Tivoli Storage Manager Recovery Techniques Using Windows Pre-installation Environment (Windows PE)

By Jason Basler, Mike Dile, Don Moxley, Jey Somaskanthan , Evan Chiu Version 2.6

Copyright Notice Copyright IBM Corporation 2009. All rights reserved. May only be used pursuant to a Tivoli Systems Software License Agreement, an IBM Software License Agreement, or Addendum for Tivoli Products to IBM Customer or License Agreement. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual, or otherwise, without prior written permission of IBM Corporation. IBM Corporation gra nts you limited permission to make hardcopy or other reproductions of any machine -readable documentation for your own use, provided that each such reproduction shall carry the IBM Corporation copyright notice. No other rights under copyright are granted wi thout prior written permission of IBM Corporation. The document is not intended for production and is furnished as is without warranty of any kind. All warranties on this document are hereby disclaimed, including the warranties of merchantability and fitness for a particular purpose. U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corporation. Trademarks IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, Cross -Site, NetView, OS/2, Planet Tivoli, RS/6000, Tivoli Certified, Tivoli Enterprise, Tivoli Enterprise Console, Tivoli Ready, and TME are trademarks or registered trademarks of International Business Machines Corporation or Tivoli Systems Inc. in the United States, other countries , or both. Lotus is a registered trademark of Lotus Development Corporation. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. C-bus is a trademark of Corollary, Inc. in the United States, other countries, or both. PC Direct is a trademark of Ziff Communications Company in the United States, other countries, or both and is used by IBM Corporation under license. ActionMedia, LANDesk, MMX, Pentium, and ProShare are trademarks of Intel Corporation in the United States, other countries, or both. For a complete list of Intel trademarks, see http://www.intel.com/sites/corporate/tradema rx.htm. SET and the SET Logo are trademarks owned by SET Secure Electronic Transaction LLC. For further information, see http://www.setco.org/aboutmark.html. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Micro systems, Inc. in the United States and other countries. Other company, product, and service names may be trademarks or service marks of others. Notices References in this publication to Tivoli Systems or IBM products, programs, or services do not imply tha t they will be available in all countries in which Tivoli Systems or IBM operates. Any reference to these products, programs, or services is not intended to imply that only Tivoli Systems or IBM products, programs, or services can be used. Subject to valid intellectual property or other legally protectable right of Tivoli Systems or IBM, any functionally equivalent product, program, or service can be used instead of the referenced product, program, or service. The evaluation and verification of operation in conjunction with other products, except those expressly designated by Tivoli Systems or IBM, are the responsibility of the user. Tivoli Systems or IBM may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to the IBM Director of Licensing, IBM Corporation, North Castle Drive, Armonk, New York 10504 -1785,

iii

U.S.A.

iv

About the Tivoli Field Guides

Sponsor
Tivoli Customer Support sponsors the Tivoli Field Guide program.

Authors
Those who write field guides belong to one of these three groups:

Tivoli Support and Services Engineers who work directly with customers Tivoli Customers and Business Partners who have experience using Tivoli software in a production environment Tivoli developers, testers, and architects

Audience
The field guides are written for all customers, both new and existing. They are applicable to external audiences including executives, pr oject leads, technical leads, team members, and to internal audiences as well.

Types of Field Guides

Two types of Tivoli Field Guides describe how Tivoli products work and how they are used in real life situations:

Field Guides for technical issues are des igned to address specific technical scenarios or concepts that are often complex to implement or difficult to understand, for example: endpoint mobility, migration, and heartbeat monitoring. Field Guides for business issues are designed to address specific business practices that have a high impact on the success or failure of an ESM project, for example: change management, asset Management, and deployment phases.

Purposes
The Field Guide program has two major purposes:

To empower customers & business part ners to succeed with Tivoli software by documenting and sharing product information that provides accurate and timely information on Tivoli products and the business issues that impact an enterprise systems management project To leverage the internal knowl edge within Tivoli Customer Support and Services and the external knowledge of Tivoli customers and Business Partners

Availability
All completed field guides are available free to registered customers and internal IBM employees at the following Web site: http://www.ibm.com/software/sysmgmt/products/support/Field_Guides.html Authors can submit proposals and access papers by e -mail: mailto:Tivoli_eSupport_Feedback@us.ibm. com

INTRODUCTION .......................................................................................... 3 HARDWARE/SOFTWARE RE QUIREMENTS........................................... 5 PREPARATION OVERVIEW ...................................................................... 6

Obtaining the WinPE Client ......................................................................................................... 6 Preparing a Network Share Containing the TSM Client .............................................................. 6 Including TSM in Bart PE ............................................................................................................. 8 Creating the Backup .................................................................................................................... 9 Document the System Disk Partitioning .................................................................................... 11

IMAGE RESTORE PROCEDURE OVERVIEW ....................................... 13 FILELEVEL RESTORE PROCEDURE.................................................... 14 RESTORING A WINDOWS SYSTEM (NOT A DOMAIN CONTROLLER) USING INCREMENTAL IMAGE REST ORE............... 16 RESTORING A WINDOWS 2000 SERVER DOMAIN CONTROLLER. 17 RESTORING A WINDOWS SYSTEM BACKED UP OFFLINE FROM WINDOWS PE ............................................................................................. 19 RESTORING A SYSTEM WITH A DYNAMIC BOOT VOLUME ......... 21 QUESTIONS AND ANSWERS .................................................................. 21 DIAGNOSTIC TIPS ..................................................................................... 23 REFERENCE INFORMATIO N .................................................................. 24

Tivoli Storage Manager Recovery Techniques Using Windows Pre-installation Environment (Windows PE)
Audience
This field guide is intended for storage administrators and skilled technical support personnel who need to recover Windows 2000, Windows XP , Windows 2003, Windows Vista, and Wind ows 2008 systems from a catastrophic system or hardware failure. This guide assumes technical proficiency with installation, configuration, and use of Windows systems with the Tivoli Storage Manager (TSM) Backup-Archive client.

