DR v2 Module 10 System Recovery PDF

Disaster Recovery
Di R and
d
Business Continuity
Module X
System Recovery
Module Objective
This module will familiarize you with the following:

System Restore in Windows XP
Linux System Recovery
Macintosh System
y Recoveryy
Restoring Windows Server 2003
Recovering from Boot problems in Windows Server 2003
Restoring
g Server Services
Restoring Exchange Server 2003
Recovering Blackberry Enterprise Server
Restoring
g MS SQL
Q Server
Restoring MySQL Server
Recovering Cisco IOS
IBM WebSphere
p Application
pp Server
Recovering Coldfusion Application Server
Recovering from Domino Server Crashes
Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction Is Strictly Prohibited
Module Flow
System Restore Boot problems in MS SQL Server

S
in Windows XP Windows Server 2003
IBM WebSphere
Linux System Recovery Server Services
Application Server
Mac System Recovery Coldfusion

Exchange Server 2003
Application Server
Blackberry Domino Server Crashes

Windows Server 2003
Enterprise Server
System Restore in Windows XP
System Restore component of Windows XP enables you to restore a system to a

previous state
It monitors changes to the system and some application files and automatically
creates easily identified restore points
Restore points
i are created
ddduring
i the
h ffollowing
ll i system events, user actions,
i or
time intervals:
• Installation of an unsigned device driver
• Installation of System Restore compliant applications
• Installation of an update by using Automatic Updates
• System Restore operation
• Restoring data from backup media
• Manually creating a restore point
• Creating scheduled restore points at regular intervals
Restore points contain the following two types of information:

• Snapshot of the registry
• Certain dynamic system files
Using System Restore in Windows XP
Start -> All Programs

Create restore point or
->Accessories ->
restore to an earlier
System
y Tools ->
time
System Restore
System Restore Settings
Linux System Recovery
Reasons for Linux system failures:
• LILO is destroyed
• Linux fails to boot
• Master Boot Record (MBR) is damaged
• Linux fails to boot when another operating system like Windows
NT is installed which erases LILO or MBR
Linux System Crash Recovery
Booting Problem
1. Log in to system using Tiny Floppy Linux such as tomsrtbt floppy
or MuLinux floppy
2. Use fdisk to find the partitions
3. Recognize root and boot partition
bash# fdisk /dev/hda
Command (m for help): m (Gives you help on commands)
Command (m for help): p (Gives you list of partitons)
Command (m for help): q
bash# mkdir /test
bash# mount /dev/hda1 /test
bash# ls /test
Linux System Crash Recovery
4
4. find /usr and /var partitions to create new LILO
configuration
5. Edit /etc/fstab file
Crash Recovery Kit for Linux
Crash Recovery Kit for Linux can be used for:
Recovery of a trashed LILO boot record
Backup over the network in the form of tar.gz tarballs
Testing
g hardware of new intel based machines
Detecting versions and types of hardware
Recovery of a misconfigured or hacked Linux system
Make tape backup of a disk which can't be booted anymore
Mac System Recovery :
Macintosh cannot find the startup hard disk or any disk
with a System Folder
Start Macintosh from System Installer CD-ROM and look for the missing hard disk icon on the desktop
If the disk appears, run Apple's Disk First Aid program to check it
If no p
problems are found,, backup
p yyour critical files and reinstall the system
y software
If the hard disk does not appear, reset Macintosh's Parameter RAM (PRAM) to its factory defaults
Hold down the Command, Option, P and R keys during start up until system chimes twice
If all fails, completely

p y remove anyy securityy p
programs
g such as DiskLock, Empower,
p or FolderBolt before
updating/installing a new driver
Rewrite device drivers using a hard disk formatting program
Use the "Update" or "Install driver" command in the formatting software

Mac System Recovery:
Disk's device driver software is damaged or has a serious
hardware problem
Completely remove any security programs
If the
th ddevice
i d driver
i software
ft iis d
damaged,
d ttry tto
rewrite/update the driver with the software used to format
the disk
• Use Drive Setup program on the System Installer CD-ROM for Apple
hard disks
• Use software that came with the drive or a third-party formatter for a
non-Apple
A l h hard
d di
disk
k
Use the "Update" or "Install driver" command in the

formatting software
Mac System Recovery (cont’d):
Directory structure of disk is damaged
((“The
The disk is damaged do you want to initialize?”
initialize? or “-127
127
error disk could not used/found” error messages )
~ It occurs when a Mac freezes in the middle of a program

p g
and must be restarted, or if the computer is not shut
down properly
1. U U
Use UnErase
E program iin S
Symantec's
t ' N Norton
t Utiliti
Utilities tto
recover drives producing these error messages
2. Recover data to a completely
p y different drive,, NOT the
crashed disk or one of its partitions
Mac System Recovery:
A removable media doesn
doesn'tt mount on the desktop
Tryy a
another
ot e good media
ed a which
c does not
ot hold
o d irreplaceable
ep aceab e
data
If the problem is specific to a particular media, reinstall the

device driver
Restoring Windows Server 2003
Potential causes of Windows Server 2003 failure include:
Hard disk subsystem failure
Power failure
Systems software failure

Accidental or malicious use of deletion or modification
commands
Destructive viruses
Natural disasters (fire, flood, earthquake, and so on)
Theft or sabotage
Recovering from Boot problems in Windows
Server 2003: Step 1 Start computer by using Last Known
Good
d Configuration
fi i
Start -> click Shut Down -> click Restart -> OK
Press F8 key when Please select the operating system to start

message appears
Select Last Known Good Configuration
Press ENTER
Server 2003: Step 2 Starting computer in Safe Mode
Follow above steps

steps, in step 3 select Safe
Mode
Press ENTER
If computer does not start in Safe mode,

try starting the computer by using the
Recovery Console
If the computer still doesn't start, look for

possible hardware p
p problems
Server 2003: Step 3 Use Event Viewer to Identify the
Cause off the
h Startup Problem
bl
Do one of the following:

