A while back, I had a problem with my Windows NT 4.0 cluster. Some of my shared printers refused to print, and some print jobs were causing access violations. During a failover, the Print Spooler resource hung. I tried to troubleshoot the problem but had no luck.
I decided to delete the Print Spooler resource and recreate it. However, after I rebuilt the resource, I realized I'd lost all the printers on my virtual server (the printers were still OK on each node). Thus, I had to reinstall all the printers on the virtual server. In addition, I had to give each printer the same share name it had before the deletion—which was difficult because I hadn't documented the share names and I couldn't remember all of them.
I started wondering whether the registry contained this information. After some investigation, I discovered that each resource, including Print Spooler, maps to the HKEY_LOCAL_MACHINE\Cluster\Resources registry subkey. For every printer you add to the virtual server, a new Print Spooler subkey is created.
I didn't want to perform a registry restore on my production server, and an NT 4.0 Emergency Repair Disk (ERD) doesn't store the registry subtree I needed. So, I needed a way to recover the necessary registry information from a file somewhere.
I found the Microsoft article "How to Use the Cluster TMP file to Replace a Damaged Clusdb File" (http://support.microsoft.com/?kbid=224999), which explains that the Clusdb file (i.e., the Microsoft Cluster Server—MCS—registry, which is stored in the \%systemroot%\cluster folder) is backed up on the shared disk on which the quorum information resides. The Clusdb file is named CHKxxx.tmp. Several files by this name might exist, so you need to use the file with the most recent timestamp. I used regedt32 to open the file and export the information I needed. I imported the information to the production node, and the printers were instantly recreated.
—Rui Silva
rjms@oninet.pt