1 Introduction
The current Windows Bare Metal Restore (BMR) procedures using Tivoli Storage Manager (TSM) are dependent on Microsoft Automated System Recovery (ASR) or on having a functioning operating system from which to run the backup/archive client. Installation of this base operating system as a pre-requisite to performing system recovery can be time consuming. An alternative method is to copy a base operating system from an image, rather than running through the full Windows installation procedure. In the past, third party imaging utilities such as Symantecs Ghost have been required to perform the image copy. Using Microsoft Windows Pre -installation Environment (WinPE) or Nu2 Productions Bart's Preinstalled Environment (BartPE), the image backup / restore facility in TSM can now be used for creating and recoverin g from an operating system image. In addition, for certain platforms, the online image backup feature in TSM can be used to take full system drive backups of running systems. When combined with traditional incremental backup and system state backup, a very fast system recovery scenario becomes possible in situations where you are restoring to identical hardware. The pre-installation environment provides a temporary operating system that is bootable from a CD and provides access to the volumes on a system's hard disk drives. Network connectivity configured through DHCP is also available after booting, so the TSM client program can be executed from a network drive, and network restor es from a TSM server are possible. Because the pre-installation environment runs directly from the CD, the local drives are unlocked and treated simply as additional data drives. Any operating system installed on the disk volumes or restored using TSM is not loaded while the pre-installation environment is running. For this reason, the operating system installed on the local disk and the operating system that runs in the pre-installation environment have no interaction. This enables scenarios such as recovering a Windows 2003 operating system using a pre-installation environment based on the Windows XP operating system. The term WinPE is used throughout the remainder of this document to refer to a booted pre-installation environment using either WinPE or BartPE. Note: BartPE can be a useful alternative to WinPE. However, you need to carefully review the Microsoft licensing discussion on the www.nu2.nu website and your specific Microsoft EULA before using it at your site. The following table summarizes the TSM image backup and restore methods in conjunction with WinPE that are available for various Windows operating systems:

Table 1: TSM image backup and restore methods for different versions of Windows operating systems Windows 2000 TSM online image backup using LVSA TSM online image backup 2 using VSS TSM offline image backup from WinPE TSM image restore running in WinPE Yes Windows XP 32-bit Yes Windows 2003, 2008, Vista 32-bit Yes Windows 2003, 2008, Vista x64 Yes Windows 2003, 2008 1 IA-64 No

No

No

Yes

Yes

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Yes

No

Whats New in Version 2.6: o Added clarification regarding compatibility problems while restoring certain operating systems with PE boot discs created using different operating systems . o Documented restrictions with file -level restore techniques for Windows 2008 and Vista operating systems. o Added additional BCDEDIT commands to issue for Windows 2008 and Vista following image restores, which avoid boot problems af ter system recovery. Whats New in Version 2.5: Provided documentation for recovery of Windows x64 operating systems. Added updated information to include support for Windows 2008 and Windows Vista. Updated installation and configuration steps to include information necessary for running TSM 5.4 and 5.5 client levels in WinPE. Added instructions for filelevel restore techniques from within WinPE. Whats New (previously): Support for single drive online -image backup Support for recovery with pre-installation environments created using Bart's PE Builde r Redirection of the error log to a writable media to bypass error log restriction TSM image restore commands specify a destination volume using a drive letter. Under certain situations, WinPE will map volumes to different drive letters than the system f rom which the backup was performed. For this reason, it is important to collect information on the volume layout
1

WinPE recovery using TSM has not been tested on Windows IA64 operating systems running on Itanium processors.
2

The online image with VSS support is available beginning with TSM 5.5.

at the time of backup and compare it to the layout presented by WinPE to ensure that your volume target during restore is correct. The image backup feature of TSM can backup FAT, FAT32, and NTFS volumes. When backing up NTFS volumes, the TSM client only sends used regions of the volume to the TSM server by default. Using WinPE to restore volume images to different hardware is not supported . See the Questions and Answers section for more details.

2 Hardware/Software Requirements
Hardware There are currently no known hardware limitations. In some cases, hardware drivers needed for disk controllers and network adapters may not be available i n the base version of WinPE or the 3 Windows CD used to build BartPE . TSM A TSM Windows client version of V5.4.0 or newer is required for running in WinPE.

Note: the TSM 5.5 client packages require restructuring in order to run in WinPE. The specifics are documented in the Preparation section of this document. A TSM server version of V5.4.0 or newer is recommended. A 5.1.x or newer level is required for support of TSM image backup. If you are backing up Windows 2003 systems, including system state and system services, then a TSM server version of 5.2.2 or newer level is required. A second Windows system is required for sharing the TSM client application for execution within WinPE. If you have included the TSM client in your pre-installation CD, this is not required. The option -asrmode=yes is required when running TSM commands in WinPE environments built from Windows 2003, Windows Vista, or Windows 2008 . The asrmode option is used to prevent TSM from invoking the Microsoft VSS se rvices, which are not available while running WinPE. Without this option, the TSM client will fail to start.