Click Start, point to Start the Event Viewer snap-in
Administrative Tools, and in Microsoft Management
then click Event Viewer Console (MMC)
In the console tree, expand Event Viewer, and then

click the log
g that yyou want to view
In the details pane, double click the event that you

double-click
want to view
T view
To i theh d i i off the
description h previous
i h
event or the
next event, press the UP ARROW key or the DOWN
ARROW key
Server 2003: Step 4 Use System Information to Identify the
Cause off the
h Startup Problem
bl
Start -> Run -> type msinfo32 -> OK
Look for problem devices or device conflicts
• In console tree, expand Components, and click Problem Devices

• In console tree, expand Hardware Resources, and click Conflicts/Sharing
• If problematic device is identified perform appropriate action and restart the computer in normal mode
If you have disabled a device to resolve the problem, make sure that the device is listed on the
Windows Server 2003 Hardware Compatibility List and is installed correctly
If no device conflicts are reported by System Information tool, look for auto start programs:
• In the console tree, expand Software Environment, and then click Startup Programs
• Disable
Di bl the
th programs one att a ti
time, and
d restart
t t computer
t
• Shut down and restart the computer each time you enable a program, and note if the incorrect startup
behavior occurs
Server 2003: Step 5 View the Safe Mode Boot Log File
Log file is located in

the %SystemRoot%
folder (default)
Start computer in
Safe mode
Use a text editor such

as Notepad to open
and view the log file
Recovering from Boot problems in
Windows Server 2003: Step 6 Use Device Manager
to Identify
d if theh Cause off the
h Startup Problem
bl
Start -> right-click My Computer -> click Manage
Expand System Tools, and then click Device Manager
Investigate possible device conflicts by double-clicking device in right pane, and

then clicking Resources tab
If problematic device is identified, disable it, and restart computer in normal

mode
Server 2003: Step 7 Use System Configuration Utility
Create a Clean Environment for Troubleshooting

g
• Start -> Run -> type msconfig -> OK
• Click the General tab -> click Diagnostic startup - load basic devices
and services only ->
> OK ->> Restart
• After Windows starts, determine whether the problem still occurs
Isolate Problems by Using System Startup Options

• Start -> Run -> type msconfig -> OK
• C c tthee Ge
Click e a tab -> Se
General ect ve Sta
Selective tup
Startup
• Clear Process SYSTEM.INI File, Process WIN.INI File and Load
System Services check boxes
• Make sure the Load Startup Items check box is selected, and then click
OK
• Restart the computer
System Configuration Utility
Server 2003: Step 7 Troubleshoot the System.ini File
((cont’d)
t’d)
Start -> Run -> type msconfig -> OK
Click SYSTEM.INI tab
Click Disable All and click OK, and then restart computer
Click the SYSTEM.INI tab
Expand all items in the list, click the check box of an item to turn it on, and then click OK
Restart your computer, and see if the problem occurs
Repeat steps 5 through 8 for each item until the problem occurs
Click Enable All,

All clear the check box next to the faulty item,
item and click OK
Restart computer
Server 2003 (cont’d): Step 7 Troubleshoot the Win.ini
Fil
File
Cli k th
Click the WIN.INI
WIN INI tab
t b
Click Disable All, click OK, and then restart your computer
Click the WIN.INI tab
Expand all items in the list, click the check box of an item to turn it on, and then click OK
Restart computer, and see if the problem occurs
Repeat steps 5 through 8 for each item until the problem occurs
Click Enable All, clear the check box of the faulty item and click OK
Restart computer
Recovering from Boot problems in
Windows Server 2003 (cont’d): Step 7
Troubleshoot
bl h the
h Boot.ini
i i File
il
Click Normal Startup - load all device

drivers and services on the General tab and
click OK
Restart computer
Microsoft Windows Recovery Console
1. Insert the Windows Server 2003 installation CD in CD-ROM or DVD-ROM drive

2. R
Restart computer
3. When prompted during text-mode setup, press R to start the Recovery Console
~ Recovery Console can be used to:
• Access drives on your computer
• Enable or disable device drivers or services
• Copy files from the Windows Server 2003 installation CD or copy files from other
removable media
• Create a new boot sector and a new master boot record (MBR)
Automated System Recovery
Prerequisites:
• ASR floppy
ppy disk
• Backup media
• Original operating system installation CD.
• Driver files
Insert original operating system installation CD into CD-ROM or
DVD-ROM drive
Restart your computer
Press F6 key to use driver as part of Setup when you are prompted
Press the F2 key when you are prompted at the start of the text-
only mode section of Setup
Insert ASR floppy

ppy disk
Follow the on-screen instructions
If you have a separate driver file, press F6 when you are prompted
after
f theh system restarts
Follow the on-screen instructions

Windows 2000 Backup and Restore Utility
Windows 2000 Backup offers three wizards:
Backup Wizard
• Helps in creating backup of programs

and files to help prevent data loss and
damage
Restore Wizard
• Helps in restoring previously backed-up

data in the event of a hardware failure,
accidental erasure and other data loss or
damage
Emergency Repair Disk
• Helps in creating an Emergency Repair

Disk
i k (ERD)
( ) that
h can bbe usedd to repair
i
and restart Windows if it is damaged
Methods for Restoring Replicated Data
Non-authoritative restore (default)

• Data from non-failed domain controllers is replicated to the newly
restored domain controller
• It results in the restored data (which may be out-of-date) becoming
synchronized with the data on other domain controllers through
replication
Authoritative restore
• It causes the restored domain controller’s
controller s replicated data to be
authoritative in relation to its replication partners
• Has effect of rolling back the entire network to the point in time of the
backup
Primary restore
• Used when the server to be restored is the only working server of a
replicated data set
• It performs
f a primary
i restore only
l when
h all ll the
h ddomain
i controllers
ll iin the
h
domain are lost, and domain is rebuilt from backup
Restoring Server Services
The following services require special attention to restore a

Windows Server 2003:
WINS
DHCP
Remote Storage
Certificate Services server
Windows Media Services server
Internet Information Services server (IIS)
Active Directory
Sysvol
Active Directory Recovery: Non-Authoritative
Restore
Press F8, For troubleshooting and advanced

p options
startup p
Select Directory Services Restore Mode from the

Safe Mode and Other Startup Options list
Select the Windows 2000 operating system and

logon with the standalone server
server'ss local
administrator account
Click Yes in warning dialog box
Start the Backup utility ( Start -> Programs ->

