JSI Tip 3200. How do I recover Windows 2000?

If you are ever required to recover a Windows 2000 system, it will be a lot easier if you are prepared.

There is no substitute for taking frequent backups, using a reliable, supported, backup device.

In addition to the steps in this document, I take differential and full backups of users home folders, User profiles, databases, and other corporate data.

If you don't have a backup device, you will require the disk space to backup system files , profiles, and the registry.

NOTE: If required, you can omit the system files and run the Repair System Files process.

Most Windows 2000 problems can be resolved by having the following:

1. A current ERD - Emergency Repair Disk. See tip 2532

2. A System State backup, which includes:

 - The registry, also copied to the %systemRoot%RepairRegBack folder.  - Boot files, including the system files, and all files protected by Windows File Protection (WFP).  - Active Directory (on a domain controller only).  - Sysvol (on a domain controller only).  - Certificate Services (on certification authority only).  - Cluster database (on a cluster node only).  - Performance counter configuration information.  - Component Services Class registration database.  - A copy of the NTUser.DAT for the logged on user to the %systemRoot%RepairRegBack folder.

3. A backup of the user profiles, Documents and Settings. If roaming profiles are employed, this would be on a server, otherwise, on the local workstation.

You CAN centrally manage the creation of the required objects!

I prefer to schedule the creation the required objects on the local machine. I then back them up, but you can leave them on the local hard drive and/or copy them to a network share, \ServerNameShareName$%ComputerName%.

1. The ERD contains:

setup.log   - from the %SystemRoot%repair folder.autoexec.nt - from the %SystemRoot%System32 folder.   config.nt   - from the %SystemRoot%System32 folder.

To create one, simply copy the files to aformatted diskette.

If you enable the Recovery Console: Allow floppy copy and access to all drives and all folders policy, you could also create an ERD from the Recovery Console, by typing:

batch makeERD.txt, a batch file which should be located in the %SystemRoot% folder. It contains:

set AllowWildCards = TRUEset AllowAllPaths - TRUEset AllowRemovableMedia = TRUEset NoCopyPrompt = TRUEcopy c:winntrepairsetup.log a:setup.logcopy c:winntsystem32autoexec.nt a:autoexec.ntcopy c:winntsystem32config.nt a:config.nt

When using an ERD:

ALWAYS run a Manual Repair.

NEVER use a Setup.log created on another computer.

ALWAYS repair the registry by copying a matched set of registry hives, from the %systemRoot%RepairRegBack folder, or the backup of same, to the %SystemRoot%System32Config folder, using the Recovery Console.

NOTE: If you know what you are doing, you don't need to copy all the hives.

NOTE: If your system is bootable, you can use any supported method of restoring the registry. I prefer RegSafe.

NOTE: The Setup.log file changes when:

- You apply a Service Pack,

- Install/remove Windows components.

- Update drivers.

- The System State changes.

NOTE: If repairing System files and restoring the Registry does NOT fix your problem, using Setup to perform an in-place upgrade generally will, though you might lose some customized settings of your system files. I do it from a SlipStream, and haven't lost anything that I am aware of.

NOTE: To reapply your hotfixes, use 1981 A better way to reapply Service Packs and Hotfixes.

2. To create the System State backup, use the technique in tip 2500.

Since the folder structure should be the same throughout your enterprise, copy the .job file to all your computers:

Copy name.job \c$winnttasks*.*, create any required folders, copy the .bks and batch files.

3. To backup the users profile, decide what you can afford. I backup everything, including the users data, but you could exclude that. If the profile is local, just add the folder(s) to the backup. If the profiles are centrally located, create a backup on the server.

I run differential backups daily and a full backup on the weekend. A differential backup includes all files whose archive bit is set, and it does NOT reset the archive bit at the end of the backup. The full backup includes all the files in the selected folders, and resets the archive bit.

NOTE: If you upgraded from Windows NT, the local profile is located at %SystemRoot%ProfilesUserName.

Summary

To recover a Windows 2000 system:

1. You can run the repair process.

2. Restore missing or corrupt files.

3. Restore the profile, and the the user's NTUser.dat file , which is their HKEY_CURRRENT_USER hive.

4. Restore the System State, including the Registry.

5. Perform an in-place upgrade.

6. Use the recovery console, when necessary.

NOTE: See 2809 How do I restore selected registry keys/values to there initial setting?

NOTE: When you choose to restore the System State, you can NOT select individual files within it. You can choose to restore to a different location and then move individual files.

NOTE: See tip 2038 What is a Windows 2000 Safe Boot?.

NOTE: See tip 2319 How can I automate a Safe-mode boot?.

To recover a Domain Controller, use Directory Services Restore Mode.

NOTE: See 2782 Recovery Console Administrator password on a domain controller?

NOTE: See tip 2817 Repairing, Recovering, and Restoring an Installation of Windows 2000.