Disaster Recovery and Preparation | Microsoft Windows Server 2003 Administrator[ap]s Pocket Consultant

Backups are only one part of a comprehensive disaster recovery plan. You also need to have emergency repair disks and boot disks on hand to ensure that you can recover systems in a wide variety of situations. You might also need to install the Recovery Console.

When you set out to recover a system, you should follow these steps:

Try to start the system in safe mode, as described in the section of this chapter entitled "Starting a System in Safe Mode."
Try to recover the system using the System Recovery Data (if available). See the section of this chapter entitled "Using the Recovery Data to Restore a System."
Try to recover the system using the Recovery Console. See the section of this chapter entitled "Working with the Recovery Console."
Restore the system from backup. Be sure to restore the system state data as well as any essential files.

Creating System Recovery Data

Automated System Recovery data can often help you recover a system that won't boot. The recovery data includes essential system files, partition boot sector information, and the startup environment for a particular system. You should create recovery data for each computer on the network, starting with servers running Windows Server 2003. Normally, you'll want to update the recovery data when you install service packs , manipulate the boot drive, or modify the startup environment.

Tip

When you completed the installation of the operating system, basic recovery information was saved in the %SystemRoot%\Repair folder on the system partition. The Repair folder contains a copy of the local Security Account Manager (SAM) data and other essential system files. It doesn't contain a backup of the Windows registry. You should create a registry backup when you create the recovery data.

You can create a system recovery data snapshot by completing the following steps:

Start the Backup utility. If wizard mode is enabled, click Next, select Prepare An Automated System Recovery Backup, and then click Next again. If wizard mode is disabled, click Automated System Recovery Wizard in the Welcome tab and then click Next .
When prompted, insert a blank 3.5-inch, 1.44-MB disk into the floppy drive.
If you want to back up the registry as well, select Also Backup The Registry To The Repair Directory. A backup of the Windows registry will then be made in the %SystemRoot%\Repair folder. If you need to restore the registry, you must use the Recovery Console.
Click OK. When prompted, remove the disk and label it as an emergency repair disk for the system.

Starting a System in Safe Mode

If a system won't boot normally, you can use safe mode to recover or troubleshoot system problems. In safe mode, Windows Server 2003 loads only basic files, services, and drivers. The drivers loaded include the mouse, monitor, keyboard, mass storage, and base video. No networking services or drivers are started ”unless you choose the Safe Mode With Networking option. Because safe mode loads a limited set of configuration information, it can help you troubleshoot problems. In most cases you'll want to use safe mode before trying to use the emergency repair disk or the Recovery Console.

You start a system in safe mode by completing the following steps:

Start (or restart) the problem system.
During startup you should see a prompt labeled Please Select The Operating System To Start. Press F8.
Use the arrow keys to select the safe mode you want to use, and then press Enter. The safe mode option you use depends on the type of problem you're experiencing. The key options you might see are:
- Safe Mode Loads only basic files, services, and drivers during the initialization sequence. The drivers loaded include the mouse, monitor, keyboard, mass storage, and base video. No networking services or drivers are started.
- Safe Mode With Command Prompt Loads basic files, services, and drivers, and then starts a command prompt instead of the Windows Server 2003 graphical interface. No networking services or drivers are started.
- Safe Mode With Networking Loads basic files, services, and drivers, as well as services and drivers needed to start networking.
- Enable Boot Logging Allows you to create a record of all startup events in a boot log.
- Enable VGA Mode Allows you to start the system in Video Graphics Adapter (VGA) mode, which is useful if the system display is set to a mode that can't be used with the current monitor.
- Last Known Good Configuration Starts the computer in safe mode using registry information that Windows Server 2003 saved at the last shutdown.
- Directory Services Recovery Mode Starts the system in safe mode and allows you to restore the directory service. This option is available on Windows Server 2003 domain controllers.
- Debugging Mode Starts the system in debugging mode, which is useful only for troubleshooting operating system bugs .
If a problem doesn't reappear when you start in safe mode, you can eliminate the default settings and basic device drivers as possible causes. If a newly added device or updated driver is causing problems, you can use safe mode to remove the device or reverse the update.

Using the Recovery Data to Restore a System

When you can't start or recover a system in safe mode, your next step is to try to recover the system using the last system recovery data snapshot you made (if available). The recovery data comes in handy in two situations. If the boot sector or essential system files are damaged, you might be able to use the recovery data to restore the system. If the startup environment is causing problems on a dual or multiboot system, you might be able to recover the system as well. You can't recover a damaged registry, however. To do that, you must use the Recovery Console.

