In order to create a suitable backup, you need a ClientRunBeforeJob script. It should create a system snapshot, and shut down any services that are not safe to back up. This example will create the backup in d:\backup\server1\system_state_Backup.bkf

rem Create a system state snapshot using the built in ntbackup utility.
ntbackup.exe backup systemstate  /J  "SERVER1 Backup" /F "D:\backup\server1\system_state_Backup.bkf"  /R:yes  /L:f  /SNAP:on
rem Stop any services required to ensure a consistent snapshot of their data.
net stop FirebirdGuardian
net stop "File Server"

An accompanying ClientRunAfterJob should restart any suspended services.

net start FirebirdGuardian
net start "File Server"
rem etc.

An ASR set should periodically be manually created and included in the backup. This requires running ntbackup.exe, selecting advanced mode if it starts in Wizard Mode, and selecting the Automated System Recovery wizard.

An ASR set contains a backup of your operating system files and a bootable floppy disk that can be used to start your computer if it will not start normally. Before creating an ASR set, make sure that you have a 3.5-inch floppy disk available to make the boot disk. If your server does not have a floppy drive, you can still perform an ASR backup by copying the asr.sif and asrpnp.sif files located in the systemroot \repair directory to another computer with a floppy drive, then copy those files onto a floppy disk. However, before running the ASR restore procedure, you must attach a floppy drive to your server.

Before beginning of restoration bare-metal you must have:

• Bootable CD-R with Windows 2003 Server install files, Service Pack1,

Support Tools, and Resource Kit Tools.

• diskette, containing archive ASR with files of archive ASR asr.sif

and asrpnp.sif.

• Empty HDD large enough to process the ntbackup state snapshot file (at least 3 GB). Note: If the network adapter normally is recognized at loading from CD-R with Windows PE it is possible to use a network folder for copying files instead of additional HDD, but you should consider throughput of a LAN and its congestion.

• Bootable CD-R with Windows PE (make from BartPE).

• Install file of a client part Bacula, a file winbacula-1.38.5.exe.

Assuming that you are not installing on identical hardware, ensure that the replacement system

• Has at least as much memory as the original

• Has at least as much hard drive space as the original

During carrying out of emergency restoration (ASR) operational system:

• Network neighborhood and network drives will be inaccessible.

• All partition on a local disk will be recreated and formatted .

First you must create a working copy of Windows on the new system. This can typically take 30 to 90 minutes.

This will require the following files, from Bacula, the system state snapshot, and the ARS set:

• ASR_Backup.bkf
• system_state_Backup.bkf
• asr.sif
• asrpnp.sif
• bacula-fd.conf
• bconsole.conf
• wx-console.conf

1. Copy files of backup copies ASR_Backup.bkf, system_state_Backup.bkf onto the separate recovery HDD. Copy an install file of a client part “Bacula” winbacula-1.38.5.exe, on the same HDD.
2. Copy files asr.sif and asrpnp.sif on a diskette.
3. Copy files bacula-fd.conf, bconsole.conf, wx-console.conf on the same or on another a diskette.
4. Ensure the system is configured to boot from CD.
5. Insert loading CD-R with install files Windows 2003 Server, SP1 into CD-ROM.
6. Insert a diskette, containing archive ASR, into the disk drive.
7. Boot server from CD-R.
8. Windows setup in a text mode will be started.
9. Wait information in the bottom line of the screen about an input in a mode “Automated System Recovery (ASR) ” and press F2.
10. During a text phase of installation will occur reformatting drive partitions.
11. After the ending of a text phase of installation the server will be reloaded.
12. Power off the server before it reboots into the next stage of installation.
13. Connect additional HDD to server.
14. Boot from the PE boot CD. This is required to copy recover files over from the secondary hard drive to the primary one, as the secondary drive is apparently not always accessible from the recovery console..
15. Copy the ASR_Backup.bkf file to d:\backup\server1 on the primary hard drive.
16. Shut down the server.
17. Disconnect the secondary hard drive.
18. Insert the Windows install CD, and boot from the hard drive. Windows installation will begin.
19. Once the ASR Wizard begins, point it at the ASR_Backup.bkf file.

At this point, the ASR Wizard should complete installation based on the system recovery files and automatically reboot.

Now that the server is in a minimally functional state, you can begin reloading the last known good system state and user data.

1. Reboot and press F8 to interrupt the boot process.
2. Select Directory Services Restore Mode.
3. Log in under the local Administrator account.
4. Start ntbackup.exe and restore the system state from D:\backup\server1\system_state_Backup.bkf. After the restoration it will offer to reboot – select “no”.
5. Install and and configure a Bacula client from the copy of the configuration files. Make sure that the Bacula service will successfully start.
6. Reboot.
7. Do a normal Bacula recover to reload user data files.
8. Check the event log to make sure there were no unexpected errors.

