Modified Instructions for Complete Restores of Windows Systems: Bare Metal
Restore (BMR), System State Restore, Windows System Object Restore
Technote (FAQ)
Problem
A number of fixes have recently been introduced in the TSM client which
impact the success of complete system restores on Windows 2000, XP, and
2003. Before performing a Windows machine recovery, ensure that you are at a
client level TSM 5.1.7.0 or newer, or 5.2.3.0 or newer. For system restores
on Windows 2003, the 5.2.3_11 interim fix or newer is required. Also, TSM
development has recently determined that it is necessary to restore the
catalogs for Windows system file protection prior to restoring other system
components to ensure a complete restore. The restore procedure below
provides details on how to restore these catalogs separately from the other
system objects. If you are using Automated System Recovery (ASR,) the
modified restore procedures are not required, however, you will want to
upgrade to the recommended TSM client levels.
Solution
Preparation:
In order to perform a complete system restore, a complete backup is needed.
The backup must include a complete backup of the system drive, and a backup
of the system objects (systemstate and systemservices on Windows 2003, but
referred to generally as system objects for the remainder of this document.)
The following points should be considered:
1. A scheduled backup of the default all-local domain will include both the
system drive and system objects.
2. Care must be taken not to exclude required application files from the
system drive backup. The sample options file in the config directory lists
suggested include/exclude rules which are known not to interfere with system
recovery. The sample options files can be found in the normal installation
path. For example, c:\program files\tivoli\tsm\config\dsm.smp.
3. A number of files on the system drive are automatically excluded from
backup based on operating system controls. The "query inclexcl" command can
be used to view the rules which will effect which files are automatically
excluded during backup. Files which are under Windows system file protection
can only be backed up as part of the system and boot files component of
system objects. They are automatically excluded from normal backup
processing.
4. System recovery time can be greatly reduced by maintaining a volume-level
image of the base Windows installation. Products such as Symantec's ghost
are useful for creating such images.
Restore Procedure:
The following modified restore procedure is required when you are restoring
your complete operating system over a running operating system. These
procedures are not required if you are restoring with Automated System
Recovery (ASR.)
1. In order to restore, you need a base operating system running with the
TSM client installed, and connectivity to the TSM server. It is strongly
recommended that you restore to identical hardware to which the backup was
taken from. The system name must match the system name at the time of
backup. Unless this is set, the system object component cannot be restored.
2. Apply the same Windows service pack to the base operating system which
was installed at the time of backup. Windows must be installed in the same
directory at which it was installed at the time of backup (c:\winnt for
example.) The file system must be formatted in the same format that existed
at the time of backup.
3. Restore the system file protection catalogs to avoid conflicts when the
remainder of the system files are restored. The commands below are examples.
Your Windows installation directory and drive letter may vary. The
%systemroot% and %systemdrive% variables can be used to create a generic
restore procedure if desired.
Windows 2000:
> dsmc restore "{SYSTEM OBJECT}\winnt\system32\catroot\*"
c:\winnt\system32\ -sub=yes -rep=all
Windows XP:
> dsmc restore "{SYSTEM OBJECT}\windows\system32\catroot\*"
c:\windows\system32\ -sub=yes -rep=all
Windows 2003:
> dsmc restore "{SYSTEM STATE}\windows\system32\catroot\*"
c:\windows\system32\ -sub=yes -rep=all
4. Restore the system drive (note: you will be prompted to reboot at the
conclusion of the restore. Ignore the request to reboot and proceed to the
next step!)
All Windows:
> dsmc restore c:\* -sub=yes -rep=all
5. Restore the system objects:
Windows 2000/XP:
> dsmc restore systemobject
Windows 2003:
> dsmc restore systemstate
> dsmc restore systemservices
6. Reboot
7. If you are recovering a domain controller, there are additional
considerations for performing authoritative restores. Information is
available in the references at the end of this document regarding the topic
of authoritative restores.