WinPE A bootable WinPE CD is required. A DHCP server may be required on your network to allow a network address to be assigned to your system wh en booting from WinPE. Some PE environments allow a static address to be assigned to the system after booting. Recovery of the following Microsoft operating systems has been tested:
3

Windows 2000

Consult the documentation provided with your pre -installation tools on how to include additional device drivers on your bootable PE environment. Both BartPE and the Windows Automated Installation Kit (WAIK) provide this capability .

Windows XP Windows 2003 Windows 2008 Windows Vista

There are a few considerations when deciding which operating system base to use when constructing a WinPE CD for system recovery purposes. Problems have been encountered while attempting image recovery of Windows 2003 servers using a newer Windows 2008 based PE 2.0 boot CD, as well as, attempting to restore a Windows 2008 operating system usin g an older operating system on the PE CD such as Windows XP . The problem appears to result from the inability of the diskpart program (included with boot CD) to create a bootable partition for a different operating system type. To avoid these types of problems, use the same operating system for the PE boot CD that is used in the system that is being recovered. You should test WinPE with your hardware to ensure that it will work before you are faced with a situation requiring a restore.

3 Preparation Overview
Obtaining the WinPE Client
The following web site contains reference information related to Microsoft Windows Automated Installation Kit (Windows AIK.) http://technet2.microsoft.com/WindowsVista/en/library/129a1712 -e3d8-46c1-bc09a14349dc67db1033.mspx?mfr=true

Obtaining the BartPE Client

The following web site contains information on how to download and build the CD from your Windows installation media: http://www.nu2.nu/

Preparing a Network Share Containing the TSM Client

These procedures assume you are using a Windows PE boot CD, which does not include a TSM client. For this reason, the TSM client program must be accessed from a network drive. Alternatively, you can bundle the TSM client into your WinPE CD using custom WinPE image build procedures. If you are using BartPE, a custom plug -in can be created to include the TSM client when the CD is built rather than using a network drive. To configure the TSM client to run from a network share, copy the TSM Client installation package directory from the TSM deskto p clients CD into a shared folder . You can also run the

self-extracting installation FTP package of the TSM Windows client. If you are extracting from the FTP package, cancel the install when the language selection prompt appears. T he extraction will then be complete. The following instructions can be used to configure the TSM client to run from a network share: 1. Create a shared folder on your system, for example, c: \tsmshare. C:\>md c:\tsmshare C:\>net share tsmshare=c: \tsmshare 2. Extract the TSM client from the FTP package but do not install the TSM client. If you have a TSM client CD, the files are already extracted on the CD . Copy the installation files into c:\tsmshare. This should result in the TSM client program files residing in the folder: x32 client: c:\tsmshare\Program Files\Tivoli\TSM\baclient x64 client: c:\tsmshare\Program Files 64\Tivoli\TSM\baclient 3. For the TSM 5.5 client, the dsmc-pe.cmd or dsmc-pe-x64.cmd command script must be executed to restructure some files within the TSM client installation package need for running within WinPE. x32 client: cd c:\tsmshare c:\tsmshare\dsmc-pe.cmd set x64 client: (available in 5.5.1 and later clients) cd c:\tsmshare c:\tsmshare\dsmc-pe-x64.cmd set 4. Create a file named tsmwinpe.cmd which will establish the environment needed to run TSM from the shared drive. You can choose to map the TSM share to a different drive letter. The required commands can be entered into a WinPE c ommand prompt, or stored on removable media so that it will be available fro m the system running WinPE. Here is an example of the file contents: x32 client: net use z: \\yourmachine\tsmshare set path=%path%;z: \system32;z:\program files\tivoli\tsm\baclient set path=%path%;z: \program files\tivoli\tsm\baclient\plugins z: cd \program files\tivoli\tsm\baclient x64 client: net use z: \\yourmachine\tsmshare set path=%path%;z: \system64 set path=%path%;z:\program files 64\tivoli\tsm\baclient set path=%path%;z: \program files 64\tivoli\tsm\baclient\plugins z: cd \program files 64\tivoli\tsm\baclient

5. Create a TSM options file containing the correct node name and communication settings in the baclient folder created by the extraction in step #2 . Optionally, this file can also be created on removable media, and the DSM_CONFIG environment varia ble be set to locate the file. Sample dsm.opt: c:\tsmshare\Program Files\Tivoli\TSM\baclient\dsm.opt * communication settings tcpserveraddr firebat.storage.sanjose.ibm.com tcpport 1500 nodename winpetest passwordaccess prompt * compression set tings; uncomment if desired *compression yes * performance tuning options txnbytelimit 25600 tcpnodelay yes tcpbuffsize 32 tcpwindowsize 63 * redirect the error log errorlogname a:\dsmerror.log * Disable AES128 encryption libraries from lo ading encryptiontype DES56

Note: you will need to specify the location of the error log for the client to run correctly. It is recommended that the errorlogname option be set in your option file to point to the floppy drive or some other temporary dri ve available to the booted PE system . Alternatively, you can also specify the error log location in your batch file by setting the DSM_LOG environmental variable or allow for write permissions in the shared network folder. Also note that offline image bac kup while booted to WinPE will fail with an error unmounting the volume if the dsmerror.log is written to the volume you are attempting to backup. Use of the passwordaccess option within WinPE can be desirable if multiple TSM commands will be used in succession. However, there is no way to use a password that was previously generated outside of WinPE, and a password generated in WinPE will not persist after the system is restarted. Some TSM client levels may not be capable of storing a generated password in WinPE. In this case, you can provide the password using the password option to avoid prompting.

Including TSM in Bart PE

The Bart PE website contains detailed instructions on how to create a custom plugin to include any application on your CD. Please consult their website for specific information . The TSM client setup files can be used as the source files. When specifying what files to copy into your CD, be sure to include the files in the System32 folder along with the baclient folder.

