Tivoli Storage Manager Recovery Techniques

Using Windows Preinstallation Environment

(Windows PE)

By Jason Basler, Mike Dile, Don Moxley, Jey Somaskanthan, Evan Chiu
Version 2.0
Copyright Notice
Copyright IBM Corporation 2005. All rights reserved. May only be used pursuant
to a Tivoli Systems Software License Agreement, an IBM Software License
Agreement, or Addendum for Tivoli Products to IBM Customer or License Agreement.
No part of this publication may be reproduced, transmitted, transcribed, stored
in a retrieval system, or translated into any computer language, in any form or
by any means, electronic, mechanical, magnetic, optical, chemical, manual, or
otherwise, without prior written permission of IBM Corporation. IBM Corporation
grants you limited permission to make hardcopy or other reproductions of any
machine-readable documentation for your own use, provided that each such
reproduction shall carry the IBM Corporation copyright notice. No other rights
under copyright are granted without prior written permission of IBM Corporation.
The document is not intended for production and is furnished “as is” without
warranty of any kind. All warranties on this document are hereby disclaimed,
including the warranties of merchantability and fitness for a particular
purpose.
U.S. Government Users Restricted Rights -- Use, duplication or disclosure
restricted by GSA ADP Schedule Contract with IBM Corporation.

Trademarks
IBM, the IBM logo, Tivoli, the Tivoli logo, AIX, Cross-Site, NetView, OS/2,
Planet Tivoli, RS/6000, Tivoli Certified, Tivoli Enterprise, Tivoli Enterprise
Console, Tivoli Ready, and TME are trademarks or registered trademarks of
International Business Machines Corporation or Tivoli Systems Inc. in the United
States, other countries, or both.
Lotus is a registered trademark of Lotus Development Corporation.
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft
Corporation in the United States, other countries, or both.
UNIX is a registered trademark of The Open Group in the United States and other
countries.
C-bus is a trademark of Corollary, Inc. in the United States, other countries,
or both.
PC Direct is a trademark of Ziff Communications Company in the United States,
other countries, or both and is used by IBM Corporation under license.
ActionMedia, LANDesk, MMX, Pentium, and ProShare are trademarks of Intel
Corporation in the United States, other countries, or both. For a complete list
of Intel trademarks, see http://www.intel.com/sites/corporate/trademarx.htm.
SET and the SET Logo are trademarks owned by SET Secure Electronic Transaction
LLC. For further information, see http://www.setco.org/aboutmark.html.
Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Sun Microsystems, Inc. in the United States and other countries.
Other company, product, and service names may be trademarks or service marks of
others.

Notices
References in this publication to Tivoli Systems or IBM products, programs, or
services do not imply that they will be available in all countries in which
Tivoli Systems or IBM operates. Any reference to these products, programs, or
services is not intended to imply that only Tivoli Systems or IBM products,
programs, or services can be used. Subject to valid intellectual property or
other legally protectable right of Tivoli Systems or IBM, any functionally
equivalent product, program, or service can be used instead of the referenced
product, program, or service. The evaluation and verification of operation in
conjunction with other products, except those expressly designated by Tivoli
Systems or IBM, are the responsibility of the user. Tivoli Systems or IBM may
have patents or pending patent applications covering subject matter in this
document. The furnishing of this document does not give you any license to these
patents. You can send license inquiries, in writing, to the IBM Director of
Licensing, IBM Corporation, North Castle Drive, Armonk, New York 10504-1785,
U.S.A.

iii
About the Tivoli Field Guides
Sponsor
Tivoli Customer Support sponsors the Tivoli Field Guide program.

Authors
Those who write field guides belong to one of these three groups:

Tivoli Support and Services Engineers who work directly with customers
Tivoli Customers and Business Partners who have experience using Tivoli software in a
production environment
Tivoli developers, testers, and architects

Audience
The field guides are written for all customers, both new and existing. They are applicable to
external audiences including executives, project leads, technical leads, team members, and to
internal audiences as well.

Types of Field Guides

Two types of Tivoli Field Guides describe how Tivoli products work and how they are used in real
life situations:

Field Guides for technical issues are designed to address specific technical scenarios or
concepts that are often complex to implement or difficult to understand, for example:
endpoint mobility, migration, and heartbeat monitoring.
Field Guides for business issues are designed to address specific business practices that
have a high impact on the success or failure of an ESM project, for example: change
management, asset Management, and deployment phases.

Purposes
The Field Guide program has two major purposes:

To empower customers & business partners to succeed with Tivoli software by

documenting and sharing product information that provides accurate and timely
information on Tivoli products and the business issues that impact an enterprise systems
management project
To leverage the internal knowledge within Tivoli Customer Support and Services and the
external knowledge of Tivoli customers and Business Partners

Availability
All completed field guides are available free to registered customers and internal IBM employees
at the following Web site:
http://www.ibm.com/software/sysmgmt/products/support/Field_Guides.html

Authors can submit proposals and access papers by e-mail:

mailto:Tivoli_eSupport_Feedback@us.ibm.com

1
Table of Contents
INTRODUCTION .......................................................................................... 3

HARDWARE/SOFTWARE REQUIREMENTS........................................... 5

PREPARATION OVERVIEW ...................................................................... 6

Obtaining the WinPE Client ......................................................................................................... 6
Preparing a Network Share Containing the TSM Client .............................................................. 6
Including TSM in Bart PE............................................................................................................. 8
Creating the Backup .................................................................................................................... 8
Document the System Disk Partitioning .................................................................................... 10

