Tivoli Storage Manager Recovery Techniques Using Windows Preinstallation Environment (Windows PE)

By Jason Basler, Mike Dile, Don Moxley, Jey Somaskanthan, Evan Chiu Version 2.0

Copyright Notice

Copyright IBM Corporation 2005. All rights reserved. May only be used pursuant to a Tivoli Systems Software License Agreement, an IBM Software License Agreement, or Addendum for Tivoli Products to IBM Customer or License Agreement. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual, or otherwise, without prior written permission of IBM Corporation. IBM Corporation grants you limited permission to make hardcopy or other reproductions of any machine-readable documentation for your own use, provided that each such reproduction shall carry the IBM Corporation copyright notice. No other rights under copyright are granted without prior written permission of IBM Corporation. The document is not intended for production and is furnished “as is” without warranty of any kind. All warranties on this document are hereby disclaimed, including the warranties of merchantability and fitness for a particular purpose.

U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corporation.

Trademarks

IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, Cross-Site, NetView, OS/2, Planet Tivoli, RS/6000, Tivoli Certified, Tivoli Enterprise, Tivoli Enterprise Console, Tivoli Ready, and TME are trademarks or registered trademarks of International Business Machines Corporation or Tivoli Systems Inc. in the United States, other countries, or both.

Lotus is a registered trademark of Lotus Development Corporation. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. C-bus is a trademark of Corollary, Inc. in the United States, other countries, or both. PC Direct is a trademark of Ziff Communications Company in the United States, other countries, or both and is used by IBM Corporation under license. ActionMedia, LANDesk, MMX, Pentium, and ProShare are trademarks of Intel Corporation in the United States, other countries, or both. For a complete list of Intel trademarks, see http://www.intel.com/sites/corporate/trademarx.htm. SET and the SET Logo are trademarks owned by SET Secure Electronic Transaction LLC. For further information, see http://www.setco.org/aboutmark.html. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries.

Other company, product, and service names may be trademarks or service marks of others.

Notices

References in this publication to Tivoli Systems or IBM products, programs, or services do not imply that they will be available in all countries in which Tivoli Systems or IBM operates. Any reference to these products, programs, or services is not intended to imply that only Tivoli Systems or IBM products, programs, or services can be used. Subject to valid intellectual property or other legally protectable right of Tivoli Systems or IBM, any functionally equivalent product, program, or service can be used instead of the referenced product, program, or service. The evaluation and verification of operation in conjunction with other products, except those expressly designated by Tivoli Systems or IBM, are the responsibility of the user. Tivoli Systems or IBM may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to the IBM Director of Licensing, IBM Corporation, North Castle Drive, Armonk, New York 10504-1785,

U.S.A.

iii

About the Tivoli Field Guides Sponsor Tivoli Customer Support sponsors the Tivoli Field Guide program.

Authors Those who write field guides belong to one of these three groups:

Tivoli Support and Services Engineers who work directly with customers

Tivoli Customers and Business Partners who have experience using Tivoli software in a production environment Tivoli developers, testers, and architects

Audience The field guides are written for all customers, both new and existing. They are applicable to external audiences including executives, project leads, technical leads, team members, and to internal audiences as well.

Types of Field Guides Two types of Tivoli Field Guides describe how Tivoli products work and how they are used in real life situations:

Field Guides for technical issues are designed to address specific technical scenarios or concepts that are often complex to implement or difficult to understand, for example: endpoint mobility, migration, and heartbeat monitoring. Field Guides for business issues are designed to address specific business practices that have a high impact on the success or failure of an ESM project, for example: change management, asset Management, and deployment phases.

Purposes The Field Guide program has two major purposes:

To empower customers & business partners to succeed with Tivoli software by documenting and sharing product information that provides accurate and timely information on Tivoli products and the business issues that impact an enterprise systems management project To leverage the internal knowledge within Tivoli Customer Support and Services and the external knowledge of Tivoli customers and Business Partners

Availability All completed field guides are available free to registered customers and internal IBM employees at the following Web site:

http://www.ibm.com/software/sysmgmt/products/support/Field_Guides.html Authors can submit proposals and access papers by e-mail:

mailto:Tivoli_eSupport_Feedback@us.ibm.com

1

Table of Contents INTRODUCTION .......................................................................................... 3

HARDWARE/SOFTWARE REQUIREMENTS........................................... 5

PREPARATION OVERVIEW ...................................................................... 6

Obtaining the WinPE Client ......................................................................................................... 6 Preparing a Network Share Containing the TSM Client .............................................................. 6 Including TSM in Bart PE............................................................................................................. 8 Creating the Backup .................................................................................................................... 8 Document the System Disk Partitioning .................................................................................... 10

RESTORE PROCEDURE OVERVIEW ..................................................... 12

RESTORING A WINDOWS SYSTEM (NOT A DOMAIN CONTROLLER) USING INCREMENTAL IMAGE RESTORE............... 13

RESTORING A WINDOWS 2000 SERVER DOMAIN CONTROLLER. 14

RESTORING A WINDOWS NT SYSTEM ............................................... 17

RESTORING A SYSTEM WITH A DYNAMIC BOOT VOLUME ......... 18

QUESTIONS AND ANSWERS .................................................................. 19

DIAGNOSTIC TIPS..................................................................................... 20

REFERENCE INFORMATION .................................................................. 21

Tivoli Storage Manager Recovery Techniques Using Windows Preinstallation Environment (Windows PE) Audience

This field guide is intended for storage administrators and skilled technical support personnel who need to recover Windows 2000, Windows XP and Windows 2003 systems from a catastrophic system or hardware failure. The guide assumes technical proficiency with installation, configuration, and use of Windows systems with the Tivoli Storage Manager (TSM) Backup-Archive client.