Creating the Backup

Offline TSM Image Backup An offline backup is performed after booting to WinPE, which ensures that the system drive will be backed up in a consistent and offline state. This procedure has the disadvantage of requiring a shutdown of the machine to be backed up , but is useful for creating a volume-level recovery image. By default, TSM image backup skips empty regions of a volume when backing up NTFS volumes. If you are backing up a non-NTFS file system or if you want to minimize the stored image size on the TSM server, consider turning on the TSM compression option for efficiency. After performing the image backup, you can use standard TSM incremental backup and system object backup to protect the latest state of your operatin g system. Optionally, you can periodically repeat the offline image backup procedure to create a more current backup. The following outlines the procedure used to perform an offline image backup from WinPE. If your system files are on more than one file system, you will need to perform image backups for each drive on which the system files reside . 1. Shutdown the system to be backed up 2. Boot from your WinPE CD 3. Run the tsmwinpe.cmd command script to set the required environment variables to run the TSM client from a network share. 4. Confirm which drive letter WinPE has assigned to the system drive of the operating system to be backed up. Use the list volume command in diskpart.exe to determine this. If there is no drive letter assigned to the system drive of the operating system to be backed up consult the diskpart.exe documentation to determine how to assign a drive letter to a selected volume. 5. Perform the TSM image backup. Note that the file space created on the TSM server will use the current system generated machine name in the file space name on the TSM server used to store the image backup. You can run dsmc query image to determine the image backup file space name. Z:\>dsmc.exe backup image c: -imagetype=static -asrmode=yes 6. Reboot the machine without the WinPE CD in the drive .

Online TSM Image Backup Online image backup uses the TSM client LVSA or Windows VSS feature to allow the image 4 backup to be performed while your operating system is running. After performing the image

TSM online image backup performs a back up based on a snapshot of the OS while it is running. There is a chance th at the snapshot will be taken at a point in which the operating system is in an inconsistent state that will not boot at recovery time. Be sure to have also documented and tested procedures for recovery using the reinstallation of the OS technique as a

backup, scheduled incremental and system object backups will protect the current state of your operating system. Optionally, you can periodically perform additional image backups to reduce the number of files that will need to be restored along with the image restore. The following steps outline the general procedure required for performing an online image backup (note this procedure assumes that your system drive is contained on c:) : 1. Install the TSM LVSA feature. This step is not required with the TSM 5.5 and newer clients if you will use VSS as the snapshot provider. 2. Perform a full volume incremental backup of your system drive. This step is required if you would like to have the option of performing an incremental image restore with the -deletefiles option. The -deletefiles option automatically removes files which were included in your original image backup, but were subsequently deleted from the operating system. You might also want to perform online image and incremental backups of other drives on your system. dsmc incremental c: 3. Perform an online image backup of the system drive. If you are using LVSA as the snapshotprovider and TSM has difficulty creating a snapshot of your system drive, you might need to vary the -snapshotidletimeout and -snapshotidleretries options to decrease the amount of idle time expected by TSM and/or increase the number of snapshot retries attempted by TSM. Also, any services or applications that access the drive, like the TSM Journal Service, will need to be stopped for the s napshot to complete successfully. dsmc backup image c: -imagetype=snapshot 4. Perform an incremental backup of the system drive. This step should be repeated as frequently as your backup policies require. Consider defining this backup to be performed by the TSM scheduler. You should also back up the system state for your system. These backups will allow you to restore your system to its most recent state following the TSM image restore. dsmc incremental c: dsmc backup system state 5. Repeat the previous step as frequently as required for your backup policies. Optionally, you can periodically repeat step #5, to create a more current image level backup. Filelevel backup Additional recovery techniques are available from file level backups and systemstate back ups. These techniques are providing with limited support for advanced users who require additional recovery methods. The minimum backup includes a backup of the system drive and a backup of the systemstate. 1. Backup the system drive. dsmc incremental c: 2. Backup the system state. dsmc backup systemstate

backup plan. You also need this backup plan in the event you are not restoring to identical hardware.

10

3. Backup the system services. (This step is not required with TSM 5.5 and newer client levels.) dsmc backup systemservices

Document the System Disk Partitioning

Document your system disk configuration using DISK PART.EXE prior to performing a backup. The diskpart program is available with most recent Windows releases . If you are running Windows 2000, you can either copy it from another system running XP or 2003, or you can boot to WinPE and run diskpart. You can find documentation for the diskpart utility on the microsoft.com website. For example: http://technet.microsoft.com/en -us/library/bb490893.aspx Consider printing documentation of your disk configuration and keeping it near your system in the event that a restore becomes necessary. You can also keep track of disk layout and mapping using either DSMC QUERY SYSTEMINFO or MSINFO32 from C: \Program Files\Common Files\Microsoft Shared\MSInfo. Use the following procedure to document the disk configuration using diskpart.exe: 1. Create a file named diskpart.in containing the following lines. Update the script as needed depending on the number of physical disks in your system. list list select list select list disk volume disk 0 partition disk 1 partition

2. Run the diskpart.exe command with the /s switch, and direct the output into a file named diskpart.txt: diskpart /s diskpart.in > diskpart.txt

11

Example Output
Microsoft DiskPart version 1.0 Copyright (C) 1999-2001 Microsoft Corporation. On computer: WINPETEST DiskPart is starting the disk management services. Disk ### -------Disk 0 Disk 1 Status ---------Online Online Ltr --H C D E F G I J Size ------34 GB 34 GB Free ------0 B 0 B Fs ----NTFS NTFS NTFS FAT32 NTFS FAT32 Dyn Gpt --- ---

