Backing Up the Registry Regularly

Backup Utility has come a long way since the original version that shipped with the earliest versions of Windows. Microsoft licenses Backup Utility from VERITAS Software Corporation (http://www.veritas.com), and it's a light edition of the company's Backup Exec. Users of the Microsoft Windows 2000 backup program are already familiar with this version. The user interfaces of the two versions are almost identical, and the steps to back up a computer are almost the same. Like the earlier version of this utility, you can back up to a file, tape, or other removable media. Enterprise users will likely have tape changers to automate a full backup schedule, including tape swapping.

Windows XP makes a few significant enhancements. The first is shadow copy. A volume shadow copy is an exact point-in-time copy of the contents of a hard disk, including open files. Users can continue to access files on the hard disk while Backup Utility backs them up during a volume shadow copy. In this way, it correctly copies files that change during the backup process. Shadow copy ensures that programs can continue to write to files on the volume, open files aren't omitted from the backup, and backing up the system doesn't lock users out.

Backing Up Using Symantec Ghost

I'm a big fan of Symantec Ghost Corporate Edition, which you can learn more about at www.symantec.com. It's the tool I prefer for deploying Windows XP in big environments. It's also useful as a backup utility, and you can use the Personal Edition of Ghost to back up a single computer.

The backup strategy for my home-office network uses both Ghost and Backup Utility. Backup Utility is better at protecting documents than it is at protecting entire configurations. To restore a computer from a backup tape, you first have to install Windows XP on the computer and honestly, it takes as much time to reinstall everything from scratch as it does to restore a good backup. That's why I prefer to protect my configurations using Ghost. After installing Windows XP and all of my applications on a computer, I create an image of the computer's disk on the server. I update that image any time I make a significant change to the computer, such as after installing new applications. If the computer fails, I can start the computer using a Ghost boot disk, restore the disk image, and I'm back up and running. The process takes less than 15 minutes whereas restoring the computer using Backup Utility can take a few hours.

I protect important documents and other important files using Backup Utility. Documents, images, and so on change often enough to make using Ghost to protect those impractical. Thus, I schedule Backup Utility to run each day so that I can restore any of my documents if something goes wrong.

I take this approach one step further by completely separating my configuration from my data. I use Folder Redirection to move users' My Documents folders from their local user profiles to a central location on the network. I back up all users' documents each time I back up their redirected folders on the server. For the most part, then, each computer's configuration is completely replaceable. I can restore its current disk image, log on to Windows XP, and I'm back where I was before the computer failed.

To open Backup Utility, click Start, All Programs, Accessories, System Tools, and then Backup. I have a preference for clicking the mouse as little as possible, so I just click Start, Run, and type ntbackup in the Run dialog box. Backup Utility has a robust set of commandline options you can use to script the backup process; you can learn more about those options in Backup Utility's Help. That's the hard way. The easy way is to schedule a job using Backup Utility, configure options in its user interface, and then copy the command line from Scheduled Tasks. Why spend an hour getting the command line just right when Backup Utility can do that for you?

Note 

To back up a computer's file and folders, users must be in the Administrators or Backup Operators groups. If they aren't in either of those groups, they must have at least read permission on each file and folder they want to back up using Backup Utility. Alternately, you can give users the Back up files and directories and the Restore files and directories rights.

Planning a Backup Strategy

If you're an IT professional in a large enterprise, you already have a backup plan. Many small and home-based businesses go without backup plans or backing up their computers at all, and that's a shame. Unproductive downtime probably hurts small businesses more than it hurts huge enterprises, and they can easily avoid it. Whether you back up your computers using Backup Utility, Symantec Ghost, or any other method, just do it, and do it often.

The first part of a good strategy is rotation. That is, keeping backups around for a period of time so you can restore to any one of them later. For example, you might back up computers once a week and keep each backup set for a month. You'll always have the four most recent backups available. I use tapes and like to keep one set of tapes offsite in case of a disaster (I also store tapes in a fireproof safe, but you never know about those things until you try them). Use a rotation that works for you; on my server, I use the one shown in Figure 3-6 on the next page (backing up individual computers isn't necessary because I store anything I care to save on the server). I don't change my daily backup tapes because one tape holds a full week's worth of changes. That's why I can get away with having only nine sets of tapes. With more users, you might change tapes daily. Here's a summary of what you see in Figure 3-6:

• Monthly Move the most recent full-backup tape offsite (tape 5).

