Computing at UW-MadisonDivision of Information Technology
Students Faculty/Staff Services Services A through D Services E through L Services M through R Services S through Z Help Desk Tech Store About DoIT   

Bucky Backup

Windows Disaster Recovery

We currently only have disaster recovery instructions for Windows. Please read through this entire page before trying anything. The DoIT-recommended process is described directly below. The official IBM / Tivoli process is linked at the end of this page. Regardless, make sure you are running a supported TSM client.

DoIT-Recommended Method:

DoIT recommends that you maintain monthly disk images of your system drive (usually C: drive) along with your TSM backups. They should be stored on an external drive, burned to CD/DVD's, or stored on another machine different from the one you are backing up with TSM. Some options for this are:

  • Drive Snapshot. This program is a single-file executable that can create disk images of your system drive while Windows is up and running. DoIT Systems Engineering uses this program to make monthly disk images of all Windows Servers on our platform. It has a fully functional 30-day trial period and is relatively cheap to purchase.
  • Altiris Deployment Solution. UW-Madison has a site license for this program, so it is free for UW-Madison faculty/staff to use on campus.
  • Symantec Ghost. Ghost is one of the oldest & most well-known disk imaging applications.

For Domain Controllers, it is imperative that you know your Active Directory Restore Mode password. If you don't know what it is, you can reset it: Windows 2003 | Windows 2000.

In addition to the disk images themselves, you will need a way of restoring a disk image onto a machine that has crashed. Altiris & Ghost include utilities to make Boot CD's for this purpose, but Drive Snapshot does not. However, you can create a Bart PE CD or bootable USB drive that includes Drive Snapshot.

In the event of a system crash where you do have a recent disk image that is at least up to the same Service Pack level as your system was when it crashed, the disaster recovery process is fairly simple:

  • Restore your most recent disk image to the system. Reboot.
  • Press F8 during the initial boot process to get the Windows boot menu:
  • If you are restoring a Domain Controller, follow these steps, otherwise jump down to the Stand-alone Servers or Workstations section:
    • Select Directory Services Restore Mode.
    • At the logon prompt, enter Administrator for the username, and your AD Restore Mode password for the password.
    • Launch the TSM Backup-Archive GUI client.
    • Restore all file-level data back to your system drive (usually C: drive) in its original location. Overwrite all existing files, and DO NOT reboot at the end.
    • Restore all components of System Object (Windows 2000), or System Services & System State (Windows 2003). Reboot only after all components have been restored. You have just restored Active Directory to this machine non-authoritatively.
    • Reboot to regular mode and verify that Active Directory is functioning correctly. Check Event Log entries & try some manual replications in Active Directory Sites & Services. If things look good, you can start restoring any other file-level data that you want.
    • If things are not working correctly, start over from the beginning and click the "Point In Time" button in the TSM Backup-Archive GUI client and set it to 24 hours prior to your last attempted restore before restoring file-level & System Object / System Services & System State.
    • If that still doesn't work, but you're sure the version of Active Directory you restored is OK for your entire domain to revert to, you can do an Authoritative restore. To do this, after you restore the data & reboot, press F8 and boot to Directory Services Restore Mode again, and click the appropriate link below. Do this only as a last resort because it can cause complications:
  • Stand-alone Servers or Workstations:
    • Select Safe Mode with Networking.
    • Logon as a user with administrator-level privileges.
    • Launch the TSM Backup-Archive GUI client.
    • If you suspect that the most recent data backed up to TSM may be corrupt, you can click the "Point In Time" button and set it to a day or 2 before today's date.
    • Restore all file-level data back to your system drive (usually C: drive) in its original location. Overwrite all existing files, and DO NOT reboot at the end.
    • Restore all components of System Object (Windows 2000 & XP), or System Services & System State (Windows 2003). Reboot only after all components have been restored.
    • Your system should now be back in the state it was after your last successful TSM backup. If things look good, you can start restoring any other file-level data that you want.

IBM / Tivoli Method

Alternatively, you can use the TSM method of doing disaster recovery. It takes a lot longer, but it can be done:

  • Windows 2000 information, provided by Berbee. Please email Kevin Flynn if you would like a copy. Ask for disaster recovery instructions for Windows 2000 in conjunction with TSM backups. The instructions are verified to work, but unsupported by DoIT.
  • Windows XP & 2003 ASR w/ TSM Documentation. Written by IBM / Tivoli.