Volume ### ---------Volume 0 Volume 1 Volume 2 Volume 3 Volume 4 Volume 5 Volume 6 Volume 7

Label -----------

WinXP Win2003NTFS WIN03F32 Backup GHOST

Type ---------CD -ROM Partition Partition Partition Partition Partition Partition Partition

Size ------0 B 6997 MB 6997 MB 6997 MB 6997 MB 6715 MB 20 GB 14 GB

Status Info --------- -------Healthy Healthy H ealthy Healthy Healthy Healthy Healthy System

Disk 0 is now the selected disk. Partition ### ------------Partition 1 Partition 2 Partition 3 Partition 4 Partition 5 Partition 6 Type ---------------Primary Extended Logical Logical Logical Logical Size ------6997 MB 27 GB 6997 MB 6997 MB 6997 MB 6715 MB Offset ------32 KB 6997 MB 6997 MB 14 GB 20 GB 27 GB

Disk 1 is now the selected disk. Partition ### ------------Partition 1 Partition 2 Partition 3 Type ---------------Primary Extended Logical Size ------20 GB 14 GB 14 GB Offset ------32 KB 20 GB 20 GB

12

4 Image Restore Procedure Overview

After booting to WinPE on the target machine, you will have access to all of the volumes used by the primary operating system. In the event that you need to replace a damaged disk, you will have access to the disks, but wil l need to recreate the volumes and in some cases format file systems on them. When restoring TSM image backups, it is not necessary to format a file system before performing the restore since the file system is recovered from the backup. Be sure that the error log is not being written to the drive being restored. Doing so will prevent TSM from dismounting the volume for image restoration. The following procedure lists the general WinPE restore flow. Later sections detail specific considerations for cer tain system configurations. 1. Boot WinPE on the machine you plan to restore. WinPE should provide a network connection with an address assigned through DHCP , or your WinPE version may provide a utility for configuring a static address . 2. Use diskpart.exe to recreate the volume layout for your system. After the volume layout is recreated, inspect the volume to drive letter mapping presented by WinPE, and correlate this with the mapping used by your initial operating system. There is a possibility that you will need to restore the TSM image backup to a different destination drive letter than the one assigned to the volume at the time the backup was taken. Image restore commands issued from WinPE need to specify the full source backup name in UNC format since WinPE boots with a different machine name than your normal operating system. Here is an example of recreating two partitions on a physical disk, one primary, and one extended. The primary partition will be set to active, to allow the system to boot. Formatting of the first partition is not required, as the image restore will recreate the file system. Formatting the second volume is required since the recovered operating system uses this volume to store swap files , and the file system will need to exist prior to booting the restored system. In general, a volume does not need to be formatted with a file system if a TSM image backup will be restored over the volume. In other cases, the volume should be formatted with the same file system type that existed previously. diskpart.exe select clean create select assign active create select create select assign list exit

disk 0 partition primary size=6997 partition 1 letter=C partition partition partition partition letter=D volume extended 2 logical size=8192 3

13

format D: /fs:ntfs /v:swapdisk

3. Using the tsmwinpe.cmd file, m ap the network share containing the TSM client program code, and set the environment variables required to run the TSM client from the network share. If you have not created this share yet, see the instructions in the section Preparing a Network Share Containing the TSM Client. For example, if you are using the tsmwinpe.cmd file on a floppy disk: a:\tsmwinpe.cmd 4. Restore the image backup of your system volume. There are several vari ations of this restore command that are detailed in upcoming sections. The most basic restore variation is given here. Note that the use of the -ASRMODE=YES option is required to bypass the attempted initialization of the Volume Shadowcopy Services (VSS) subsystem which is not present in a Windows Server 2003 WinPE environment. The query image command can be used to determine the full name of the image backup object to restore, and to test your connectivity to the TSM server. The -virtualnode option is not required if you have specified the correct nodename option in the dsm.opt file. Passwords generated by TSM are not available when running in WinPE, so the -virtualnode option also prevents unsuccessful attempts to store the TSM password in the Windows registry. dsmc query image -asrmode=yes -virtualnode=tsmnodename dsmc restore image \\backupmachinename\c$ c:\ asrmode=yes virtualnode=tsmnodename 5. For Windows 2008 and Windows Vista systems, the BCDEDIT program must be used to repair the system boot information prior to rebooting to the restored operating system. bcdedit /set {bootmgr} device BOOT bcdedit /set {default} device BOOT bcdedit /set {default} osdevice BOOT

5 Filelevel Restore Procedure

This section documents a recovery procedure inten ded for advanced users that require an alternative to the standard machine recovery procedures which involve restoring from file-level backups over a running operating system. Files are recovered from both the system drive backup and the systemstate backup using regular restore commands. The restore systemstate command cannot be used within WinPE. Very limited support is availa ble for this recovery technique. It cannot be used for complete recovery of Windows 2008 or Windows Vista operating systems due to problem s recovering boot files and the inability to correctly recover the hardlinks , which are part of the systemstate . 1. Boot WinPE on the machine you plan to restore. WinPE should provide a network connection with an address assigned thr ough DHCP, or your WinPE version may provide a utility for configuring a static address.