RESTORE PROCEDURE OVERVIEW ..................................................... 12

RESTORING A WINDOWS SYSTEM (NOT A DOMAIN

CONTROLLER) USING INCREMENTAL IMAGE RESTORE............... 13

RESTORING A WINDOWS 2000 SERVER DOMAIN CONTROLLER. 14

RESTORING A WINDOWS NT SYSTEM ............................................... 17

RESTORING A SYSTEM WITH A DYNAMIC BOOT VOLUME ......... 18

QUESTIONS AND ANSWERS .................................................................. 19

DIAGNOSTIC TIPS..................................................................................... 20

REFERENCE INFORMATION .................................................................. 21

Tivoli Storage Manager Recovery Techniques

Using Windows Preinstallation Environment
(Windows PE)

Audience
This field guide is intended for storage administrators and skilled technical support personnel who
need to recover Windows 2000, Windows XP and Windows 2003 systems from a catastrophic
system or hardware failure. The guide assumes technical proficiency with installation,
configuration, and use of Windows systems with the Tivoli Storage Manager (TSM) Backup-
Archive client.

2
1
Introduction
The current Windows bare metal restore (BMR) procedures using Tivoli Storage Manager (TSM)
are dependent on Microsoft Automated System Recovery (ASR) or on having a functioning
operating system from which to run the backup/archive client. Installation of this base operating
system as a pre-requisite to performing system recovery can be time consuming. An alternative
method is to copy a base operating system from an image, rather than running through the full
Windows installation procedure. In the past, third party imaging utilities such as Symantec’s
Ghost™ have been required to perform the image copy. Using Microsoft Windows Preinstallation
Environment (WinPE) or Nu2 Production’s Bart's Preinstalled Environment (BartPE), the image
backup / restore facility in TSM can now be used for creating and recovering from an operating
system image. In addition, for certain platforms, the Logical Volume Snapshot Agent (LVSA) in
TSM can be used to allow online image backups (hot backups) to be taken. When combined with
traditional incremental backup, and system object backup, a very fast system recovery scenario
becomes possible in situations where you are restoring to identical hardware.

The preinstallation environment provides a temporary operating system which is bootable from a
CD and provides access to the volumes on a system's hard disk drives. Network connectivity
configured through DHCP is also available after booting, so the TSM client program can be
executed from a network drive, and network restores from a TSM server are possible. Because
the preinstallation environment runs directly from the CD, the local drives are unlocked and
treated simply as additional data drives. Any operating system installed on the disk volumes or
which is restored using TSM is not loaded while the preinstallation environment is running. For
this reason, the operating system installed on the local disk, and the operating system which runs
in the preinstallation environment have no interaction. This enables scenarios such as recovering
a Windows 2003 operating system using a preinstallation environment based on the Windows XP
operating system. The term WinPE is used throughout the remainder of the document to refer to
a booted preinstallation environment using either WinPE or BartPE.

Note that BartPE can be a useful alternative to WinPE, however, you need to carefully review the
Microsoft licensing discussion on the www.nu2.nu website and your specific Microsoft EULA
before using it at your site.

The following table summarizes the TSM image backup and restore methods in conjunction with
WinPE that are available for various Windows operating systems:

3
Table 1: TSM image backup and restore methods for different versions of Windows operating
systems

Windows Windows Windows Windows Windows Windows

NT41 2000 XP 32-bit 2003 32- XP/2003 XP/2003
bit x64 IA-64 2

TSM online No Yes Yes Yes No No

image backup
using LVSA

TSM offline Yes Yes Yes Yes Yes No

image backup
from WinPE

TSM image Yes Yes Yes Yes Yes No

restore
running in
WinPE

What’s New for TSM 5.3.0:

• Support for single drive online-image backup

• Support for recovery with preinstallation environments created using Bart's PE Builder
• Redirection of the error log to a writable media to bypass error log restriction

TSM image restore commands specify a destination volume using a drive letter. Under certain
situations WinPE will map volumes to different drive letters than the system from which the
backup was performed. For this reason, it is important to collect information on the volume layout
at the time of backup, and compare it to the layout presented by WinPE to ensure that your
volume target during restore is correct. The image backup feature of TSM can backup FAT,
FAT32, and NTFS volumes. When backing up NTFS volumes, the TSM client only sends used
regions of the volume to the TSM server by default. To help keep track of disk layout and
mapping for Windows versions other than NT 4.0, you can either use DSMC QUERY
SYSTEMINFO or run MSINFO32 from C:\Program Files\Common Files\Microsoft Shared\MSInfo.

Using WinPE to restore volume images to different hardware is not supported. See the Questions
and Answers section for more details.

1
Image backup is performed offline from WinPE. TSM image backup is not supported under NT
4.0

2
WinPE recovery using TSM has not been tested on Windows 64bit operating systems running
on Itanium. You can make a 64-bit version of WinPE. Consult the OPK User’s Guide for specific
instructions on creating a 64-bit version of WinPE. Furthermore, TSM online image backup is not
available with 64bit versions of Windows, so only offline image backup from WinPE will be
supported in a 64-bit environment.

