Restore the Normal Backup Sets
Select the Restore tab from the main NTBackup interface. From here you can highlight each piece of cataloged media to see a list of available backup sets. Select the most recent Normal backup sets for all volumes on your system. To make the selection process easier, click the Method column label to sort each set by backup method. Each backup set you want to restore should have a check mark in the box next to the volume name, and the method for each set should be Normal, as Figure 3 shows. Because NTBackup always uses the Copy method to back up the System State data, you don't need to restore this data at this point because the most recent System State backup occurred with the last Differential backup.
After you select which data you want to restore, select Original location in the Restore files to drop-down box and ensure that Always replace appears beneath the If files already exist text. Next, click Start Restore to open the Confirm Restore dialog box, then click the Advanced button to ensure that NTBackup will properly handle your restored files. Most important, assuming you're using NTFS volumes, make sure that you select the option to restore the appropriate security with your files. Other options will depend on whether you're using Removable Storage, Junction Points, Volume Mount Points, or File Replication Service (FRS) in your environment. Make your selections, then click OK twice to begin the restore process. If the correct media isn't in the drive, NTBackup will prompt you to insert it.
Restore the Differential Backup Sets and System State Data
After you successfully restore the Normal backup sets, NTBackup will prompt you to reboot your server. During the reboot, press F8 when Starting Windows is displayed to open the Windows 2000 Advanced Options Menu. Select Directory Services Restore Mode, which lets you perform a nonauthoritative restore of AD. (When and why you should perform an authoritative restore is outside the scope of this discussion, and the need to do so shouldn't coincide with a disaster-recovery operation. For information about performing an authoritative restore and a nonauthoritative restore of AD, see Sean Daily, "Repairing and Recovering AD," page 53.) Log on using an account with appropriate permissions to restore data.
Open NTBackup and select the Restore tab. The media you cataloged will still be present. This time, locate and select the most recent System State and Differential backup sets. The previous operation might have restored settings related to how NTBackup operates, so you might need to revisit the Options dialog box to make sure that restored files will overwrite the files on disk.
After you've made your selections and you're satisfied with your restore location and overwrite settings, click the Start Restore button. NTBackup will display a warning message about overwriting the System State. Click OK on the warning dialog box, then select the Advanced Restore Options button. When performing a nonauthoritative restore of AD, you must select the Restore junction points and restore file and folder data under junction points to the original location option. Verify that the other settings in the Options dialog box meet your needs, then click OK twice to begin the restore. NTBackup will prompt you to insert appropriate media if it isn't already in the drive and ask you to reboot the server following the restore.
Restore Open Files
The server is now online and you've restored all your data, but a few steps remain to finish the recovery process. You will recall that you wrote a quick script to back up the DHCP and WINS database files in the \%systemroot%\svcbak directory. To restore those two services to their predisaster state, you need to reverse the initial process you used to back them up.
For the DHCP database files, perform the following steps:
- Stop the DHCP service by typing at the command prompt
net stop dhcpserver
- Delete all files from the \%systemroot%\system32\dhcp directory.
- Copy all files from the \%systemroot%\svcbak\dhcp directory to the \%systemroot%\system32\dhcp directory.
- Restart the DHCP service by typing at the command prompt
net start dhcpserver
For WINS, perform the following steps:
- Stop the WINS service by typing at the command prompt
net stop wins
- Delete all files from the \%systemroot%\system32\wins directory.
- Copy all files from your chosen WINS backup location to the \%systemroot%\system32\wins directory.
- Restart the WINS service by typing at the command prompt
net start wins
Test the Server and Services
After you restart the services, use their respective consoles to verify the services are behaving properly; if possible, make sure the services are responding appropriately to client requests. Also, verify the functionality of other critical services and file systems on the server. If any problems exist, you'll hear about them from your users. By looking for any mistakes that require another restore from tape, you can head off problems now.
If You Really Need to Know, Test It
The procedure I've outlined for restoring your data after a disaster should serve as a model for drafting your own recovery process. A solid backup strategy and offsite storage of media and recovery documentation are keys to ensuring the recoverability of your servers. Slight variations in your environment might necessitate modifications to this process.
The only way to know exactly what's required for a foolproof recovery is to step through the process at least once (using a test server, not a production server), document all phases of the process, and create a collection of everything you used (e.g., tape drive and SCSI drivers, documentation of your server's disk configuration) to ensure a successful recovery. If possible, place these items, as well as a step-by-step procedure for executing the recovery, in a recovery kit and place the kit at your offsite media storage location. If you don't have the time to create your own document, perhaps you can use this article as a generic substitute.