2

1 Introduction The current Windows bare metal restore (BMR) procedures using Tivoli Storage Manager (TSM) are dependent on Microsoft Automated System Recovery (ASR) or on having a functioning operating system from which to run the backup/archive client. Installation of this base operating system as a pre-requisite to performing system recovery can be time consuming. An alternative method is to copy a base operating system from an image, rather than running through the full Windows installation procedure. In the past, third party imaging utilities such as Symantec’s Ghost™ have been required to perform the image copy. Using Microsoft Windows Preinstallation Environment (WinPE) or Nu2 Production’s Bart's Preinstalled Environment (BartPE), the image backup / restore facility in TSM can now be used for creating and recovering from an operating system image. In addition, for certain platforms, the Logical Volume Snapshot Agent (LVSA) in TSM can be used to allow online image backups (hot backups) to be taken. When combined with traditional incremental backup, and system object backup, a very fast system recovery scenario becomes possible in situations where you are restoring to identical hardware.

The preinstallation environment provides a temporary operating system which is bootable from a CD and provides access to the volumes on a system's hard disk drives. Network connectivity configured through DHCP is also available after booting, so the TSM client program can be executed from a network drive, and network restores from a TSM server are possible. Because the preinstallation environment runs directly from the CD, the local drives are unlocked and treated simply as additional data drives. Any operating system installed on the disk volumes or which is restored using TSM is not loaded while the preinstallation environment is running. For this reason, the operating system installed on the local disk, and the operating system which runs in the preinstallation environment have no interaction. This enables scenarios such as recovering a Windows 2003 operating system using a preinstallation environment based on the Windows XP operating system. The term WinPE is used throughout the remainder of the document to refer to a booted preinstallation environment using either WinPE or BartPE.

Note that BartPE can be a useful alternative to WinPE, however, you need to carefully review the Microsoft licensing discussion on the www.nu2.nu website and your specific Microsoft EULA before using it at your site.

The following table summarizes the TSM image backup and restore methods in conjunction with WinPE that are available for various Windows operating systems:

3

Table 1: TSM image backup and restore methods for different versions of Windows operating systems

Windows NT41

Windows 2000

Windows XP 32-bit

Windows 2003 32-bit

Windows XP/2003 x64

Windows XP/2003 IA-64 2

TSM online image backup using LVSA

No Yes Yes Yes No No

TSM offline image backup from WinPE

Yes Yes Yes Yes Yes No

TSM image restore running in WinPE

Yes Yes Yes Yes Yes No

What’s New for TSM 5.3.0:

• Support for single drive online-image backup • Support for recovery with preinstallation environments created using Bart's PE Builder • Redirection of the error log to a writable media to bypass error log restriction

TSM image restore commands specify a destination volume using a drive letter. Under certain situations WinPE will map volumes to different drive letters than the system from which the backup was performed. For this reason, it is important to collect information on the volume layout at the time of backup, and compare it to the layout presented by WinPE to ensure that your volume target during restore is correct. The image backup feature of TSM can backup FAT, FAT32, and NTFS volumes. When backing up NTFS volumes, the TSM client only sends used regions of the volume to the TSM server by default. To help keep track of disk layout and mapping for Windows versions other than NT 4.0, you can either use DSMC QUERY SYSTEMINFO or run MSINFO32 from C:\Program Files\Common Files\Microsoft Shared\MSInfo. Using WinPE to restore volume images to different hardware is not supported. See the Questions and Answers section for more details.

1 Image backup is performed offline from WinPE. TSM image backup is not supported under NT 4.0

2 WinPE recovery using TSM has not been tested on Windows 64bit operating systems running on Itanium. You can make a 64-bit version of WinPE. Consult the OPK User’s Guide for specific instructions on creating a 64-bit version of WinPE. Furthermore, TSM online image backup is not available with 64bit versions of Windows, so only offline image backup from WinPE will be supported in a 64-bit environment.

4

2 Hardware/Software Requirements Hardware:

There are currently no known hardware limitations. In some cases, hardware drivers needed for disk controllers and network adapters may not be available in the base version of WinPE or the Windows CD used to build BartPE.3

TSM:

• A TSM Windows client at V5.2.2 or newer is required for running within WinPE

• A TSM Windows client at V5.1.x is required for performing backups on Windows NT4, however, the V5.2.2 client is required for performing image backup and restore operations of these systems from within WinPE.

