Tivoli Storage Manager Recovery TechniquesUsing Windows Pre-installation Environment(Windows PE)

By Jason Basler, Mike Dile, Don Moxley, Jey Somaskanthan , Evan ChiuVersion 2.6

iii

Copyright Notice

Copyright IBM Corporation 2009. All rights reserved. May only be used pursuantto a Tivoli Systems Software License Agreement, an IBM Software LicenseAgreement, or Addendum for Tivoli Products to IBM Customer or LicenseAgreement. No part of this publication may be reproduced, transmitted,transcribed, stored in a retrieval system, or translated into any computerlanguage, in any form or by any means, electronic, mechanical, magnetic,optical, chemical, manual, or otherwise, without prior written permission ofIBM Corporation. IBM Corporation gra nts you limited permission to make hardcopyor other reproductions of any machine -readable documentation for your own use,provided that each such reproduction shall carry the IBM Corporation copyrightnotice. No other rights under copyright are granted wi thout prior writtenpermission of IBM Corporation. The document is not intended for production andis furnished “as is” without warranty of any kind. All warranties on thisdocument are hereby disclaimed, including the warranties of merchantability andfitness for a particular purpose.

U.S. Government Users Restricted Rights -- Use, duplication or disclosurerestricted by GSA ADP Schedule Contract with IBM Corporation.

Trademarks

IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, Cross -Site, NetView, OS/2,Planet Tivoli, RS/6000, Tivoli Certified, Tivoli Enterprise, Tivoli EnterpriseConsole, Tivoli Ready, and TME are trademarks or registered trademarks ofInternational Business Machines Corporation or Tivoli Systems Inc. in theUnited States, other countries, or both.

Lotus is a registered trademark of Lotus Development Corporation.Microsoft, Windows, Windows NT, and the Windows logo are trademarks ofMicrosoft Corporation in the United States, other countries, or both.UNIX is a registered trademark of The Open Group in the United States and othercountries.C-bus is a trademark of Corollary, Inc. in the United States, other countries,or both.PC Direct is a trademark of Ziff Communications Company in the United States,other countries, or both and is used by IBM Corporation under license.ActionMedia, LANDesk, MMX, Pentium, and ProShare are trademarks of IntelCorporation in the United States, other countries, or both. For a complete listof Intel trademarks, see http://www.intel.com/sites/corporate/tradema rx.htm.SET and the SET Logo are trademarks owned by SET Secure Electronic TransactionLLC. For further information, see http://www.setco.org/aboutmark.html.Java and all Java-based trademarks and logos are trademarks or registeredtrademarks of Sun Microsystems, Inc. in the United States and other countries.

Other company, product, and service names may be trademarks or service marks ofothers.

Notices

References in this publication to Tivoli Systems or IBM products, programs, orservices do not imply that they will be available in all countries in whichTivoli Systems or IBM operates. Any reference to these products, programs, orservices is not intended to imply that only Tivoli Systems or IBM products,programs, or services can be used. Subject to valid intellectual property orother legally protectable right of Tivoli Systems or IBM, any functionallyequivalent product, program, or service can be used instead of the referencedproduct, program, or service. The evaluation and verification of operation inconjunction with other products, except those expressly designated by TivoliSystems or IBM, are the responsibility of the user. Tivoli Systems or IBM mayhave patents or pending patent applications covering subject matter in thisdocument. The furnishing of this document does not give you any license tothese patents. You can send license inquiries, in writing, to the IBM Directorof Licensing, IBM Corporation, North Castle Drive, Armonk, New York 10504 -1785,

iv

U.S.A.

1

About the Tivoli Field Guides

SponsorTivoli Customer Support sponsors the Tivoli Field Guide program.

AuthorsThose who write field guides belong to one of these three groups:

Tivoli Support and Services Engineers who work directly with customers Tivoli Customers and Business Partners who have experience using Tivoli software in a

production environment Tivoli developers, testers, and architects

AudienceThe field guides are written for all customers, both new and existing. They are applicable toexternal audiences including executives, pr oject leads, technical leads, team members, and tointernal audiences as well.

Types of Field GuidesTwo types of Tivoli Field Guides describe how Tivoli products work and how they are used in reallife situations:

Field Guides for technical issues are des igned to address specific technical scenarios orconcepts that are often complex to implement or difficult to understand, for example:endpoint mobility, migration, and heartbeat monitoring.

Field Guides for business issues are designed to address specific business practices thathave a high impact on the success or failure of an ESM project, for example: changemanagement, asset Management, and deployment phases.

PurposesThe Field Guide program has two major purposes:

To empower customers & business part ners to succeed with Tivoli software bydocumenting and sharing product information that provides accurate and timelyinformation on Tivoli products and the business issues that impact an enterprise systemsmanagement project

To leverage the internal knowledge within Tivoli Customer Support and Services and theexternal knowledge of Tivoli customers and Business Partners

AvailabilityAll completed field guides are available free to registered customers and internal IBM employeesat the following Web site:

http://www.ibm.com/software/sysmgmt/products/support/Field_Guides.html

Authors can submit proposals and access papers by e -mail:mailto:Tivoli_eSupport_Feedback@us.ibm. com

2

INTRODUCTION .......................................................................................... 3

HARDWARE/SOFTWARE REQUIREMENTS........................................... 5

PREPARATION OVERVIEW ...................................................................... 6

Obtaining the WinPE Client ................................ ................................ ................................ ......... 6Preparing a Network Share Containing the TSM Client ................................ .............................. 6Including TSM in Bart PE ................................ ................................ ................................ ............. 8Creating the Backup ................................ ................................ ................................ .................... 9Document the System Disk Partitioning ................................ ................................ .................... 11