You can repair a system using the recovery data by completing the following steps:

Insert the Windows Server 2003 CD or the first setup boot disk into the appropriate drive, and then restart the computer. When booting from a floppy disk, you'll need to remove and insert disks when prompted.
When the Setup program begins, follow the prompts, and then choose the Repair Or Recover option by pressing R.
If you haven't already done so, insert the Windows Server 2003 CD into the appropriate drive when prompted.
Choose emergency repair by pressing R and then do one of the following:
- Press M For Manual Repair Select this option to choose whether you want to repair system files, the partition boot sector, or the startup environment. Only advanced users or administrators should use this option.
- Press F For Fast Repair Select this option to have Windows Server 2003 attempt to repair problems related to system files, the partition boot sector, and the startup environment.
Insert the System Recovery floppy disk when prompted. Damaged or missing files are replaced with files from the Windows Server 2003 CD or from the %SystemRoot%\Repair folder on the system partition. These replacement files won't reflect any configuration changes made after setup, and you might need to reinstall service packs and other updates.
If the repair is successful, the system is restarted and should boot normally. If you still have problems, you might need to use the Recovery Console.

Working with the Recovery Console

The Recovery Console is one of your last lines of defense in recovering a system. The Recovery Console operates much like the command prompt and is ideally suited to resolving problems with files, drivers, and services. Using the Recovery Console, you can fix the boot sector and master boot record; enable and disable device drivers and services; change the attributes of files on FAT, FAT32, and NTFS volumes; read and write files on FAT, FAT32, and NTFS volumes ; copy files from floppy or CD to hard disk drives; run Check Disk; and format drives .

The sections that follow discuss techniques you can use to work with the Recovery Console. As you'll learn, you can start the Recovery Console from the setup boot disks or you can install the Recovery Console as a startup option.

Installing the Recovery Console as a Startup Option

On a system with frequent or recurring problems, you might want to install the Recovery Console as a startup option. In this way you don't have to go through the setup boot disks to access the Recovery Console. You can use this option only if the system is running. If you can't start the system, see the section of this chapter entitled "Starting the Recovery Console."

You install the Recovery Console as a startup option by completing the following steps:

Insert the Windows Server 2003 CD into the CD-ROM drive.
Click the Start menu and then click Run. This displays the Run dialog box.
Type h:\i386\winnt32.exe /cmdcons in the Open field, where h is the CD-ROM drive letter.
Click OK, and then when prompted, click Yes. The Recovery Console is then installed as a startup option.

Note

Normally, only administrators can install and run the Recovery Console. If you want normal users to be able to run the Recovery Console, you must enable the Auto Admin Logon policy for the local computer policy (Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Recovery Console: Allow Automatic Administrative Logon).

Starting the Recovery Console

If a computer won't start and you haven't installed the Recovery Console as a startup option, you can start the computer and the Recovery Console by completing the following steps:

Insert the Windows Server 2003 CD or the first setup boot disk into the appropriate drive, and then restart the computer. When booting from a floppy disk, you'll need to remove and insert disks when prompted.
When the Setup program begins, follow the prompts, and then choose the Repair Or Recover option by pressing R.
If you haven't already done so, insert the Windows Server 2003 CD into the appropriate drive when prompted.
Choose Recovery Console by pressing C. When prompted, type the local administrator password.
When the system starts, you'll see a command prompt into which you can type Recovery Console commands. Exit the console and restart the computer by typing exit .

Recovery Console Commands

The Recovery Console is run in a special command prompt. At this command prompt, type HELP to list all available commands.

The commands you'll use most often are ATTRIB, NET, FIXBOOT, FIXMBR, and EXIT. ATTRIB changes the attributes of files. You could, for example, change a read-only file to read/write. Windows Server 2003 allows you to map to a shared folder on another system using the NET command. You could then transfer files to or from the remote system.

The FIXBOOT and FIXMBR commands can get you out of real jams. These commands can resolve problems with the boot sector and the master boot record on Master Boot Record drives. Once you've made any necessary changes or repairs , use the EXIT command to exit the console and restart the computer.

Deleting the Recovery Console

If you installed Recovery Console as a startup option and no longer want this option to be available, you can delete the Recovery Console. To do that, follow these steps:

Start Windows Explorer, and then select the hard disk drive on which you installed the Recovery Console. This is normally the boot drive.
From the Tools menu, select Folder Options.
In the View tab, select Show Hidden Files And Folders, and then clear the Hide Protected Operating System Files check box. Click OK.
The right pane should show the root directory for the boot drive. Delete the Cmdcons folder and the Cmldr file.
Right-click the Boot.ini file, and then click Properties.
In the Properties dialog box, clear the Read-only check box. Then click OK.
Open Boot.ini in Notepad. Then remove the startup entry for the Recovery Console. The entry looks like this:
```
 C:\CMDCONS \BOOTSECT.DAT="Microsoft Windows Server 2003 Recovery  Console " //cmdcons 
```
Save the Boot.ini file and then change its property settings back to read-only. Once deleted, the Recovery Console is no longer listed as a startup option. You can reinstall the console if you need to at a later date or run the console as described in the "Starting the Recovery Console" section of this chapter.