Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Miscellaneous Backup Tools

While you should create both system state backups and data backups, many functions and services provide tools for backing up their critical data, thus allowing recovery of their functions without restoring the entire computer. Some of these functions are user-oriented, such as the password reset disk and EFS import and export functions, whereas others are relevant to the user or computer, such as registry backup. Nevertheless, they may have meaning and use on servers when account profiles may be stored there or where standalone servers are used. Other backup functions are provided to assist in the recovery of network services, such as DHCP, DNS, and WINS.

Backup Critical User Functions

On a standalone server, local accounts may be used for administration of the server and its services, or provided for special operations, such as database administration, or file backup and management. These accounts can be managed by local administrator accounts, and passwords can be reset using Computer Management. When local accounts on a standalone server are reset, it is possible to lose data (for example, if the local accounts have been used to encrypt files or if the server has recorded an Internet password). If the user of a local account forgets his or her password, instead of having an administrator reset the password, the user should use a password reset disk. The disk must be made before the password is reset.

If an administrator has already reset the user's password, thus preventing them from accessing encrypted files, the user can use his backup of EFS keys to regain access to them.

Password Reset Disk

When a local account is created on a standalone server, a password reset disk should be made. (This option is also viable for Windows XP computers that will not be joined to a domain.) A public and private key pair is created when a password reset disk is created. The private key is stored on the password reset disk; the public key is used to encrypt the local user account password. If a user forgets their password, the password reset disk can be used. The Forgotten Password Wizard uses the private key on the disk to decrypt the local password, and the user is prompted to enter a new password.

Password reset disks should be stored in a safe place, as an unauthorized individual could use them to gain access to the computer. In some environments, password reset disks should not be made in order to reduce risk. In these environments, the type of data that is at risk may also be disallowed or alternative recovery methods can be put into place.

To create a password reset disk, follow these steps:

To use the password reset disk, follow these steps:

It is not necessary to create a new password disk after changing the account.

EFS Import and Export Functions

EFS encrypted files use a public/private key pair to protect the symmetric key used to encrypt the files. The public/private key pair is stored in the user's profile. If something happens to the keys, such as if the profile is destroyed or if a local computer account user's password is reset, it will not be possible for the user to decrypt the encrypted files. If the keys have been exported, they can be imported into a user profile, and the files can be accessed. Alternatively, if key archival has been configured, the keys can be recovered. (For more information on how EFS works and how to export and import keys, see Chapter 6, "EFS Basics," and for information on key archival, see Chapter 13, "Implementing a Secure PKI.")

Backup and Restore Registry Keys

The registry is backed up when you back up the system state data. Nevertheless, when modifying registry keys, it is a good idea to back up or export the key that you are changing a value in before you change it.

To export a registry key, follow these steps:

To restore the registry key, double-click the .reg file to which you exported the key.

Backup Network Services and Other Server Utilities

Network services information is backed up when a complete backup is made. In addition, much of the information may be duplicated on other servers of the same type that are established as secondary servers (DNS) or replication partners (WINS), and local back ups of configuration data may be made.

DNS Backup

DNS secondary servers are usually deployed to provide alternative and redundant sources of DNS databases. When DNS data is stored in the Active Directory, secondary servers can be established, but it is not necessary because each domain controller will have a copy of the data. A backup of the DNS zone file is saved the <%systemroot%>\ DNS\backup folder. If DNS is integrated with Active Directory, the backup files are not updated.

To recover a zone from the backup, follow these steps:

DHCP Backup

The DHCP database is backed up automatically every 60 minutes to <%systemroot%>\DHCP\backup. You can also use the backup command from the DHCP console or the Backup program. (You do not need to stop the DHCP service to make a backup.) When the database is backed up from the DHCP console, all scopes, reservations, leases, options, registry keys, and other configuration settings, such as audit log settings and folder location settings if configured in DHCP property pages, are backed up. Dynamic update credentials, such as user name, domain, and password used when registering DHCP client computer with DNS, are not backed up.

Changing DHCP Backup

Change the default DHCP database backup interval at this registry location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\BackupInterval

To restore the database, use the Restore command from the Action menu of the DHCP console.

WINS Backup

WINS database backups are not made by default. If you want to back up the database, you must set the database backup path and perform a backup.

To change the WINS database backup path, follow these steps:

To back up the WINS database, follow these steps:

TIP: Database Location is Important

The WINS database must be restored from the same location it was backed up to.

To restore the WINS database, follow these steps:

Remote Storage Data

When removable storage or remote storage is used, back up the following files on a regular basis. This makes it possible to restore remote storage and removable storage data:

<%systemroot%>\System32\Ntmsdata

<%systemroot%>\System32\remotestorage

If you need to restore remote-storage files, you cannot do so to a different folder.