IMAGE RESTORE PROCEDURE OVERVIEW ....................................... 13

FILE–LEVEL RESTORE PROCEDURE.................................................... 14

RESTORING A WINDOWS SYSTEM (NOT A DOMAINCONTROLLER) USING INCREMENTAL IMAGE RESTORE............... 16

RESTORING A WINDOWS 2000 SERVER DOMAIN CONTROLLER. 17

RESTORING A WINDOWS SYSTEM BACKED UP OFFLINE FROMWINDOWS PE ............................................................................................. 19

RESTORING A SYSTEM WITH A DYNAMIC BOOT VOLUME ......... 21

QUESTIONS AND ANSWERS .................................................................. 21

DIAGNOSTIC TIPS ..................................................................................... 23

REFERENCE INFORMATION .................................................................. 24

3

Tivoli Storage Manager Recovery TechniquesUsing Windows Pre-installation Environment(Windows PE)

Audience

This field guide is intended for storage administrators and skilled technical support personnel whoneed to recover Windows 2000, Windows XP , Windows 2003, Windows Vista, and Windows2008 systems from a catastrophic system or hardware failure. This guide assumes technicalproficiency with installation, configuration, and use of Windows systems with the Tivoli StorageManager (TSM) Backup-Archive client.

1IntroductionThe current Windows Bare Metal Restore (BMR) procedures using Tivoli Storage Manager (TSM)are dependent on Microsoft Automated System Recovery (ASR) or on having a functioningoperating system from which to run the backup/archive client. Installation of this base operatingsystem as a pre-requisite to performing system recovery can be time consuming. An alternativemethod is to copy a base operating system from an image, rather than running through the fullWindows installation procedure. In the past, third party imaging utilities such as Symantec’sGhost™ have been required to perform the image copy. Using Microsoft Windows Pre -installationEnvironment (WinPE) or Nu2 Production’s Bart's Preinstalled Environment (BartPE), the imagebackup / restore facility in TSM can now be used for creating and recoverin g from an operatingsystem image. In addition, for certain platforms, the online image backup feature in TSM can beused to take full system drive backups of running systems. When combined with traditionalincremental backup and system state backup, a very fast system recovery scenario becomespossible in situations where you are restoring to identical hardware.

The pre-installation environment provides a temporary operating system that is bootable from aCD and provides access to the volumes on a system's hard disk drives. Network connectivityconfigured through DHCP is also available after booting, so the TSM client program can beexecuted from a network drive, and network restor es from a TSM server are possible. Becausethe pre-installation environment runs directly from the CD, the local drives are unlocked andtreated simply as additional data drives. Any operating system installed on the disk volumes orrestored using TSM is not loaded while the pre-installation environment is running. For thisreason, the operating system installed on the local disk and the operating system that runs in thepre-installation environment have no interaction. This enables scenarios such as recovering aWindows 2003 operating system using a pre-installation environment based on the Windows XPoperating system. The term WinPE is used throughout the remainder of this document to refer toa booted pre-installation environment using either WinPE or BartPE.

Note: BartPE can be a useful al ternative to WinPE. However, you need to carefully review theMicrosoft licensing discussion on the www.nu2.nu website and your specific Microsoft EULAbefore using it at your site.

The following table summarizes the TSM image backup and restore methods in conjunction withWinPE that are available for various Windows operating systems:

4

Table 1: TSM image backup and restore methods for different versions of Windows operatingsystems

Windows2000

WindowsXP 32-bit

Windows2003, 2008,Vista 32-bit

Windows2003, 2008,Vista x64

Windows2003, 2008IA-64 1

TSM onlineimage backupusing LVSA

Yes Yes Yes Yes No

TSM onlineimage backupusing VSS 2

No No Yes Yes No

TSM offlineimage backupfrom WinPE

Yes Yes Yes Yes No

TSM imagerestorerunning inWinPE

Yes Yes Yes Yes No

What’s New in Version 2.6:o Added clarification regarding compatibility problems while restoring certain operating

systems with PE boot discs created using different operating systems .o Documented restrictions with file -level restore techniques for Windows 2008 and Vista

operating systems.o Added additional BCDEDIT commands to issue for Windows 2008 and Vista following

image restores, which avoid boot problems af ter system recovery.

What’s New in Version 2.5: Provided documentation for recovery of Windows x64 operating systems. Added updated information to include support for Windows 2008 and Windows Vista. Updated installation and configuration steps to include information necessary for running

TSM 5.4 and 5.5 client levels in WinPE. Added instructions for file–level restore techniques from within WinPE.

What’s New (previously): Support for single drive online-image backup Support for recovery with pre-installation environments created using Bart's PE Builde r Redirection of the error log to a writable media to bypass error log restriction

TSM image restore commands specify a destination volume using a drive letter. Under certainsituations, WinPE will map volumes to different drive letters than the system f rom which thebackup was performed. For this reason, it is important to collect information on the volume layout

1 WinPE recovery using TSM has not been tested on Windows IA64 operating systems runningon Itanium processors.

2 The online image with VSS support is available beginning with TSM 5.5.

5

at the time of backup and compare it to the layout presented by WinPE to ensure that yourvolume target during restore is correct. The image backup feature of TSM can backup FAT,FAT32, and NTFS volumes. When backing up NTFS volumes, the TSM client only sends usedregions of the volume to the TSM server by default.

Using WinPE to restore volume images to different hardware is not supported . See the Questionsand Answers section for more details.

2Hardware/Software RequirementsHardware

There are currently no known hardware limitations. In some cases, hardware drivers needed fordisk controllers and network adapters may not be available i n the base version of WinPE or theWindows CD used to build BartPE.3

TSM

A TSM Windows client version of V5.4.0 or newer is required for running in WinPE.

Note: the TSM 5.5 client packages require restructuring in order to run in WinPE. Thespecifics are documented in the Preparation section of this document.

A TSM server version of V5.4.0 or newer is recommended. A 5.1.x or newer level isrequired for support of TSM image backup. If you are backing up Windows 2003systems, including system state and system services, then a TSM server version of 5.2.2or newer level is required.