14

2. Use diskpart.exe to recreate the volume layout for your system . This step is optional, depending on your restore scenario and whether your system already has a worki ng partition layout. See the previous section for additional details on using diskpart. 3. Format a file system on your system drive. This step is not required if the file system already exists, or depending on your recovery situation . format c: /fs:ntfs /q 4. Run query filespace to determine the correct file space names to use in restore commands. dsmc query fi 5. Restore the required files. There are many possible restore scenarios. Several examples are given here to demonstrate the command syntax needed for different platforms and TSM levels. a. Restore an entire system (system drive and system state) using the TSM 5.5 client. dsmc virtualnode=mach1 pass=pw tsm> rest \\mach1\c$\* c:\ -sub=yes -rep=all tsm> rest "{MACH1\SystemState\NULL\System State\SystemState}\*" c:\ -sub=yes -rep=all Win2003: registry files must manually be copied from the temporary restore location to config directory: copy c:\windows\repair\Backup\BootableSystemState \Registry\* c:\windows\system32\config b. Restore an entire system (system drive and system state) using the TSM 5. 4 client.. dsmc virtualnode=mach1 pass=pw tsm> rest \\mach1\c$\* c:\ -sub=yes -rep=all tsm> rest "{SYSTEM STATE}\*" c:\ -sub=yes Win2003: registry files must manually be copied from the temporary restore location to config directory: copy c:\windows\repair\Backup\BootableSystemState \Registry\* c:\windows\system32\config c. Restore individual files from the systemstate backup using a TSM 5.5 client. dsmc virtualnode=mach1 pass=pw tsm> rest "{MACH1\SystemState\NULL\System State\SystemState}\\mach1\c$|\windows\system32\config\*" c:\ -sub=y preservepath=complete

15

6 Restoring a Windows System (not a Domain Controller) Using Incremental Image Restore
The following procedure describes how to recover a Windows 2000, XP, Server 2003 , Vista, or Server 2008 system. This procedure assumes that your backup followed the correct procedure to allow for incremental image restore using the -deletefiles option, and that you have performed system state backups (system object backups for Windows XP and 2000 .) This restore method allows you to bring your system back to its most current backup state. The default Windows directories are used in this procedure. In the event that your Windows installation is not in the default location, modify the path appropriately. You can determine where your Windows dire ctory is by looking at the SystemRoot environmental variable. 1. Perform the restore preparation steps outlined in the Rest ore Procedure Overview section excluding the restore image step. 2. Run query image to determine the machine name and drive letter of th e image backup dsmc query image -asrmode=yes -virtualnode=tsmnodename 3. Restore the system drive image backup, including more recently backed up files from the system drive incremental backup. The -deletefiles options will remove any files that were restored from the image backup, but were deleted from your system after the image backup was taken. dsmc restore image \\backupmachinename\c$ c: -asrmode=yes -noprompt -incremental -deletefiles -virtualnode=tsmnodename 4. Reboot to the restored operating syst em. 5. This step is only required if your are restoring a Windows 2000 or XP system, or if you are restoring a Windows 2000, XP, or 2003 system with a TSM client at level 5.3.4 or older. The following commands can be used to pre -restore the Windows system fi le protection catalogs: Your Windows installation directory and drive letter may vary. The %systemroot% and %systemdrive% variables can be used to create a generic restore procedure if desired. Windows 2000: dsmc restore "{SYSTEM OBJECT} \winnt\system32\catroot\*" c:\winnt\system32\ -sub=yes -rep=all Windows XP: dsmc restore "{SYSTEM OBJECT} \windows\system32\catroot\*" c:\windows\system32\ -sub=yes -rep=all Windows 2003/Windows 2003 R2 for 5.3.4 and older client levels only: dsmc restore "{SYSTEM STATE} \windows\system32\catroot\*" c:\windows\system32\ -sub=yes -rep=all 6. Restore the entire system state (system object for older Windows releases.) Windows 2000/XP: dsmc restore systemobject

16

Windows 2003/Windows 2003 R2 /Windows Vista/Windows 2008 dsmc restore systemstate 7. Restore the system services. This step only applies to TSM 5.4 and older clients since the system service components are included as part of the systemstate backup beginning with TSM 5.5. Windows 2003/2003 R2/Vista: dsmc restore systemservic es 8. Reboot without the WinPE CD.

7 Restoring a Windows 2000 Server Domain Controller

The following restore procedure is specific to the test configuration documented below. It can easily be adapted for a domain controller with a different disk layout or a different operating system such as Windows 2003 . Test configuration: 1. IBM eServer xSeries 345, with 2 SCSI hard disks 2. First disk is a basic disk, with C: as system/boot partition containing c: \winnt 3. Second disk is a dynamic disk with three simple volumes on D:, E:, and F: 4. NTDS database contained on D: \NTDS\DB 5. NTDS log contained on E: \NTDS\LOG 6. SYSVOL contained on F:\SYSVOL 7. Win2000 advanced server installed, with SP3 and latest security hot fixes as of 02/27/2004 8. Configured as a peer domain controller in a domain with two pre-existing domain controllers Backup steps: 1. Perform an all-local domain incremental backup which include s backups of c:, d:, e:, f:, and system objects. dsmc inc 2. Perform an online image backup of the system drive c: dsmc backup image c: 3. Repeatedly perform the all-local domain incremental backup including system objects as required by your backup policy. Restore procedure with two new hard disks on identical system:

