The typical directory workload consists of more query operations than update operations. Active Directory is optimized for such a workload. To obtain the maximum benefit, the most important performance tuning step is to make sure that the server has sufficient RAM to be able to cache the most frequently used part of the database in memory. Query performance on a freshly rebooted server, or after the Active Directory service has been restarted, might initially be low until the cache is populated. Active Directory automatically populates the cache as queries visit parts of the directory.
Considerations for Write-Heavy Scenarios
Write-heavy scenarios do not benefit as much from the Active Directory cache. To guarantee the transactional durability of data that is written to the directory, Active Directory does not cache disk writes. It commits all writes to the disk before it returns a successful completion status for an operation, unless explicitly requested not to do this. Therefore, fast disk I/O is important to the performance of writes to Active Directory. The following are hardware recommendations that might improve performance for these scenarios:
Hardware RAID controllers.
Low-latency/high-RPM disks.
Battery-backed write caches on the controller.
To determine whether disk I/O is a bottleneck, monitor the Physical Disk\Average Disk Queue Length counter for the volumes on which the Active Directory database and logs are located. A high queue length indicates a large amount of disk I/O that is being serialized. Choosing a storage system to improve write performance on those volumes might improve Active Directory performance.
Indexing of attributes is useful when you search for objects that have the attribute name in the filter. Indexing can reduce the number of objects that must be visited when you evaluate the filter. However, this reduces the performance of write operations because the index must be updated when the corresponding attribute is modified or added. You can use logging to find the expensive and inefficient queries and consider indexing some attributes that are used in the corresponding queries to improve the search performance. For more information on Active Directory event logging on servers, see "Resources."
Optimizing Trust Paths
Trusts are a way to enable users to authenticate across different forests or domains. If the trust path between the resource and the user is long, then the user might experience high latency because the authentication request must travel through the trust path and return. For example, if a user from the grandchild of a domain tries to log on from a different grandchild in the same forest, the authentication request must travel up the chain from the grandchild to the root and then take the path to the other grandchild. To avoid this, you can create a shortcut trust directly between the two grandchild domains that avoids the long path. However, the administrator must manage trusts. Therefore you must consider how frequently a given trust will be used before you create it. You can create “external trusts” to reduce the trust path when authenticating between inter-forest domains.
Active Directory Performance Counters
You can use several resources to conduct performance diagnosis of a domain controller that is not performing as expected.
You can use the following Reliability and Performance Monitor (Perfmon) counters to track and analyze a domain controller’s performance:
If slow write operations or read operations are noticed, check the following disk I/O counters under the Physical Disk category to see whether many queued disk operations exist:
Avg. Disk Queue Length
Avg. Disk Read Queue Length
Avg. Disk Write Queue Length
If lsass.exe uses lots of physical memory, check the following Database counters under the Database category to see how much memory is used to cache the database For Active Directory Domain Services. These counters are located under the lsass.exe instance, whereas for Active Directory Lightweight Directory Services they are located under the Directory instance:
Database Cache % Hit
Database Cache Size (MB)
If Isass.exe uses lots of CPU, check Directory Services\ATQ Outstanding Queued Requests to see how many requests are queued at the domain controller. A high level of queuing indicates that requests are arriving at the domain controller faster than they can be processed. This can also lead to a high latency in responding to requests.
Data Collector Sets is another tool that is included with Windows Server 2008 that you can use to see the activity inside the domain controller. On a server on which the Active Directory Domain Services or Active Directory Lightweight Directory Services role has been installed, the collector template can be found in Reliability and Performance Monitor under Reliability and Performance > Data Collector Sets > System > Active Directory Diagnostics. To start it, click the Play icon.
The data is collected for 5 minutes and a report is generated under Reliability and Performance > Reports > System > Active Directory Diagnostics. This report contains information about CPU usage by different processes, Lightweight Directory Access Protocol (LDAP) operations, Directory Services operations, Kerberos Key Distribution Center operations, NT LAN Manager (NTLM) authentications, Local Security Authority/Security Account Manager (LSA/SAM) operations, and averages of all the important performance counters. This report identifies the workload that is being placed on the domain controller, identifies the contribution of different aspects of that workload to the overall CPU usage, and locates the source of that workload such as an application sending a high rate of requests to the domain controller. The CPU section of the report indicates whether lsass.exe is the process that is taking highest CPU percentage. If any other process is taking more CPU on a domain controller, you should investigate it.
Performance Tuning for Terminal Server Selecting the Proper Hardware for Performance
In a Terminal Server deployment scenario, the choice of hardware is governed by the application set and how the users exercise it. The key factors that affect the number of users and their experience are CPU, memory, disk, and graphics. Earlier in this guide was a discussion on server hardware guidelines. Although these guidelines still apply in this role, this section contains additional guidelines that are specific to Terminal Server, mostly related to the multiuser environment of Terminal Server.