4
2
Hardware/Software Requirements
Hardware:

There are currently no known hardware limitations. In some cases, hardware drivers needed for
disk controllers and network adapters may not be available in the base version of WinPE or the
Windows CD used to build BartPE.3

TSM:

• A TSM Windows client at V5.2.2 or newer is required for running within WinPE

• A TSM Windows client at V5.1.x is required for performing backups on Windows NT4,
however, the V5.2.2 client is required for performing image backup and restore
operations of these systems from within WinPE.

• A TSM server at a 5.1.x or newer level is required for support of TSM image backup. If
you are backing up Windows 2003 systems including system state and system services,
then a TSM server at a 5.2.2 or newer level is required.

• A second Windows system is required for sharing the TSM client application for
execution within WinPE. If you have included TSM in your preinstallation CD, this is not
required.

• A minimum of two volumes (disk partitions) is required in order to use the TSM LVSA for
online image backup if you are using a V5.2.x client.

• The option -asrmode=yes is required when running TSM commands in WinPE

environments built from Windows 2003. The -asrmode option is used to prevent TSM
from invoking the Microsoft VSS services which are not available while running WinPE.
Without this option, the TSM client will fail to start.

WinPE:

A bootable WinPE CD is required. A DHCP server is required on your network to allow a network
address to be assigned to your system when booting from WinPE.

Recovery of the following Microsoft operating systems has been tested:

• Windows NT 4.0

• Windows 2000

• Windows XP

• Windows 2003

3
Consult the OPK User’s guide for information on how to include additional device drivers in your
pre-installation environment. For BartPE, consult the website for information on how to include
additional drivers when building.

5
BartPE:

A bootable BartPE CD is required. A DHCP server is recommended by not required as a static

network address may be used.

Recovery of the following Microsoft operating systems has been tested:

• Windows 2000

• Windows XP

• Windows 2003

You should test WinPE with your hardware to ensure that it will work before you are faced with a
situation requiring a restore.

3
Preparation Overview
Obtaining the WinPE Client

The following web site contains information on how Microsoft Software Assurance customers can
obtain Windows PE:

http://www.microsoft.com/licensing/programs/sa/support/winpe.mspx

Obtaining the BartPE Client

The following web site contains information on how to download and build the CD from your
Windows installation media:

http://www.nu2.nu/

Preparing a Network Share Containing the TSM Client

These procedures assume you are using the standard Microsoft Windows OEM Preinstallation Kit
(OPK) CD provided by Microsoft. For this reason, the TSM client program must be accessed
from a network drive. Alternatively, you can bundle the TSM client into your WinPE CD using
Microsoft's OPK custom WinPE image build procedures. If you are using BartPE, a custom plug-
in can be created to include the TSM client when the CD is built rather than using a network drive.

To configure the TSM client to run from a network share, copy the TSM Client installation
package directory from the TSM desktop clients CD into a shared folder. You can also run the
self-extracting installation FTP package of the TSM Windows client. If you are extracting from the
FTP oackage, cancel the install when the language selection prompt appears. The extraction will
then be complete.

6
The following instructions can be used to configure the TSM client to run from a network share:

1. Create a shared folder on your system, for example, c:\tsmshare.

C:\>md c:\tsmshare
C:\>net share tsmshare=c:\tsmshare

2. Extract the TSM client from the FTP package but do not install the TSM client. If you
have a TSM client CD, the files are already extracted on the CD. Copy the installation
files into c:\tsmshare. This should result in the TSM client program files residing in the
folder:

c:\tsmshare\Program Files\Tivoli\TSM\baclient

3. Create a file named tsmwinpe.cmd which will establish the environment needed to run
TSM from the shared drive. You can choose to map the TSM share to a different drive
letter. The required commands can be entered into a WinPE command prompt, or stored
in a file on a floppy disk so that it will be available from the system running WinPE. Here
is an example of the file contents:

net use z: \\yourmachine\tsmshare

set path=%path%;z:\system32;z:\program files\tivoli\tsm\baclient
set path=%path%;z:\program files\tivoli\tsm\baclient\plugins
z:
cd \program files\tivoli\tsm\baclient

4. Create a TSM options file containing the correct nodename and communication settings
in the baclient folder created by the extraction in step #2.

Sample dsm.opt: c:\tsmshare\Program Files\Tivoli\TSM\baclient\dsm.opt

* communication settings
tcpserveraddr firebat.storage.sanjose.ibm.com
tcpport 1500
nodename winpetest
passwordaccess prompt

* compression settings; uncomment if desired

*compression yes

* performance tuning options

txnbytelimit 25600
tcpnodelay yes
tcpbuffsize 32
tcpwindowsize 63

* redirect the error log

errorlogname a:\dsmerror.log

Note that if you are using the 5.3.0 client or newer, you will need to specify the location of
the error log for the client to run correctly. It is recommended that the errorlogname
option be set in your option file to point to the floppy drive. Alternatively, you can also
specify the error log location in your batch file by setting the DSM_LOG environmental
variable or allow for write permissions in the shared network folder.

7
 Also note that offline image backup while booted to WinPE will fail with an error
unmounting the volume if the dsmerror.log is written to the volume you are attempting to
backup.

Including TSM in Bart PE

The Bart PE website contains detailed instructions on how to create a custom plugin to include
any application on your CD. Please consult their website for specific information. The TSM client
setup files can be used as the source files. When specifying what files to copy into your CD, be
sure to include the files in the System32 folder along with the baclient folder.