• Weekly Back up the entire server to tape (tapes 1 through 4).

• Daily Back up changed files to tape and mark those files as archived (tapes 6 through 9). The backup set includes system information, users' home folders, documents, mail folders, roaming user profiles, and so on.

Figure 3-6: Normal backup tapes contain all the server's files; incremental backup tapes contain only files that changed since the last normal or incremental backup.

The second part of a good strategy is automation. You'll never stick to your backup plan if you don't automate it. Backup Utility integrates with Scheduled Tasks to schedule backup jobs through its own user interface, so this is easy. You can schedule your own backup jobs in Scheduled Tasks, but the command-line options are a bit intense, so I'd stick to the user interface. If your backup jobs require multiple tapes, as mine usually do, you'll have to be around to swap tapes. Large organizations will want to consider investing in a robotic tape changer or library, if they haven't already invested in large-scale backup technology.

Backing Up System State Data

In Backup Utility, you don't see an option to back up the registry. Furthermore, if you try to back up the hive files in %SYSTEMROOT%\System32\config, you'll fail. Instead, you back up the Windows XP system state data. System state data is the combination of the following system components (a server's system state data includes additional components, including Active Directory data, SYSVOL, and more):

• Registry

• COM+ Class Registration database

• Boot files, including the system files

• System files that are under Windows File Protection

To back up the registry, you have to copy all the system state data. Likewise, in order to restore the registry, you have to restore all the system state data. This makes Backup Utility a less-than-ideal way to back up the registry if that's all you're really trying to accomplish. To back up Windows XP system state data, select the System State check box in Backup Or Restore Wizard, shown in Figure 3-7; or click Only Backup The System State Data in Backup Wizard (yes, they are two different wizards). You can also select the System State check box on Backup Utility's Backup tab.

Figure 3-7: Backup Or Restore Wizard is the default user interface for Backup Utility. If you'd rather use the classic user interface, click Advanced Mode on the first page.

Backup Utility doesn't back up and restore everything on the computer, by the way. The key HKLM\SYSTEM\CurrentControlSet\Control\BackupRestorecontains two interesting subkeys. The first subkey, FilesNotToBackup, contains a list of files and folders that Backup Utility skips. Each value contains a path to skip, and those values often contain wildcards. The second subkey, KeysNotToRestore, contains a list of keys not to restore to the computer. Likewise, each value contains a key to skip, and you see wildcards in many of the values. You'll find few surprises in either subkey. For example, Backup Utility doesn't back up System Restore's restore points because \System Volume Information \_restoreGUID\* is in FilesNotToBackup. It doesn't restore Plug and Play information, either, because CurrentControlSet\Enum\is in KeysNotToRestore.

Restoring System State Data

Restoring system state data from a backup is similar to backing up the system state data in the first place. If all you backed up was system state data, just restore the entire backup. Otherwise, click System State in Backup Or Restore Wizard or on Backup Utility's Restore And Manage Media tab. If you restore the files to the original location, you'll restore your computer's settings, protected system files, boot files, and so on. This is the shotgun approach to restoring system state data from a backup.

Instead of the shotgun approach, the surgical approach is sometimes more appropriate. Restore the files to an alternate location. Backup Utility tells you that it won't restore all system state data to alternate locations, but don't worry; it does restore the registry hive files. Figure 3-8 shows you the contents of system state data as well as how Backup Utility restores the registry to an alternate location. When you restore system state data to a folder, the registry hive files are in the subfolder \Registry. You can load these hive files in Regedit and then copy settings from them to the working registry.

Figure 3-8: Restoring system state data to an alternate location is the best choice if you want to restore a limited number of files or settings.

You don't always have to restore a backup to get at the backup copy of the registry. If the most recent backup contains the settings you want to restore, you'll be happy to know that Backup Utility copies the hive files to %SYSTEMROOT%\repair. Don't try replacing the hive files in %SYSTEMROOT%\System32\config with the backup copies you find in %SYSTEMROOT%\repair—you can't because they're in use by Windows XP. You can load the backup hive files in Regedit to borrow settings from them, or you can start Recovery Console and then copy the backup hive files to %SYSTEMROOT%\System32\config. It's worth pointing out that System Restore does a far better job of restoring your settings than you can.