Accessories -> System Tools -> Backup)
Active Directory Recovery: Non-Authoritative
Restore (cont’d)
( )
Click the Restore Wizard button to start the

restoration process.
process Click Next
Expand File, expand the appropriate Media

created <date> at <time> entry and then
checkmark the System State entry. Click Next
Click the Advanced button, check other options,

and click Finish
Cli k No
Click N if you wish
i h tto perform
f an A th it ti
Authoritative
Restore of Active Directory objects
Active Directory Recovery: Authoritative Restore
Go to Start -> Programs -> Accessories -> Command Prompt.
Type ntdsutil
At the NTDSUTIL prompt, type authoritative restore
At the authoritative restore prompt, type restore subtree

OU=Marketing,DC=Antipodes,DC=COM, as shown in figure below
You should see the message "Authoritative Restore completed successfully"
To exit the authoritative restore prompt, type quit
To exit the Ntdsutil prompt, type quit
Verifying Active Directory Restoration: Advanced
Verification
Click Start, click Run, type regedit, click OK
Select the registry key , HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS. Check for subkey

called Restore In Progress. close regedit
Using Ntdsutil utility:
Start -> Programs -> Command Prompt -> type

ntdsutil
At the Ntdsutil prompt, type files
At the file maintenance prompt, type info
If recovery is successful, information similar to that shown

in figure
g will appear
pp
Exit Ntdsutil prompt by typing quit and close DOS prompt
Restart the server in normal mode and logon to the system

normally
ll
Perform basic verification

Verifying Active Directory Restoration: Advanced
Verification (cont’d)
( )
Verifying Active Directory Restoration: Basic
Verification
Restart computer in normal mode
Active Directory will automatically detect that it has been

recovered from a backup, will perform an integrity check,
and
d will
ill re-index
i d its
i d
database
b
Both Active Directory and FRS will be brought up-to-date

from their replication partners using the standard
replication protocols for each of those services
Check the directory to confirm that all the user and group
j
objects that were p
present in the directoryy p
prior to backup
p
were restored
Confirm if files that were members of an FRS replica set

and certificates that were issued byy the Certificate Service
are present
Active Directory Recovery on a Computer with
a Different Hardware Configuration
Perform a full backup of the domain controller, including the system state and the drive that
contains the system volume
On the new computer, perform a clean installation of Windows 2000 as a stand-alone server
in a workgroup
Active Directory restoration steps:
Click Start -> Programs -> Accessories -> System Tools ->Backup
Click Restore Wizard -> Next
Click Import File -> Browse, backup file -> Open -> OK
In What to restore list, click to select the computer partition check box and the System State check box
that you want to restore
Click Next -> Advanced

Active Directory Recovery on a Computer with
a Different Hardware Configuration (cont
(cont’d)
d)
In the Restore files to list, click Original location, and then click
Next
Click Always replace the file on disk, and then click Next
Follow
F ll the
th remaining
i i steps
t iin th
the Restore
R t Wi
Wizard
d to
t complete
l t th
the
disaster recovery restoration
In the restored domain controller

controller, change the BurFlags value to d4:
• Click Start -> Run -> in the Open box, type regedit -> OK
• expand My Computer, In the left pane
• E
Expand d HKEY_LOCAL_MACHINE,
HKEY LOCAL MACHINE and d th
then expandd SYSTEM
• Expand CurrentControlSet, and then expand Services
• Expand NtFrs, and then expand Parameters
• Expand Backup/Restore, and then click Process at Startup
• In the right pane, right-click BurFlags, and then click Modify
• In the Value data box, type d4, and then click OK
Sysvol Recovery: Primary Restore
Primary restore is performed when all domain

controllers in the domain are lost and need to
rebuild from backup
It builds a new FRS database by loading the

data present under Sysvol onto the local
d
domaini controller
t ll
Steps:
Launch Backup utility
select the Advanced option to access the Advanced Restore Options

dialog box
select checkbox When restoring replicated data sets, mark the

restored data as the primary data for all replicas
Sysvol Recovery: Non-authoritative Restore
Non-authoritative restore is performed when at least one other domain
controller in the domain is available and working
Steps:
P
Press F8 to b
boot target system iinto Di
Directory S
Services
i R
Restore
Mode during startup
Select Directory Services Restore Mode
Select the operating system and Log in as Administrator
Launch Backup utility and select Restore Wizard button
Select the appropriate backup location and ensure that at least

the System disk and System State containers are checked
Sysvol Recovery: Non-authoritative
Restore (cont’d)
(cont d)
Click the Advanced button and make sure you are restoring
junction points
Select Original Location in “Restore Files to” drop down

box
In Advanced Restore Options window, check the

boxes for Restore security;
y Restore junction
j points,
p
and restore file and folder data under junction
points to the original location; Preserve existing
volume mount points
Click on Finish button and click YES to restart computer
Sysvol Recovery: Authoritative Restore
Authoritative restore is performed when critical Sysvol data is accidentally
deleted from the local domain controller and the delete has propagated out to
other domain controllers
Steps:
First follow steps for a non-authoritative restore but do not

restart system
Click on the Restore Tab
Ensure Alternate Location is selected in the “Restore Files

to” drop down list
to
Use Ntbackup to restore the System State to an alternative

location
Launch Ntdsutil by opening command prompt and typing

ntdsutil. Press Enter Copyright © by EC-Council
Sysvol Recovery: Authoritative Restore
(cont’d)
(cont d)
Type authoritative restore and press Enter
At the next prompt, type restore database
At the “Authoritative Restore Confirmation Dialog” box, click OK
Type Quit, and repeat until you exit out of the application
Reboot the system in normal mode and allow the Sysvol to be published
C
Copy required
i d fil
files/folders
/f ld ffrom th
the SYSVOL didirectory
t th
thatt was copied
i d tto th
the alternate
lt t
location to the original location
Recovery of Global Catalog Server: Steps
for restoring Global Catalog Server from backup
Backup p restoring
g can be used to
automatically restore DC to the role of GC
(refer previous slide for restore from backup)
Restoring a GC from backup takes more time

than restoring a normal domain controller, in
a multi-domain environment
Steps for Assigning a New GC:
To enable a new GC, follow the steps outlined

in the To enable or disable a global catalog
section in the Windows 2000 Server Help
Recovery of an Operations Master
There are two methods to recover
an operational
a ope at o a manager:
a age :
Restore failed operations master

from backup
Seize the role from another DC

within the environment
Steps to Seize an Operations

Master:
In command prompt, Type NTDSUTIL
At the ntdsutil prompt, type: roles
Recovery of an Operations Master
(cont d)
(cont’d)
At the FSMO maintenance prompt, type: connections
At the server connections prompt, type: connect to server <FQDN of Server>. For
example: connect to server syd02.whitepaper.com.au
At the server connections prompt, type: quit
At the FSMO maintenance p

prompt,
p type:
yp seize <operations
p master>. For example:
p seize
schema master
At the popup window, click Yes to verify the seizure.
At the FSMO maintenance prompt, type: quit
At the ntdsutil prompt, type: quit