17

The restoration procedures are performed on an identical system with two replacement hard disks of equal capacity as the original hard disks that were backed up . 1. Boot the system from a Windows PE CD. 2. Reconstruct the partitioning of each disk. Note: when assigning drive letters to the newly created volumes, be sure not to assign the same letter which is being used by WinPE for the CD device. The letter assignments made while WinPE is running are temporary, and do not reflect the assignments that will be used when the primary OS is booted. In this example, WinPE has ass igned the drive letter D: to the CD device. The subsequent drive letter assignments in this example avoid the use of D:. diskpart.exe select disk 0 clean create partition primary size=6997 select partition 1 assign letter=C active select disk 1 clean convert dynamic create volume simple size=10240 assign letter=E create volume simple size=2048 assign letter=F create volume simple size=2048 assign letter=G list volume exit 3. Format file systems on all drives except the system drive format E: /fs:ntfs /v :NTDSDB format F: /fs:ntfs /v:NTDSLOG format G: /fs:ntfs /v:SYSVOL 4. Use the tsmwinpe.cmd to map the network share and set the required environment variables, then run the query image command to determine the machine name and drive letter of the image backup a:\tsmwinpe.cmd dsmc query image -asrmode=yes -virtualnode=tsmnodename 5. Run the query image command to determine the machine name and drive letter of the image backup dsmc query image -asrmode=yes -virtualnode=tsmnodename 6. Restore the system drive imag e backup, including more recently backed up files from the system drive incremental backup. The -deletefiles options will remove any files that were restored from the image backup, but that were deleted from your system after the image backup was taken. dsmc restore image \\backupmachinename\c$ c: -asrmode=yes

18

-noprompt -incremental -deletefiles -virtualnode=tsmnodename

7. Reboot the restored operating system into Directory Services Restore Mode. This is accomplished by pressing F8 early in the Windows boot process, and selecting Directory Services Restore Mode fr om the list that is presented. 8. Since the second hard disk was recreated, Windows will require this disk to be imported, and drive letters to be re-assigned before it can be accessed. Run the Windows disk manager from the computer management console to import the foreign dynamic disk and reassign the appropriate drive letters to the three simple volumes. 9. Restore the SFP catalog files from the system object first. dsmc restore {SYSTEM OBJECT }\winnt\system32\CatRoot\* c:\winnt\system32\ -sub=yes -rep=all 10. From Directory Services Restore Mode , recover the remaining data drives and system objects. Do not reboot until after the final step, even if you are prompted to do so. dsmc dsmc dsmc dsmc restore restore restore restore d:\* -sub=yes -rep=all e:\* -sub=yes -rep=all f:\* -sub=yes -rep=all systemobject

11. Reboot and allow Windows to start normally.

8 Restoring a Windows System Backed Up Offline from Windows PE

Offline image level backups can be performed against a system after bringing the system down and performing the backups from Windows PE. The test system for this scenario contained a single IDE hard drive which was partitioned with a primary partition and two logical drives in an extended partition. Backup steps 1. Perform a full incremental backup of all local hard disks . dsmc inc 2. Shutdown the Windows system, and boot from a CD to Windows PE. 3. From Windows PE, back up each of the file systems using offline image backup a:\tsmasr.cmd dsmc backup image c: -asrmode=yes -imagetype=static dsmc backup image d: -asrmode=yes -imagetype=static dsmc backup image e: -asrmode=yes -imagetype=static 4. Restart the Windows operating system. 5. Repeatedly perform additional incremental backups as required by y our backup policy.

19

6. Optionally, you can periodically repeat the offline image backups from Windows PE. Restore procedure with a new hard disk, on identical system: 1. Boot the system from a Windows PE CD. 2. Reconstruct the partitioning on the new disk. Note: when assigning drive letters to the newly created volumes, be sure not to assign the same letter used by the CD device. The letter assignments made while WinPE is running are temporary, and do not reflect the assignments that will be used when the primary OS is booted. diskpart.exe select disk 0 clean create partition primary size=7805 select partition 1 assign letter=C active create partition extended create partition logical size=4542 assign letter=F create partition logical size=298 assign letter=G exit 3. Run the TSM query image command to determine the machine name and drive letter of the image backups. Take note of the backup date/time of the image backup for each drive. This information will be needed later. a:\tsmwinpe.cmd dsmc query image -asrmode=yes -virtualnode=tsmnodename 4. Restore each of the image backups. You will need to use the correct machine name matching that shown in the output of query image. Also, care must be taken to restore to the correct destination drive letter. dsmc restore image \\minint-ttbkbk\c$ c: -asrmode=yes -noprompt -virtualnode=tsmnodename dsmc restore image \\minint-ttbkbk\d$ e: -asrmode=yes -noprompt -virtualnode=tsmnodename dsmc restore image \\minint-ttbkbk\e$ f: -asrmode=yes -noprompt -virtualnode=tsmnodenam e 5. Reboot the machine. 6. Restore files from the file level incremental backups that were backed up after the date of the image backup. The date and time to be entered should match the backup date / time of the image backup which was restored. dsmc restore c:\* -sub=yes -rep=all -fromdate=03/02/200 8 -fromtime=00:00:00 dsmc restore d:\* -sub=yes -rep=all -fromdate=03/02/200 8 -fromtime=00:00:00 dsmc restore e:\* -sub=yes -rep=all -fromdate=03/02/200 8 -fromtime=00:00:00

20

9 Restoring a System with a Dy namic Boot Volume

Windows operating systems beginning with Windows 2000 support an enhanced disk format referred to as a dynamic disk. It is possible to convert a system disk from a basic disk to a dynamic disk. However, Windows cannot be initially insta lled on a dynamic disk. When recovering your operating system through Windows PE using TSM, you will need to create a primary partition on a basic disk for restore purposes. After the restore has completed, you can boot into the restored operating system and convert the disk back from basic to dynamic.