CPU Configuration
CPU configuration is conceptually determined by multiplying the required CPU to support a session by the number of sessions that the system is expected to support, while maintaining a buffer zone to handle temporary spikes. Multiple processors and cores can help reduce abnormal CPU congestion situations, which are usually caused by a few overactive threads that are contained by a similar number of cores. Therefore, the more cores on a system, the lower the cushion margin that must be built into the CPU usage estimate, which results in a larger percentage of active load per CPU. One important factor to remember is that doubling the number of CPUs does not double CPU capacity. For more considerations, see “Performance Tuning for Server Hardware” earlier in this guide.
Processor Architecture
In a 32-bit architecture, all system processes share a 2‑GB kernel virtual address space, which limits the maximum number of attainable Terminal Server sessions. Because memory that the operating system allocates across all processes shares the same 2‑GB space, increasing the number of sessions and processes eventually exhausts this resource. Significant improvements have been made in Windows Server 2008 to better manage the 2‑GB address space. Some of these improvements include dynamic reallocation across different internal memory subareas. This reallocation is based on consumption compared to Windows Server 2003, which had static allocation that left some fraction of the 2 GB unused depending on the specifics of the usage scenario. The most important kernel memory areas that affect Terminal Server capacity are system page table entries (PTEs), system cache, and paged pool. Improvements also include reducing consumption in some critical areas such as kernel stacks for threads. Nevertheless, either significant performance degradation or failures can occur if the number of sessions or processes is high. Actual values vary significantly with the usage scenario, but a good watermark is approximately 250 sessions. Using large amounts of memory (greater than 12 GB) also consumes substantial amounts from the 2‑GB space for memory management data structures, which further accentuates the issue.
The 64-bit processor architecture provides a significantly higher kernel virtual address space, which makes it much more suitable for systems that need large amounts of memory. Specifically, the x64 version of the 64-bit architecture is the more workable option for Terminal Server deployments because it provides very small overhead when it runs 32-bit processes. The most significant performance drawback when you migrate to 64-bit architecture is significantly greater memory usage.
Memory Configuration
It is difficult to predict the memory configuration without knowing the applications that users employ. However, the required amount of memory can be estimated by using the following formula:
TotalMem = OSMem + SessionMem * NS
OSMem is how much memory the operating system requires to run (such as system binary images, data structures, and so on), SessionMem is how much memory processes running in one session require, and NS is the target number of active sessions. The amount of required memory for a session is mostly determined by the private memory reference set for applications and system processes that are running inside the session. Shared pages (code or data) have little effect because only one copy is present on the system.
One interesting observation is that, assuming the disk system that is backing the pagefile does not change, the larger the number of concurrent active sessions the system plans to support, the bigger the per-session memory allocation must be. If the amount of memory that is allocated per session is not increased, the number of page faults that active sessions generate increases with the number of sessions and eventually overwhelms the I/O subsystem. By increasing the amount of memory that is allocated per session, the probability of incurring page faults decreases, which helps reduce the overall rate of page faults.
Disk
Storage is one of the aspects most often overlooked when you configure a Terminal Server system, and it can be the most common limitation on systems that are deployed in the field.
The disk activity that is generated on a typical Terminal Server system affects the following three areas:
System files and application binaries.
Pagefiles.
User profiles and user data.
Ideally, these three areas should be backed by distinct storage devices. Using RAID configurations or other types of high-performance storage further improves performance. We highly recommend that you use storage adapters with battery-backed cache that allows writeback optimizations. Controllers with writeback cache support offer improved support for synchronous disk writes. Because all users have a separate hive, synchronous disk writes are significantly more common on a Terminal Server system. Registry hives are periodically saved to disk by using synchronous write operations. To enable these optimizations, from the Disk Management console, open the Properties dialog box for the destination disk and, on the Policies tab, select the Enable write caching on the disk and Enable advanced performance check boxes.
For more specific storage tunings, see the guidelines in “Performance Tuning for the Storage Subsystem” earlier in this guide.
Network
Network usage includes two main categories:
Terminal Server connections traffic in which usage is determined almost exclusively by the drawing patterns exhibited by the applications that are running inside the sessions and the redirected devices I/O traffic.
For example, applications handling text processing and data input consume bandwidth of approximately 10 to 100 Kb per second, whereas rich graphics and video playback cause significant increases in bandwidth usage. We do not recommend video playback over Terminal Server connections because desktop remoting is not optimized to support the high frame rate rendering that is associated with video playback. Frequent use of device redirection features such as file, clipboard, printer, or audio redirection also significantly increases network traffic. Generally, a single 1‑GB adapter is satisfactory for most systems.
Back-end connections such as roaming profiles, application access to file shares, database servers, e-mail servers, and HTTP servers.
The volume and profile of network traffic is specific to each deployment.
|