Domain Controller Recovery: With a
Working Domain Controller
It involves three stages
Seize all FSMO roles:
Log on to a Windows 2000 Server or Server 2003

based
b d member b computer
t or d
domaini controller
t ll
Click Start, click Run, type ntdsutil in the Open box,

and then click OK
Type roles, and then press ENTER
Type connections,
connections and then press ENTER
Type connect to server servername, and then press

ENTER where
ENTER, h servername isi the
th name off th
the d
domain
i
controller that you want to assign the FSMO role to
Working Domain Controller (cont’d)
(cont d)
At the server connections prompt, type q, and
then press ENTER
Type seize role, where role is the role that you want
t seize
to i
For a list of roles that you can seize, type ? at the

ffsmo maintenance
i prompt, andd then
h press
ENTER, or see the list of roles at the start of this
article
At the fsmo maintenance prompt, type q, and then

press ENTER to gain access to the ntdsutil prompt.
T
Type q, and
d then
th press ENTER to t quit
it the
th Ntd
Ntdsutil
til
utility
Working
g Domain Controller ((cont’d))
Rebuild the failed domain controller
Redeploy the FSMO roles:
Follow the steps to sieze FSMO roles
In 8th step, type transfer role, where role is the role that you want to transfer
For a list of roles that you can transfer, type ? at the fsmo maintenance prompt, and
then press ENTER, or see the list of roles at the start of this article
Domain Controller Recovery: Without
a Working Domain Controller
Non-authoritative restore
• Follow the steps for Active Directory Recovery: Non-Authoritative
Restore
A h i i restore
Authoritative
• Follow the steps for Active Directory Recovery: Authoritative Restore
Database Integrity Testing
Perform Soft Recovery of the Log Files

• Soft recovery is performed automatically when the domain controller starts if the
previous shutdown was not clean
Ensure File Integrity

• integrity command can be used to detect low level (binary level) database corruption
• C:\>ntdsutilntdsutil: files
• file maintenance: Integrity
Ensure Database Integrity

• Run Ntdsutil tool during Directory Service Restore mode and perform the following
functions:
f i
• Reference count check
• Deleted object check
• Ancestor check
• Security descriptor check
• Replication check
Rights Management Services Restoration
(cont d)
(cont’d)
Prerequisites:
Functioning Intranet network connection
Virtual directories
• Certification pipeline
• Licensing pipelines
Configuration database servers
Directory services
Restoration steps: If RMS server is not a member of a cluster
Re-install
Re install operating system and other necessary RMS software
Reprovision server
RMS server will detect the presence of the original configuration database
Click “yes” on ‘if the database should be reused’ prompt

Rights Management Services
Restoration (cont
(cont’d)
d)
Rights Management Services Restoration
(cont d)
(cont’d)
Restoration steps: (If the server being
restored is the RMS root server and a
ServiceConnectionPoint object for RMS is
present in Active Directory)
Options:
• Manually delete the ServiceConnectionPoint in

Active Directory before beginning the
provisioning
i i i process
• Re-provision the server - when taken to the
page ProvisionLicensing.aspx, replace, in the
URL,, tthee page name
U a e with
t
ProvisionCertification.aspx and Click GO
button in the browser
Rights Management Services Database
Restoration: Restoration steps: If RMS server is a member
off a cluster
l
Remove and Repair node
Re-install software, if necessary
Re-install failed components and software
Restore database
b from b
backup
p media
Apply transaction logs
Restart the RMS servers
Obtain or renew RACs, if the transaction logs are unavailable and RAC is available
Tools for Active Directory Disaster
Recovery: Recovery Manager
Recovery manager provides solution for fast, granular, online recovery of Active
Directory in the event of inadvertent modification due to software failure or human
error
It minimizes downtime caused by corruption or improper modification of directory,

configuration and Group Policy data
data, assist in meeting the critical service level
agreement requirements, and help s to comply with external regulations
Features
eatu es a
and
d be
benefits:
e ts:
• Comprehensive Recovery Options

• Efficient, Flexible Backup Of Active Directory
• Create Differential Backups Of Active Directory
• Use 3rd Party Active Directory Backups
• Comparison Reporting
• Group p Policyy Restore
• Backup and Restore Of ADAM
• Scheduling Capabilities
Recovery Manager: Screenshot
Restoring IIS Configurations:
iisback vbs
iisback.vbs
Log in as Open command Run iisback

Administrator prompt command
~ Syntax
iisback /restore/b BackupName [/v {Integer | HIGHEST_VERSION}] [/e
EncryptionPassword] [/s Computer [/u [Domain\]User/p Password]]
~ Parameters
• /bBackupName
• /v{Integer | HIGHEST
HIGHEST_VERSION}
VERSION}
• /eEncryption Password
• /sComputer
• /u[Domain\]User
• /pPassword
Restoring Microsoft IIS
Metabase Backup
Go to Start -> Programs -> Administrative
Tools ->> Internet Information Services
Manager
Start the Microsoft Management Console