• A TSM server at a 5.1.x or newer level is required for support of TSM image backup. If you are backing up Windows 2003 systems including system state and system services, then a TSM server at a 5.2.2 or newer level is required.

• A second Windows system is required for sharing the TSM client application for execution within WinPE. If you have included TSM in your preinstallation CD, this is not required.

• A minimum of two volumes (disk partitions) is required in order to use the TSM LVSA for online image backup if you are using a V5.2.x client.

• The option -asrmode=yes is required when running TSM commands in WinPE environments built from Windows 2003. The -asrmode option is used to prevent TSM from invoking the Microsoft VSS services which are not available while running WinPE. Without this option, the TSM client will fail to start.

WinPE:

A bootable WinPE CD is required. A DHCP server is required on your network to allow a network address to be assigned to your system when booting from WinPE.

Recovery of the following Microsoft operating systems has been tested:

• Windows NT 4.0

• Windows 2000

• Windows XP

• Windows 2003

5

3 Consult the OPK User’s guide for information on how to include additional device drivers in your pre-installation environment. For BartPE, consult the website for information on how to include additional drivers when building.

BartPE:

A bootable BartPE CD is required. A DHCP server is recommended by not required as a static network address may be used.

Recovery of the following Microsoft operating systems has been tested:

• Windows 2000

• Windows XP

• Windows 2003

You should test WinPE with your hardware to ensure that it will work before you are faced with a situation requiring a restore.

3 Preparation Overview Obtaining the WinPE Client

The following web site contains information on how Microsoft Software Assurance customers can obtain Windows PE:

http://www.microsoft.com/licensing/programs/sa/support/winpe.mspx

Obtaining the BartPE Client

The following web site contains information on how to download and build the CD from your Windows installation media:

http://www.nu2.nu/

Preparing a Network Share Containing the TSM Client

These procedures assume you are using the standard Microsoft Windows OEM Preinstallation Kit (OPK) CD provided by Microsoft. For this reason, the TSM client program must be accessed from a network drive. Alternatively, you can bundle the TSM client into your WinPE CD using Microsoft's OPK custom WinPE image build procedures. If you are using BartPE, a custom plug-in can be created to include the TSM client when the CD is built rather than using a network drive. To configure the TSM client to run from a network share, copy the TSM Client installation package directory from the TSM desktop clients CD into a shared folder. You can also run the self-extracting installation FTP package of the TSM Windows client. If you are extracting from the FTP oackage, cancel the install when the language selection prompt appears. The extraction will then be complete.

6

The following instructions can be used to configure the TSM client to run from a network share:

1. Create a shared folder on your system, for example, c:\tsmshare. C:\>md c:\tsmshare C:\>net share tsmshare=c:\tsmshare

2. Extract the TSM client from the FTP package but do not install the TSM client. If you have a TSM client CD, the files are already extracted on the CD. Copy the installation files into c:\tsmshare. This should result in the TSM client program files residing in the folder: c:\tsmshare\Program Files\Tivoli\TSM\baclient

3. Create a file named tsmwinpe.cmd which will establish the environment needed to run TSM from the shared drive. You can choose to map the TSM share to a different drive letter. The required commands can be entered into a WinPE command prompt, or stored in a file on a floppy disk so that it will be available from the system running WinPE. Here is an example of the file contents: net use z: \\yourmachine\tsmshare set path=%path%;z:\system32;z:\program files\tivoli\tsm\baclient set path=%path%;z:\program files\tivoli\tsm\baclient\plugins z: cd \program files\tivoli\tsm\baclient

4. Create a TSM options file containing the correct nodename and communication settings in the baclient folder created by the extraction in step #2.

Sample dsm.opt: c:\tsmshare\Program Files\Tivoli\TSM\baclient\dsm.opt * communication settings tcpserveraddr firebat.storage.sanjose.ibm.com tcpport 1500 nodename winpetest passwordaccess prompt * compression settings; uncomment if desired *compression yes * performance tuning options txnbytelimit 25600 tcpnodelay yes tcpbuffsize 32 tcpwindowsize 63 * redirect the error log errorlogname a:\dsmerror.log

Note that if you are using the 5.3.0 client or newer, you will need to specify the location of the error log for the client to run correctly. It is recommended that the errorlogname option be set in your option file to point to the floppy drive. Alternatively, you can also specify the error log location in your batch file by setting the DSM_LOG environmental variable or allow for write permissions in the shared network folder.

7

Also note that offline image backup while booted to WinPE will fail with an error unmounting the volume if the dsmerror.log is written to the volume you are attempting to backup.

Including TSM in Bart PE

The Bart PE website contains detailed instructions on how to create a custom plugin to include any application on your CD. Please consult their website for specific information. The TSM client setup files can be used as the source files. When specifying what files to copy into your CD, be sure to include the files in the System32 folder along with the baclient folder.

Creating the Backup

Offline TSM Image Backup:

An offline backup is performed after booting to WinPE, which ensures that the system drive will be backed up in a consistent and offline state. This procedure has the disadvantage of requiring a shutdown of the machine to be backed up, but is useful for creating a volume-level recovery image. This procedure is also the only backup option available for systems running Windows NT 4.0.