A second Windows system is required for sharing the TSM client application forexecution within WinPE. If you have included the TSM client in your pre-installation CD,this is not required.

The option -asrmode=yes is required when running TSM commands in WinPEenvironments built from Windows 2003, Windows Vista, or Windows 2008 . The asrmodeoption is used to prevent TSM from invoking the Microsoft VSS se rvices, which are notavailable while running WinPE. Without this option, the TSM client will fail to start.

WinPE

A bootable WinPE CD is required. A DHCP server may be required on your network to allow anetwork address to be assigned to your system wh en booting from WinPE. Some PEenvironments allow a static address to be assigned to the system after booting.

Recovery of the following Microsoft operating systems has been tested:

Windows 2000

3 Consult the documentation provided with your pre -installation tools on how to include additionaldevice drivers on your bootable PE environment. Both BartPE and the Windows AutomatedInstallation Kit (WAIK) provide this capability .

6

Windows XP

Windows 2003

Windows 2008

Windows Vista

There are a few considerations when deciding which operating system base to use whenconstructing a WinPE CD for system recovery purposes. Problems have been encountered whileattempting image recovery of Windows 2003 servers using a newer Windows 2008 based PE 2.0boot CD, as well as, attempting to restore a Windows 2008 operating system usin g an olderoperating system on the PE CD such as Windows XP . The problem appears to result from theinability of the diskpart program (included with boot CD) to create a bootable partition for adifferent operating system type. To avoid these types of problems, use the same operatingsystem for the PE boot CD that is used in the system that is being recovered.

You should test WinPE with your hardware to ensure that it wil l work before you are faced with asituation requiring a restore.

3Preparation OverviewObtaining the WinPE Client

The following web site contains reference information related to Microsoft Windows AutomatedInstallation Kit (Windows AIK.)

http://technet2.microsoft.com/WindowsVista/en/library/129a1712 -e3d8-46c1-bc09-a14349dc67db1033.mspx?mfr=true

Obtaining the BartPE Client

The following web site contains information on how to download and build the CD from yourWindows installation media:

http://www.nu2.nu/

Preparing a Network Share Containing the TSM Client

These procedures assume you are using a Windows PE boot CD, which does not include a TSMclient. For this reason, the TSM client program must be accessed from a network drive.Alternatively, you can bundle the TSM client into your WinPE CD using custom WinPE imagebuild procedures. If you are using BartPE, a custom plug-in can be created to include the TSMclient when the CD is built rather than using a network drive.

To configure the TSM client to run from a network share, copy the TSM Client installationpackage directory from the TSM deskto p clients CD into a shared folder . You can also run the

7

self-extracting installation FTP package of the TSM Windows client. If you are extracting from theFTP package, cancel the install when the language selection prompt appears. T he extraction willthen be complete.

The following instructions can be used to configure the TSM client to run from a network share:

1. Create a shared folder on your system, for example, c: \tsmshare.

C:\>md c:\tsmshareC:\>net share tsmshare=c:\tsmshare

2. Extract the TSM client from the FTP package but do not install the TSM client. If youhave a TSM client CD, the files are already extracted on the CD . Copy the installationfiles into c:\tsmshare. This should result in the TSM client program files residing in thefolder:

x32 client:c:\tsmshare\Program Files\Tivoli\TSM\baclient

x64 client:c:\tsmshare\Program Files 64\Tivoli\TSM\baclient

3. For the TSM 5.5 client, the dsmc-pe.cmd or dsmc-pe-x64.cmd command script mustbe executed to restructure some files within the TSM client installation package need forrunning within WinPE.

x32 client:cd c:\tsmsharec:\tsmshare\dsmc-pe.cmd set

x64 client: (available in 5.5.1 and later clients)cd c:\tsmsharec:\tsmshare\dsmc-pe-x64.cmd set

4. Create a file named tsmwinpe.cmd which will establish the environment needed to runTSM from the shared drive. You can choose to map the TSM share to a different driveletter. The required commands can be entered into a WinPE c ommand prompt, or storedon removable media so that it will be available from the system running WinPE. Here isan example of the file contents:

x32 client:net use z: \\yourmachine\tsmshareset path=%path%;z:\system32;z:\program files\tivoli\tsm\baclientset path=%path%;z:\program files\tivoli\tsm\baclient\pluginsz:cd \program files\tivoli\tsm\baclient

x64 client:net use z: \\yourmachine\tsmshareset path=%path%;z:\system64set path=%path%;z:\program files 64\tivoli\tsm\baclientset path=%path%;z:\program files 64\tivoli\tsm\baclient\pluginsz:cd \program files 64\tivoli\tsm\baclient

8

5. Create a TSM options file containing the correct node name and communication settingsin the baclient folder created by the extraction in step #2 . Optionally, this file can also becreated on removable media, and the DSM_CONFIG environment varia ble be set tolocate the file.

Sample dsm.opt: c:\tsmshare\Program Files\Tivoli\TSM\baclient\dsm.opt* communication settingstcpserveraddr firebat.storage.sanjose.ibm.comtcpport 1500nodename winpetestpasswordaccess prompt

* compression settings; uncomment if desired*compression yes

* performance tuning optionstxnbytelimit 25600tcpnodelay yestcpbuffsize 32tcpwindowsize 63

* redirect the error logerrorlogname a:\dsmerror.log

* Disable AES128 encryption libraries from lo adingencryptiontype DES56

Note: you will need to specify the location of the error log for the client to run correctly. Itis recommended that the errorlogname option be set in your option file to point to thefloppy drive or some other temporary drive available to the booted PE system .Alternatively, you can also specify the error log location in your batch file by setting theDSM_LOG environmental variable or allow for write permissions in the shared networkfolder.

Also note that offline image backup while booted to WinPE will fail with an errorunmounting the volume if the dsmerror.log is written to the volume you are attempting tobackup.

