Currently the System State when selected is restored in its entirety including the Registry. Only local System State restores are permitted. Restoring only the registry is covered elsewhere in this manual. Currently the Registry is the only component of the System State that can be restored individually. All other components can only be restored as part of the System State.
Before restoring the System State determine what System State components will be restored. What components your computer has determine what type of restore is required. The following chart reflects the various System State components:
System State Components
|
Windows 2000 |
Professional |
Server |
+ Certificate Server |
+ Domain Controller |
+ Domain Controller + DNS |
+ Cluster |
|
Registry |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
COM + Class Registration Database |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
Boot Files - Including System Files |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
|
Certificate Services Database |
No |
No |
Yes |
No |
No |
No |
|
Active Directory Directory Service |
No |
No |
No |
Yes |
Yes + DNS Zone Information |
Yes |
|
SYSVOL Directory |
No |
No |
No |
Yes |
Yes |
Yes |
|
Cluster Service Information |
No |
No |
No |
No |
No |
Yes |
Chart: System State Components
Three types of System States restores exist, Normal, Authoritative and Non-Authoritative. Any System State Restore that does not include the Active Directory is a Normal System State Restore. All others, System State restores that include the Active Directory, will be either Authoritative System State Restores or Non-Authoritative System State Restores.
Before restoring a System State that includes the Active Directory determine if an Authoritative or a Non-Authoritative Restore is required. Note: If the domain has more than one domain controller restoring using replication is an option. Restoring using replication is beyond the scope of this manual. For information refer to Microsoft's documentation on restoring a domain controller.
Currently the Active Directory Directory Service can only be restored as part of a System State Restore. When restoring the Active Directory to a previous state, and the Active Directory is replicated, an Authoritative Restore must be performed. The above chart reflects what installations' System States include the Active Directory:
Examples of when you might use Non-Authoritative Restore:
No other domain controllers exist on the network (the active directory is not replicated).
When replacing or rebuilding a domain controller or it's primary disk (e.g. system disk has completely failed).
Examples of when you might use Authoritative Restore:
Restoring the Active Directory to a previous state and the Active Directory is replicated.
Restoring objects that were accidentally deleted.
If UltraBac is used to restore without any other tool the result is a Non-Authoritative Restore. The Non-Authoritative Restore does not alter the replication process of components within the System State. You must use Microsoft's NTDSUtil utility in conjunction with UltraBac to perform an Authoritative Restore. The Authoritative Restore allows the user to alter the replication process.
The replication process keeps separate instances of each object in sync with all other instances distributed over the domain controllers. When an object is restored there will exist the restored instance of the object and the pre-existing instance(s) of the object. If the replication process is not altered, the "newest" instance of the object will be propagated (replicated), updating any "old" instances. Typically the restored object appears as the "old" instance and is updated to match the "newer" pre-existing instance of the object. Essentially the restored object is replaced with the pre-existing object nullifying the restore.
To ensure the restored instance of the object gets propagated throughout domain controllers perform an Authoritative Restore and mark the objects as Authoritative.
To perform a Normal System State Restore operation, follow these steps:
Load the storage media that the registry files are to be restored from in the drive.
Run UltraBac by selecting from Window's Task Bar, "Start"/"Programs"/"UltraBac"/"UltraBac".
From UltraBac's Menu Bar, select "Mode"/"Restore".
Again from UltraBac's Menu Bar select "Restore"
Select either "Load Index from Disk" or "Load Index From Storage Media".
Highlight and load the appropriate set index.
The following illustration shows a System State directory entry:
Figure: Restore System State Files
Take note that the System State files for a machine are always backed up in the first "*.UB" set written to storage media. This is pertinent when performing multiple set backups of NT/2000 Servers and NT/2000 Workstations/Professionals. Note that the computer name for the System State to be restored will be displayed next to the registry directory entry. Currently only local System State restores are allowed.
Select the System State icon and then the "Perform Restore" button.
After selecting "Perform Restore" the "Restore File(s)" dialog box appears:
Figure: Restore Files
Select "Restore". For information on this dialog box and completing the restore process, follow instructions in the "Method One: Load Index from Disk" section of the "Restoring From Storage Media" chapter.
IMPORTANT WARNING! Your system must be REBOOTED before the restored System State files will be activated.