By default, TSM image backup skips empty regions of a volume when backing up NTFS volumes. If you are backing up a non-NTFS file system or if you want to minimize the stored image size on the TSM server, consider turning on the TSM compression option for efficiency. After performing the image backup, you can use standard TSM incremental backup and system object backup to protect the latest state of your operating system. Optionally, you can periodically repeat the offline image backup procedure to create a more current backup.

The following outlines the procedure used to perform an offline image backup from WinPE. If your system files are on more than one file system, you will need to perform image backups for each drive on which the system files reside.

1. Shutdown the system to be backed up

2. Boot from your WinPE CD

3. Run the tsmwinpe.cmd command script to set the required environment variables to run the TSM client from a network share.

4. Confirm which drive letter WinPE has assigned to the system drive of the operating system to be backed up. Use the “list volume” command in diskpart.exe to determine this. If there is no drive letter assigned to the system drive of the operating system to be backed up consult the diskpart.exe documentation to determine how to assign a drive letter to a selected volume.

5. Perform the TSM image backup. Note that the file space created on the TSM server will use the current system generated machine name in the file space name on the TSM server used to store the image backup. You can run “dsmc query image” to determine the image backup file space name. Z:\>dsmc.exe backup image c: -imagetype=static -asrmode=yes

6. Reboot the machine without the WinPE CD in the drive.

8

Online TSM Image Backup:

Online image backup uses the TSM client LVSA feature to allow the image backup to be performed while your operating system is running.4 After performing the image backup, scheduled incremental and system object backups will protect the current state of your operating system. Optionally, you can periodically perform additional image backups to reduce the number of files that will need to be restored in addition to the image restore. The following steps outline the general procedure required for performing an online image backup (note this procedure assumes that your system drive is contained on c:)

1. You will need at least two volumes accessible to your operating system to perform online image backup if using a 5.2 client. The second volume is used for storing the TSM LVSA cache. If you do not have a second volume available, you will need to perform offline image backup. If you are using a 5.3 client, the TSM LVSA cache can be stored on the same volume being backed up.

2. Install the TSM online image backup feature if it is not already installed.

3. If you are using a 5.2 client, override the default value for the SNAPSHOTCACHELOCATION option in the dsm.opt file so that the cache will be stored on a drive other than your system drive.

4. Perform a full volume incremental backup of your system drive. This step is required if you would like to have the option of performing an incremental image restore with the -deletefiles option. The -deletefiles option automatically removes files which were included in your original image backup, but were subsequently deleted from the operating system. You might also want to perform online image and incremental backups of other drives on your system. dsmc incremental c:

5. Perform an online image backup of the system drive. If TSM has difficulty creating a snapshot of your system drive, you might need to vary the -snapshotidletimeout and -snapshotidleretries options to decrease the amount of idle time expected by TSM and/or increase the number of snapshot retries attempted by TSM. Also, any services or applications that access the drive, like the TSM Journal Service, will need to be stopped for the snapshot to complete successfully. dsmc backup image c: -imagetype=snapshot

6. Perform an incremental backup of the system drive. This step should be repeated as frequently as your backup policies require. Consider defining this backup to be performed by the TSM scheduler. You should also back up the system objects for your system. These backups will allow you to restore your system to its most recent state following the TSM image restore. dsmc incremental c: dsmc backup systemobject

9

4 TSM online image backup performs a back up based on a snapshot of the OS while it is running. There is a chance that the snapshot will be taken at a point in which the operating system is in an inconsistent state that will not boot at recovery time. Be sure to have also documented and tested procedures for recovery using the reinstallation of the OS technique as a backup plan. You also need this backup plan in the event you are not restoring to identical hardware.

7. Repeat the previous step as frequently as required for your backup policies. Optionally, you can periodically repeat step #5, to create a more current image level backup.

Document the System Disk Partitioning

Document your system disk configuration using DISKPART.EXE prior to performing a backup. The diskpart program is available if you are running Windows XP or 2003. If you are running Windows 2000, you can either copy it from another system running XP or 2003, or you can boot to WinPE and run diskpart. You can find documentation for the diskpart utility on the microsoft.com website. For example:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/diskpart.mspx

Consider printing the documentation of your disk configuration and keeping it near your system in the event a restore becomes necessary. You can also keep track of disk layout and mapping using either DSMC QUERY SYSTEMINFO or MSINFO32 from C:\Program Files\Common Files\Microsoft Shared\MSInfo. Use the following procedure to document the disk configuration using diskpart.exe:

1. Create a file named diskpart.in containing the following lines. Update the script as needed depending on the number of physical disks in your system. list disk list volume select disk 0 list partition select disk 1 list partition

2. Run the diskpart.exe command with the /s switch, and direct the output into a file named diskpart.txt: diskpart /s diskpart.in > diskpart.txt

Example output:

