More reasons why System State Backups are a Good Idea

The default settings for the built-in backup tools with SBS 2003 include a System State backup every time the backup process runs. The System State backup collects not only the files in the Windows system directories, but it also backs up the registry and the Active Directory database. Jeff Middleton’s disaster recovery presentation at SMB Nation Amsterdam from last week makes a few references to the system state backup and how it can be used to get back from a real jam. But I was reminded this morning of another very important reason why system state backups are important.

When a System State backup is run, not only does it copy all the system state information into the backup location (tape or file, wherever SBS is configured to do its backup) but it also makes a backup copy of the registry files in the C:\Windows\Repair directory (normally these files live in C:\Windows\System32\Config).

This morning I got a call from a client who rebooted his server and received the ever frightening “Windows could not locate the following file C:\Windows\System32\Config\System” and booting stopped at that point. I immediately had him boot from a 2003 install CD and get into the Recovery Console and looked in the C:\Windows\Repair directory. Sure enough, the System file was there (this file represents the System hive of the registry) but it was dated from the initial install of the SBS server over 2 years ago. The backup software he is running is not configured to do a System State backup as part of its normal process, so no recent copies of the System registry hive were located there.

As it turns out, his problem was not a corrupt or missing registry hive but instead was bad memory that he had tried to install, but that’s another story. We did run a System State backup using NTBackup as soon as we got the server booted again, and I’ve set up a weekly process to run a System State backup prior to the start of the backup process of his other software.

The bottom line is that recovering from a damaged or deleted registry hive file can actually be a simple process, if a System State backup has been done recently. If not, recovering from a damaged registry hive file can be much more cumbersome, and probably a topic for a different post.