your production environment without any kind of disciplined daily scan, then yes — that’s exactly where things end up.
Server health isn’t something you check once and forget about. It’s a recurring habit: look at the event logs for errors that accumulated while nobody was watching, review performance counters to see whether resources are trending in dangerous directions, and schedule these checks so they run automatically before business hours begin. The best part is that Windows Server gives you all three of those capabilities out of the box — no third-party tool required.
In this article, I’m going to walk through a practical daily health scan built around Event Viewer, Performance Monitor (PerfMon), and Task Scheduler. Each one covers a different layer of server observability, and when combined, they give you coverage from critical errors to resource trends to automated reporting — all using native Windows Server components.
Why Your Daily Scan Needs Three Distinct Tools
Think about what can go wrong with a production Windows Server in a single day. You’ve got event logs filling up with warnings that nobody triaged, performance counters climbing steadily toward dangerous thresholds, and services silently restarting without anyone noticing until the next reboot cycle. Each of these failure modes maps cleanly to one of the three tools we’re using here: Event Viewer catches logged problems, Performance Monitor tracks resource trends, and Task Scheduler automates everything so it happens on a schedule rather than relying on someone’s memory.
The key insight is that no single tool covers all three areas effectively. Event Viewer won’t tell you whether your disk is 87% full unless you’ve already set up a data collector set in PerfMon to log it over time, and neither of those will alert you if the Windows Time service stopped responding this morning. Task Scheduler bridges everything by running custom scripts or scheduled tasks that pull from each tool’s output.
Rather than trying to get one dashboard to do all three jobs (which is where commercial monitoring products come in), I prefer a lean approach: use what’s already there, combine it with simple PowerShell commands, and schedule the whole thing via Task Scheduler so you wake up to a summary rather than an outage. The result is a health scan that costs nothing extra but saves hours of firefighting.
Event Viewer: Hunting for Errors That Accumulated Overnight
Event Viewer is the first stop in any daily health scan because it’s where Windows Server records everything from hardware failures to application crashes to service restarts. You don’t need to manually browse through thousands of entries every morning — instead, you set up targeted queries or custom views that surface only what matters.
Start by opening Event Viewer (eventvwr.msc) and navigating to the Windows Logs > System section. This is where critical errors like disk I/O failures, driver problems, and hardware malfunctions get logged. A healthy server should have very few entries here per day; anything above that threshold is a red flag worth investigating before business hours begin.
The Application log tells another story — it captures issues from installed software, Windows services, and third-party applications. Common culprits include SQL Server errors, web application crashes, or certificate failures that silently degrade functionality until something breaks visibly for the user.
To make Event Viewer practical for a daily scan rather than a manual exercise, take advantage of Custom Views. You can create a custom view called “Daily Health Scan” and pre-configure it to show only specific error-level entries from the last 24 hours across System, Application, and Security logs. This single view becomes your morning dashboard — anything outside that window is already handled yesterday’s scan.
What to look for in Event Viewer:
- Critical errors (Level: Critical) — These are system-level failures like disk corruption or memory hardware faults
- Error entries from the last 24 hours — Application crashes, service restarts, and timeout conditions that slipped past earlier checks
- Warning spikes compared to baseline — A sudden jump in warning events often precedes an error escalation
One practical technique is to save a custom view as XML and deploy it via a PowerShell script so every server in your pool gets the same scan configuration. That way you’re not scanning each machine individually — you’re running a consistent check across everything at once.
Performance Monitor: Tracking Resource Trends Over Time
If Event Viewer tells you what broke, Performance Monitor (PerfMon) tells you whether things are getting worse before something actually breaks. This is the difference between catching a disk that’s already at 95% capacity versus noticing it was climbing steadily for three days and acting before it hits that point.
Windows Server exposes hundreds of performance counters through PerfMon, but for a daily scan you only need a handful: CPU usage per core, available memory in MB or percentage, free disk space on each drive, network I/O throughput, and system uptime. You don’t want to log everything — you want the specific metrics that would trigger an alert if they crossed known thresholds.
The most practical approach is to create custom Data Collector Sets (DCS) through PerfMon rather than relying on default data collectors. Here’s what a useful daily DCS looks like:
- Create a new Data Collector Set called “Daily Health Scan”
- Add counters for
Processor(_Total)\% Processor Time— this tracks CPU utilization across all cores - Add
Memory\Available MBytesto watch free physical memory - Add
_Total Free Space (MB)from the PhysicalDisk object for each drive letter, or alternatively pull disk info via PowerShell’sGet-PhysicalDiskcmdlet
Schedule these collectors to run once per day — say at 5:30 a.m. before business hours begin. The data collector set saves its counters to a CSV file on the server by default, which gives you a historical record without requiring any extra infrastructure. After the scan completes, you open that CSV and check whether any metric crossed your threshold.
If you prefer automation over manual CSV review, pair PerfMon with PowerShell’s CIM provider (Get-CimInstance) to pull live metrics at scheduled times. This is what many production environments already do: a small script runs every morning, grabs CPU load averages and memory statistics, checks disk free space against configurable thresholds (say 20% warning / 10% critical), and either emails the results or logs them for later review.
The beauty of this approach is that you get both historical trend data (from PerfMon’s saved counters) and current snapshots (from PowerShell CIM calls). Trends help you plan capacity — “memory has been climbing 2% per week” tells you exactly when to add resources. Current snapshots tell you what state the server is in right now — “CPU is at 94% and still climbing.”
Task Scheduler: Turning Manual Checks Into Automated Routine
Even with Event Viewer configured and PerfMon collectors running, nothing happens unless something triggers them. This is where Task Scheduler becomes essential — it’s the glue that turns a manual health scan into an automatic daily routine that runs without you doing anything.