10

Microsoft DiskPart version 1.0 Copyright (C) 1999-2001 Microsoft Corporation. On computer: WINPETEST DiskPart is starting the disk management services. Disk ### Status Size Free Dyn Gpt -------- ---------- ------- ------- --- --- Disk 0 Online 34 GB 0 B Disk 1 Online 34 GB 0 B Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- Volume 0 H CD-ROM 0 B Volume 1 C NTFS Partition 6997 MB Healthy System Volume 2 D WinXP NTFS Partition 6997 MB Healthy Volume 3 E Win2003NTFS NTFS Partition 6997 MB Healthy Volume 4 F WIN03F32 FAT32 Partition 6997 MB Healthy Volume 5 G Backup NTFS Partition 6715 MB Healthy Volume 6 I GHOST FAT32 Partition 20 GB Healthy Volume 7 J Partition 14 GB Healthy Disk 0 is now the selected disk. Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 6997 MB 32 KB Partition 2 Extended 27 GB 6997 MB Partition 3 Logical 6997 MB 6997 MB Partition 4 Logical 6997 MB 14 GB Partition 5 Logical 6997 MB 20 GB Partition 6 Logical 6715 MB 27 GB Disk 1 is now the selected disk. Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 20 GB 32 KB Partition 2 Extended 14 GB 20 GB Partition 3 Logical 14 GB 20 GB

11

4 Restore Procedure Overview After booting to WinPE on the target machine, you will have access to all of the volumes used by the primary operating system. In the event that you need to replace a damaged disk, you will have access to the disks, but will need to recreate the volumes and in some cases format file systems on them. When restoring TSM image backups, it is not necessary to format a file system before performing the restore since the file system is recovered from the backup. Be sure that the error log is not being written to the drive being restored. Doing so will prevent TSM from dismounting the volume for image restoration. The following procedure lists the general WinPE restore flow. Later sections detail specific considerations for certain system configurations.

1. Boot WinPE on the machine you plan to restore. WinPE should provide a network connection with an address assigned through DHCP.

2. Use diskpart.exe to recreate the volume layout for your system. After the volume layout is recreated, inspect the volume to drive letter mapping presented by WinPE, and correlate this with the mapping used by your initial operating system. There is a possibility that you will need to restore the TSM image backup to a different destination drive letter than the one assigned to the volume at the time the backup was taken. Image restore commands issued from WinPE need to specify the full source backup name in UNC format since WinPE boots with a different machine name than your normal operating system. Here is an example of recreating two partitions on a physical disk, one primary, and one extended. The primary partition will be set to active, to allow the system to boot. Formatting of the first partition is not required, as the image restore will recreate the file system. Formatting the second volume is required since the recovered operating system uses this volume to store swap files, and the file system will need to exist prior to booting the restored system. In general, a volume does not need to be formatted with a file system if a TSM image backup will be restored over the volume. In other cases, the volume should be formatted with the same file system type that existed previously. diskpart.exe

select disk 0 clean create partition primary size=6997 select partition 1 assign letter=C active create partition extended select partition 2 create partition logical size=8192 select partition 3 assign letter=D list volume exit

12

format D: /fs:ntfs /v:swapdisk

3. Using the tsmwinpe.cmd file, map the network share containing the TSM client program code, and set the environment variables required to run the TSM client from the network share. If you have not created this share yet, see the instructions in the section “Preparing a Network Share Containing the TSM Client.” For example, if you are using the tsmwinpe.cmd file on a floppy disk: a:\tsmwinpe.cmd

4. Restore the image backup of your system volume. There are several variations of this restore command that are detailed in upcoming sections. The most basic restore variation is given here. Note that the use of the -ASRMODE=YES option is required to bypass the attempted initialization of the Volume Shadowcopy Services (VSS) subsystem which is not present in a Windows Server 2003 WinPE environment. The query image command can be used to determine the full name of the image backup object to restore, and to test your connectivity to the TSM server. The -virtualnode option is not required if you have specified the correct nodename option in the dsm.opt file. Passwords generated by TSM are not available when running in WinPE, so the -virtualnode option also prevents unsuccessful attempts to store the TSM password in the Windows registry. dsmc query image -asrmode=yes -virtualnode=tsmnodename dsmc restore image \\backupmachinename\c$ c:\ –asrmode=yes –virtualnode=tsmnodename

5 Restoring a Windows System (not a Domain Controller) Using Incremental Image Restore The following procedure describes how to recover a Windows 2000, XP, or Server 2003 system. This procedure assumes that your backup followed the correct procedure to allow for incremental image restore using the -deletefiles option, and that you have performed system object backups. This restore method allows you to bring your system back to its most current backup state. The default Windows directories are used in this procedure. In the event that your Windows installation is not in the default location, modify the path appropriately. You can determine where your Windows directory is by looking at the SystemRoot environmental variable.

1. Perform the restore preparation steps outlined in the “Restore Procedure Overview” section excluding the restore image step.