Use of the passwordaccess option within WinPE can be desirable if multiple TSMcommands will be used in succession. However, there is no way to use a password thatwas previously generated outside of WinPE, and a password generated in WinPE will notpersist after the system is restarted. Some TSM client levels may not be capable ofstoring a generated password in WinPE. In this case, you can provide the passwordusing the –password option to avoid prompting.

Including TSM in Bart PE

The Bart PE website contains detailed instructions on how to create a custom plugin to includeany application on your CD. Please consult their website for specific information . The TSM clientsetup files can be used as the source files. When specifying what files to copy into your CD, besure to include the files in the System32 folder along with the baclient folder.

9

Creating the Backup

Offline TSM Image Backup

An offline backup is performed after booting to WinPE, which ensures that the system drive willbe backed up in a consistent and offline state. This procedure has the disadvantage of requiring ashutdown of the machine to be backed up , but is useful for creating a volume-level recoveryimage.

By default, TSM image backup skips empty regions of a volume when backing up NTFS volumes.If you are backing up a non-NTFS file system or if you want to minimize the stored image size onthe TSM server, consider turning on the TSM compression option for efficiency. After performingthe image backup, you can use standard TSM incremental backup and system object backup toprotect the latest state of your operatin g system. Optionally, you can periodically repeat the offlineimage backup procedure to create a more current backup.

The following outlines the procedure used to perform an offline image backup from WinPE. Ifyour system files are on more than one file system, you will need to perform image backups foreach drive on which the system files reside .

1. Shutdown the system to be backed up

2. Boot from your WinPE CD

3. Run the tsmwinpe.cmd command script to set the required environment variables to runthe TSM client from a network share.

4. Confirm which drive letter WinPE has assigned to the system drive of the operatingsystem to be backed up. Use the “list volume” command in diskpart.exe to determinethis. If there is no drive letter assigned to the system drive of the operating system to bebacked up consult the diskpart.exe documentation to determine how to assign a driveletter to a selected volume.

5. Perform the TSM image backup. Note that the file space created on the TSM server willuse the current system generated machine name in the file space name on the TSMserver used to store the image backup. You can run “dsmc query image” to determinethe image backup file space name.

Z:\>dsmc.exe backup image c: -imagetype=static -asrmode=yes

6. Reboot the machine without the WinPE CD in the drive .

Online TSM Image Backup

Online image backup uses the TSM client LVSA or Windows VSS feature to allow the imagebackup to be performed while your operating system is running. 4 After performing the image

4 TSM online image backup performs a back up based on a snapshot of the OS while it isrunning. There is a chance that the snapshot will be taken at a point in which the operatingsystem is in an inconsistent state that will not boot at recovery time. Be sure to have alsodocumented and tested procedures for recovery using the reinstallation of the OS technique as a

10

backup, scheduled incremental and system object backups will protect the current state of youroperating system. Optionally, you can periodically perform additional image backups to reducethe number of files that will need to be restored along with the image restore. The following stepsoutline the general procedure required for performing an online image backup (note thisprocedure assumes that your system drive is contained on c:) :

1. Install the TSM LVSA feature. This step is not required with the TSM 5.5 and newerclients if you will use VSS as the snapshot provider.

2. Perform a full volume incremental backup of your system drive. This step is required ifyou would like to have the option of performing an incremental image restore with the-deletefiles option. The -deletefiles option automatically removes files which wereincluded in your original image backup, but were subsequently deleted from the operatingsystem. You might also want to perform online image and incremental backups of otherdrives on your system.

dsmc incremental c:

3. Perform an online image backup of the system drive. If you are using LVSA as thesnapshotprovider and TSM has difficulty creating a snapshot of your system drive, youmight need to vary the -snapshotidletimeout and -snapshotidleretries options to decreasethe amount of idle time expected by TSM and/or increase the number of snapshot retriesattempted by TSM. Also, any services or applications that access the drive, like the TSMJournal Service, will need to be stopped for the s napshot to complete successfully.

dsmc backup image c: -imagetype=snapshot

4. Perform an incremental backup of the system drive. This step should be repeated asfrequently as your backup policies require. Consider defining this backup to beperformed by the TSM scheduler. You should also back up the system state for yoursystem. These backups will allow you to restore your system to its most recent statefollowing the TSM image restore.

dsmc incremental c:dsmc backup systemstate

5. Repeat the previous step as frequently as required for your backup policies. Optionally,you can periodically repeat step #5, to create a more current image level backup.

File–level backup

Additional recovery techniques are available from file –level backups and systemstate back ups.These techniques are providing with limited support for advanced users who require additionalrecovery methods. The minimum backup includes a backup of the system drive and a backup ofthe systemstate.

1. Backup the system drive.dsmc incremental c:

2. Backup the system state.dsmc backup systemstate

backup plan. You also need this backup plan in the event you are not restoring to identicalhardware.

11

3. Backup the system services. (This step is not required with TSM 5.5 and newer clientlevels.)dsmc backup systemservices

Document the System Disk Partitioning

Document your system disk configuration using DISK PART.EXE prior to performing a backup.The diskpart program is available with most recent Windows releases . If you are runningWindows 2000, you can either copy it from another system running XP or 2003, or you can bootto WinPE and run diskpart. You can find documentation for the diskpart utility on themicrosoft.com website. For example:

http://technet.microsoft.com/en-us/library/bb490893.aspx

Consider printing documentation of your disk configuration and keeping it near your system in theevent that a restore becomes necessary. You can also keep track of disk layout and mappingusing either DSMC QUERY SYSTEMINFO or MSINFO32 from C: \Program Files\CommonFiles\Microsoft Shared\MSInfo. Use the following procedure to document the disk configurationusing diskpart.exe:

1. Create a file named diskpart.in containing the following lines. Update the script asneeded depending on the number of physical disks in your system.

list disklist volumeselect disk 0list partitionselect disk 1list partition

2. Run the diskpart.exe command with the /s switch, and direct the output into a file nameddiskpart.txt:

diskpart /s diskpart.in > diskpart.txt

12

Example OutputMicrosoft DiskPart version 1.0

Copyright (C) 1999-2001 Microsoft Corporation.On computer: WINPETEST

DiskPart is starting the disk management services.