You will want to install the Support Tools and Resource Kit Tools to help in troubleshooting.

One problem you may run into is the File Server service does not start, or starts with errors, due to numerous missing files. This is typically because while the OS has been restored via ASR, none of the user data has been restored yet. Things should start working properly again once the full restore and reboot has been completed.

If for some reason you do not have a good ASR floppy set (ie, the floppy media failed), you can still recreate the appropriate boot floppies if you have the data files backed up elsewhere.

On a functional system, restore the relevant ntbackup archive file. From this archive, you should be able to restore the asr.sif and asrpnp.sif files, and copy them over to a floppy set. This floppy set should then function as the original.

If the Event Log Application contains

Source: MSDTC
Type: Warning
Category: SVC
Event ID: 53258
Description: MS DTC could not correctly process a DC
Promotion/Demotion event. MS DTC will continue to function and will
use the existing security settings. Error Specifics: %1

1. Start equipment Component Services (Start - Programs - Administrative Tools).
2. Expand Component Services.
3. Expand section Computers.
4. Right click on My Computer, select Properties, MSDTC tab.
5. Select Security Configuration, then OK.
6. Select OK again.
7. Right click on My Computer, and select Stop MS DTC. This will stop the Distributed Transaction Coordinator.
8. Right click again on My Computer, and select Start MS DTC.
9. Check the Event Log again. If this continues to fail, it may be necessary to reload the server.

Source: MSDTC
Type: Error
Category: Tracing Infrastructure
Event ID: 4404
Description: MS DTC Tracing infrastructure: the initialization of the
tracing infrastructure failed. Internal Information: msdtc_trace:
File: d:\srvrtm\com\complus\dtc\dtc\trace\src\tracelib.cpp, Line:
1107, StartTrace Failed, hr=0x80070070

1. Start equipment Component Services (Start - Programs - Administrative Tools).
2. Expand Component Services.
3. Right click on My Computer, select Properties, MSDTC tab.
4. Choose Tracing Options.
5. Select Stop Session, New Session, Flush Data, and OK twice.
6. Right click on My Computer, and select Stop MS DTC. This will stop the Distributed Transaction Coordinator.
7. Right click again on My Computer, and select Start MS DTC.

Source: Userenv
Type: Error
Event ID: 1058
Description: Windows cannot access the file gpt.ini for GPO CN =
{31B2F340-016D-11D2-945F-00C04FB984F9}, CN=Policies, CN=System,
DC=test, DC=net. The file must be present at the location <\\ test.net
\sysvol \test.net \Policies \ {31B2F340-016D-11D2-945F-00C04FB984F9}
\gpt.ini>. (The network location cannot be reached. For information
about network troubleshooting, see Windows Help.). Group Policy
processing aborted.

or also

Source: Userenv
Type: Error
Event ID: 1030
Description: Windows cannot query for the list of Group Policy
objects. Check the event log for possible messages previously logged
by the policy engine that describes the reason for this.

A full description of the solution is contained in article Microsoft #842804 at http://support.microsoft.com/?id=842804 . Be sure that:

• Netlogon and DFS services are started.
• The Controller of the domain valid reads and applies rules from

Domain Controllers Policy.

• The NTFS-rights to common resource Sysvol are configured correctly.
• DNS records on server DNS are correct.
• Other useful links for these problems:
  • http://technet.microsoft.com/default.aspx
  • http://www.eventid.net/

• “Backing Up and Restoring Data for Windows Server 2003”
  http://www.microsoft.com/technet/security/smallbusiness/prodtech/windowsserver2003/ntbackup.mspx

• Article ID#326216 “How to use the backup feature to back up and restore data in Windows Server 2003”
  http://support.microsoft.com/kb/326216/

• Article ID#814583 “How to use command line parameters with the Ntbackup command in Windows Server 2003”

http://support.microsoft.com/kb/814583/en-us

• “Backup Troubleshooting” http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/

• Microsoft Corp. “Windows 2000 Server Disaster Recovery Guidelines. White Paper.”

• “Bare metal restore via Automated System Recovery” Brien M. Posey, http://searchtechtarget.techtarget.com/

• Full version in Russian Резервное копирование и восстановление bare metal одиночного сервера Windows 2003 (PDC) из резервной копии с применением ПО резервного копирования "Bacula".

© 2006 Yuri Timofeev