2. Run query image to determine the machine name and drive letter of the image backup dsmc query image -asrmode=yes -virtualnode=tsmnodename

13

3. Restore the system drive image backup, including more recently backed up files from the system drive incremental backup. The -deletefiles options will remove any files that were restored from the image backup, but were deleted from your system after the image backup was taken. dsmc restore image \\backupmachinename\c$ c: -asrmode=yes -noprompt -incremental -deletefiles -virtualnode=tsmnodename

4. Reboot to the restored operating system. 5. Restore the SFP catalog files from the system object first.

Win2000: dsmc restore “{SYSTEM OBJECT}\winnt\system32\CatRoot\*” c:\winnt\system32\ -subdir=yes -replace=all WinXP: dsmc restore “{SYSTEM OBJECT}\windows\system32\CatRoot\*” c:\windows\system32\ -subdir=yes -replace=all Win2003: dsmc restore group "{SYSTEM STATE}\SYSSTATE" c:\systemp\ -showmembers -preservepath=complete -replace=all xcopy /h /s /y c:\systemp\SYSFILES\WINDOWS\system32\CatRoot\* c:\system32\CatRoot\ rmdir /s /q c:\system

6. Restore the entire system object.

Win2000/XP: dsmc restore systemobject Win2003: dsmc restore systemstate dsmc restore systemservices

7. Reboot without the WinPE CD.

6 Restoring a Windows 2000 Server Domain Controller The following restore procedure is specific to the test configuration documented below. It can easily be adapted for a domain controller with a different disk layout or a different operating system such as Windows 2003. Test configuration:

1. IBM eServer xSeries 345, with 2 SCSI hard disks 2. First disk is a basic disk, with C: as system/boot partition containing c:\winnt 3. Second disk is a dynamic disk with three simple volumes on D:, E:, and F: 4. NTDS database contained on D:\NTDS\DB 5. NTDS log contained on E:\NTDS\LOG 6. SYSVOL contained on F:\SYSVOL 7. Win2000 advanced server installed, with SP3 and latest security hot fixes as of

02/27/2004

14

8. Configured as a peer domain controller in a domain with two pre-existing domain controllers

Backup steps:

1. Perform an all-local domain incremental backup which includes backups of c:, d:, e:, f:, and system objects. dsmc inc

2. Perform an online image backup of the system drive c: dsmc backup image c:

3. Repeatedly perform the all-local domain incremental backup including system objects as required by your backup policy.

Restore procedure with two new hard disks on identical system: The restoration procedures are performed on an identical system with two replacement hard disks of equal capacity as the original hard disks that were backed up.

1. Boot the system from a Windows PE CD. 2. Reconstruct the partitioning of each disk. Note: when assigning drive letters to the newly

created volumes, be sure not to assign the same letter which is being used by WinPE for the CD device. The letter assignments made while WinPE is running are temporary, and do not reflect the assignments that will be used when the primary OS is booted. In this example, WinPE has assigned the drive letter D: to the CD device. The subsequent drive letter assignments in this example avoid the use of D:. diskpart.exe

select disk 0 clean create partition primary size=6997 select partition 1 assign letter=C active select disk 1 clean convert dynamic create volume simple size=10240 assign letter=E create volume simple size=2048 assign letter=F create volume simple size=2048 assign letter=G list volume exit

3. Format file systems on all drives except the system drive

15

format E: /fs:ntfs /v:NTDSDB format F: /fs:ntfs /v:NTDSLOG format G: /fs:ntfs /v:SYSVOL

4. Use the tsmwinpe.cmd to map the network share and set the required environment

variables, then run the query image command to determine the machine name and drive letter of the image backup a:\tsmwinpe.cmd dsmc query image -asrmode=yes -virtualnode=tsmnodename

5. Run the query image command to determine the machine name and drive letter of the image backup dsmc query image -asrmode=yes -virtualnode=tsmnodename

6. Restore the system drive image backup, including more recently backed up files from the system drive incremental backup. The -deletefiles options will remove any files that were restored from the image backup, but that were deleted from your system after the image backup was taken. dsmc restore image \\backupmachinename\c$ c: -asrmode=yes -noprompt -incremental -deletefiles -virtualnode=tsmnodename

7. Reboot the restored operating system into Directory Services Restore Mode. This is accomplished by pressing F8 early in the Windows boot process, and selecting Directory Services Restore Mode from the list that is presented.

8. Since the second hard disk was recreated, Windows will require this disk to be imported, and drive letters to be re-assigned before it can be accessed. Run the Windows disk manager from the computer management console to import the foreign dynamic disk and reassign the appropriate drive letters to the three simple volumes.