Disk ### Status Size Free Dyn Gpt-------- ---------- ------- ------- --- ---

Disk 0 Online 34 GB 0 B Disk 1 Online 34 GB 0 B

Volume ### Ltr Label Fs Type Size Status Info---------- --- ----------- ----- ---------- ------- --------- --------

Volume 0 H CD -ROM 0 B Volume 1 C NTFS Partition 6997 MB Healthy System Volume 2 D WinXP NTFS Partition 6997 MB Healthy Volume 3 E Win2003NTFS NTFS Partition 6997 MB H ealthy Volume 4 F WIN03F32 FAT32 Partition 6997 MB Healthy Volume 5 G Backup NTFS Partition 6715 MB Healthy Volume 6 I GHOST FAT32 Partition 20 GB Healthy Volume 7 J Partition 14 GB Healthy

Disk 0 is now the selected disk.

Partition ### Type Size Offset------------- ---------------- ------- -------

Partition 1 Primary 6997 MB 32 KB Partition 2 Extended 27 GB 6997 MB Partition 3 Logical 6997 MB 6997 MB Partition 4 Logical 6997 MB 14 GB Partition 5 Logical 6997 MB 20 GB Partition 6 Logical 6715 MB 27 GB

Disk 1 is now the selected disk.

Partition ### Type Size Offset------------- ---------------- ------- -------

Partition 1 Primary 20 GB 32 KB Partition 2 Extended 14 GB 20 GB Partition 3 Logical 14 GB 20 GB

13

4Image Restore Procedure OverviewAfter booting to WinPE on the target machine, you will have access to all of the volumes used bythe primary operating system. In the event that you need to replace a damaged disk, you willhave access to the disks, but wil l need to recreate the volumes and in some cases format filesystems on them. When restoring TSM image backups, it is not necessary to format a file systembefore performing the restore since the file system is recovered from the backup. Be sure thatthe error log is not being written to the drive being restored. Doing so will prevent TSM fromdismounting the volume for image restoration. The following procedure lists the general WinPErestore flow. Later sections detail specific considerations for cer tain system configurations.

1. Boot WinPE on the machine you plan to restore. WinPE should provide a networkconnection with an address assigned through DHCP , or your WinPE version may providea utility for configuring a static address .

2. Use diskpart.exe to recreate the volume layout for your system. After the volume layoutis recreated, inspect the volume to drive letter mapping presented by WinPE, andcorrelate this with the mapping used by your initial operating system. There is apossibility that you will need to restore the TSM image backup to a different destinationdrive letter than the one assigned to the volume at the time the backup was taken. Imagerestore commands issued from WinPE need to specify the full source backup name inUNC format since WinPE boots with a different machine name than your normaloperating system.

Here is an example of recreating two partitions on a physical disk, one primary, and oneextended. The primary partition will be set to active, to allow the system to boot.Formatting of the first partition is not required, as the image restore will recreate the filesystem. Formatting the second volume is required since the recovered operating systemuses this volume to store swap files , and the file system will need to exist prior to bootingthe restored system. In general, a volume does not need to be formatted with a filesystem if a TSM image backup will be restored over the volume. In other cases, thevolume should be formatted with the same file system type that existed previously.

diskpart.exeselect disk 0cleancreate partition primary size=6997select partition 1assign letter=Cactivecreate partition extendedselect partition 2create partition logical size=8192select partition 3assign letter=Dlist volumeexit

14

format D: /fs:ntfs /v:swapdisk

3. Using the tsmwinpe.cmd file, m ap the network share containing the TSM client programcode, and set the environment variables required to run the TSM client from the networkshare. If you have not created this share yet, see the instructions in the section“Preparing a Network Share Containing the TSM Client.” For example, if you are usingthe tsmwinpe.cmd file on a floppy disk:

a:\tsmwinpe.cmd

4. Restore the image backup of your system volume. There are several vari ations of thisrestore command that are detailed in upcoming sections. The most basic restorevariation is given here. Note that the use of the -ASRMODE=YES option is required tobypass the attempted initialization of the Volume Shadowcopy Services (VSS) subsystemwhich is not present in a Windows Server 2003 WinPE environment. The query imagecommand can be used to determine the full name of the image backup object to restore,and to test your connectivity to the TSM server. The -virtualnode option is not required ifyou have specified the correct nodename option in the dsm.opt file. Passwordsgenerated by TSM are not available when running in WinPE, so the -virtualnode optionalso prevents unsuccessful attempts to store the TSM password in the Windows registry.

dsmc query image -asrmode=yes -virtualnode=tsmnodenamedsmc restore image \\backupmachinename\c$ c:\ –asrmode=yes–virtualnode=tsmnodename

5. For Windows 2008 and Windows Vista systems, the BCDEDIT program must be used torepair the system boot information prior to rebooting to the restored operating system.

bcdedit /set {bootmgr} device BOOTbcdedit /set {default} device BOOTbcdedit /set {default} osdevice BOOT

5File–level Restore ProcedureThis section documents a recovery procedure inten ded for advanced users that require analternative to the standard machine recovery procedures which involve restoring from file-levelbackups over a running operating system. Files are recovered from both the system drive backupand the systemstate backup using regular restore commands. The restore systemstatecommand cannot be used within WinPE. Very limited support is available for this recoverytechnique. It cannot be used for complete recovery of Windows 2008 or Windows Vista operatingsystems due to problems recovering boot files and the inability to correctly recover the hardlinks ,which are part of the systemstate .

1. Boot WinPE on the machine you plan to restore. WinPE should provide a networkconnection with an address assigned thr ough DHCP, or your WinPE version may providea utility for configuring a static address.

