While taking a backup of files, the Backup utility creates a volume shadow copy of the data to create an accurate copy of the contents. It includes any open files or files that are being used by the system. Users can continue to access the system while the Backup utility is running without the risk of losing data.

Volume Shadow Copy

Backup provides a feature of taking a backup of files that are opened by a user or system. This feature is known as volume shadow copy. Volume shadow copy makes a duplicate copy of all files at the start of the backup process. In this way, files that have changed during the backup process are copied correctly. Due to this feature, applications can continue writing data to the volume during a backup operation, and backups can be scheduled at any time without locking out users.

Types of Backups

The Windows Backup utility provides various types of backups. While planning for a backup strategy, it is important to choose an appropriate type or combination of different types of backups. The backup type determines which files are transferred to the destination media.

Each backup type relates to an attribute maintained by every file known as archive (A). The archive attribute is set when a file is created or changed. When an archive attribute is set, it means that the backup of this file has not been taken or it is due.

Note: When it is said that “The file is marked as backup”, it means that the archive attribute of the file has been cleared.

Normal Backups

When an administrator chooses to use a normal backup, all selected files and folders are backed up and the archive attribute of all files are cleared. A normal backup does not use the archive attribute to determine which files to back up. A normal backup is used as the first step of any backup plan. It is used with the combination of other backup types for planning a backup strategy of an organization. Normal backups are the most time-consuming and are resource hungry. Restoration from a normal backup is more efficient than other types of backups.

Incremental Backups

An incremental backup backs up files that are created or changed since the last normal or incremental backup. It takes the backup of files of which the archive attribute is set. After taking a backup, it clears the archive attribute of files. An incremental backup is the fastest backup process. Restoring data from an incremental backup requires the last normal backup and all subsequent incremental backups. Incremental backups must be restored in the same order as they were created.

Note: If any media in the incremental backup set is damaged or data becomes corrupt, the data backed up after corruption cannot be restored.

Differential Backups

Differential backup backs up files that are created or changed since the last normal backup. It does not clear the archive attribute of files after taking a backup. The restoration of files from a differential backup is more efficient than an incremental backup.

Copy Backups

A copy backup copies all selected files and folders. It neither uses nor clears the archive attribute of the files. It is generally not a part of a planned scheduled backup.

Daily Backups

A daily backup backs up all selected files and folders that have changed during the day. It backs up data by using the modified date of the files. It neither uses nor clears the archive attribute of the files.

Combining backup types

The easiest backup plan is to take a normal backup every night. A normal backup every night ensures that the data is restored from a single job the next day. Although the restoration of data from a normal backup is easy, taking a backup is time consuming. Hence, an administrator is required to make an optimal backup plan. An administrator must consider the following points before creating a backup plan:

• The time involved in taking the backup.
• The size of the backup job.
• The time required to restore a system in the event of a system failure.

The most common solutions for the needs of different organizations include the combination of normal, differential, and incremental backups.

Combination of Normal and Differential Backups

An administrator can use a combination of a normal backup and a differential backup to save time in taking a backup as well as for a restoration of data. In this plan, a normal backup can be taken on Sunday, and differential backups can be taken on Monday through Friday every night. If data becomes corrupt at any time, only a normal and last differential backup are required to be restored. Although this combination is easier and takes lesser time for restoration, it takes more time to take backup if data changes frequently.

Combination of Normal and Incremental Backups

A combination of normal and incremental backups can be used to save more time for taking backups. In this plan, a normal backup is taken on Sunday and incremental backups on Monday through Friday every night. If data becomes corrupt at any time, a normal and all incremental backups till date are required to be restored.

Backing up a System State Data

System State Data

System State data contains critical elements of the Windows 2000 and Windows Server 2003 operating systems. Following are the files included in the System State data:

• Boot files, including the system files and all files protected by Windows File Protection (WFP)
• Active Directory (on domain controller only)
• SYSVOL (on domain controller only)
• Certificate Services (on certification authority only)
• Cluster database (on cluster node only)
• Registry
• IIS metabase
• Performance counter configuration information
• Component Services Class registration database

For backing up the System State of a computer, the System State node is included as a part of the backup selection in the Backup utility.

Note: On domain controllers, System State can be restored only by restarting the domain controller in Directory Services Restore Mode. NTDSUTIL is used to recover deleted objects in Active Directory.

System Recovery

In the event of a system failure, the recovery of the system is difficult and tedious for administrators. Recovery involves reinstallation of the operating system, mounting and cataloging the backup tape, and then performing the full restore. To make this process easier, Windows provides a feature called Automated System Recovery (ASR). ASR is used to perform a restore of the System State data and services in the event of a major system failure. An ASR restore includes the configuration information for devices. ASR backs up the system data and local system partition.

