System state backup and restore on Windows Server

In Windows Server, the components which make up the system state depend on the configuration of the server. System state data, at a minimum, includes:

     Registry

     COM+ class registration database

     Boot files, including system files

     DFS namespaces/replications

A domain controller system state includes at least the following:

     Active Directory Domain Services

     Registry

     COM+ class registration database

     Boot files, including system files

     SYSVOL directory

When installed, the following components are included in the system state:

     Microsoft Internet Information Services (IIS) meta-directory

     Certificate Services database

     Cluster Service information

When a file-level backup of a Windows Server system is performed, the server’s system state is captured in a file that is placed on the C-drive of the system. This file is present during the file-level backup and is deleted when the backup ends. The file is backed up to the system during the file-level backup process.

The file created during the backup of the Windows Server system will use space on the C: drive of the server, possibly as much as one gigabyte.

If the C: drive of a Windows machine is excluded from backup, the system state is not captured, resulting in the backup completing with warnings. Instead, exclude all subdirectories and files but leave “C:” itself to be backed up.

Note: System state must be present in the backup for it to be used for Windows Instant Recovery and Windows integrated bare metal restore.

To recover the system state, restore the last incremental or master backup to the Windows Server system.

After restoring the system state, rebooting is required before continuing to the next restore step.

Note: The first boot after doing a full OS restore of Windows 2012, 2012 R2, 2008, or 2008 R2 may take 5-10 minutes or longer. You may see a blank screen during this time. The machine is not hung. Do not reboot forcefully during this time, as it may corrupt the OS causing it not to boot up. The slow boot is due to a bulk file-rename for files which were restored with temporary file names because their production counterparts were active and locked at the time of the restore. This also happens with Windows 2003, but the file-set is much smaller and the boot-lag is therefore much shorter in duration.