(MMC) Internet Information Services (IIS)
Manager snap-in
Right-click the name of the machine that hosts

the IIS services, then select Backup/Restore
Configuration from the All Tasks menu
S l t the
Select th backup
b k you wantt to t restore,
t th
then
click Restore
Restoring Microsoft IIS Metabase
Backup (cont
(cont’d)
d)
Click Yes on confirmation prompt
Enter the password if backup is

password protected
Click OK to close the confirmation

window
WANSync IIS
WANSync IIS is a Microsoft IIS server replication and disaster Recovery Solution
WANSync IIS features and services:
It uses asynchronous host-based real-time replication to provide cost-effective disaster

recovery capabilities for Microsoft IIS on 32- and 64-bit Windows standalone and cluster
servers
It transfers changes to application data as they occur to a standby replica server located
locally or over the WAN
Continuous data protection based on XOsoft's Rewind Technology for recovery from data
corrupted by virus action or user or application error
IIS server recovery software to automatically recover your data from your replica
It supports automated remote installation, and wizard-driven creation of new IIS disaster
recovery scenarios
Assessment mode measures exact change rate during evaluation to aid in estimating
bandwidth requirements
WANSync IIS: Working
Restoring Exchange Server 2003
Fast Automatic Recoveryy Using

g Transaction Rollback
Transaction log file is scanned when an Exchange Server

information
i f ti store
t or directory
di t service
i isi started
t t d after
ft abnormal
b l
server shutdown, to see if there were any incomplete transactions
Incomplete transactions are rolled back automatically to their pre-

shutdown state
This is a relatively fast process as only the most recent

transactions in the log have to be checked
Data Recovery Scenarios
Three recovery scenarios:
Single-item
• Single mailbox recovery by restoring the entire private information
store
g item recoveryy using
• Single g the Exchange
g 55.5
5 Deleted Items Retention
feature
• Single item recovery using third-party brick backup programs
F ll
Full-server
.PST,
PST .OST,
OST and
d .PAB
PAB
Exchange Data Recovery Preparation
Prepare a non-production recovery server and Create a new site
IInstall
t ll complete
l t Exchange
E h with
ith service
i packk using
i the
th same site
it andd
organization name used on the server from which you are restoring
the mailbox
Install the Exchange client on the recovery server
Restore the Information Store from Tape
(cont’d)
(cont d) : If online tape back
back-up
up is not available
Insert the backup tape in the drive
From the Administrative Tools group run Backup
From the pull

pull-down
down menu
menu, click Operations,
Operations Microsoft Exchange
Click the Tapes icon and double-click on the tape name
Click "ORG\SITE\SERVER"\information store in the right side of the Tapes window
Click the Restore button
Enter name of the destination server in destination server field
Select Erase All Existing Data, Private, Public, Verify After Restore, and Start Service After
Restore. Click the OK button three times
Exchange Data Recovery Preparation (cont’d):
If offline backup
p of the Exchange
g information store is available
Stop all Exchange information store services
Determine the location of the database and logs from the

f ll i registry
following i t llocations:
ti
Information store service Private information store Public information store
log path: database path: database path:
• HKEY_LOCAL_MACHINE
HKEY LOCAL MACHINE • HKEY_LOCAL_MACHINE
HKEY LOCAL MACHINE • HKEY_LOCAL_MACHINE
HKEY LOCAL MACHINE
\System \CurrentControlSet \System \CurrentControlSet \System \CurrentControlSet
\Services \MSExchangeIS \Services \MSExchangeIS \Services \MSExchangeIS
\ParametersSystem \DB Log \ParametersPrivate \DB Path \ParametersPublic \DB
Path Path3.Move out all files from
the
h EXCHSRVR\MDBDATA
directories on all drives
(cont’d)
(cont d)
Copy the PRIV.EDB file to the private information store database path
Copy the PUB.EDB file to the public information store database path
Copy any information store log files to the information store service log path
Make sure that the Exchange directory service is started
From the command prompt, change to the EXCHSRVR\BIN directory and execute the
following command: isinteg –patch
Start the information store service
Single Mailbox Recovery
Run the Exchange Administrator program
Run the
h DS/IS
S/ S consistency
i adjuster
dj and
d Highlight
i hli h the
h server name
From File menu -> Properties -> Advanced tab -> Advanced (v5.5)-> Consistency Adjuster (bring up the
DS/IS consistency adjuster dialog box, Select all the options for the private and public information stores) ->
All inconsistencies -> OK
Select the Recipients container and double-click on the desired user's mailbox name
From the General tab -> Primary Windows NT Account -> Select An Existing Windows NT Account -> OK
From the Add User Or Group screen -> Administrator -> Add -> OK ->OK on the User Property screen
From the Windows NT control panel, run Mail and Fax
Configure a profile for the desired user
Add a p
personal folder file to the p
profile
Run the Exchange client

Single Mailbox Recovery (cont’d)
Select Mailbox - <USERNAME> on the left panel
Select the first folder or item in the list on the right panel
From the pull-down menu, click Edit and Select All
From the pull-down menu, click File and then Copy
In the Copy screen,

screen click Personal Folder and then click OK.
OK This copies all data to this .PST
PST file
Copy the .PST to the destination location
Add this .PST to the user's profile on the production server or send the .PST to the end user with
instructions
Recover the user's Schedule+ data, if the user runs the Schedule+ client to schedule activities
Log on to Schedule+ as the user, select the option to create a local schedule (.SCD) file, and then send the
.SCD file to the user
Single Item Recovery using Deleted
Items Retention
~ Configuring Deleted Items Retention
~ Restoring Items from the Outlook Client

• Client uses an extension available with
O tl k 8
Outlook 8.03
03 or llater
t
• Click the Deleted Items folder in the

Outlook client -> Tools -> Recover
Deleted Items
• Select messages or folders to recover
Single Item Recovery using Third-
party Brick Backup Programs
Exchange brick backup solutions
back up and restore individual
mailboxes,
ilb ffolders,
ld and
d public
bli
folders
Some of the third-party

third party brick
backup solutions are:
GFI MailArchiver
BrightStor ARCser
ARCservee Backup
Back p
Agent for Microsoft
Exchange
SonaSafe® for Exchange

S
Server
Full-Server Recovery: Preparation
Run the Exchange Server Setup program. If you are not using Exchange Server 4.0, you can use Setup
/R to recover an existing Exchange server onto new hardware
Make sure the server name is the same as that of the original production computer
Select Create New Site with same organization

g and site names and same service account and same
connectors
Run the Exchange Performance Optimizer
Install the same Exchange service pack as was installed on the original production server
Configure Microsoft Mail (MS Mail) Connector identical to old server
If the Key Management server was installed on the original server, install it on the new server
Install Exchange Client or Outlook on the recovery server