Creating the Backup

Offline TSM Image Backup:

An offline backup is performed after booting to WinPE, which ensures that the system drive will
be backed up in a consistent and offline state. This procedure has the disadvantage of requiring
a shutdown of the machine to be backed up, but is useful for creating a volume-level recovery
image. This procedure is also the only backup option available for systems running Windows NT
4.0.

By default, TSM image backup skips empty regions of a volume when backing up NTFS volumes.
If you are backing up a non-NTFS file system or if you want to minimize the stored image size on
the TSM server, consider turning on the TSM compression option for efficiency. After performing
the image backup, you can use standard TSM incremental backup and system object backup to
protect the latest state of your operating system. Optionally, you can periodically repeat the
offline image backup procedure to create a more current backup.

The following outlines the procedure used to perform an offline image backup from WinPE. If
your system files are on more than one file system, you will need to perform image backups for
each drive on which the system files reside.

1. Shutdown the system to be backed up

2. Boot from your WinPE CD

3. Run the tsmwinpe.cmd command script to set the required environment variables to run
the TSM client from a network share.

4. Confirm which drive letter WinPE has assigned to the system drive of the operating
system to be backed up. Use the “list volume” command in diskpart.exe to determine
this. If there is no drive letter assigned to the system drive of the operating system to be
backed up consult the diskpart.exe documentation to determine how to assign a drive
letter to a selected volume.

5. Perform the TSM image backup. Note that the file space created on the TSM server will
use the current system generated machine name in the file space name on the TSM
server used to store the image backup. You can run “dsmc query image” to determine
the image backup file space name.

Z:\>dsmc.exe backup image c: -imagetype=static -asrmode=yes

6. Reboot the machine without the WinPE CD in the drive.

8
Online TSM Image Backup:

Online image backup uses the TSM client LVSA feature to allow the image backup to be
performed while your operating system is running.4 After performing the image backup,
scheduled incremental and system object backups will protect the current state of your operating
system. Optionally, you can periodically perform additional image backups to reduce the number
of files that will need to be restored in addition to the image restore. The following steps outline
the general procedure required for performing an online image backup (note this procedure
assumes that your system drive is contained on c:)

1. You will need at least two volumes accessible to your operating system to perform online
image backup if using a 5.2 client. The second volume is used for storing the TSM LVSA
cache. If you do not have a second volume available, you will need to perform offline
image backup. If you are using a 5.3 client, the TSM LVSA cache can be stored on the
same volume being backed up.

2. Install the TSM online image backup feature if it is not already installed.

3. If you are using a 5.2 client, override the default value for the
SNAPSHOTCACHELOCATION option in the dsm.opt file so that the cache will be stored
on a drive other than your system drive.

4. Perform a full volume incremental backup of your system drive. This step is required if
you would like to have the option of performing an incremental image restore with the
-deletefiles option. The -deletefiles option automatically removes files which were
included in your original image backup, but were subsequently deleted from the operating
system. You might also want to perform online image and incremental backups of other
drives on your system.

dsmc incremental c:

5. Perform an online image backup of the system drive. If TSM has difficulty creating a
snapshot of your system drive, you might need to vary the -snapshotidletimeout and
-snapshotidleretries options to decrease the amount of idle time expected by TSM and/or
increase the number of snapshot retries attempted by TSM. Also, any services or
applications that access the drive, like the TSM Journal Service, will need to be stopped
for the snapshot to complete successfully.

dsmc backup image c: -imagetype=snapshot

6. Perform an incremental backup of the system drive. This step should be repeated as
frequently as your backup policies require. Consider defining this backup to be
performed by the TSM scheduler. You should also back up the system objects for your
system. These backups will allow you to restore your system to its most recent state
following the TSM image restore.

dsmc incremental c:
dsmc backup systemobject

4
TSM online image backup performs a back up based on a snapshot of the OS while it is
running. There is a chance that the snapshot will be taken at a point in which the operating
system is in an inconsistent state that will not boot at recovery time. Be sure to have also
documented and tested procedures for recovery using the reinstallation of the OS technique as a
backup plan. You also need this backup plan in the event you are not restoring to identical
hardware.

9
 7. Repeat the previous step as frequently as required for your backup policies. Optionally,
you can periodically repeat step #5, to create a more current image level backup.

Document the System Disk Partitioning

Document your system disk configuration using DISKPART.EXE prior to performing a backup.
The diskpart program is available if you are running Windows XP or 2003. If you are running
Windows 2000, you can either copy it from another system running XP or 2003, or you can boot
to WinPE and run diskpart. You can find documentation for the diskpart utility on the
microsoft.com website. For example:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/diskpart.mspx

Consider printing the documentation of your disk configuration and keeping it near your system in
the event a restore becomes necessary. You can also keep track of disk layout and mapping
using either DSMC QUERY SYSTEMINFO or MSINFO32 from C:\Program Files\Common
Files\Microsoft Shared\MSInfo. Use the following procedure to document the disk configuration
using diskpart.exe:

1. Create a file named diskpart.in containing the following lines. Update the script as
needed depending on the number of physical disks in your system.

list disk
list volume
select disk 0
list partition
select disk 1
list partition

2. Run the diskpart.exe command with the /s switch, and direct the output into a file named
diskpart.txt:

diskpart /s diskpart.in > diskpart.txt

Example output:

10
Microsoft DiskPart version 1.0
Copyright (C) 1999-2001 Microsoft Corporation.
On computer: WINPETEST

DiskPart is starting the disk management services.

