What is a system state backup for?

The windows backup utility comes with an option to backup the system-state. What is this for? Has it a real utility? Can I recover that windows on another machine?

The system state contains a number of items:

• System Registry
• COM + Database
• Certificate Services
• Active Directory
• SysVol
• IIS Metabase

Some of these items are only included if the specified service is installed (AD, IIS, Certificates). (Details are online. TechNet: Server 2003/2003R2. MSDN: Server 2003/2003R2.TechNet forums: Server 2008. MSDN: Server 2008 and upwards)

If you need to restore a server, you will need this state to recover the registry, or your AD Domain, or IIS sites.

You can restore system state to the same server, or another server with identical hardware. Microsoft does not support restoring system state to different hardware (see this article), however it is possible in some occasions, and with some parts of the system state, for example the IIS metabase. In that guess its really a case of try it an see, but its not a recommended solution..

Regardless of what Microsoft says - it's possible to restore the system to basically any compatible hardware.

Here how this works (Windows 2000 & 2003 validated):

1. Create a machine with identical CPU type (e.g x32 or x64 as the original server)
2. Apply all the latest SP to it.

3. Copy to C:\exclude folder (just as example) the following files:

   %systemdrive%\boot.ini
   %systemdrive%\ntdetect.com
   %systemdrive%\ntldr
   %systemroot%\system32\hal.dll
   %systemroot%\system32\kernel32.dll
   %systemroot%\system32\ntoskrnl.exe
   %systemroot%\system32\ntkrnlpa.exe
   %systemroot%\system32\ntdll.dll
   %systemroot%\system32\win32k.sys
   %systemroot%\system32\winsrv.dll
   %systemroot%\system32\drivers\etc\hosts
   

4. Perform full system restore. Do not reboot.

5. Perform System State restore. Do not reboot.
6. Copy the excluded files back to the original location. Reboot.
7. System will boot and will request to install drivers for the hardware.
8. After several reboots, the server will be exactly as a previous one, just on the different hardware.

It works for AD DCs as well.

The System State Backup should be part of your Windows Server backup plan and preparation for a disaster recovery.

The System State contains the operating configuration files. Before you install a driver, patch or program on your server, consider, what will be your fall back position if the operating system crashes. You should create a System State backup which you could use to rollback in case of a problem.

The System State contains boot files (Boot.ini, NDTLDR, NTDetect.com), the Windows Registry including COM settings, the SYSVOL (Group Policies and Logon Scripts), the Active Directory and NTDS.DIT on Domain Controllers and, if the service is installed, the Certificate Store. If your server runs IIS, the IIS Metadirectory will be includedand Cluster Service information if the server is part of a cluster.

You don’t have to know which of these components to choose. The Backup/Restore application will do this automatically when you start a System State backup. Likewise you cannot choose which components to restore: all System State data will be restored, because of possible dependencies among the components. It is possible to restore the System State to an alternative location. Not all data is restored when you restore to an alternative location. Only the components System boot files, registry files, SYSVOL directory files and Cluster database information files will be restored.

Note: When you backup System State, you can either include or exclude system-protected boot files. System-protected boot files are not used for installations from restored backup media. When the backup file that you create is to be used for additional domain controller installations, you can uncheck the advanced option to back up system-protected files. Clearing this option decreases the size of the .bkf file, as well as the time required to backup, restore, and copy the System State files.

Windows in-built backup utility is basically useful.

For regular office backup, I do the following

1. A full backup for system state (maybe a system partition backup is necessary)
2. File backup for those important data, and then do incremental file backup with daily rate (it means an automatic backup with pre-set schedules)

For regular home PC backup:

1. Full backup for system state
2. Back up important data, maybe docs, photos, and other things. No matter which utility you use, please check the image integrity after you finish the backup work.

And I thought the way you referred, recovering system windows on another machine, is universal restore. It seems that windows in-built backup does not support universal restore. Two ways you can restore system to another machine:

1. Directly clone your system based HDD to another hard drive disk, and you will get a new HDD with system installed and programs saved. For sure, the SAM configuration. Useful but value-added backup programs ToDo backup XXclone.

2. Back up system firstly, and then use universal restore to restore it to another. I've checked some popular programs, little of them can do universal restore. For a program with built-in universal restore, I only found ToDo Backup can do this, and works well. That means, if you pay for a backup program, there is no need for you to pay more to get universal restore.