15

2. Use diskpart.exe to recreate the volume layout for your system . This step is optional,depending on your restore scenario and whether your system already has a worki ngpartition layout. See the previous section for additional details on using diskpart.

3. Format a file system on your system drive. This step is not required if the file systemalready exists, or depending on your recovery situation .

format c: /fs:ntfs /q

4. Run query filespace to determine the correct file space names to use in restorecommands.

dsmc query fi

5. Restore the required files. There are many possible restore scenarios. Severalexamples are given here to demonstrate the command syntax needed for differentplatforms and TSM levels.

a. Restore an entire system (system drive and system state) using the TSM 5.5client.

dsmc –virtualnode=mach1 –pass=pwtsm> rest \\mach1\c$\* c:\ -sub=yes -rep=alltsm> rest "{MACH1\SystemState\NULL\SystemState\SystemState}\*" c:\ -sub=yes -rep=all

Win2003: registry files must manually be copied from the temporary restorelocation to config directory:

copyc:\windows\repair\Backup\BootableSystemState\Registry\*c:\windows\system32\config

b. Restore an entire system (system drive and system state) using the TSM 5. 4client..

dsmc –virtualnode=mach1 –pass=pwtsm> rest \\mach1\c$\* c:\ -sub=yes -rep=alltsm> rest "{SYSTEM STATE}\*" c:\ -sub=yes

Win2003: registry files must manually be copied from the temporary restorelocation to config directory:

copyc:\windows\repair\Backup\BootableSystemState\Registry\*c:\windows\system32\config

c. Restore individual files from the systemstate backup using a TSM 5.5 client.

dsmc –virtualnode=mach1 –pass=pwtsm> rest "{MACH1\SystemState\NULL\SystemState\SystemState}\\mach1\c$|\windows\system32\config\*"c:\ -sub=y –preservepath=complete

16

6Restoring a Windows System (not a DomainController) Using Incremental Image Restore

The following procedure describes how to recover a Windows 2000, XP, Server 2003 , Vista, orServer 2008 system. This procedure assumes that your backup followed the correct procedure toallow for incremental image restore using the -deletefiles option, and that you have performedsystem state backups (system object backups for Windows XP and 2000 .) This restore methodallows you to bring your system back to its most current backup state. The default Windowsdirectories are used in this procedure. In the event that your Windows installation is not in thedefault location, modify the path appropriately. You can determine where your Windows dire ctoryis by looking at the SystemRoot environmental variable.

1. Perform the restore preparation steps outlined in the “Rest ore Procedure Overview”section excluding the restore image step.

2. Run query image to determine the machine name and drive letter of th e image backup

dsmc query image -asrmode=yes -virtualnode=tsmnodename

3. Restore the system drive image backup, including more recently backed up files from thesystem drive incremental backup. The -deletefiles options will remove any files that wererestored from the image backup, but were deleted from your system after the imagebackup was taken.dsmc restore image \\backupmachinename\c$ c: -asrmode=yes-noprompt -incremental -deletefiles -virtualnode=tsmnodename

4. Reboot to the restored operating system.

5. This step is only required if your are restoring a Windows 2000 or XP system, or if youare restoring a Windows 2000, XP, or 2003 system with a TSM client at level 5.3.4 orolder. The following commands can be used to pre -restore the Windows system fi leprotection catalogs:

Your Windows installation directory and drive letter may vary. The %systemroot% and%systemdrive% variables can be used to create a generic restore procedure if desired.Windows 2000:dsmc restore "{SYSTEM OBJECT}\winnt\system32\catroot\*"c:\winnt\system32\ -sub=yes -rep=allWindows XP:dsmc restore "{SYSTEM OBJECT}\windows\system32\catroot\*"c:\windows\system32\ -sub=yes -rep=allWindows 2003/Windows 2003 R2 for 5.3.4 and older client levels only:dsmc restore "{SYSTEM STATE}\windows\system32\catroot\*"c:\windows\system32\ -sub=yes -rep=all

6. Restore the entire system state (system object for older Windows releases.)

Windows 2000/XP:dsmc restore systemobject

17

Windows 2003/Windows 2003 R2 /Windows Vista/Windows 2008dsmc restore systemstate

7. Restore the system services. This step only applies to TSM 5.4 and olderclients since the system service components are included as part of thesystemstate backup beginning with TSM 5.5.

Windows 2003/2003 R2/Vista:dsmc restore systemservices

8. Reboot without the WinPE CD.

7Restoring a Windows 2000 Server DomainControllerThe following restore procedure is specific to the test configuration documented below. It caneasily be adapted for a domain controller with a different disk layout or a different operatingsystem such as Windows 2003.

Test configuration:1. IBM eServer xSeries 345, with 2 SCSI hard disks2. First disk is a basic disk, with C: as system/boot partition containing c: \winnt3. Second disk is a dynamic disk with three simple volumes on D:, E:, and F:4. NTDS database contained on D: \NTDS\DB5. NTDS log contained on E: \NTDS\LOG6. SYSVOL contained on F:\SYSVOL7. Win2000 advanced server installed, with SP3 and latest security hot fixes as of

02/27/20048. Configured as a peer domain controller in a domain with two pre-existing domain

controllers

Backup steps:1. Perform an all-local domain incremental backup which include s backups of c:, d:, e:, f:,

and system objects.

dsmc inc

2. Perform an online image backup of the system drive c:

dsmc backup image c:

3. Repeatedly perform the all-local domain incremental backup including system objects asrequired by your backup policy.

Restore procedure with two new hard disks on identical system:

18

The restoration procedures are performed on an identical system with two replacement harddisks of equal capacity as the original hard disks that were backed up .