9. Restore the SFP catalog files from the system object first. dsmc restore “{SYSTEM OBJECT}\winnt\system32\CatRoot\*” c:\winnt\system32\ -sub=yes -rep=all

10. From Directory Services Restore Mode, recover the remaining data drives and system objects. Do not reboot until after the final step, even if you are prompted to do so. dsmc restore d:\* -sub=yes -rep=all dsmc restore e:\* -sub=yes -rep=all dsmc restore f:\* -sub=yes -rep=all dsmc restore systemobject

11. Reboot and allow Windows to start normally.

16

7 Restoring a Windows NT System 5 Image level backups can be performed against a system running Windows NT 4.0 by bringing the system down and performing the backups from Windows PE. The following procedure was tested against a system running Windows NT 4.0 workstation with service pack 6a. A single IDE hard drive was partitioned with a primary partition and two logical drives in an extended partition. Backup steps

1. Perform a full incremental backup of all local hard disks. This backup should be performed from the running Windows NT operating system, and will require a TSM client at the 5.1 level. dsmc inc

2. Shutdown the Windows NT system, and boot from a CD to Windows PE. 3. From Windows PE, back up each of the file systems using offline image backup

a:\tsmasr.cmd dsmc backup image c: -asrmode=yes -imagetype=static dsmc backup image d: -asrmode=yes -imagetype=static dsmc backup image e: -asrmode=yes -imagetype=static

4. Restart the Windows NT operating system. 5. Repeatedly perform additional incremental backups as required by your backup policy. 6. Optionally, you can periodically repeat the offline image backups from Windows PE.

Restore procedure with a new hard disk, on identical system:

1. Boot the system from a Windows PE CD. 2. Reconstruct the partitioning on the new disk. Note: when assigning drive letters to the

newly created volumes, be sure not to assign the same letter used by the CD device. The letter assignments made while WinPE is running are temporary, and do not reflect the assignments that will be used when the primary OS is booted. diskpart.exe

select disk 0 clean create partition primary size=7805 select partition 1 assign letter=C active create partition extended create partition logical size=4542 assign letter=F create partition logical size=298 assign letter=G exit

17

5 Windows NT is extremely sensitive to changed hardware which may result in the restored image not booting.

3. Run the TSM query image command to determine the machine name and drive letter of the image backups. Take note of the backup date/time of the image backup for each drive. This information will be needed later. a:\tsmwinpe.cmd dsmc query image -asrmode=yes -virtualnode=tsmnodename

4. Restore each of the image backups. You will need to use the correct machine name matching that shown in the output of query image. Also, care must be taken to restore to the correct destination drive letter. dsmc restore image \\minint-ttbkbk\c$ c: -asrmode=yes -noprompt -virtualnode=tsmnodename dsmc restore image \\minint-ttbkbk\d$ e: -asrmode=yes -noprompt -virtualnode=tsmnodename dsmc restore image \\minint-ttbkbk\e$ f: -asrmode=yes -noprompt -virtualnode=tsmnodename

5. Reboot the machine.

6. Restore files from the file level incremental backups that were backed up after the date of the image backup. The date and time to be entered should match the backup date / time of the image backup which was restored. dsmc restore c:\* -sub=yes -rep=all -fromdate=03/02/2004 -fromtime=00:00:00 dsmc restore d:\* -sub=yes -rep=all -fromdate=03/02/2004 -fromtime=00:00:00 dsmc restore e:\* -sub=yes -rep=all -fromdate=03/02/2004 -fromtime=00:00:00

8 Restoring a System with a Dynamic Boot Volume Windows operating systems beginning with Windows 2000 support an enhanced disk format referred to as a dynamic disk. It is possible to convert a system disk from a basic disk to a dynamic disk. However, Windows cannot be initially installed on a dynamic disk. When recovering your operating system through Windows PE using TSM, you will need to create a primary partition on a basic disk for restore purposes. After the restore has completed, you can boot into the restored operating system and convert the disk back from basic to dynamic.

9

18

Questions and Answers Q: Why can’t I boot my system drive after running DISKPART? I set the correct partition active.

A: You must use the DISKPART CLEAN command to write the master boot record (MBR) to the disk that you want to boot as the first step in preparing the disk for recovery.

Q: Can I restore Windows system state or system objects using WinPE? A: No. While you may be able to trick TSM into restoring the state information to the target drive via the –machinename option, ultimately the restore will be unsuccessful because the registry merge operation will not be possible. Q: When would I want to use WinPE-based recovery instead of using TSM with Windows ASR?

A: Use WinPE when high speed recovery is needed because of a boot partition file system corruption or catastrophic operating system failure and you are recovering to the same hardware. Use ASR for recovery of a system to new hardware possibly due to disaster recovery at a new site. ASR allows for some hardware differences between the original and the target recovery machine.

Q: How do I customize or configure WinPE so that I can automatically detect different disk controllers, set a specific IP address for a given NIC, etc?

A: Customizing WinPE is outside the scope of this field guide. The intent here is to provide a quick, minimal setup and recovery method for recovery based on an unmodified WinPE base. For information regarding customizing WinPE, consult the Microsoft Windows OEM Preinstallation Kit (OPK) User’s Guide. Or the Microsoft OEM System Builder website http://www.microsoft.com/oem/default.mspx

Q: How do I use WinPE to recover a Windows 64-bit system?

A: The approach used in this paper should be extensible to 64-bit Windows systems, but this procedure has not been tested or verified in the 64-bit environment. Consult the OPK User’s Guide for specific instructions on creating a 64-bit version of WinPE which would be required to perform this task.

Q: Can I use the TSM Backup-Archive client GUI instead of the command line under WinPE?

