Shadow Copies

The idea behind Shadow Copies is awesome : preserve some number of copies of the user's precious files on the server. When the user performs a CLM (Career-Limiting Move) by deleting a file or overwriting a file with data that cannot be undone, they can simply get that file back from a point in time. Microsoft's code name for this feature was "Time Warp," and I think that pretty much says it all.

Technically, the system doesn't precisely store "copies" of a file. Really, this current magic preserves a "point-in-time" copy of a filenot a copy of all the bytes that compose the entire file. Sometimes, this magic is referred to as "Snapshots," though, technically again, it's not a direct bitwise snapshot of the file.

This feature only works when the files are stored on a Windows 2003 server. However, the clients can be either Windows 2000 or Windows XP. You must take care of two tasks before the user can use Shadow Copies:

• Set up the Windows 2003 server to start creating these snapshots.

• Deliver the Shadow Copies client piece to the desktops. You need to do this for Windows 2000 and Windows XP (pre-SP2). The Shadow Copies client piece is already integrated into Windows XP/Service Pack 2.

So, let's do that now.

Setting Up Shadow Copies on the Server

Shadow Copies works because you're making a point-in-time copy of the users' data files, which preserves them in case of a future calamity. The best place to do this is on the volume to which you've redirected My Documents. However, first you need to ask yourself several questions:

• How much junk, I mean, data, are my users taking up on each drive on the server?

• How much more space on this drive am I willing to cordon off to preserve previous versions of files?

• How often do I want to take a snapshot to preserve user data?

Once you answer these questions, follow these steps:

1. Right-click a drive letter on a server and choose Properties from the shortcut menu to open the Properties dialog box, as shown in Figure 11.1.

2. Click the Shadow Copies tab, select a drive letter, and click the Settings button to open the Settings dialog box, as shown in Figure 11.2.

Figure 11.1: You set the Shadow Copies characteristics on a per-volume basis.

Figure 11.2: You can specify how much space to dedicate when files change, set a schedule to make Shadow Copies, and specify where to locate the storage area.

Here you can specify how much space you want to set aside for this particular volume. My recommendation is to set aside about 20-30 percent. The point of Shadow Copies isn't to keep backup copies of all user files forever; rather, similar to the Offline Caching mechanism, user files that get old will be flushed out of this space to make room for new files. Although Shadow Copies is a great preventive measure, it's not a substitute or replacement for general backups should the file turn out not to be available for restores

1. In the Use Limit spin box, specify the size , and then click the Schedule button to open up the Schedule tab for the volume.

2. The Schedule tab is pretty self-explanatory. You might just wish to leave the defaults for now. When ready, press OK to confirm a changed schedule, or press Cancel to return to the Settings tab. Click OK or Cancel again to return to the Properties tab.

The default schedule for any enabled volume is at 7:00 A.M. and 12:00 P.M. workdays (Monday through Friday). The idea is that you'll snag points in time of the data before the workday begins and again at the halfway point in the workday . If a user screws up and deletes a file, you've got at least two potentially restorable files from just today! If you have even more space available, you can store days or weeks of restorable data! Set the schedule however you want, but note two things.

• Shadow Copies keeps a maximum of 64 previous versions of a file. Every time you take a snapshot, you're potentially dumping older files. The default schedule is usually pretty good for most organizations; it's estimated that it should provide about a month's worth of previous versions.

• The server will be hammered for a bit while the Shadow Copy snapshot is being made Consequently, taking multiple snapshots during the day might not be such a hot idea. Therefore, you might want to perform fewer snapshots, say, once a day.

Delivering Shadow Copies to the Client

Once you set up the server, you're ready to deploy the client piece. If your clients are already on Windows XP/Service Pack 2, they have got the client piece built in, and you can skip this section.

The good news is that the Shadow Copy client is valid for Windows XP (pre-SP2) and Windows 2000. Although a version of the Shadow Copies client is on the Windows 2003 Server CD, it's better to download the update, which you'll find at www.microsoft.com/windowsserver2003/downloads/shadowcopyclient.mspx .

To do the deployment, simply take what you learned in the previous chapter and use it to your advantage:

• Share the file out on a shared folder or Dfs.

• Round up the computers you want to get the Shadow Copy client into an OU.

• Create a GPO, link it to the OU, and then use GPSI to deploy the .msi file

Figure 11.3 demonstrates how to assign the application to your Windows 2000 and Windows XP computers.

Figure 11.3: You can simply use GPSI to deploy the Shadow Copy client to your Windows 2000 and Windows XP (pre-SP2) machines.

Restoring Files with the Shadow Copies Client

Before you can restore a file, the data must be shadow copied at least once, changed, and then shadow copied again. This process maintains a point in time of the volumein its changed state and ready to be reverted to a previous version or restored if it was deleted altogether.

Reverting to a Previous Version of a File

Oftentimes, users inadvertently overwrite their documents with data. As a result, you have now given them the ability to revert to a previous version of the file. To do so, users follow these steps:

1. Open the My Documents folder, and right-click any file and choose Properties from the shortcut menu to open the Properties dialog box, as shown in Figure 11.4.

2. Click the Previous Versions tab.

3. Select the version you want, and can then click View, Copy, or Restore:

   • View Clicking View launches the program associated with the file type, and you can view the file. You might be able to make temporary changes in the document, but you cannot save them back to the same place on the server as the original document. You can do a Save As and save the file somewhere else.

   • Copy You can copy the file to an alternate location. A popular location is the desktop, but any locations that users have access to are equally valid.

   • Restore The title of this button is sort of a misnomer. When I think of the word Restore , I think of restoring a deleted file, but the file needn't be fully deleted in order to use this option. Clicking this button will cause the selected file to revert to the previous version. Note, however, that it will overwrite the current version. So, use this Restore button with caution, because any changes in the document since a Shadow Copy was performed are deleted.

Figure 11.4: After at least one change is preserved, users can revert to a point-in-time file.

Restoring a Previous Version of a File

If a user actually deletes a copy of a preserved file you or they can restore it. Since we're using Shadow Copies on the volume that houses our redirected My Documents, we can leverage this magic. Simply right-click the user's My Documents folder, choose Properties from the shortcut menu to open the Properties dialog box, and click the Previous Versions tab, as shown in Figure 11.5.

Figure 11.5: You can restore the entire contents of the folder, or just use View to drag and drop the file to be restored to an alternate location.

You'll have the same three options as before: View, Copy, or Restore. My suggestion is to select View and then drag the file you need to the intended location. Restore is quite dangerous, actually. It will restore the entire contents of the folder upon the live copy. This is not a good idea. Clicking Copy copies the entirety of the folder to a specific location; this is not all that useful either, as the user might not want to restore the entirety of the point in time of the folder.

Shadow Copies completes the circle of user data protection. Without it, the only data protection (other than normal, regularly scheduled backups) is Offline Files. Offline Files is a good piece of technology, but ultimately not enough if the data on the server is deleted or inadvertently overwritten.