Disk ### Status Size Free Dyn Gpt

-------- ---------- ------- ------- --- ---
Disk 0 Online 34 GB 0 B
Disk 1 Online 34 GB 0 B

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 H CD-ROM 0 B
Volume 1 C NTFS Partition 6997 MB Healthy System
Volume 2 D WinXP NTFS Partition 6997 MB Healthy
Volume 3 E Win2003NTFS NTFS Partition 6997 MB Healthy
Volume 4 F WIN03F32 FAT32 Partition 6997 MB Healthy
Volume 5 G Backup NTFS Partition 6715 MB Healthy
Volume 6 I GHOST FAT32 Partition 20 GB Healthy
Volume 7 J Partition 14 GB Healthy

Disk 0 is now the selected disk.

Partition ### Type Size Offset

------------- ---------------- ------- -------
Partition 1 Primary 6997 MB 32 KB
Partition 2 Extended 27 GB 6997 MB
Partition 3 Logical 6997 MB 6997 MB
Partition 4 Logical 6997 MB 14 GB
Partition 5 Logical 6997 MB 20 GB
Partition 6 Logical 6715 MB 27 GB

Disk 1 is now the selected disk.

Partition ### Type Size Offset

------------- ---------------- ------- -------
Partition 1 Primary 20 GB 32 KB
Partition 2 Extended 14 GB 20 GB
Partition 3 Logical 14 GB 20 GB

11
4
Restore Procedure Overview
After booting to WinPE on the target machine, you will have access to all of the volumes used by
the primary operating system. In the event that you need to replace a damaged disk, you will
have access to the disks, but will need to recreate the volumes and in some cases format file
systems on them. When restoring TSM image backups, it is not necessary to format a file system
before performing the restore since the file system is recovered from the backup. Be sure that
the error log is not being written to the drive being restored. Doing so will prevent TSM from
dismounting the volume for image restoration. The following procedure lists the general WinPE
restore flow. Later sections detail specific considerations for certain system configurations.

1. Boot WinPE on the machine you plan to restore. WinPE should provide a network
connection with an address assigned through DHCP.
2. Use diskpart.exe to recreate the volume layout for your system. After the volume layout
is recreated, inspect the volume to drive letter mapping presented by WinPE, and
correlate this with the mapping used by your initial operating system. There is a
possibility that you will need to restore the TSM image backup to a different destination
drive letter than the one assigned to the volume at the time the backup was taken. Image
restore commands issued from WinPE need to specify the full source backup name in
UNC format since WinPE boots with a different machine name than your normal
operating system.

Here is an example of recreating two partitions on a physical disk, one primary, and one
extended. The primary partition will be set to active, to allow the system to boot.
Formatting of the first partition is not required, as the image restore will recreate the file
system. Formatting the second volume is required since the recovered operating system
uses this volume to store swap files, and the file system will need to exist prior to booting
the restored system. In general, a volume does not need to be formatted with a file
system if a TSM image backup will be restored over the volume. In other cases, the
volume should be formatted with the same file system type that existed previously.

diskpart.exe
select disk 0
clean
create partition primary size=6997
select partition 1
assign letter=C
active
create partition extended
select partition 2
create partition logical size=8192
select partition 3
assign letter=D
list volume
exit

format D: /fs:ntfs /v:swapdisk

12
 3. Using the tsmwinpe.cmd file, map the network share containing the TSM client program
code, and set the environment variables required to run the TSM client from the network
share. If you have not created this share yet, see the instructions in the section
“Preparing a Network Share Containing the TSM Client.” For example, if you are using
the tsmwinpe.cmd file on a floppy disk:

a:\tsmwinpe.cmd

4. Restore the image backup of your system volume. There are several variations of this
restore command that are detailed in upcoming sections. The most basic restore
variation is given here. Note that the use of the -ASRMODE=YES option is required to
bypass the attempted initialization of the Volume Shadowcopy Services (VSS) subsystem
which is not present in a Windows Server 2003 WinPE environment. The query image
command can be used to determine the full name of the image backup object to restore,
and to test your connectivity to the TSM server. The -virtualnode option is not required if
you have specified the correct nodename option in the dsm.opt file. Passwords
generated by TSM are not available when running in WinPE, so the -virtualnode option
also prevents unsuccessful attempts to store the TSM password in the Windows registry.

dsmc query image -asrmode=yes -virtualnode=tsmnodename

dsmc restore image \\backupmachinename\c$ c:\ –asrmode=yes
–virtualnode=tsmnodename

5
Restoring a Windows System (not a Domain
Controller) Using Incremental Image Restore
The following procedure describes how to recover a Windows 2000, XP, or Server 2003 system.
This procedure assumes that your backup followed the correct procedure to allow for incremental
image restore using the -deletefiles option, and that you have performed system object backups.
This restore method allows you to bring your system back to its most current backup state. The
default Windows directories are used in this procedure. In the event that your Windows
installation is not in the default location, modify the path appropriately. You can determine where
your Windows directory is by looking at the SystemRoot environmental variable.

