A System State backup is a copy of several critically important system files. If you want to make a complete system backup, you need to make a copy of the System State as well, because it contains files that cannot be copied "by hand," but are required to restore the state of the system.
Here is what the System State backup contains:
- A complete copy of the Registry. A backup of the Registry is also kept in the %systemRoot%\Repair\RegBack folder.
- NTUser.DAT. This file contains the current user's profile information, and is also backed up to %systemRoot%\Repair\RegBack.
- All boot files -- BOOT.INI, NTLDR and NTDETECT.COM. If you are using certain types of disk controllers, the file NTBOOTDD.SYS will also be included.
- Files protected by Windows File Protection (WFP). This may include system drivers, critical system .DLLs, and other protected files in %systemroot%
- Performance counter configuration information, which is used to generate real-time statistics about the behavior of system components. Since these counters vary from system to system, they also need to be backed up.
- The Component Services Class registration database, which contains all of the classes registered to that copy of Windows.
- A copy of the Active Directory database, if there's one present on that system.
- SYSVOL, which is present only on domain controllers. This is a tree
- of folders containing files that need to be available and synchronized between domain controllers in a domain or forest.
- A copy of Certificate Services, if you're running that on the server in question.
- A copy of the cluster database, if the system in question is a node in a cluster.
The built-in Windows 2000 Backup tool has the ability to make a copy of the System State, either to tape or to some other backup medium. If you select the Backup tab in the program, one of the choices in the left-hand drive/directory tree is a box labeled "System State." Check it to back up the system state to the media of your choice. Restoring the System State on a conventional computer is the same as restoring other files or folders.
To restore the System State on a domain controller, however, you need to press F8 at boot time and start the server in Directory Services Restore Mode. Once the system is up, restore the System State backup through the Windows 2000 Backup tool as you would restore any file or folder, although you'll be prompted to reboot the system. (Note that if the system appears to hang for a period of time when shutting down, this is normal, since Windows is scanning all protected files during this time.)
Another option available with backing up the System State is available by clicking the Advanced button in the backup job information window (available after you press Start Backup). If you select "Automatically backup System Protected System Files with the System State," everything in the %SystemRoot% folder is automatically backed up, but this makes the System State backup much larger.
Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter.
This was first published in July 2002