This section covers Authoritative Restores of the System State (including the Active Directory) on a Domain Controller. The basic steps of an Authoritative Restore are:
Start (boot) the Domain Controller in Directory Services Restore Mode.
Within UltraBac load the set containing the local System State backup.
Select the System State.
Perform the UltraBac restore.
Run NTDSUtil and mark appropriate objects as "Authoritative".
Reboot.
Start in Directory Services Restore Mode
Start the Domain Controller in "Directory Services Restore Mode" before restoring the System State.
Start the Domain Controller in Directory Services Restore Mode by doing the following:
Reboot the computer.
When prompted to select an operating system or as soon as Windows displays the Starting Windows progress bar, press F8.
From the list of Safe Modes, select "Directory Services Restore Mode (Windows 2000 domain controllers only.)" and then press "Enter".
If prompted select an appropriate operating system and then press "Enter".
Wait for the "Welcome to Windows" screen appears and press "Ctrl+Alt+Delete".
Log in using an Administrator account and password stored in the SAM (Security Accounts Manager). This account was created when Active Directory was installed. Note: Active Directory Administrator accounts are not available since the active directory is off-line.
Select "OK" within the "Desktop" dialog box. This dialog box starts with the text, "Windows is running in Safe Mode."
Restoring the System State Using UltraBac
To perform a System State restore operation, follow these steps:
Load the storage media that the System State files are to be restored from in the drive.
Run UltraBac by selecting from Window's Task Bar, "Start"/"Programs"/"UltraBac"/"UltraBac".
From UltraBac's Menu Bar, select "Mode"/"Restore".
Again from UltraBac's Menu Bar select "Restore"
Select either "Load Index from Disk" or "Load Index From Storage Media".
Highlight and load the appropriate set index.
The System State must be restored in its entirety including the registry. Note: Selecting the System State forces the selection of the Registry and un-selecting any part of the Registry will un-select the System State
The following illustration shows a System State and a registry directory entry:
Figure: Restore System State Files
Select the System State icon and then the "Perform Restore" button.
After selecting "Perform Restore" the "Restore File(s)" dialog box appears:
Figure: Restore Files
Select "Restore". For information on this dialog box and completing the restore process, follow instructions in the "Method One: Load Index from Disk" section of the "Restoring From Storage Media" chapter.
Take note that the System State files for a machine are always backed up in the first "*.UB" set written to storage media. This is pertinent when performing multiple set backups of NT/2000 Servers and NT/2000 Workstations/Professionals.
Select "OK" to the following screen(s) if they appear at the end of the restore process (Selecting OK will not reboot the computer.):
Figure: UltraBac - Reboot Request
Figure: UltraBac - Reboot Request 2
Select "Restore Log" when the "Statistics" dialog box appears and verify the restore was successful.
Close the word editor.
Select "Close" on the "Statistics" dialog box
At the end of the restore process UltraBac will prompt you to run NTDSUtil from within UltraBac. Select "Yes" or run NTDSUtil from the command prompt before re-booting - see the next section.
Figure: NTDSUtil prompt
Run NTDSUtil
To perform an Authoritative Restore use NTDSUtil after you restore the System State data but before you restart the server on the network. NTDSUtil allows Active Directory Objects to be marked for Authoritative Restore, ensuring proper replication and distribution of data.
Run NTDSUtil and mark all appropriate objects as Authoritative. If NTDSUtil is not run as part of the UltraBac restore, then NTDSUtil can be run from the Command Prompt. Note: Type ntdsutil /? for help on this utility.
If necessary, from the command prompt type in NTDSUtil and press "Enter".
Type in the text: "authoritative restore" less the quotes at the NTDSUTIL.EXE: prompt and press "Enter".
To mark the full restore as authoritative, type in the text "restore database" less the quotes at the authoritative restore: prompt and press "Enter". To mark just a subtree as authoritative, type in the text "restore subtree ***" where *** is a string (e.g. restore subtree "cn=DomainController,ou=DomainControllers,dc=DomainName,dc=TopLevelDomainName") at the authoritative restore: prompt and press "Enter". See Microsoft's documentation for more information on restoring subtrees.
Select "Yes" when prompted with the following confirmation screen:
Figure: Authoritative Restore Confirmation Dialog
Type in "quit" less the quotes at the authoritative restore: prompt and press "Enter".