Questions and Answers

Q: Why cant I boot my system drive after running DISKPART? I set the correct partition active. A: You must use the DISKPART CLEAN command to write the master boot record (MBR) to the disk that you want to boot as the first step in preparing the disk for recovery. This may also be a result of the operating system base of the PE boot disc not matching the operating system of the system being recovered. Q: Can I restore Windows system state or system objects using WinPE? A: The restore systemstate command will not work in a WinPE environment, however, the contents of systemstate can be restored using special commands documented in this document in the section on restoring from fil e-level backups. Q: When would I want to use WinPE -based recovery instead of using TSM with Windows ASR? A: ASR provides a more completely automated process for recovery. The WinPE approach can provide for a faster recovery, and provides a recovery solut ion for more Windows operating systems. Q: How do I customize or configure WinPE so that I can automatically detect different disk controllers, set a specific IP address for a given NIC, etc? A: Customizing WinPE is outside the scope of this field guide. The intent here is to provide a quick, minimal setup and recovery method for recovery based on an unmodified WinPE base. Q: Can I use the TSM Backup-Archive client GUI instead of the command line under WinPE?

21

A: Only if your WinPE CD is based on Windows XP. Since the asrmode option is not available for the GUI, Volume Shadowcopy Service (VSS) initialization can not be bypassed. Also, you must ensure that you have the environment variables established via the tsmwinpe.cmd file as you would have done for the command line client. Since the display color depth and resolution under WinPE is low, the GUI background will appear grainy. You might need to use the keyboard shortcut <alt><spacebar> to display the system menu from which you can select move or size items to allow you to resize the GUI to fit on the reduced size screen. Not all functionality of the GUI is available for use. For example the system state and system service tree items are displayed but are non-functional. Q: Why does TSM not see my har d disks after I boot into WinPE? A: TSM can only see a hard drive if your PE environment can see it. Check to make sure your WinPE CD has support for your hard disk controller. If necessary, you can manually specify additional drivers by pressing F6 durin g the boot process. Consult your preinstallation toolkit documentation for details on adding additional device drivers on your boot CD. Q: Can I use a 32-bit based WinPE CD with a x64-bit processor? A: Yes, however, you must then run the TSM Windows x32 cl ient, and will need the fix for APAR IC56273 in order to restore image backups taken using the Windows x64 client. Q: Can I back up and restore an image onto different hardware ? A: It might work, but it has not been tested or verified by the TSM team and i s not supported. In general, restoring to similar hardware is more successful than dissimilar hardware. If you have problems booting up the restored image, you will need to perform a Windows Repair Install. Note that this is not a repair of a Windows in stallation.

22

10 Diagnostic Tips
1. If the CLEAN subcommand of DISKPART was not issued during the recovery procedure and you cannot boot from the restored image, you might not need to start the recovery procedure from the beginning. If you have a bootable CD of your host operating system, you can boot that CD and enter the recovery console. From the recovery console you can use the FIXMBR command to rewrite the master boot record. This will allow you to boot the active partition. For Windows 2008 systems, which are experiencing boot problems following a PE recovery, the following commands can be issued from the recovery console : bootrec /FIXMBR bootrec /FIXBOOT bootrec /REBUILDBCD 2. You might see the following error messages in the client error log (dsmerror .log). These are normal when running the client under WinPE. The Volume Shadowcopy Service (VSS) is not available under WinPE and WinPE does not have a registry.
03/22/2004 21:29:14 InitializeVss(): InitializeForBackup() returns hr=E_UNEXPECTED 03/22/2004 21:29:15 ANS1009W An error occurred processing the operating system include/exclude statements. The error was detected while processing: FilesNotToBackup: RegOpenKeyEx = 2. 03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 . 03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 .

3. If you receive the error message ANS1287E Volume could not be locked, when backing up or restoring an image, there might be a process accessing the drive. Be sure that no other programs are reading or writing to the drive you are trying to back up. If the TSM Journal Service is installed, stop the service or remove the drive from the list of journaled file systems. If you are restoring in WinPE, be sure to redirect the TSM error log to another drive. 4. You might be able to improve the network performance by manually setting the link speed to your network cards maximum value instead of using the default auto -detect value. To do so, complete the following steps: a. Determine the name of your n etwork card, for example, Broadcom NetXtreme. b. Run regedit.exe and highlight the HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet key. c. Click on Edit->Find and search for your card name.

23

d. Look in each subfolder of the found key (0000, 0001, etc.) for the SpeedDupl ex key. e. The value for the SpeedDuplex key should be set to a number, typically 4 for 100Mbps Full-duplex, as determined by the INF file for your card. See the InfPath key for the location of the associated INF file. The INF file can be found in your Windows/INF folder. The [Speed100.reg] section of the INF file will enumerate the possible values for the SpeedDuplex key. 5. If you are having problems running the TSM Backup -Archive GUI, verify the following settings: a. Your WinPE CD is based on Windows XP and not on Windows Server 2003. Because the Volume Shadowcopy Service is not available in WinPE, the GUI does not start up properly. b. The DSM_DIR environmental variable is set to the baclient folder. c. There is an option file in your baclient folder or the DSM_CONFIG environmental variable points to a valid option file.

d. The System32 folder of the extracted client is in your path. 6. If the TSM client fails to load within a Windows PE envi ronment with the error ANS1464S Cannot load ICC encryption library,add the followi ng option to the dsm.opt file: ENCRYPTIONTYPE des56

11 Reference Information
Information on the DISKPART utility You can find documentation for the diskpart utility on the microsoft.com website, for example at: http://technet.microsoft.com/en -us/library/bb490893.aspx Microsoft Windows Preinstallation Environment (WinPE) website http://oem.microsoft.com/publi c/seo/winpe.htm Tivoli Field Guide on Using TSM with Microsoft ASR http://www.ibm.com/support/docview.wss?rs=663&&uid=swg27007346

24