Windows Server includes Task Scheduler (accessible via taskschd.msc) with enough built-in functionality to schedule both PerfMon data collector sets and custom PowerShell scripts on any cadence you need. For example, if you created that “Daily Health Scan” DCS above, you can schedule it through Task Scheduler by creating a task that runs the PerfMon tool at your chosen time (5:30 a.m., for instance).
But Task Scheduler’s real power is running custom scripts — PowerShell scripts that combine multiple checks into one automated job. Here’s how to think about it:
- Build a PowerShell script that pulls CPU, memory, and disk metrics
- Have the same script parse Event Viewer logs from the last 24 hours for critical errors
- Output everything as an HTML report with color-coded severity indicators (green = healthy, yellow = warning, red = action needed)
- Schedule that script through Task Scheduler to run daily at 5:30 a.m.
The PowerShell Tips approach takes exactly this form — they demonstrate how to build a complete server health check function using Get-CimInstance for CPU and memory stats, then add disk space checks with configurable warning thresholds (20% free triggers a yellow alert, 10% triggers red). Combine that with Event Viewer log parsing (Get-WinEvent) and you have one script doing everything.
When Task Scheduler runs this combined script at your chosen time, it can also:
* Email the results — send an HTML report to yourself or your team so you wake up with a summary instead of having to manually check three places
* Log output to a file — keep a daily log for audit trails and historical analysis
* Trigger alerts automatically — if any metric crosses its threshold, the script can call Send-MailMessage to notify the right person immediately rather than waiting until tomorrow
The key design principle here is that your scheduled task should be idempotent: it runs successfully regardless of whether anything went wrong yesterday. If something’s broken, it reports that; if everything’s fine, it confirms that. Both outcomes are valid.
Building the Combined Scan Into a Single Workflow
Here’s where I want to pull these three tools together into one coherent workflow rather than treating them as separate checklists:
The 5:30 a.m. automated scan runs automatically:
1. PerfMon data collector set logs yesterday’s CPU, memory, and disk metrics
2. PowerShell script grabs current system state via CIM and checks against thresholds
3. The same script queries Event Viewer for critical errors in the past 24 hours
4. Everything gets formatted into an HTML report that emails to you at 6:00 a.m.
The manual morning review takes one minute:
1. Open the email — it tells you whether everything is green or flagged red/yellow
2. If anything’s yellow, drill down manually through Event Viewer to understand why
3. If something’s red, investigate immediately and fix before users notice
This isn’t a luxury of commercial monitoring tools — it’s built from components that ship with Windows Server. You’re not paying for dashboards or sending data to a cloud service. Everything runs locally on your servers using native Event Viewer, Performance Monitor, and Task Scheduler. The only extra is writing the PowerShell script once (and deploying it across your server pool via Group Policy if you have multiple machines).
What to Do When Something Goes Wrong During Your Scan
Even with a well-designed scan, something will occasionally trip one of your checks — a disk filling faster than expected, a service that failed silently overnight, or an event log spike from a third-party application. The difference between a manageable incident and a full-blown outage is how quickly you catch it, which is why automation matters so much here.
When the automated scan flags something, don’t panic — check the severity level first. Yellow means “something’s trending toward trouble” and usually just needs closer monitoring over the next few days. Red means “something broke” and requires immediate investigation. The Event Viewer log will almost always tell you exactly what failed: a specific service name in the Application log, a hardware error code in System events, or a driver crash that shows up as a BugCheck entry.
The historical data from PerfMon’s saved counters is your friend here too — if memory usage has been climbing 2% per week for three weeks and now it’s flagged yellow at 85%, you know exactly when to plan capacity expansion before it becomes an emergency. That kind of foresight only comes from collecting metrics over time, not just checking current state once.
Conclusion
A daily health scan built around Event Viewer, Performance Monitor, and Task Scheduler gives you three layers of observability without any commercial monitoring product or third-party cost: Event Viewer catches what broke overnight, PerfMon tracks whether things are getting worse before they break, and Task Scheduler makes the whole thing automatic so it runs every morning without you having to remember. The total setup time is roughly one hour — writing a PowerShell script that combines all three checks, configuring one PerfMon data collector set for historical trends, and scheduling everything through Task Scheduler at your chosen time. After that, each day becomes a matter of reviewing an email summary instead of firefighting after the fact. It’s not glamorous work, but it’s exactly the kind of discipline that separates servers that run smoothly from ones that keep waking you up on Friday mornings.
Frequently Asked Questions
What is the primary benefit of using native Windows tools for a daily health scan?
The main advantage is that this approach leverages built-in components like Event Viewer, Performance Monitor, and Task Scheduler rather than requiring expensive third-party monitoring solutions. By combining these tools, administrators gain a cost-free solution that automates oversight before business hours begin without needing any external dependencies.
How does Task Scheduler integrate with the other tools in this workflow?
Task Scheduler serves as the automation backbone by running custom scripts or scheduled tasks that pull data from both Event Viewer and Performance Monitor logs on a defined schedule. This ensures consistent daily checks happen automatically every night, eliminating reliance on manual intervention or an administrator’s memory to catch overnight issues.
What specific types of server issues are best detected through Event Viewer?
The System log is ideal for identifying critical hardware failures such as disk I/O errors and driver problems, while the Application log surfaces software-specific crashes like SQL Server errors or certificate failures. Setting up Custom Views allows administrators to filter these logs to focus only on relevant entries during their morning review instead of wading through thousands of routine entries.
Why should performance counters be reviewed alongside event logs?
While Event Viewer catches discrete logged events, Performance Monitor tracks resource trends over time, such as disk space filling up toward dangerous thresholds that might not yet trigger an error log entry. Reviewing both layers ensures you catch immediate failures before they happen and spot gradual degradation early enough to prevent a full outage during peak business hours.