1. Boot the system from a Windows PE CD.2. Reconstruct the partitioning of each disk. Note: when assigning drive letters to the newly

created volumes, be sure not to assign the same letter which is being used by WinPE forthe CD device. The letter assignments made while WinPE is running are temporary, anddo not reflect the assignments that will be used when the primary OS is booted. In thisexample, WinPE has assigned the drive letter D: to the CD device. The subsequentdrive letter assignments in this example avoid the use of D:.diskpart.exe

select disk 0cleancreate partition primary size=6997select partition 1assign letter=Cactiveselect disk 1cleanconvert dynamiccreate volume simple size=10240assign letter=Ecreate volume simple size=2048assign letter=Fcreate volume simple size=2048assign letter=Glist volumeexit

3. Format file systems on all drives except the system drive

format E: /fs:ntfs /v:NTDSDBformat F: /fs:ntfs /v:NTDSLOGformat G: /fs:ntfs /v:SYSVOL

4. Use the tsmwinpe.cmd to map the network share and set the required environmentvariables, then run the query image command to determine the machine name and driveletter of the image backup

a:\tsmwinpe.cmddsmc query image -asrmode=yes -virtualnode=tsmnodename

5. Run the query image command to determine the machine name and drive letter of theimage backup

dsmc query image -asrmode=yes -virtualnode=tsmnodename

6. Restore the system drive image backup, including more recently backed up files from thesystem drive incremental backup. The -deletefiles options will remove any files that wererestored from the image backup, but that were deleted from your system after the imagebackup was taken.

dsmc restore image \\backupmachinename\c$ c: -asrmode=yes

19

-noprompt -incremental -deletefiles -virtualnode=tsmnodename

7. Reboot the restored operating system into Directory Services Restore Mode. This isaccomplished by pressing F8 early in the Windows boot process, and selecting DirectoryServices Restore Mode from the list that is presented.

8. Since the second hard disk was recreated, Windows will require this disk to be imported,and drive letters to be re-assigned before it can be accessed. Run the Windows diskmanager from the computer management console to import the foreign dynamic diskand reassign the appropriate drive letters to the three simple volumes.

9. Restore the SFP catalog files from the system object first.

dsmc restore “{SYSTEM OBJECT}\winnt\system32\CatRoot\*”c:\winnt\system32\ -sub=yes -rep=all

10. From Directory Services Restore Mode , recover the remaining data drives and systemobjects. Do not reboot until after the final step, even if you are prompted to do so.

dsmc restore d:\* -sub=yes -rep=alldsmc restore e:\* -sub=yes -rep=alldsmc restore f:\* -sub=yes -rep=alldsmc restore systemobject

11. Reboot and allow Windows to start normally.

8Restoring a Windows System Backed UpOffline from Windows PEOffline image level backups can be performed against a system after bringing the system downand performing the backups from Windows PE. The test system for this scenario contained asingle IDE hard drive which was partitioned with a primary partition and two logical drives in anextended partition.

Backup steps1. Perform a full incremental backup of all local hard disks .

dsmc inc

2. Shutdown the Windows system, and boot from a CD to Windows PE.3. From Windows PE, back up each of the file systems using offline image backup

a:\tsmasr.cmddsmc backup image c: -asrmode=yes -imagetype=staticdsmc backup image d: -asrmode=yes -imagetype=staticdsmc backup image e: -asrmode=yes -imagetype=static

4. Restart the Windows operating system.5. Repeatedly perform additional incremental backups as required by y our backup policy.

20

6. Optionally, you can periodically repeat the offline image backups from Windows PE.

Restore procedure with a new hard disk, on identical system:

1. Boot the system from a Windows PE CD.2. Reconstruct the partitioning on the new disk. Note: when assigning drive letters to the

newly created volumes, be sure not to assign the same letter used by the CD device.The letter assignments made while WinPE is running are temporary, and do not reflectthe assignments that will be used when the primary OS is booted.diskpart.exe

select disk 0cleancreate partition primary size=7805select partition 1assign letter=Cactivecreate partition extendedcreate partition logical size=4542assign letter=Fcreate partition logical size=298assign letter=Gexit

3. Run the TSM query image command to determine the machine name and drive letter ofthe image backups. Take note of the backup date/time of the image backup for eachdrive. This information will be needed later.

a:\tsmwinpe.cmddsmc query image -asrmode=yes -virtualnode=tsmnodename

4. Restore each of the image backups. You will need to use the correct machine namematching that shown in the output of query image. Also, care must be taken to restore tothe correct destination drive letter.

dsmc restore image \\minint-ttbkbk\c$ c: -asrmode=yes-noprompt -virtualnode=tsmnodenamedsmc restore image \\minint-ttbkbk\d$ e: -asrmode=yes-noprompt -virtualnode=tsmnodenamedsmc restore image \\minint-ttbkbk\e$ f: -asrmode=yes-noprompt -virtualnode=tsmnodename

5. Reboot the machine.

6. Restore files from the file level incremental backups that were backed up after the date ofthe image backup. The date and time to be entered should match the backup date / timeof the image backup which was restored.

dsmc restore c:\* -sub=yes -rep=all -fromdate=03/02/2008-fromtime=00:00:00dsmc restore d:\* -sub=yes -rep=all -fromdate=03/02/2008-fromtime=00:00:00dsmc restore e:\* -sub=yes -rep=all -fromdate=03/02/2008-fromtime=00:00:00

21

9Restoring a System with a Dynamic BootVolumeWindows operating systems beginning with Windows 2000 support an enhanced disk formatreferred to as a dynamic disk. It is possible to convert a system disk from a basic disk to adynamic disk. However, Windows cannot be initially insta lled on a dynamic disk. Whenrecovering your operating system through Windows PE using TSM, you will need to create aprimary partition on a basic disk for restore purposes. After the restore has completed, you canboot into the restored operating system and convert the disk back from basic to dynamic.

Questions and AnswersQ: Why can’t I boot my system drive after running DISKPART? I set the correct partition active.

