Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Volume Shadow Copy Service

The volume shadow copy Service is used for two purposes. First, the service makes a snapshot disk copy at the start of ntbackup, and then ntbackup backs up the selected files and folders from the copy. When volume shadow copy is used, even open files can be backed up. Second, the service is used to provide users the opportunity to recover deleted files or earlier versions of a current file. This is called User Based File Recovery in technical documents and Previous Versions in end-user documents.

When Shadow Copy is used during backup, it does not need to be configured and is turned on by default. However, User Based File Recovery must be configured and client software distributed before it can be used. User Based File Recovery is configured on Windows Server 2003 shares; however, once configured, all shares on the volume are backed up. You can configure it for one volume and not another, but you cannot selectively choose shares within a volume and have some backed up and others not.

A Shadow Copy Client is required in order to recover files protected by Shadow Copy. The client must be added to Windows 2000 or Windows XP. The client is located on the <%system folder%>\ system32\clients\x86\twsclient.exe. It can also be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyID=e382358f-33c3-4de7-acd8-a33ac92d295e&displaylang=en. The client can be distributed via Group Policy or placed on a share. Double-clicking the client executable installs the client without any other necessary interaction.

Best Practices for Shadow Copies of Shared Folders

Use a storage location other than the disk of the volume that will be shadow copies. This may improve performance.

Set appropriate NTFS file permissions. Do not give unauthorized users the ability to modify data in this way. If users can access previous versions of files, they can restore them and might inappropriately replace current data with older data. Instead of a tool that helps users recover inadvertently deleted data, the use of shadow copies can cause problems with data integrity. Restoration of old data may not be detected immediately, especially by the users of the files, and old data could be used. The integrity of data is dependent, as it always is, on the people who have access to files.

Do not use shadow copies of shared folders where the risk that someone might restore old data without an approval process is considered too high. Keep backups of previous versions for historical reference.

Do not use shadow copies of shared folders to replace regular backup processes. There are too many ways that previous versions of the files could be lost.

Do not schedule shadow copies to happen more frequently than once every hour. Each shadow copy degrades system performance, and frequent shadow copies may do so to an unacceptable level. Frequent shadow copies can also fill up the disk too quickly, or reach the 64 Shadow Copy limit too quickly.

Adjust the schedule of shadow copies of shared folders to meet the needs of users. By default, no shadow copies are made on the weekend, for example, and you may have users that work on these days.

Delete Shadow Copy tasks before deleting a volume that is being shadow copied. Otherwise, the task will fail and could fill the event log with errors.

Use an allocation unit size of 16 KB or larger when formatting a volume on which shadow copies of shared folders will be enabled. Defragging volumes allocated with smaller units can result in the loss of previous versions of files.

Do not enable shadow copies on volumes that use mount points. Mounted drives will not be included when shadow copies are made.

Do not use shadow copies of shared folders on dual-boot computers.

Once a volume is configured for Shadow Copy, older versions of files can be located and recovered by any users authorized to read the current version of the file. Take care to set user expectations. Shadow copies are scheduled, and files created and deleted between backups cannot be recovered.

To Create Shadow Copy Volumes

Creating the volumes is easy, and there are only a few configuration options. To create the volume and make the first Shadow Copy volume, follow these steps:

Open Computer Management, and then right-click the Shared Folders folder, as shown in Figure 17-16.

Figure 17-16. Open Computer Management and locate Shared Folders.

Select All Tasks, and then click Configure Shadow Copies.

In the Shadow Copies dialog, select the volume to prepare, as shown in Figure 17-17.

Figure 17-17. Shadow copies are set by the volume, not the share.

Click Settings to change the volume on which the Shadow Copies will be stored, as shown in Figure 17-18. By default, shadow copies will be stored on the same volume as the share. If you are not using RAID volumes, it is a good idea to place the shadow copies on another volume. This way, the shadow copies will not fill the original disk, and on servers with a high I/0 load, it can make a real difference in performance. Remember, if you have to change the storage location of the shadow copy, you will have to delete the shadow copy. All old versions of the files will be lost.

Figure 17-18. Change the location for the shadow copy storage.

Click Details and view the available disk space. Click OK.

Set the amount of space to allocate to the shadow copies. By default, 10 percent of the available space is allocated. When the allocated space is gone, older shadow copies are deleted. Also, a maximum of 64 shadow copies can be recorded. At that point, older copies are deleted before new ones are saved.

Click Schedule to set the times when a shadow copy will be made, as shown in Figure 17-19. By default, a shadow copy will be made at 7 A.M. and 12 P.M. You will want to adjust this schedule to meet your needs. For example, if you have people working on weekends or from different time zones, you may want to add additional times. Microsoft recommends that you do not schedule shadow copies less than one hour apart.

Figure 17-19. Set the shadow copy schedule that fits the way users work.

Click OK to close the schedule page and click OK to close the Settings page.

On the main page, shadow copies are enabled. Click Create Now to create the shadow copy, as shown in Figure 17-20. A shadow copy is made. View the Details page to see how much space was required.

Figure 17-20. After enabling, you'll be able to view the shadow copies and space used on the drive.

10.

Click OK to close the Shadow Copies page.

WARNING: Shadow Copy Location

Determine the best location for shadow copies before enabling them. You will have to delete any shadow copies in order to move the location where they will be saved.

Alternatively, open the Local Disk Properties for an NTFS volume and select the Shadow Copies tab, as shown in Figure 17-21.

Figure 17-21. The Shadow Copies Property page is used to create shadow copies.

Restoring from Shadow Copies

Users must install client software before they can view or restore previous versions. They will be able to view file content before restoring files, but they will not be able to modify the previous version. After they restore the file, if they have permission, they can modify the file.

NOTE: Permissions Maintained

Shadow copies maintain permission settings. If a user does not have permission to read the file, he will not be able to read the Shadow Copy file.

Files can be viewed and restored from the Previous Versions tab of the shared folder properties, as shown in Figure 17-22, using a network connection. When the View button is selected, as shown in Figure 17-23, each file can be opened for read only. The Restore button restores the older version.

Figure 17-22. Previous versions are viewed through the Previous Version tab on the shared folder.

Figure 17-23. When the files are viewed, the version is specified next to the shared drive letter in the address file.

[View full size image]

Command-Line Shadow Copy Administration

The vssadmin tool can be used at the command line to manage shadow copies. Vssadmin is provided for Windows XP and Windows Server 2003. The Windows XP version provides only a few commands and is mostly useful for management of previous versions of files from the user's perspective. Some useful examples of using vssadmin on Windows Server 2003 are listed in Table 17-5. A complete syntactical reference is located at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/standard/vssadmin.asp.

Table 17-5. Vssadmin
Command	Function
`Vssadmin add shadowstorage /for=D:\research /or=e:\`	Creates Shadow Volume for D:\ on the E:\drive. D:\ must be a local volume or mount point.
`Vssadmin create shadow /for=D:\`	Creates a new shadow copy.
`Vssadmin list shadows`	Lists all shadow copies on the system.
`Vssadmin list shadows /for=D:\`	Lists all shadows for volume D:\.
`Vssadmin list shadowstorage /for=D:\`	Lists all associate shadow copies on any volumes for volume D:\.