1. Perform the restore preparation steps outlined in the “Restore Procedure Overview”
section excluding the restore image step.
2. Run query image to determine the machine name and drive letter of the image backup

dsmc query image -asrmode=yes -virtualnode=tsmnodename

3. Restore the system drive image backup, including more recently backed up files from the
system drive incremental backup. The -deletefiles options will remove any files that were
restored from the image backup, but were deleted from your system after the image
backup was taken.
dsmc restore image \\backupmachinename\c$ c: -asrmode=yes
-noprompt -incremental -deletefiles -virtualnode=tsmnodename

13
 4. Reboot to the restored operating system.

5. Restore the SFP catalog files from the system object first.

Win2000:
dsmc restore “{SYSTEM OBJECT}\winnt\system32\CatRoot\*”
c:\winnt\system32\ -subdir=yes -replace=all

WinXP:
dsmc restore “{SYSTEM OBJECT}\windows\system32\CatRoot\*”
c:\windows\system32\ -subdir=yes -replace=all

Win2003:
dsmc restore group "{SYSTEM STATE}\SYSSTATE" c:\systemp\
-showmembers -preservepath=complete -replace=all
xcopy /h /s /y c:\systemp\SYSFILES\WINDOWS\system32\CatRoot\*
c:\system32\CatRoot\
rmdir /s /q c:\system

6. Restore the entire system object.

Win2000/XP:
dsmc restore systemobject

Win2003:
dsmc restore systemstate
dsmc restore systemservices

7. Reboot without the WinPE CD.

6
Restoring a Windows 2000 Server Domain
Controller
The following restore procedure is specific to the test configuration documented below. It can
easily be adapted for a domain controller with a different disk layout or a different operating
system such as Windows 2003.

Test configuration:
1. IBM eServer xSeries 345, with 2 SCSI hard disks
2. First disk is a basic disk, with C: as system/boot partition containing c:\winnt
3. Second disk is a dynamic disk with three simple volumes on D:, E:, and F:
4. NTDS database contained on D:\NTDS\DB
5. NTDS log contained on E:\NTDS\LOG
6. SYSVOL contained on F:\SYSVOL
7. Win2000 advanced server installed, with SP3 and latest security hot fixes as of
02/27/2004

14
 8. Configured as a peer domain controller in a domain with two pre-existing domain
controllers

Backup steps:
1. Perform an all-local domain incremental backup which includes backups of c:, d:, e:, f:,
and system objects.

dsmc inc

2. Perform an online image backup of the system drive c:

dsmc backup image c:

3. Repeatedly perform the all-local domain incremental backup including system objects as
required by your backup policy.

Restore procedure with two new hard disks on identical system:

The restoration procedures are performed on an identical system with two replacement hard
disks of equal capacity as the original hard disks that were backed up.

1. Boot the system from a Windows PE CD.

2. Reconstruct the partitioning of each disk. Note: when assigning drive letters to the newly
created volumes, be sure not to assign the same letter which is being used by WinPE for
the CD device. The letter assignments made while WinPE is running are temporary, and
do not reflect the assignments that will be used when the primary OS is booted. In this
example, WinPE has assigned the drive letter D: to the CD device. The subsequent
drive letter assignments in this example avoid the use of D:.
diskpart.exe
select disk 0
clean
create partition primary size=6997
select partition 1
assign letter=C
active
select disk 1
clean
convert dynamic
create volume simple size=10240
assign letter=E
create volume simple size=2048
assign letter=F
create volume simple size=2048
assign letter=G
list volume
exit

3. Format file systems on all drives except the system drive

format E: /fs:ntfs /v:NTDSDB

format F: /fs:ntfs /v:NTDSLOG
format G: /fs:ntfs /v:SYSVOL

15
4. Use the tsmwinpe.cmd to map the network share and set the required environment
variables, then run the query image command to determine the machine name and drive
letter of the image backup

a:\tsmwinpe.cmd
dsmc query image -asrmode=yes -virtualnode=tsmnodename

5. Run the query image command to determine the machine name and drive letter of the
image backup

dsmc query image -asrmode=yes -virtualnode=tsmnodename

6. Restore the system drive image backup, including more recently backed up files from the
system drive incremental backup. The -deletefiles options will remove any files that were
restored from the image backup, but that were deleted from your system after the image
backup was taken.

dsmc restore image \\backupmachinename\c$ c: -asrmode=yes

-noprompt -incremental -deletefiles -virtualnode=tsmnodename

7. Reboot the restored operating system into Directory Services Restore Mode. This is
accomplished by pressing F8 early in the Windows boot process, and selecting Directory
Services Restore Mode from the list that is presented.

8. Since the second hard disk was recreated, Windows will require this disk to be imported,
and drive letters to be re-assigned before it can be accessed. Run the Windows disk
manager from the computer management console to import the foreign dynamic disk
and reassign the appropriate drive letters to the three simple volumes.

9. Restore the SFP catalog files from the system object first.

dsmc restore “{SYSTEM OBJECT}\winnt\system32\CatRoot\*”

c:\winnt\system32\ -sub=yes -rep=all

10. From Directory Services Restore Mode, recover the remaining data drives and system
objects. Do not reboot until after the final step, even if you are prompted to do so.

dsmc restore d:\* -sub=yes -rep=all

dsmc restore e:\* -sub=yes -rep=all
dsmc restore f:\* -sub=yes -rep=all
dsmc restore systemobject

11. Reboot and allow Windows to start normally.

16
7
Restoring a Windows NT System 5
Image level backups can be performed against a system running Windows NT 4.0 by bringing the
system down and performing the backups from Windows PE. The following procedure was
tested against a system running Windows NT 4.0 workstation with service pack 6a. A single IDE
hard drive was partitioned with a primary partition and two logical drives in an extended partition.