A: Only if your WinPE CD is based on Windows XP. Since the asrmode option is not available for the GUI, Volume Shadowcopy Service (VSS) initialization can not be bypassed. Also, you must ensure that you have the environment variables established via the tsmwinpe.cmd file as you would have done for the command line client. Since the display color depth and resolution under WinPE is low, the GUI background will appear grainy. You might need to use the keyboard shortcut <alt><spacebar> to display the system menu from which you can select move or size items to allow you to resize the GUI to fit on the reduced size screen. Not all functionality of the GUI is available for use. For example the system state and system service tree items are displayed but are non-functional.

Q: Why does TSM not see my hard disks after I boot into WinPE?

A: TSM can only see a hard drive if your PE environment can see it. Check to make sure your WinPE CD has support for your hard disk controller. If necessary, you can manually specify additional drivers by pressing F6 during the boot process. Consult the OPK User’s guide for

19

information on how to include additional device drivers in your pre-installation environment. For BartPE, consult the website for information on how to include additional drivers when building.

Q: Can I use a 32-bit based WinPE CD with a 64-bit processor?

A: Depending on the hardware, some 64-bit processors have support for 32-bit code. For example, this procedure has been tested with AMD’s Opteron64 and Intel’s Xeon MP 64 processors using a Windows XP SP2 32-bit based CD.

Q: Can I back up and restore an image onto different hardware?

A: It might work, but it has not been tested or verified by the TSM team and is not supported. In general, restoring to similar hardware is more successful than dissimilar hardware. If you have problems booting up the restored image, you will need to perform a Windows Repair Install. Note that this is not a repair of a Windows installation.

10 Diagnostic Tips

1. If the CLEAN subcommand of DISKPART was not issued during the recovery procedure and you cannot boot from the restored image, you might not need to start the recovery procedure from the beginning. If you have a bootable CD of your host operating system, you can boot that CD and enter the recovery console. From the recovery console you can use the FIXMBR command to rewrite the master boot record. This will allow you to boot the active partition.

2. You might see the following error messages in the client error log (dsmerror.log). These are normal when running the client under WinPE. The Volume Shadowcopy Service (VSS) is not available under WinPE and WinPE does not have a registry.

03/22/2004 21:29:14 InitializeVss(): InitializeForBackup() returns hr=E_UNEXPECTED

03/22/2004 21:29:15 ANS1009W An error occurred processing the operating system include/exclude statements.

The error was detected while processing: FilesNotToBackup: RegOpenKeyEx = 2.

03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 .

03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 .

3. If you receive the error message “ANS1287E Volume could not be locked, when backing up or restoring an image,” there might be a process accessing the drive. Be sure that no other programs are reading or writing to the drive you are trying to back up. If the TSM Journal Service is installed, stop the service or remove the drive from the list of journaled file systems. If you are restoring in WinPE, be sure to redirect the TSM error log to another drive.

20

4. You might be able to improve the network performance by manually setting the link speed to your network card’s maximum value instead of using the default auto-detect value. To do so, complete the following steps:

a. Determine the name of your network card, for example, Broadcom NetXtreme.

b. Run regedit.exe and highlight the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key.

c. Click on Edit->Find and search for your card name.

d. Look in each subfolder of the found key (0000, 0001, etc.) for the SpeedDuplex key.

e. The value for the SpeedDuplex key should be set to a number, typically 4 for 100Mbps Full-duplex, as determined by the INF file for your card. See the InfPath key for the location of the associated INF file. The INF file can be found in your Windows/INF folder. The [Speed100.reg] section of the INF file will enumerate the possible values for the SpeedDuplex key.

5. If you are having problems running the TSM Backup-Archive GUI, verify the following settings:

a. Your WinPE CD is based on Windows XP and not on Windows Server 2003. Because the Volume Shadowcopy Service is not available in WinPE, the GUI does not start up properly.

b. The DSM_DIR environmental variable is set to the baclient folder.

c. There is an option file in your baclient folder or the DSM_CONFIG environmental variable points to a valid option file.

d. The System32 folder of the extracted client is in your path.

11 Reference Information Information on the DISKPART utility You can find documentation for the diskpart utility on the microsoft.com website, for example at: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/diskpart.mspx Microsoft OEM System Builder website http://www.microsoft.com/oem/default.mspx Tivoli Field Guide on Using TSM with Microsoft ASR http://www-1.ibm.com/support/entdocview.wss?rs=663&context=SSGSG7&uid=swg27003812&loc=en_US&cs=utf-8&lang=en%20en The following IBM Redbooks supplement the recovery information provided in this guide: Disaster Recovery Strategies with Tivoli Storage Management - SG-24-6844

21

http://www.redbooks.ibm.com/abstracts/sg246844.html Windows NT Backup and Recovery with ADSM – SG-24-2231 http://www.redbooks.ibm.com/abstracts/sg242231.html Deploying the Tivoli Storage Manager Client in a Windows 2000 Environment – SG-24-6141 http://www.redbooks.ibm.com/abstracts/sg246141.html

TechNet Webcast: Windows PE (Level 200), March 2005 http://www.microsoft.com/events/webcasts/library/200503.mspx

End of document

22