Restoring System State Data on a Domain Controller with wbadmin
If the server is a domain
controller, you need to take a couple of extra steps to restore system
state. You are not able to restore Active Directory while Active
Directory is running, so you need to enter Active Directory Restore Mode
and then restore it. The following table shows the steps in this
process.
Tip
This is also called performing a critical volume restore.
| Step | Action |
|---|
| 1. | Reboot the system and press F8 to access the Advanced Boot Options page. |
| 2. | Select Directory Services Restore Mode and press Enter. When prompted, log on with the user name of .\administrator and the DSRM password. |
| 3. | Launch a command prompt. |
| 4. | Type the following command to identify the version information for the system state backup:
wbadmin get versions |
| 4. | Type the wbadmin
command to restore system state data using the version information
retrieved with the previous step. The command has the following format:
wbadmin start systemstaterecovery -version:mm/dd/yyyy-hh:mm wbadmin start systemstaterecovery -version:01/03/2011-20:51 |
| 5. | When prompted to continue with the restore, press y.
When this is complete, the
non-authoritative restore of Active Directory is complete. If you want
to do an authoritative restore of an object or an OU, you can use the ntdsutil command at this time.
restore subtree dn-of-the-ou
The basic command to restore an object (such as a user) is
restore object dn-of-the-object |
| 6. | After the restore has completed, reboot the domain controller. |
Backing Up Volumes with wbadmin
You can use the start backup command to back up entire volumes. The basic syntax is
wbadmin start backup -backuptarget:volume-where-backup-stored
-include:volumes-to-back-up
For example, the following command backs up the E: volume to F:
wbadmin start backup -backuptarget:f: -include:e:
The following listing shows the output:
C:\>wbadmin start backup -backuptarget:f: -include:e:
wbadmin 1.0 - Backup command-line tool
(C) Copyright 2004 Microsoft Corp.
Retrieving volume information...
This would backup volume Data(E:) to f:.
Do you want to start the backup operation?
[Y] Yes [N] No y
Backup to F: is starting.
Creating the shadow copy of volumes requested for backup.
Running backup of volume Data(E:), copied (0%).
Running backup of volume Data(E:), copied (84%).
Backup of volume Data(E:) completed successfully.
Backup completed successfully.
Summary of backup:
------------------
Backup of volume Data(E:) completed successfully.
The following table shows switches you can use with the wbadmin start backup command.
| wbadmin Start Backup Switches | Comments |
|---|
-backuptarget: volume-
name | network-share-
path
-backuptarget: e:
| Specifies
the storage location for this backup.
This requires either a drive letter or a Universal Naming Convention
(UNC) path to a remote shared network folder in the format of \\servername\sharename\.
Note
If a remote shared folder is specified, this backup overwrites any existing backups of this server in that location.
|
-include: volumes-to-
back-up
-include: c:,d:
| Identifies
a comma-delimited list of volume drive letters, volume mount points, or
GUID-based volume names to include in the backup. |
| -allcritical | Automatically
includes all critical volumes (volumes that contain operating system
components) in the backup. This can be used with the -include parameter.
Tip
This command is useful if you are creating a backup for full system or system state recovery.
|
| -noverify | If
specified, backups written to removable media (such as a DVD) are not
verified for errors. If you do not use this parameter, backups written
to removable media are verified. |
-user:username
-user:sally
| Specifies the user name with write access to the target location. |
-password:password
-password:P@ssw0rd
| Specifies the password for the user name that is specified with the -user switch. |
| -vssfull | If
specified, it performs a full backup using the Volume Shadow Copy
Service (VSS). Each file’s history is updated to reflect that it was
backed up.
If this parameter is not specified, start backup makes a copy backup,
but the history of files being backed up is not updated.