Full-Server Recovery: Option 1
Recovery if online backup is available
Insert the restore tape and click the Backup From the Administrative Tools group
Double-click the Tapes icon
Double-click "Full Backup Tape…."
Click the Restore button from the top of the Backup window
On Catalog Status screen select the Directory and Information Store
On the Restore Information screen enter the name of the destination server. Select Erase
all
ll Existing
i i Data. Verify
if that
h the
h Private,
i Public,
bli Start
S Services
S i After
f Restore, and
d
Verify after Restore options are all selected. Click OK
dialog After
Click OK on the Restore Information dialog to display the Restore Status dialog.
the restore is completed click OK on the Restore Status dialog box
If original production server was changed after the last backup
and transaction logs are a
available
ailable
In new server, move out all files from the MDBDATA and DSADATA directories on each
d i
drive
Copy the transaction log files from DSADATA and MDBDATA directories.
directories Check these
registry entries:
Directory service log path: Information store service log path:
•HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services •HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services
\MSExchangeDS \Parameters \Database log files path \MSExchangeDS \ParametersSystem \DB Log Path
Run the Backup program to restore the directory service and information store data
On the Restore Information screen, select Verify After Restore and Start Services
After Restore. Click OK.
If Offline Backup is available
1. Stop all Exchange services and determine location of database and logs for the directory service
and information store service, from these registry locations:
• Directory service log path:
HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \MSExchangeDS \Parameters
\Database log files path
• Directory service database path:
HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \MSExchangeDS \Parameters \DSA
Database file
• Information store service log path:
HKEY_LOCAL_MACHINE
HKEY LOCAL MACHINE \System
\S \C
\CurrentControlSet
C lS \Services
\S i \MSE h
\MSExchangeIS
IS \ParametersSystem
\P S
\DB Log Path
• Private information store database path:
HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \MSExchangeIS \ParametersPrivate
\DB Path
• Public information store database path:
HKEY_LOCAL_MACHINE \System \CurrentControlSet \Services \MSExchangeIS \ParametersPublic
\DB Path
Full-Server Recovery: Option 3 (cont’d)
2. Copy
py DIR.EDB file to the directoryy service database , directoryy service log
g
files to the directory service log , PRIV.EDB file to the private information
store database,, PUB.EDB file to the public

p information store database,, anyy
information store log files to the information store service log path
3
3. Start the Exchange directory service
4. From the command prompt, change to the EXCHSRVR\BIN directory and
execute:
isinteg –patch
5. Start the information store service

Restoring the Key Management Server Dat
If the KM server service has not been installed,
install it
Stop the KM server service
Restore the KM server data:

If yyou are running
g Exchangeg If yyou are running g Exchange
g
Server 4.0 or 5.0, restore the Server 5.5, restore the
\SECURITY\MGRENT EXCHSRVR\KMSDATA
directory directory
Restore the KM server startup disk
Start the KM server service

Exchange Server Backup/Recovery
Solution: SonaSafe
SonaSafe for Exchange Server is Sonasoft’s data recovery and business
continuance solution
Features:
Support for Exchange 2000 and 2003

Ability to recover to the point-of-failure or to a point-in-time
Compression reduces storage costs by up to 65%
Intelligent, brick-level backup and recovery capability
Ability to recover a single email message with just one click
Backup
p and recover Active Directoryy and IIS Metabase
Web-based interface; can be accessed from anywhere in the world
Automated policy-based purging functionality
Excellent diagnostic
g capability
p y
Exchange Server Backup/Recovery
Solution: SonaSafe (cont
(cont’d)
d)
Affordable, easy-to-use disaster recovery solution for Microsoft Exchange server
The standby exchange server can be anywhere; no distance limitation
Ability to archive mailboxes
Meets regulatory
l compliance
li requirements
i lik
like S
Sarbanes
b O
Oxley,
l HIPAA etc.
The standby server is available for testing/searching/monitoring purposes
Facilitates migration of Exchange servers from one version to another
Ability to failover and failback just a single mailbox to test disaster recovery preparedness
Ideally suited for SMB Exchange environments
Ability to load balance by distributing mailboxes across multiple Exchange Servers
Cost-effective solution that can be implemented within a couple of hours
Inexpensive alternative to exchange clusters

SonaSafe: Screenshots
SonaSafe: Screenshots
Recovering Blackberry Enterprise Server
Hardware failure
• Restore the ghost image
• Reinstall OS and restore backup
• Rebuild
• Install a new Blackberry Enterprise Server using same server name, server
admin mailbox, SRP ID and Authentication Key
• SQL database including restore backups
• Admin mailbox MAPI profile
p
• Start MMC
SQL database data loss

• Restore from SQL backup
• Create a new database and use Blackberry Enterprise Server to install and
repair or create db.sql script
• Start MMC to re-add the server and policies
Recovering Blackberry Enterprise
Server (cont’d)
(cont d)
Accidental user mailbox

deletion
• Recover individual mailbox from

Microsoft Exchange backups
• Restore from Blueberry Exchange Server
backup
Accidental Blackberry
Enterprise server admin
mailbox deletion
• Recreate the mailbox with the same

name
• Start MMC
• Add the users
IBM WebSphere Application Server
Recovery
Gracefully stop one

or more application
server cluster
members
Forcefully kill one or

more application
pp
server cluster
members
Disable the network

access from one of
the application server
nodes and then
enable it again
IBM WebSphere Application Server
Recovery (cont’d)
(cont d)
Unplug the power cord
from one of the
application server nodes,
then plug it back in
Reboot one of the

application server nodes
Kill the deployment

manager and node agents
at various times and then
restart them
Stop applications from the

administrative console and
then restart them
Recovering Coldfusion Application
Server: CFMAIL Bug
Open the Services dialog
Stop the ColdFusion Application