The following example shows a complete sequence of commands for restoring a
Windows 2000 system using environment variables to avoid fixed drive letters
and paths:
> dsmc restore "{SYSTEM OBJECT}\winnt\system32\catroot\*"
%systemroot%\system32\ -sub=yes -rep=all
> dsmc restore %systemdrive%\* -sub=yes -rep=all
> dsmc restore systemobject
Additional Information
There are four files under system file protection which cannot be restored
due to a Microsoft Windows limitation with replace on reboot. These files
are: ntdll.dll, smss.exe, dtcsetup.exe, and ctl3dv2.dll. If you are
restoring over a base Windows image which contains down-level versions of
these files versus those contained in your backup image, you may experience
system problems following the restore including:
Failure of your system to boot due to a down-level version of ntdll.dll (see
Microsoft article KB328035 for additional information.) The work-around to
this problem is to apply Windows XP SP1 prior to performing the restore, or
to use Automated System Recovery (ASR.)
One or more Windows critical updates may not be correctly restored.
Following the restore, use Windows Update to reapply the critical updates
which are not correctly restored.
If you are using Automated System Recovery (ASR) which is available for
Windows XP and Windows 2003 in TSM 5.2, then you will not be required to
perform the pre-restore of the SFP catalogs. The TSM restores performed
during ASR occur while Windows system file protection is not running. For
this reason, the pre-restore of the SFP catalogs is not necessary. Also,
issues restoring the four restricted Windows system files (ntdll.dll,
smss.exe, dtcsetup.exe, and ctl3dv2.dll ) will not occur when using ASR. If
you are running Windows XP or Windows 2003, we strongly recommend that you
use ASR instead of restoring system state over a running Windows operating
system.
More information on authoritative restore and ASR is available at the
following links:
Redbook titled "Deploying the Tivoli Storage Manager Client in a Windows
2000 Environment"
http://publib-b.boulder.ibm.com/Redbooks.nsf/RedbookAbstracts/sg246141.html?
Open
White paper titled "Tivoli Field Guide - Using Microsoft Windows Automated
System Recovery (ASR) to Recover Windows XP and Windows 2003 Systems with
the IBM Tivoli Storage Manager Backup-Archive Client for Windows"
http://www-1.ibm.com/support/entdocview.wss?rs=663&context=SSGSG7&uid=swg270
03812&loc=en_US&cs=utf-8&lang=en%20en
-----Original Message-----
From: ADSM: Dist Stor Manager [mailto:[EMAIL PROTECTED] Behalf Of
Bell, Charles (Chip)
Sent: Tuesday, September 05, 2006 10:26 AM
To: ADSM-L@VM.MARIST.EDU
Subject: Win2003 Full system restore
Is it documented what the steps are for full system restore of Win2003
client? As in C:\, then system state/services, then D:\...
What is the order, and where do you reboot? I have it for the 2000 servers,
but I'm too busy working on a VTL problem to do a search. :-)
God bless you!!!
Chip Bell
Network Engineer I
IBM Tivoli Certified Deployment Professional (ITSM 5.2)
Baptist Health System
Birmingham, AL
Office (205) 715-5106
Pager (205) 817-0357
Home (256) 739-0947
Cell (256) 347-7294
-----------------------------------------
Confidentiality Notice:
The information contained in this email message is privileged and
confidential information and intended only for the use of the
individual or entity named in the address. If you are not the
intended recipient, you are hereby notified that any dissemination,
distribution, or copying of this information is strictly
prohibited. If you received this information in error, please
notify the sender and delete this information from your computer
and retain no copies of any of this information.
Confidentiality Note: The information transmitted is intended only for the
person or entity to whom or which it is addressed and may contain
confidential and/or privileged material. Any review, retransmission,
dissemination or other use of this information by persons or entities other
than the intended recipient is prohibited. If you receive this in error,
please delete this material immediately.
Please be advised that someone other than the intended recipients, including
a third-party in the Seligman organization and government agencies, may
review all electronic communications to and from this address.
