Scheduling Command-Line Win2K Backups

The arrival of a new Windows 2000 server outfitted with Quantum's DLT 7000 tape drive convinced me that it was time to retire the old Windows NT 4.0 server that I'd been using to do tape backups. So, I needed to rescript my backups for Win2K. I didn't expect Win2K's NTBackup to be much different from NT's, but I discovered they are quite different.

My backup approach is simple: Every Monday, I put a tape in the drive. That night, I run at.exe and use the Schedule service to erase the tape and do a full backup. Every subsequent night of the week, I schedule a differential backup. I rotate several tapes and keep a recent backup offsite. Although my approach isn't enterprise-level, it works—and it requires that I write only two batch files: one for the complete backup and one for the differential backup.

The bare minimum syntax for a command-line backup is

ntbackup backup  

where directory is the name of the directory you want to back up (I explain the tapetype value later). Win2K lets you specify the name of a backup selection (.bks) file, which contains a list of directories and files to back up. To indicate that the file is a .bks file, you prefix the file's name with the at (@) character. To make a .bks file, open Notepad and list the directories or files that you want to back up, one to a line. You can add the line

systemstate

to back up the registry and—if the server is a domain controller (DC)—Active Directory (AD). To skip a file or directory, add a line that specifies the name of the file or directory that you want to skip, followed by the /exclude parameter. If I want to back up C:stuff, C:mystuff, and the registry but not the C:mystuffpst directory, I'd type

c:stuffc:mystuffc:mystuffpst /excludesystemstate

Next, I'd save the file—I'll call mine C:files.bks. The only catch is that when I save the file in Notepad, I need to choose Unicode encoding (from the Encoding drop-down list box in the Save As dialog box) instead of the default ASCII encoding. After saving the .bks file, I put it into action by starting NTBackup:

ntbackup backup @c:files.bks 

NTBackup has many other options. I usually add the following options to my differential backup:

/v:yes /hc:on /a /m differential /l:f

The /v:yes option tells NTBackup to verify the backup. The /hc:on option activates hardware compression on tapes that support it. The /a option appends the backup to the tape without erasing existing data—if you don't use the /a option, your backup will overwrite other backups on the tape. The /m differential option tells NTBackup to copy files whose archive bits are set but not to clear those bits. Alternative values for this option are normal, which specifies a full backup and is the default; incremental, which is similar to differential but clears the archive bits; daily, which copies only files that have changed that day (and doesn't clear the archive bits); and copy, which is like a full backup but doesn't reset the archive bits. The /l:f option creates an extensive (i.e., complete) log file. Alternatively, you can opt for /l:s (summary log—the default) or /l:n (no log).

Speaking of log files, another oddity about Win2K's NTBackup program is its hidden log files. You'd expect the log files to be easy to find, but Microsoft has put them in a hidden folder inside a hidden folder inside a hidden folder. Whenever you create a backup, NTBackup creates a log file named backupnn.log, where nn can range from 01 to 10. NTBackup keeps only the last 10 logs, rotating the numbers and overwriting older logs as necessary. You can view the logs by starting the Backup GUI application and choosing Tools/Reports, or you can find the files in Documents and SettingsusernameLocalSettingsApplicationDataMicrosoftWindows NTNtbackupData (where username is the username of the person who initiated the backup). However, if you use at.exe to schedule the backup, the logs go into Documents and SettingsDefault UserLocal SettingsApplication DataMicrosoftWindows NTNtbackupData.

Finally, specify the tape drive to use for the backup. Although you usually have only one tape drive, you still need to specify it. Unlike NT's NTBackup, Win2K's utility delegates control of the tape drive to a subsystem, called the Remote Storage Manager (RSM). And RSM's way of managing tape drives has a side effect: You use different syntax to tell NTBackup to overwrite data on the tape than you use to append a backup. To tell NTBackup to overwrite data, you use

ntbackup backup @c:files.bks  /v:yes /hc:on /m differential  /l:f /p "" /um

where the /p switch specifies that you want to use media from the media pool, and tapetype is a tape-drive description (e.g., DLT, 4 millimeter—mm—DDS). The /um switch tells NTBackup to find the first available media of the specified type, format it, and use it for the backup.

To determine what type your tape is, first—if you've never done so on your system before—start Backup (click Start, Programs, Accessories, System Tools, Backup), then close it. Next, right-click My Computer, select Manage, and navigate to StorageRemovable StorageMedia PoolsBackup. You should see one or more folders, and one of those folders' names is your tape type. My system, for example, has a folder named DLT under Backup. If you see no folder under Backup, RSM doesn't have a driver for your tape drive.

Thus, if I have a 4mm DAT tape whose type shows up as 4mm DDS, I would use the following command to tell NTBackup to wipe whatever is on the tape and do a full backup of my files:

ntbackup backup @c:files.bks  /v:yes /hc:on /m normal /l:f  /p "4mm DDS" /um

I'd put that command in my batch file and tell at.exe to run that batch file every Monday morning.

Next, I want to tell the system to do daily differential backups to the same tape the rest of the week. To append backups, you use the /g option instead of the /p "tapetype" /um syntax:

ntbackup backup @c:files.bks  /v:yes /hc:on /a /m differential  /l:f /g ""

where guid is the tape drive's globally unique identifier (GUID). Win2K is rife with GUIDs. Each removable storage device gets a GUID, and every tape that you format on a Win2K system gets a "physical media" GUID. Like hard disks, each tape has partitions—typically one per tape—and every partition gets a partition GUID. Within that partition is one "logical media," which gets a logical media GUID. NTBackup needs that logical media GUID.

Acquiring that GUID is the stumbling block in the otherwise simple process of building the batch file. To fetch GUIDs, you use the Rsm View command:

rsm view /t  [/guiddisplay] [/cg]

Choices for object-type include library (to list your drives), physical_media (to show the tapes in a drive), partition (to get the tape's partition) and logical_media (to show the tape's logical media). The /guiddisplay parameter lists objects and their GUIDs. The /cg parameter lets you specify what object you want to examine; guid is the object's GUID. To find the GUID of your tape drive, type

rsm view /tlibrary /guiddisplay

RSM will probably list several drives. The 32-character string to the right of your tape drive's name is the drive's GUID.

Then, create the diff.cmd batch file that Listing 1 shows. Locate the line that corresponds to callout A in Listing 1 and replace the string that follows the equal sign (=) with your drive's GUID. This GUID will never change. (Logical media GUIDs change every time you erase the tape, but diff.cmd handles those changes.)

Ugly as it is, diff.cmd is fairly simple. It uses the drive's GUID to ask RSM for the GUID of the tape that's in the drive, uses the tape's GUID to find the tape partition's GUID, then uses that GUID to get the logical media's GUID. Diff.cmd reformats the GUID to the format that NTBackup requires by adding hyphens in certain places in the GUID string (e.g., E30ADF03-E801-4BA4-BB82-4AD69B39FBE7).

Before I finish, let me pass along three Win2K NTBackup anomalies. First, typical backups have a bug that causes them to fail to reset archive bits on random files. (Let's hope for a Service Pack 3—SP3—fix.) Second, NTBackup won't back up to CD-R discs, CD-RWs, DVD-RWs, or similar drives. And third, you can use the command line only to back up; to restore, you must use the GUI.