Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

How to Use Ntbackup

The ntbackup tool can be used for all basic backup processes, including the following:

Immediate or scheduled backup of files to disk, tape, or optical disc

System state backup, the backup of important system files and configuration data

Restore from backup

Restore systems state data

Automated Systems Recovery

Automated Systems Recovery (ASR) is detailed in the section "Automated Systems Recovery" later in this chapter. ntbackup can be used via the backup GUI or at the command line. Backup can be scheduled or scripted. Backup over the network can be configured, but the system state backup must be done locally.

Many excellent third-party products extend the functionality of ntbackup, and you should be sure that the companies that create them understand how Windows Server 2003 operates to ensure that they are able to back up and restore critical system data.

Back Up Files and Folders

To back up files without having the Read, Modify, Full Control, or Owner permission, a user must be a member of either the Administrators or Backup Operators groups or be granted the Backup Files and Folders permission. A member of the Backup Operators group in the domain can back up files on any computer in the domain. Backup rights can be granted to other custom groups, and users with the following rights can also backup a file: Read, Read and Execute, Modify, or Full Control. Administrators and members of the Backup Operators group also have the right to restore backed up data. You can restrict access to specific backups by using the Allow only the owner and the administrator access to the backup data option in the Backup Job Information dialog box before the backup is made.

To do an immediate complete backup of all information on the computer follow these steps:

For additional options, such as scheduling a backup, you must start Backup in Advanced mode. To do so, follow these steps:

One of the most common backup strategies is to make a normal backup on a Sunday, and then either incremental or differential backups every day of the week. If a restore is necessary and incremental backups were made, the normal backup from Sunday and all the incremental backups must be applied to perform a restore. If a restore is necessary and differential backups were made, the Sunday backup and the last differential backup are necessary. This difference is illustrated in Figures 17-4 and 17-5. The backup tapes used for incremental or differential backups are rotated each week, but the normal Sunday backups are usually kept for 30 days, and an end-of-month tape is kept for a year. Tapes that are reused should be periodically replaced with new tapes. Check the manufacturer's instructions to determine the correct replacement timeframe.

NOTE: Incremental or Differential?

Differential backup is often selected because of its conveniencefewer tapes are necessary for a restore. However, if change is volatile, it may take too long to back up all changes every day. In this case, incremental backups are better.

Default Backup options are set from the Tools, Options pages of Backup. The menus are displayed when ntbackup is started in Advanced mode. Table 17-2 lists the advanced backup options.

System State Backup

In addition to backing up applications and files, you must ensure that system state data is backed up. System state backup backs up critical system files and configuration data. These files are necessary to recover a server and must be restored in a certain order. Do not attempt to use a normal file backup to manage system state backup. The following items are always backed up when a system state backup is made:

Registry

COM+ Class Registration database

Boot files

System files that are under Windows File Protection

In addition, the components in Table 17-3 are backed up if the requisite service or application is installed.

To make a system state backup, follow these steps:

The system state data is critical, sensitive information that might allow an attacker to compromise the system. Always ensure the safe storage of the system state data.

NOTE: Skipped File During System State Backup May Be Ok

After backing up the system state, an error may report that some files were skipped. Examine the backup report. If the backup report includes only the error: Warning: unable to open "C:\windows\sysvol\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory", the integrity of the backup is OK according to Microsoft (see KB article 822132). It seems that this file should not be backed up, but under some circumstances, backup may attempt to do so.

Backup Defaults and Configuration Options

It is not necessary to use the backup wizard; instead, many options can be set manually. Select individual tabs to configure the backup:

Welcome tab
Choose the Backup Wizard (Advanced), Restore Wizard, or ASR Wizard.

Backup tab
Select the files to back up. Back up system state data. Select the Tools menu, then select options to open the backup Property pages.

General tab
Change defaults, as shown in Figure 17-7.

Backup Type tab
Change default backup type, as shown in Figure 17-8. (Backup types were detailed in Table 17-1.)

Backup Log tab
Change how much information is added to the log, as shown in Figure 17-9.

Exclude Files tab
Remove files listed to not be backed up. Add files to skip, as shown in Figure 17-10. Excluded files include those that run the volume copy shadow service, pagefile.sys, and so on.

Restore and Manage Media tab
Restore files and folders from backup.

Schedule Job tab
Change or add schedules.

Command-Line Backup

ntbackup can be used to back up at the command line or within a script. You cannot restore files from backup using the ntbackup command. Any option that is not specified in the command line defaults to those set in the backup program. The general form for the command is

Ntbackup backup logical_disk_path_and_file_name /J name_of_the_job /F or_
/Tand_the_filename_or_tape_name_to_put_backup_on

Any options left off the command default to those configured in the backup program.

To create a normal backup named Backup job 2 that backs up the system state data to the D:\systemstate.bkf file, use

Ntbackup backup systemstate /M normal /J "backup job 2" /F "D:\systemstate.bkf"

To set advanced options such as verifying data, using hardware compression or volume shadow copy, use the following syntax. For an explanation, see Table 17-4:

ntbackup backup /V:{yes|no} /HC:{on|off} /SNAP:{on|off}

A complete ntbackup command syntax is located in the local Windows Server 2003 help files.

Here's a sample command that would create the backup job "Backup 1", back up data on drive E:\ to the file D:\mybackup.bkf, and verify the data:

ntbackup backup E:\ /J "Backup 1" /F "D:\mybackup.bkrf" /V:yes

TIP: An Easy Way to Write Backup Commands

To quickly and accurately create a backup command, create a scheduled backup job and then open the Scheduled Tasks control panel. The full command line is displayed in the control panelcopy this command into a batch file and modify if necessary.

Restore Files and Folders

The backup program can also be used to restore files and folders from a backup. To restore individual files or folders, follow these steps:

Alternatively, the Restore and Manage Media tab can be used to restore files and folders:

Restore System State Backup

When you restore system state data, you can restore it to the same location or to an alternative location. If you restore to a different location, some data will not be restored. Specifically, only registry files, SYSVOL directory files, cluster database information, and system boot files are restored. When restoring the system state data to the original location, the current system state data is erased, and the backup is restored. This is the opposite of the default for file backup, which does not overwrite existing files unless the default has been changed.Active Directory Restore."