How to create an ASR set?

Take the following steps to create an Automated System Recovery (ASR) set by using the Backup or Restore Wizard:

1. Run Backup from Start Menu > Programs > Accessories > System Tools > Backup.
2. In the welcome screen of the Backup or Restore Wizard, click the Advanced Mode link.
3. On the welcome page of the Advanced Mode of the Backup utility, choose the ASR Wizard option from the Tools menu.
4. In the welcome screen of the ASR Wizard, click the Next button.
5. On the Backup Destination page, specify the location of the backup, and click the Next button.
6. Click the Finish button.

Note: An ASR backup does not include folders and files.

Best practices for Backup

According to Microsoft, administrators should take the following steps to ensure the recovery in case of a system failure:

• Develop backup and restore strategies and test them.
• Train appropriate personnel.
• In a high-security network, ensure that only administrators are able to restore files.
• Back up all data on the system and boot volumes and the System State.
• Back up the data on all volumes and the System State data at the same time.
• Create an Automated System Recovery backup set.
• Create a backup log.
• Keep at least three copies of the media. Keep at least one copy off-site in a properly controlled environment.
• Perform trial restorations.
• Secure devices and media.
• Do not disable the default volume shadow copy backup method and revert to the pre-Windows Server 2003 backup method.
• Back up your server cluster effectively.
• Back up the cluster disks from each node.

About the Author:

uCertify was formed in 1996 with an aim to offer high quality educational training software and services in the field of information technology to its customers. uCertify provides exam preparation solutions for the certification exams of Microsoft, CIW, CompTIA, Oracle, Sun and other leading IT vendors. To know more about uCertify, please visit http://www.ucertify.com/

Compression

Compression is an NTFS attribute of files and folders. It increases the amount of available hard disk space by reducing the size of the files or folders. Compressing files and folders on a computer allows users to store more data on the computer’s hard disk. NTFS supports compression on volumes, folders, as well as on the files that are compressed on an NTFS volume. A user can read a compressed file located on an NTFS volume without decompressing it. The file is decompressed automatically as soon as the file read process starts. On a volume that is running low on the available disk space, the compression proves to be a very effective means of increasing the empty space on the hard disk, thereby managing the disk space. A user can control the compression attributes on the files or folders individually.

In order to enable compression on a file, folder, or a complete NTFS volume, a user has to follow the steps given below:

Right-click the volume, file, or the folder, and select Properties.

On the General tab page of the Properties dialog box for the file, folder, or volume, click the Advanced button.
In the Advanced Attributes dialog box, select the Compress Contents To Save Disk Space check box in the Compress or Encrypt attributes section, and click the OK button.
Moving and copying compressed files and folders: When a user moves or copies compressed files and folders in Windows, these files and folders are affected in the following manner:

When the files and folders are moved within the NTFS volume, the compression attribute remains the same in the new location irrespective of the status of the destination folder (i.e., whether it is compressed or uncompressed).

When the files and folders are copied within the same volume from one location to another, the original compression attribute is lost and the files inherit the attributes of the new parent folder (destination).

When the files and folders are copied or moved to a different volume, the compression attribute is lost and the files or folders inherit the attributes of the destination folder.

Copying or moving compressed files and folders from an NTFS volume to a FAT or FAT32 volume does not sustain the compression because FAT or FAT32 does not support compression of files or folders.
Windows XP supports a new feature called compressed (zipped) folder. This feature can be used on volumes with either the FAT or NTFS file system, or both. The compressed (zipped) folder can be easily shared with other users even if they are not running Windows XP Professional or using a drive formatted with the NTFS file system.

Supporting File Encryption

File encryption is a file attribute that allows a user to protect files and folders. It is a way of making data illegible to protect it from unauthorized users, especially during network transmission. Windows XP Professional allows a user to protect the files and folders by using the Encrypting File System (EFS). EFS encodes a file in a manner so that a user cannot read the file’s data even if he gets access to the file. Only an authorized user can read the file. When an unauthorized user attempts to access an EFS-encrypted resource, the user receives the Access Denied message. EFS implementation consists of two restrictions. First, an EFS-encryption can be used only on volumes formatted as NTFS, and secondly, a user cannot use EFS to encrypt a file that has been compressed by using NTFS compression. By default, Windows XP displays the names of encrypted files with a green color. A user can also change the color as per his requirement.