Server and Executive Services
Delete files from \cfusion\mail\spool

folder using command prompt
Restart the ColdFusion Application

Server and Executive Services
Server: Variable Deadlocks
1. Log
g in to yyour CF Administrator and enable
"Full Checking" on the Server, Application,
and Session scopes in the Locking section of
the configuration
• or
1. Use Studio's multiple file search for the
strings "server", "session", and "application"
and ensure that you are using CFLOCK with
all of yyour shared variables
2. Browse Application log (\cfusion\log\

application.log) to see which CFM files and
variables are causing the problem
3. Disable "Full Checking" and fix the code

within the application
Server: ODBC Errors
Restart ColdFusion Application

Server services
Use software utilities to repair corrupt

MDB files or identify the presence of
an MDB password such as Compact
and Repair Utility from Microsoft
Server:500 IIS Internal Server Error
Open Internet Services Manager
Right click and open the Properties of the Web site with the problem
Click on Home Directory Tab
Click Unload Button
Server: System Registry Access Problem
Purge client variables from the

registry by using tools such as
Macromedia's clientVarPurger
Store client variables in a

database preferably a SQL
Server database
Ensure that variables in system

registry expire in a timely
fashion
For Windows platforms,
Restart server from cold
If you are running Domino as a Windows system service be sure to

restart Domino in the same way, rather than manually from the user
interface
If the server is part of a cluster, set the server to be "restricted“
From console command, set config server_restricted=n,

•where
h n iis 0, 1, or 2. ((0 = unrestricted,
i d users can llog on; 1 = users cannot llog on until
il the
h
server is restarted; 2 = server is restricted until this parameter is changed)
(cont d)
(cont’d)
Run the FIXUP and
COMPACT ttask
k on all
ll
databases
Search for .TMP files
Examine the running

tasks by looking in
NOTES.INI at the
ServerTasks line
Remove tasks that are not

needed
(cont d)
(cont’d)
Remove any "add-in" tasks on the
server, such as third-party products
or custom written DLLs, from
NOTES.INI
Re-install
Re install Domino on top of itself
For repeated immediate failures, edit

NOTES.INI and place an exclamation
mark (!) in front of the ServerTasks
line, save the file, then reboot
Start all the other tasks manually, one

b one
by one. After reboot this helps in
finding the task responsible for
crashes
Clear restricted setting so that users

can log on again
Tool: SteelEye LifeKeeper
SteelEye's LifeKeeper is a software application that ensures the

continuous
ti availability
il bilit off applications
li ti b
by maintaining
i t i i system
t uptime
ti
Features:
Fault Resilience
Proactive Protection
Transparent Failover
Scalability
D
Data A
Access and
d IIntegrity
i
Recovery Operations
Application Recovery Kits
U ti
Uptime D
During
i M Maintenance
i t and
dUUpgrades
d
Restoring MS SQL Server: Option 1
Restoring a Complete Backup to the Same Database
Open SQL Server Enterprise Manager and

connect to the server where the backup is to be
restored
Right-click the database and select All Tasks,

then select Restore database
From the list of databases, select the database for

which the backup has to be restored
From the list of backups, select the backup to

restore, then click the Properties button to
display the Backup Set Properties dialog box
Restoring MS SQL Server: Option 1 (cont’d)
In the Backup Set Properties dialog box, click OK
In the Restore Database dialog box. click the Options tab
(cont’d)
(cont d)
Select the appropriate

settings in this dialog
Click OK to start the

restore operation
Click OK to close
confirmation prompt
Restoring a Complete Backup to a New Database on the Same
Server
Open SQL Server Enterprise Manager and connect to the server where the backup is to be restored
Right-click any database and select All Tasks, then select Restore Database to open the dialog box
In the Restore as database: text box, enter the name of the new database that you wish to create
Under Parameters, select the database for which you intend to restore the backups
Select the backup that you would like to restore and click Properties to verify the properties for that backup and go to
O ti
Options t b
tab
If necessary, modify the file name and location of the database files listed in the Restore As list.
Select all the other options from this dialog box as necessary
To start the restore operation, click OK
Click OK to close confirmation prompt
Restoring a Complete Backup to a New Server
Copy the database backup file to the target

machine or share it on the network so that
it is accessible from the server
Open Enterprise Manager and connect to

the server to which the backup is to be
restored
Right-click any database and select All

Tasks then select Restore Database to
Tasks,
display the Restore Database dialog box
Enter the name of the new database

that the backup process will create and
restore the backup to, in the Restore
as database: list box
Select the From device radio button
Click the Select Devices button
In the Choose Restore Devices dialog

box, select either the Disk or the Tape radio
button
Click the Add button to display

p y the dialog
g
box
Enter the file name of the backup file that is

to be restored. If the file exists on a network
share provide the UNC share name in the
share,
File name text box
Click the OK button. Then Choose Restore

Device dialog box
Click the OK button to return to the Restore

Database dialog box
Click the Options tab and select appropriate

options for the restore operation
Click
Cli k OK in
i the
th Restore
R t Database
D t b dialog
di l
box
Click OK in the confirmation dialog box.

Partial Database Restoration
Open SQL Query

Analyzer and perform the
query to get the names of
files that constitute the
complete backup
Execute the command

from the SQL Query
Analyzer window
Restoring Transaction Log Backups to the Same Server
Open Enterprise Manager,

connect to the server, and
expand Databases
Right-click the database

name and select All Tasks,
Tasks
then select Restore Database
In the Show backups of database list, select the

database name
Select the database name and click on Properties

p
button to view properties for the log backup
Click Options tab to view and,

and if necessary,
necessary modify
any option relating to the restore operation
Click OK to start restore of the transaction log
Click OK in the confirmation dialog box
Restoring Transaction Log Backups to a Different Server
Open SQL Server Enterprise

Manager and connect to the server
Expand Databases. Right-click the

database for which the transaction
log backup is to be restored and
select All Tasks, then select
Restore Database...
To select the backup file(s) containing transaction log backup(s) to be restored, click the Select
Devices... button
Select the Transaction log radio button under Restore backup set
Click the Options tab and select appropriate options for the restore
If this is the final transaction log

g backup,
p, select the Leave database operational.
p No additional
transaction logs can be restored option.
If there are further backups to be applied after this one, select one of the other two options for the
Recovery completion state
Click OK to start the restore operation
Click OK in the confirmation dialog box
Restoring Filegroup Backups if Filegroup Files are Damaged
Open an SQL Q
O Query
Analyzer window and
connect to the server where
th files
the fil d t b
database id
resides
Select master database

from the list box and enter
the command
(cont’d)
(cont d)
Right-click the files database and select
All Tasks, then select Restore
D t b
Database..
Select the Filegroups or files radio

button
Ensure that the files database is selected in

the Show backups of database: list box
Select the Select a subset of backup

p sets
check box
In the Filter Backup Sets dialog box, select

Only
O l backup
b k sets
t off th
the following
f ll i
filegroups and files:
Check the filegroup in the list of files/filegroups

that is displayed
Click the OK button in the Filter Backup Sets

dialog box
Select latest backup displayed in the list
Click the Options tab and select options as necessary
Click OK to start the restore operation for the filegroup
Once the filegroup is restored successfully, repeat the process

and restore all the transaction log backups, selecting the tail that
we backed
bac ed up in Step 2 as tthee last
ast log
og tthat
at iss restored
esto ed
Restoring a database on another server
In Enterprise Manager,
g click on the
right
database and select All
Tasks -> Restore
database
Select a database or give a

name for new database
select the "From Device"

option
Check Parameters and

click OK
Restoring MySQL Server
1. Launch MySQL
y Q
Administrator from
program menu
2 Click on the Restore

