ntbackup: Restoring Data

Tutorial: Restoring a Domain Controller to a Working Condition Using NTBACKUP

Let's pretend that DC02 has become unusable and must be restored from a backup. In order to restore a domain controller to a working condition, Active Directory and domain services must not be running. To guarantee this, we must restart the domain controller in a special mode called Directory Services Restore Mode . ( Note: recall that the Directory Services Restore Mode password was entered in the dcpromo wizard ). Once this is done, we can launch ntbackup and initiate the restore process. Be warned : this tutorial destroys all data on DC02; ntbackup may also give "other than expected" results when performing restores . You have been warned!

1. Restart DC02 in Directory Services Restore Mode . This is done by restarting the server, and, once the screen fades to black, repeatedly pressing the F8 key . On the menu that appears, use the arrow keys to select Directory Services Restore Mode and hit Enter . Make sure that Windows Server 2003 is selected, and hit Enter . The system boots into the appropriate mode.

2. Log into the server using the Administrator username and the Directory Services Restore Mode password. Windows informs you that you are running in a special diagnostics mode. Click OK .

3. Open ntbackup and click Next . Select Restore files and settings and click Next . In the left column, expand the item labeled File . Three items appear: Backup - Normal.bkf , Backup - Differential A.bkf , and Backup - Differential B.bkf . We must first restore the normal backup

4. Expand the normal backup item and place checks in the options labeled C: and System State . This tells ntbackup that we wish to restore these two items in their entirety using the information stored in the normal backup. This is shown in figure 6-2.

   
   Figure 6-2: On the first leg of restoring a domain controller using ntbackup, make sure to select both the C drive and the system state options from the normal backup.

5. Click Next , and then click Advanced . In the Restore files to field, choose Original Location ( Note: we do have the option to restore the entire contents of the backup set to either an alternate location or to a single folder. This can be handy when you are only restoring portions of your backed up data and do not wish to overwrite any existing data on the domain controller ). Click Next .

6. Windows warns us that restoring the system state data to the same location in which it was backed up will overwrite the current system state. Since we wish to restore this domain controller to a state in which it was backed up, we do indeed want to overwrite the current system state. Click OK .

7. We want to completely overwrite all existing data on DC02 with the data contained in our backup set. Select Replace existing files on the How to Restore window and click Next .

8. On the Advanced Restore Options window, make sure that all options are checked except for the last two. The cluster option pertains to a cluster of domain controllers. The very last option, labeled When restoring replicated data sets, mark the restored data as the primary data for all replicas , controls the direction of replication when this domain controller is brought back online. If this box is checked, this domain controller's data appears "new" to all existing domain controllers in the domain and/or forest, and all Active Directory data is therefore replicated back to all existing domain controllers. This may not be a good situation, as you may have had corruption or may have made a mistake in DC02's Active Directory information. You wouldn't want those mistakes to be replicated back to other domain controllers. If the box remains unchecked, data from other domain controllers replicates back to DC02.

9. Click Next and Finish . Windows asks you to confirm the backup file location. Ensure that the path is correct. For this example, we have E:\ntbackup\Backup-Normal.bkf . Click OK . The restore operation proceeds, and may take some time to complete.

10. Once the backup completes, restart DC02 once again in Directory Services Restore Mode.

11. Perform a restore again using the same options that we have outlined in the previous 10 steps. However this time, use the most recent differential backup set, Backup - Differential B ( Note: remember that we do not need to restore using every differential backup set; only the most recent one ).

12. Reboot DC02 .

If this had been an actual emergency, DC02 would now be back up and ready to roll, restored to a functional condition.

As shown here, the differential set is wonderful for speedy recoveries . But as shown earlier, it's lousy for conserving backup media space, and it takes longer to run backup sessions simply because it repeatedly backs up all data since the last normal backup, even if some of that data does not need to be backed up. This results in backing up the same data multiple times.

On the other hand, the incremental backup excels at producing small and fast backups because it only backs up data that has changed since our last normal backup. But restores are another story, as we must restore every single one of the incremental backup sessions to produce a working domain controller. And, if the incremental restore isn't performed just right, we also risk multiple copies of the same file appearing on our domain controller.

Keep these tidbits of information regarding ntbackup in your storehouse of knowledge:

• Backup sessions can be scheduled so that you do not have to constantly initiate the process manually. This is done by clicking Schedule instead of Now in the backup wizard.

• Sometimes, even when you do everything right, ntbackup may produce "other than expected" results.

• You cannot restore individual files. However, you can restore individual folders. So if you need to restore a single file named graph.tif inside a folder located in C:\shares\works_in_progress\art , you must restore the entire art folder. If your art folder contains a large amount of data, you might potentially have to restore gigabytes of data just to retrieve a single file that might be a few megabytes in size .

• If you have a file that has been backed up, but you don't know its exact location within the backup set, you must restore the entire backup set (or the portion of the backup set that you think may contain the file) and then search the restored data for the file. There is no mechanism to search a backup set before you restore its data.

• If we have at all discouraged you from using ntbackup, it does have one very compelling advantage over any third-party backup solution: it's included with Server 2003, and is therefore no extra cost.