Managing Disk Quotas

Disk quota is a very efficient disk management feature of Windows XP Professional. The administrators on NTFS-formatted volumes can use this feature. It allows administrators to limit or fix the amount of disk space for multiple users on an NTFS volume. Disk quotas provide system administrators with a powerful tool for managing storage growth. Administrators can set both soft and hard limits, i.e., when a user exceeds a warning level (soft limit), an event is logged; when a user exceeds the hard limit, they receive an Out of Disk error. Disk quotas apply to the entire volume. It cannot be configured on a folder-by-folder basis. When a user reaches or exceeds the assigned quota limit, he will have to delete files to create empty space, transfer the ownership of some of his files to other users, or ask the administrator to provide more disk space. Compression does not work when the limit is exceeded. Merely by compressing some of the folders, a user cannot increase the available disk space in his assigned quota.

Managing Security

Windows XP provides an excellent way of securing the shared files and folders across a network by properly assigning the standard NTFS permissions. There are six basic NTFS folder permissions and five basic NTFS file permissions. In addition to these standard permissions, an NTFS-formatted volume also provides advanced files and folders permissions that an administrator can assign in a more specific manner. The system or network administrators on both files as well as folders can apply all of these permissions. The entire assigned standard as well as the advanced permissions can be viewed on the Security tab page of the File’s or Folder’s Properties dialog box.

Another way of managing security is to control the permission inheritance. When an administrator assigns some NTFS permissions on a folder, all the files and subfolders within the parent folder automatically inherit the parent folder’s permissions. This is called permission inheritance. An administrator can stop such inheritance either at the parent level or child level by configuring the Security tab page of the Parent folder’s dialog box. Therefore, Windows XP with the NTFS-formatted volume provides a very effective and efficient way of managing the files and folders both locally as well as in a networked environment.

About the Author:

uCertify was formed in 1996 with an aim to offer high quality educational training software and services in the field of information technology to its customers. uCertify provides exam preparation solutions for the certification exams of Microsoft, CIW, CompTIA, Oracle, Sun and other leading IT vendors. To know more about uCertify, please visit http://www.ucertify.com/

Following is the description of all logical components of the Active Directory structure:
Forest: A forest is the outermost boundary of an Active Directory structure. It is a group of multiple domain trees that share a common schema but do not form a contiguous namespace. It is created when the first Active Directory-based computer is installed on a network. There is at least one forest on a network. The first domain in a forest is called a root domain. It controls the schema and domain naming for the entire forest. It can be separately removed from the forest. Administrators can create multiple forests and then create trust relationships between specific domains in those forests, depending upon the organizational needs.
Trees: A hierarchical structure of multiple domains organized in the Active Directory forest is referred to as a tree. It consists of a root domain and several child domains. The first domain created in a tree becomes the root domain. Any domain added to the root domain becomes its child, and the root domain becomes its parent. The parent-child hierarchy continues until the terminal node is reached. All domains in a tree share a common schema, which is defined at the forest level. Depending upon the organizational needs, multiple domain trees can be included in a forest.
Domains: A domain is the basic organizational structure of a Windows Server 2003 networking model. It logically organizes the resources on a network and defines a security boundary in Active Directory. The directory may contain more than one domain, and each domain follows its own security policy and trust relationships with other domains. Almost all the organizations having a large network use domain type of networking model to enhance network security and enable administrators to efficiently manage the entire network.
Objects: Active Directory stores all network resources in the form of objects in a hierarchical structure of containers and subcontainers, thereby making them easily accessible and manageable. Each object class consists of several attributes. Whenever a new object is created for a particular class, it automatically inherits all attributes from its member class. Although the Windows Server 2003 Active Directory defines its default set of objects, administrators can modify it according to the organizational needs.
Organizational Unit (OU): It is the least abstract component of the Windows Server 2003 Active Directory. It works as a container into which resources of a domain can be placed. Its logical structure is similar to an organization’s functional structure. It allows creating administrative boundaries in a domain by delegating separate administrative tasks to the administrators on the domain. Administrators can create multiple Organizational Units in the network. They can also create nesting of OUs, which means that other OUs can be created within an OU.
In a large complex network, the Active Directory service provides a single point of management for the administrators by placing all the network resources at a single place. It allows administrators to effectively delegate administrative tasks as well as facilitate fast searching of network resources. It is easily scalable, i.e., administrators can add a large number of resources to it without having additional administrative burden. It is accomplished by partitioning the directory database, distributing it across other domains, and establishing trust relationships, thereby providing users with benefits of decentralization, and at the same time, maintaining the centralized administration.