2.
icon
Restoring MySQL Server (cont’d)
Go to General Tab
Following options are available:

Create
File to restore Target Schema Backup Type Ignore Errors File Charset
database(s)
Select file to restore
G to
Go t R t
Restore C t t ttab
Content b
MySQL Administrator Screenshot
Restoring MySQL Server (cont’d)
Select back files to

restore
Click Start Restore

button
Recovering Cisco IOS
Pre-requisites:
• Console cable
• tftp server
• db9 serial adapter for the console cable
Steps:
1. Connect to the router and you will see:
rommon 1:gt;
2. Set some variables for the router:
The required variables are:
IP_ADDRESS=
IP_SUBNET_MASK=
DEFAULT GATEWAY=
DEFAULT_GATEWAY=
TFTP_SERVER=
TFTP_FILE= Optional Variables are:
TFTP_VERBOSE: Print Setting. 0=Quiet, 1=progress(default), 2=verbose
TFTP_RETRY_COU
COUNT: Retryy count
o for
o ARP and
d TFTP (d
(default=7)
7)
TFTP_TIMEOUT: Overall timeout of operation in seconds (default=7200)
TFTP_CHECKSUM: Perform checksum test on image, 0=no, 1=yes (default=1)
Recovering Cisco IOS (cont’d)
3. Command line options:

-r : do not write to flash, load to DRAM only and launch image
4. Download your TFTP server to your PC
5. Install the program and start the TFTP server
6. Place IOS image in the TFTP server
7. Set the IP address, subnet mask, default gateway, tftp server, and tftp file.
For example:
rommon 1> IP_ADDRESS=10.0.0.5 rommon 2>
IP_SUBNET_MASK=255.0.0.0 rommon 3>
DEFAULT GATEWAY=10.0.0.1
DEFAULT_GATEWAY 10.0.0.1 rommon 4> TFTP
TFTP_SERVER
SERVER=10.0.0.6
10.0.0.6
rommon 5> TFTP_FILE=c827v-y6-mz.121-1
Recovering Cisco IOS (cont’d)
7
7. Use "set"
set command to ensure the required variables are
set and that your settings are correct
8. Use tftpdnld command as the command used after the

variables are set to download the IOS image
g
9. Select "Y" or “yes” in erase flash prompt to continue
10. Cold restart for the router once this has been completed
Summary
System Restore component of Windows XP enables users to restore a

system to a previous state
It monitors changes to the system and some application files and

automatically
t ti ll creates
t easilyil id
identified
tifi d restore
t points
i t
Crash Recovery Kit for Linux can be used for recovery of a trashed LILO
b
boot record
d
Potential causes of Windows Server 2003 3 failure include Hard disk

subsystem failure, Power failure, Systems software failure, etc.
Methods for restoring g replicated

p data include Non-authoritative restore
(default), Authoritative restore and Primary restore

DR v2 Module 10 System Recovery PDF

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

DR v2 Module 10 System Recovery PDF

Transféré par

Droits d'auteur :

Formats disponibles

Disaster Recovery

This module will familiarize you with the following:

System Restore Boot problems in MS SQL Server

Mac System Recovery Coldfusion

Blackberry Domino Server Crashes

System Restore component of Windows XP enables you to restore a system to a

Restore points contain the following two types of information:

Start -> All Programs

System Restore Settings

Reasons for Linux system failures:

5. Edit /etc/fstab file

Crash Recovery Kit for Linux can be used for:

Recovery of a trashed LILO boot record

Backup over the network in the form of tar.gz tarballs

Detecting versions and types of hardware

Recovery of a misconfigured or hacked Linux system

Make tape backup of a disk which can't be booted anymore

If all fails, completely

Rewrite device drivers using a hard disk formatting program

Use the "Update" or "Install driver" command in the formatting software

Completely remove any security programs

Use the "Update" or "Install driver" command in the

~ It occurs when a Mac freezes in the middle of a program

If the problem is specific to a particular media, reinstall the

Potential causes of Windows Server 2003 failure include:

Hard disk subsystem failure

Systems software failure

Natural disasters (fire, flood, earthquake, and so on)

Start -> click Shut Down -> click Restart -> OK

Press F8 key when Please select the operating system to start

Select Last Known Good Configuration

Follow above steps

If computer does not start in Safe mode,

If the computer still doesn't start, look for

Do one of the following:

In the console tree, expand Event Viewer, and then

In the details pane, double click the event that you

Start -> Run -> type msinfo32 -> OK

Look for problem devices or device conflicts

• In console tree, expand Components, and click Problem Devices

Log file is located in

Use a text editor such

Start -> right-click My Computer -> click Manage

Expand System Tools, and then click Device Manager

Investigate possible device conflicts by double-clicking device in right pane, and

If problematic device is identified, disable it, and restart computer in normal

Create a Clean Environment for Troubleshooting

Isolate Problems by Using System Startup Options

Click SYSTEM.INI tab

Start -> Run -> type msconfig -> OK

Click the SYSTEM.INI tab

Restart your computer, and see if the problem occurs

Click Enable All,

Start -> Run -> type msconfig -> OK

Click the WIN.INI tab

Restart computer, and see if the problem occurs

Start -> Run -> type msconfig -> OK

Click Normal Startup - load all device

1. Insert the Windows Server 2003 installation CD in CD-ROM or DVD-ROM drive

Restart your computer

Insert ASR floppy

Follow the on-screen instructions

Follow the on-screen instructions