Tip
Do not use this parameter if you are using a product other than Windows
Server Backup to back up applications that are on the volumes included
in the current backup. Doing so can potentially break the incremental,
differential, or other type of backups the other backup product is
taking.
|
| -quiet | Runs the command with no prompts to the user. |
Restoring Volumes with wbadmin
You can also restore entire volumes with the wbadmin
tool. This is useful if one or more drives on your system ever suffers a
catastrophic failure. The basic syntax to recover a volume is
wbadmin start recovery -version:mm/dd/yyyy-hh:mm -itemtype:volume
-items:volume-to-recover -recoverytarget:volume-to-recover-to
For example, the following command restores the volume E: contained in the backup to the g: volume:
C:\>wbadmin start recovery -version:01/04/2011-11:15
-itemtype:volume -items:e: -recoverytarget:g:
The following listing shows the output you see from this command:
G:\>wbadmin start recovery -version:01/04/2011-11:15
-itemtype:volume -items:e: -recoverytarget:g:
wbadmin 1.0 - Backup command-line tool
(C) Copyright 2004 Microsoft Corp.
Retrieving volume information...
You have chosen to recover volume(s) e: from the backup taken on
1/4/2011 6:15 AM to a different location, g:.
WARNING:
You have chosen to recover a full volume. This will DELETE any
existing data on the volume you recover to, even if the operation
is canceled or fails. Before you continue, make sure that this
volume does not contain any data that you might want in the future.
Note: If the recovered volume contains applications, you will need
to recover those applications after you recover the volume.
Do you want to continue?
[Y] Yes [N] No y
Running recovery for volume Data(E:), copied (0%).
Running recovery for volume Data(E:), copied (90%).
Recovery for volume Data(E:) completed successfully.
Recovery operation completed.
Summary of recovery:
--------------------
Recovery for volume Data(E:) completed successfully.
The following table shows some switches you can use with wbadmin start recovery.
| wbadmin start recovery Switches | Comments |
|---|
-version:version-
identifier
-version: 01/03/2011-
20:51
| Version identifier of the backup is in the format of mm/dd/yyyy-hh:mm:
Tip
You can get the information with the wbadmin get versions command.
|
-itemtype: volume | file
| app
-itemtype:volume
| Specifies the type of items to recover. Must be volume, file, or app.
Tip
Applications you can restore include Active Directory and Windows SharePoint Services (WSS) or SharePoint Portal applications.
Tip
When restoring SharePoint applications to a different target system, you must first install WSS on the target system.
|
-items:volumes-to-
recover | files-
folders-to-recover |
apps-to-recover
-items:c:,d:
-items:d:\scripts
-items:adifm
| Identifies a comma-delimited list of volumes, files, or applications to recover.
If -itemtype is volume,
it can be only a single volume that is specified by providing the
volume drive letter, volume mount point, or GUID-based volume name.
If -itemtype is file, it can be files or directories, but it should be part of the same volume and should be under the same parent.
If -itemtype is app,
it can be only a single application. Applications that have registered
with Windows Server Backup can be recovered. You can also use the value adifm to recover an installation of Active Directory. |
-recursive
-items:d:\scripts
-recursive
| Valid
only when recovering files. Recovers the files in the folders and all
files subordinate to the specified folders. By default, only files that
reside directly under the specified folders are recovered. |
-recoverytarget:volume-
to-recover-to
-recoverytarget:g:
| Specifies
the drive letter to restore to.
This is useful if the drive is different from the one that was
previously backed up. You can use this to restore volumes or files. If
you are restoring a volume, you can specify the volume drive letter of
the alternative volume. If you are restoring a file or application, you
can specify an alternative backup path. |
-overwrite:overwrite |
createcopy | skip
-overwrite:overwrite
-overwrite:createcopy
-overwrite:skip
| Valid only when recovering files.
Specifies the action to take when a file that is being recovered already exists in the same location.
overwrite causes the recovery to overwrite the existing file with the file from the backup.
createcopy causes the recovery to create a copy of the existing file so that the existing file will not be modified.
skip causes the recovery to skip the existing file and continue with recovery of the next file. |
| -quiet | Runs the command with no prompts to the user. |