Type in "quit" less the quotes at the NTDSUTIL.EXE: prompt and press "Enter".
The following screen illustrates a typical NTDSUtil session:
Figure: Typical NTDSUtil Session
Reboot
IMPORTANT WARNING! Your system must be REBOOTED before the restored System State files will be activated.
Note: Only restored objects specifically marked as Authoritative will update their respective objects on other domain controllers. All other objects will still be Non-Authoritative. See Microsoft's documentation on Authoritative Restores for more Information.
Note: The Active Directory uses the USN (Update Sequence Number) to determine which instance of an object is "older".
This section covers Non-Authoritative restores of the System State. Non-Authoritative Restores may be applied to all Windows 2000 computers, not just Domain Controllers. Non-Authoritative restores to Domain Controllers (installations with Active Directory) require booting into Directory Services Restore Mode. All other installations do not. The basic steps of an Authoritative Restore are:
If restoring to a Domain Controller, start (boot) the Domain Controller in Directory Services Restore Mode.
Within UltraBac load the set containing the local System State backup.
Select the System State.
Perform the UltraBac restore.
Reboot.
Start in Directory Services Restore Mode
If restoring to a Domain Controller, start the Domain Controller in Directory Services Restore Mode before restoring the System State.
Start the Domain Controller in Directory Services Restore Mode by doing the following:
Reboot the computer.
When prompted to select an operating system or as soon as Windows displays the Starting Windows progress bar, press F8.
From the list of Safe Modes, select "Directory Services Restore Mode (Windows 2000 domain controllers only.)" and then press "Enter".
If prompted select an appropriate operating system and then press "Enter".
Wait for the "Welcome to Windows" screen appears and press "Ctrl+Alt+Delete".
Log in using an Administrator account and password stored in the SAM (Security Accounts Manager). This account was created when Active Directory was installed. Note: Active Directory Administrator accounts are not available since the active directory is off-line.
Select "OK" within the "Desktop" dialog box. This dialog box starts with the text, "Windows is running in Safe Mode."
Restoring the System State Using UltraBac
To perform a System State restore operation, follow these steps:
Load the storage media that the System State files are to be restored from in the drive.
Run UltraBac by selecting from Window's Task Bar, "Start"/"Programs"/"UltraBac"/"UltraBac".
From UltraBac's Menu Bar, select "Mode"/"Restore".
Again from UltraBac's Menu Bar select "Restore"
Select either "Load Index from Disk" or "Load Index From Storage Media".
Highlight and load the appropriate set index.
The System State must be restored in its entirety including the registry. Note: Selecting the System State forces the selection of the Registry and un-selecting any part of the Registry will un-select the System State
The following illustration shows a System State and a registry directory entry:
Figure: Restore System State Files
Select the System State icon and then the "Perform Restore" button.
After selecting "Perform Restore" the "Restore File(s)" dialog box appears:
Figure: Restore Files
Select "Restore". For information on this dialog box and completing the restore process, follow instructions in the "Method One: Load Index from Disk" section of the "Restoring From Storage Media" chapter.
Take note that the System State files for a machine are always backed up in the first "*.UB" set written to storage media. This is pertinent when performing multiple set backups of NT/2000 Servers and NT/2000 Workstations/Professionals.
Select "OK" to the following screen(s) if they appear at the end of the restore process (Selecting OK will not reboot the computer.):
Figure: UltraBac - Reboot Request
Figure: UltraBac - Reboot Request 2
Select "Restore Log" when the "Statistics" dialog box appears and verify the restore was successful.
Close the word editor.
Select "Close" on the "Statistics" dialog box
At the end of the restore process UltraBac will prompt you to run NTDSUtil from within UltraBac. Select "No".
Figure: NTDSUtil prompt
Reboot
IMPORTANT WARNING! Your system must be REBOOTED before the restored System State files will be activated.
Currently System States can only be backed up and restored locally. This means each computer requiring its System State to be backed up must have UltraBac installed on it. However, a tape device is not mandatory. A disk-path may be used as the target of a System State backup and the source of a System State restore. A network disk-path may be used provided the UltraBac edition (license) allows network disk-paths. If another installation of UltraBac exists on the network and is capable of backing up this disk path to tape, then a history can be created on tape.