A: You must use the DISKPART CLEAN command to write the master boot record (MBR) to thedisk that you want to boot as the first step in preparing the disk for recovery. This may also be aresult of the operating system base of the PE boot disc not matching the operating system of thesystem being recovered.

Q: Can I restore Windows system state or system objects using WinPE?

A: The “restore systemstate” command will not work in a WinPE environment, however, thecontents of systemstate can be restored using special commands documented in this documentin the section on restoring from file-level backups.

Q: When would I want to use WinPE-based recovery instead of using TSM with Windows ASR?

A: ASR provides a more completely automated process for recovery. The WinPE approach canprovide for a faster recovery, and provides a recovery solut ion for more Windows operatingsystems.

Q: How do I customize or configure WinPE so that I can automatically detect different diskcontrollers, set a specific IP address for a given NIC, etc?

A: Customizing WinPE is outside the scope of this field guide. The intent here is to provide aquick, minimal setup and recovery method for recovery based on an unmodified WinPE base.

Q: Can I use the TSM Backup-Archive client GUI instead of the command line under WinPE?

22

A: Only if your WinPE CD is based on Windows XP. Since the asrmode option is not availablefor the GUI, Volume Shadowcopy Service (VSS) initialization can not be bypassed. Also, youmust ensure that you have the environment variables established via the tsmwinpe.cmd file asyou would have done for the command line client. Since the display color depth and resolutionunder WinPE is low, the GUI background will appear grainy. You might need to use the keyboardshortcut <alt><spacebar> to display the system menu from which you can select move or sizeitems to allow you to resize the GUI to fit on the reduced size screen. Not all functionality of theGUI is available for use. For example the system state and system service tree items aredisplayed but are non-functional.

Q: Why does TSM not see my hard disks after I boot into WinPE?

A: TSM can only see a hard drive if your PE environment can see it. Check to make sure yourWinPE CD has support for your hard disk controller. If necessary, you can manually specifyadditional drivers by pressing F6 durin g the boot process. Consult your preinstallation toolkitdocumentation for details on adding additional device drivers on your boot CD.

Q: Can I use a 32-bit based WinPE CD with a x64-bit processor?

A: Yes, however, you must then run the TSM Windows x32 cl ient, and will need the fix for APARIC56273 in order to restore image backups taken using the Windows x64 client.

Q: Can I back up and restore an image onto different hardware ?

A: It might work, but it has not been tested or verified by the TSM team and i s not supported. Ingeneral, restoring to similar hardware is more successful than dissimilar hardware. If you haveproblems booting up the restored image, you will need to perform a Windows Repair Install. Notethat this is not a repair of a Windows in stallation.

23

10Diagnostic Tips

1. If the CLEAN subcommand of DISKPART was not issued during the recovery procedureand you cannot boot from the restored image, you might not need to start the recoveryprocedure from the beginning. If you have a bootable CD of your host operating system,you can boot that CD and enter the recovery console. From the recovery console youcan use the FIXMBR command to rewrite the master boot record. This will allow you toboot the active partition.

For Windows 2008 systems, which are experiencing boot problems following a PErecovery, the following commands can be issued from the recovery console :

bootrec /FIXMBRbootrec /FIXBOOTbootrec /REBUILDBCD

2. You might see the following error messages in the client error log (dsmerror .log). Theseare normal when running the client under WinPE. The Volume Shadowcopy Service(VSS) is not available under WinPE and WinPE does not have a registry.

03/22/2004 21:29:14 InitializeVss(): InitializeForBackup() returnshr=E_UNEXPECTED

03/22/2004 21:29:15 ANS1009W An error occurred processing the operatingsystem include/exclude statements.

The error was detected while processing: FilesNotToBackup: RegOpenKeyEx =2.

03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 .

03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 .

3. If you receive the error message “ANS1287E Volume could not be locked, when backingup or restoring an image,” there might be a process accessing the drive. Be sure that noother programs are reading or writing to the drive you are trying to back up. If the TSMJournal Service is installed, stop the service or remove the drive from the list of journaledfile systems. If you are restoring in WinPE, be sure to redirect the TSM error log toanother drive.

4. You might be able to improve the network performance by manually setting the linkspeed to your network card’s maximum value instead of using the default auto -detectvalue. To do so, complete the following steps:

a. Determine the name of your network card, for example, Broadcom NetXtreme.

b. Run regedit.exe and highlight theHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key.

c. Click on Edit->Find and search for your card name.

24

d. Look in each subfolder of the found key (0000, 0001, etc.) for the SpeedDupl exkey.

e. The value for the SpeedDuplex key should be set to a number, typically 4 for100Mbps Full-duplex, as determined by the INF file for your card. See the InfPathkey for the location of the associated INF file. The INF file can be found in yourWindows/INF folder. The [Speed100.reg] section of the INF file will enumeratethe possible values for the SpeedDuplex key.

5. If you are having problems running the TSM Backup -Archive GUI, verify the followingsettings:

a. Your WinPE CD is based on Windows XP and not on Windows Server 2003.Because the Volume Shadowcopy Service is not available in WinPE, the GUIdoes not start up properly.

b. The DSM_DIR environmental variable is set to the baclient folder.

c. There is an option file in your baclient folder or the DSM_CONFIG environmentalvariable points to a valid option file.

d. The System32 folder of the extracted client is in your path.

6. If the TSM client fails to load within a Windows PE envi ronment with the error“ANS1464S Cannot load ICC encryption library”,add the followi ng option to the dsm.optfile:

ENCRYPTIONTYPE des56

11Reference InformationInformation on the DISKPART utilityYou can find documentation for the diskpart utility on the microsoft.com website, for example at:http://technet.microsoft.com/en-us/library/bb490893.aspx

Microsoft Windows Preinstallation Environment (WinPE) websitehttp://oem.microsoft.com/public/seo/winpe.htm

Tivoli Field Guide on Using TSM with Microsoft ASRhttp://www.ibm.com/support/docview.wss?rs=663&&uid=swg27007346