Backup steps
1. Perform a full incremental backup of all local hard disks. This backup should be
performed from the running Windows NT operating system, and will require a TSM
client at the 5.1 level.

dsmc inc

2. Shutdown the Windows NT system, and boot from a CD to Windows PE.

3. From Windows PE, back up each of the file systems using offline image backup

a:\tsmasr.cmd
dsmc backup image c: -asrmode=yes -imagetype=static
dsmc backup image d: -asrmode=yes -imagetype=static
dsmc backup image e: -asrmode=yes -imagetype=static

4. Restart the Windows NT operating system.

5. Repeatedly perform additional incremental backups as required by your backup policy.
6. Optionally, you can periodically repeat the offline image backups from Windows PE.

Restore procedure with a new hard disk, on identical system:

1. Boot the system from a Windows PE CD.

2. Reconstruct the partitioning on the new disk. Note: when assigning drive letters to the
newly created volumes, be sure not to assign the same letter used by the CD device.
The letter assignments made while WinPE is running are temporary, and do not reflect
the assignments that will be used when the primary OS is booted.
diskpart.exe
select disk 0
clean
create partition primary size=7805
select partition 1
assign letter=C
active
create partition extended
create partition logical size=4542
assign letter=F
create partition logical size=298
assign letter=G
exit

5
Windows NT is extremely sensitive to changed hardware which may result in the restored image
not booting.

17
 3. Run the TSM query image command to determine the machine name and drive letter of
the image backups. Take note of the backup date/time of the image backup for each
drive. This information will be needed later.

a:\tsmwinpe.cmd
dsmc query image -asrmode=yes -virtualnode=tsmnodename

4. Restore each of the image backups. You will need to use the correct machine name
matching that shown in the output of query image. Also, care must be taken to restore to
the correct destination drive letter.

dsmc restore image \\minint-ttbkbk\c$ c: -asrmode=yes

-noprompt -virtualnode=tsmnodename
dsmc restore image \\minint-ttbkbk\d$ e: -asrmode=yes
-noprompt -virtualnode=tsmnodename
dsmc restore image \\minint-ttbkbk\e$ f: -asrmode=yes
-noprompt -virtualnode=tsmnodename

5. Reboot the machine.

6. Restore files from the file level incremental backups that were backed up after the date of
the image backup. The date and time to be entered should match the backup date / time
of the image backup which was restored.

dsmc restore c:\* -sub=yes -rep=all -fromdate=03/02/2004

-fromtime=00:00:00
dsmc restore d:\* -sub=yes -rep=all -fromdate=03/02/2004
-fromtime=00:00:00
dsmc restore e:\* -sub=yes -rep=all -fromdate=03/02/2004
-fromtime=00:00:00

8
Restoring a System with a Dynamic Boot
Volume
Windows operating systems beginning with Windows 2000 support an enhanced disk format
referred to as a dynamic disk. It is possible to convert a system disk from a basic disk to a
dynamic disk. However, Windows cannot be initially installed on a dynamic disk. When
recovering your operating system through Windows PE using TSM, you will need to create a
primary partition on a basic disk for restore purposes. After the restore has completed, you can
boot into the restored operating system and convert the disk back from basic to dynamic.

18
Questions and Answers
Q: Why can’t I boot my system drive after running DISKPART? I set the correct partition active.

A: You must use the DISKPART CLEAN command to write the master boot record (MBR) to the
disk that you want to boot as the first step in preparing the disk for recovery.

Q: Can I restore Windows system state or system objects using WinPE?

A: No. While you may be able to trick TSM into restoring the state information to the target drive
via the –machinename option, ultimately the restore will be unsuccessful because the registry
merge operation will not be possible.

Q: When would I want to use WinPE-based recovery instead of using TSM with Windows ASR?

A: Use WinPE when high speed recovery is needed because of a boot partition file system
corruption or catastrophic operating system failure and you are recovering to the same hardware.
Use ASR for recovery of a system to new hardware possibly due to disaster recovery at a new
site. ASR allows for some hardware differences between the original and the target recovery
machine.

Q: How do I customize or configure WinPE so that I can automatically detect different disk
controllers, set a specific IP address for a given NIC, etc?

A: Customizing WinPE is outside the scope of this field guide. The intent here is to provide a
quick, minimal setup and recovery method for recovery based on an unmodified WinPE base.
For information regarding customizing WinPE, consult the Microsoft Windows OEM
Preinstallation Kit (OPK) User’s Guide. Or the Microsoft OEM System Builder website
http://www.microsoft.com/oem/default.mspx

Q: How do I use WinPE to recover a Windows 64-bit system?

A: The approach used in this paper should be extensible to 64-bit Windows systems, but this
procedure has not been tested or verified in the 64-bit environment. Consult the OPK User’s
Guide for specific instructions on creating a 64-bit version of WinPE which would be required to
perform this task.

Q: Can I use the TSM Backup-Archive client GUI instead of the command line under WinPE?