The physical network infrastructure of Active Directory is far too simple as compared to its logical structure. The physical components are domain controllers and sites.
Domain Controller: A Windows 2003 server on which Active Directory services are installed and run is called a domain controller. A domain controller locally resolves queries for information about objects in its domain. A domain can have multiple domain controllers. Each domain controller in a domain follows the multimaster model by having a complete replica of the domain’s directory partition. In this model, every domain controller holds a master copy of its directory partition. Administrators can use any of the domain controllers to modify the Active Directory database. The changes performed by the administrators are automatically replicated to other domain controllers in the domain.

However, there are some operations that do not follow the multimaster model. Active Directory handles these operations and assigns them to a single domain controller to be accomplished. Such a domain controller is referred to as operations master. The operations master performs several roles, which can be forest-wide as well as domain-wide.
Forest-wide roles: There are two types of forest-wide roles:

Schema Master and Domain Naming Master. The Schema Master is responsible for maintaining the schema and distributing it to the entire forest. The Domain Naming Master is responsible for maintaining the integrity of the forest by recording additions of domains to and deletions of domains from the forest. When new domains are to be added to a forest, the Domain Naming Master role is queried. In the absence of this role, new domains cannot be added.
Domain-wide roles: There are three types of domain-wide roles: RID Master, PDC Emulator, and Infrastructure Master.

RID Master: The RID Master is one of the operations master roles that exist in each domain in a forest. It controls the sequence number for the domain controllers within a domain. It provides a unique sequence of RIDs to each domain controller in a domain. When a domain controller creates a new object, the object is assigned a unique security ID consisting of a combination of a domain SID and a RID. The domain SID is a constant ID, whereas the RID is assigned to each object by the domain controller. The domain controller receives the RIDs from the RID Master. When the domain controller has used all the RIDs provided by the RID Master, it requests the RID Master to issue more RIDs for creating additional objects within the domain. When a domain controller exhausts its pool of RIDs, and the RID Master is unavailable, any new object in the domain cannot be created.

PDC Emulator: The PDC emulator is one of the five operations master roles in Active Directory. It is used in a domain containing non-Active Directory computers. It processes the password changes from both users and computers, replicates those updates to backup domain controllers, and runs the Domain Master browser. When a domain user requests a domain controller for authentication, and the domain controller is unable to authenticate the user due to bad password, the request is forwarded to the PDC emulator. The PDC emulator then verifies the password, and if it finds the updated entry for the requested password, it authenticates the request.

Infrastructure Master: The Infrastructure Master role is one of the Operations Master roles in Active Directory. It functions at the domain level and exists in each domain in the forest. It maintains all inter-domain object references by updating references from the objects in its domain to the objects in other domains. It performs a very important role in a multiple domain environment. It compares its data with that of a Global Catalog, which always has up-to-date information about the objects of all domains. When the Infrastructure Master finds data that is obsolete, it requests the global catalog for its updated version. If the updated data is available in the global catalog, the Infrastructure Master extracts and replicates the updated data to all the other domain controllers in the domain.

Domain controllers can also be assigned the role of a Global Catalog server. A Global Catalog is a special Active Directory database that stores a full replica of the directory for its host domain and the partial replica of the directories of other domains in a forest. It is created by default on the initial domain controller in the forest. It performs the following primary functions regarding logon capabilities and queries within Active Directory:
It enables network logon by providing universal group membership information to a domain controller when a logon request is initiated.

It enables finding directory information about all the domains in an Active Directory forest.

A Global Catalog is required to log on to a network within a multidomain environment. By providing universal group membership information, it greatly improves the response time for queries. In its absence, a user will be allowed to log on only to his local domain if his user account is external to the local domain.
Site: A site is a group of domain controllers that exist on different IP subnets and are connected via a fast and reliable network connection. A network may contain multiple sites connected by a WAN link. Sites are used to control replication traffic, which may occur within a site or between sites. Replication within a site is referred to as intrasite replication, and that between sites is referred to as intersite replication. Since all domain controllers within a site are generally connected by a fast LAN connection, the intrasite replication is always in uncompressed form. Any changes made in the domain are quickly replicated to the other domain controllers. Since sites are connected to each other via a WAN connection, the intersite replication always occurs in compressed form. Therefore, it is slower than the intrasite replication.
About the Author:

uCertify was formed in 1996 with an aim to offer high quality educational training software and services in the field of information technology to its customers. uCertify provides exam preparation solutions for the certification exams of Microsoft, CIW, CompTIA, Oracle, Sun and other leading IT vendors. To know more about uCertify, please visit http://www.ucertify.com/