A: Only if your WinPE CD is based on Windows XP. Since the asrmode option is not available
for the GUI, Volume Shadowcopy Service (VSS) initialization can not be bypassed. Also, you
must ensure that you have the environment variables established via the tsmwinpe.cmd file as
you would have done for the command line client. Since the display color depth and resolution
under WinPE is low, the GUI background will appear grainy. You might need to use the keyboard
shortcut <alt><spacebar> to display the system menu from which you can select move or size
items to allow you to resize the GUI to fit on the reduced size screen. Not all functionality of the
GUI is available for use. For example the system state and system service tree items are
displayed but are non-functional.

Q: Why does TSM not see my hard disks after I boot into WinPE?

A: TSM can only see a hard drive if your PE environment can see it. Check to make sure your
WinPE CD has support for your hard disk controller. If necessary, you can manually specify
additional drivers by pressing F6 during the boot process. Consult the OPK User’s guide for

19
information on how to include additional device drivers in your pre-installation environment. For
BartPE, consult the website for information on how to include additional drivers when building.

Q: Can I use a 32-bit based WinPE CD with a 64-bit processor?

A: Depending on the hardware, some 64-bit processors have support for 32-bit code. For
example, this procedure has been tested with AMD’s Opteron64 and Intel’s Xeon MP 64
processors using a Windows XP SP2 32-bit based CD.

Q: Can I back up and restore an image onto different hardware?

A: It might work, but it has not been tested or verified by the TSM team and is not supported. In
general, restoring to similar hardware is more successful than dissimilar hardware. If you have
problems booting up the restored image, you will need to perform a Windows Repair Install. Note
that this is not a repair of a Windows installation.

10
Diagnostic Tips
1. If the CLEAN subcommand of DISKPART was not issued during the recovery procedure
and you cannot boot from the restored image, you might not need to start the recovery
procedure from the beginning. If you have a bootable CD of your host operating system,
you can boot that CD and enter the recovery console. From the recovery console you
can use the FIXMBR command to rewrite the master boot record. This will allow you to
boot the active partition.

2. You might see the following error messages in the client error log (dsmerror.log). These
are normal when running the client under WinPE. The Volume Shadowcopy Service
(VSS) is not available under WinPE and WinPE does not have a registry.

03/22/2004 21:29:14 InitializeVss(): InitializeForBackup() returns

hr=E_UNEXPECTED

03/22/2004 21:29:15 ANS1009W An error occurred processing the operating

system include/exclude statements.

The error was detected while processing: FilesNotToBackup: RegOpenKeyEx =

2.

03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 .

03/22/2004 21:29:24 ReadPswdFromRegistry(): RegOpenPathEx(): Win32 RC=2 .

3. If you receive the error message “ANS1287E Volume could not be locked, when backing
up or restoring an image,” there might be a process accessing the drive. Be sure that no
other programs are reading or writing to the drive you are trying to back up. If the TSM
Journal Service is installed, stop the service or remove the drive from the list of journaled
file systems. If you are restoring in WinPE, be sure to redirect the TSM error log to
another drive.

20
 4. You might be able to improve the network performance by manually setting the link
speed to your network card’s maximum value instead of using the default auto-detect
value. To do so, complete the following steps:

a. Determine the name of your network card, for example, Broadcom NetXtreme.

b. Run regedit.exe and highlight the

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet key.

c. Click on Edit->Find and search for your card name.

d. Look in each subfolder of the found key (0000, 0001, etc.) for the SpeedDuplex
key.

e. The value for the SpeedDuplex key should be set to a number, typically 4 for
100Mbps Full-duplex, as determined by the INF file for your card. See the InfPath
key for the location of the associated INF file. The INF file can be found in your
Windows/INF folder. The [Speed100.reg] section of the INF file will enumerate
the possible values for the SpeedDuplex key.

5. If you are having problems running the TSM Backup-Archive GUI, verify the following
settings:

a. Your WinPE CD is based on Windows XP and not on Windows Server 2003.

Because the Volume Shadowcopy Service is not available in WinPE, the GUI
does not start up properly.

b. The DSM_DIR environmental variable is set to the baclient folder.

c. There is an option file in your baclient folder or the DSM_CONFIG environmental

variable points to a valid option file.

d. The System32 folder of the extracted client is in your path.

11
Reference Information
Information on the DISKPART utility
You can find documentation for the diskpart utility on the microsoft.com website, for example at:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/diskpart.mspx

Microsoft OEM System Builder website

http://www.microsoft.com/oem/default.mspx

Tivoli Field Guide on Using TSM with Microsoft ASR

http://www-
1.ibm.com/support/entdocview.wss?rs=663&context=SSGSG7&uid=swg27003812&loc=en_US&
cs=utf-8&lang=en%20en

The following IBM Redbooks supplement the recovery information provided in this guide:

Disaster Recovery Strategies with Tivoli Storage Management - SG-24-6844

21
http://www.redbooks.ibm.com/abstracts/sg246844.html

Windows NT Backup and Recovery with ADSM – SG-24-2231

http://www.redbooks.ibm.com/abstracts/sg242231.html

Deploying the Tivoli Storage Manager Client in a Windows 2000 Environment – SG-24-6141
http://www.redbooks.ibm.com/abstracts/sg246141.html

TechNet Webcast: Windows PE (Level 200), March 2005

http://www.microsoft.com/events/webcasts/library/200503.mspx

End of document

22