The sircles.net blog SEO, Copy Writing, Networking and Internet Safety & Security

The other day we had an issue with the Windows Backup on a Windows 2012 R2 server that had previously backed up OK.

On start-up of the Windows Backup application we received a message saying that the windows backup wbadmin snap-in failed to start and that we should restart the service and retry the snap-in.

When we tried the command line we received a message saying that the command was not available on portable workstations

After some looking around we found that a possible cause was that the registry had this entry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

PortableOperatingSystem = 1

So we changed to 0 as the server would have been tricky to carry and then wbadmin stated that there were no jobs scheduled.

We then ran the following command in order:

1. Get-WBPolicy | Remove-WBPolicy
2. Remove-WBBackupSet
3. Remove-WBCatalog
4. get-Service *wb* | Start-Service
5. Restart Windows Server Backup

We then found that the backup record was destroyed but that the service could be run in the GUI once more.

When it comes to backup and restore on Windows 10 the default is to backup your disk every hour which is a pretty surefire way to ruin your backup disk, internal disk and electricity bill. You can obviously backup your files manually but an easy option is to create a shortcut on your desktop that will backup your files to your external hard disk so that you can simply copy them back if you lose your laptop or restore individual files if you lose or accidentally delete files.

If you wish to run the backup one time, you can by using the following:

If you run the following command by pressing [windows key] + R

Then paste in the code but substitute the drive letter of your external drive as appropriate:

xcopy "%userprofile%\*.*" [drive letter]:\profilebackup\ /c /s /r /d /y /i

And leave the colon in place but not the square brackets.

This will copy all of the files in your user profile into a folder called profilebackup onto the external drive from pictures and desktop, documents etc.

Or you can make a shortcut on your desktop as follows:

1. Minimise all your applications down to the task bar to get your desktop clear.
2. Right click on your desktop and choose 'create shortcut'

       3. Enter the command line once you have entered the drive letter:

      4. Name the shortcut something you will remember to run regularly:

      5. Click finish and you're done.

You now have a shortcut that you can use to backup anytime - just remember to plug in the external hard disk first.

Whilst restoring (transferring) a Windows 2008 R2 machine using the built-in Windows Backup software we ran into a few problems:

The original machine was a PC server with some dynamic disks as the system did not have RAID support for all drives.

The system disk was 111 GB

The data disk was 465 GB

The log file disk was 69 GB

We were restoring to a SUN X4150 with:

131GB system disk

514 GB Data disk

131 GB log file disk

The error we were getting was that the disks were too few or too small ????

0x80042408 We have never understood why it thought that there were not enough disks but...

We used the workaround with the wbadmin command line:

wbadmin get versions –backuptarget:<Target:> 

This is to interrogate the media for the backup sets that are present on the target drive.

wbadmin get items –version:<versionid> -backuptarget:<Target:>

Then this command shows the volumes and applications contained within the backup set on that drive or device.

Wbadmin start recovery –version:<versionid> -backuptarget:<Target:> -itemType:Volume –items:C: -recoverytarget:D:

Where Target: is the target drive letter. This command performs the restore. Here we are only restoring the system drive, as the applications and services relying on the data contained on other disks could be restored simply by robocopying the data back onto those data disks and then correcting the drive letters afterwards whereupon the services could be started.

After completing the above, the system was then still missing some boot files.

We then repaired using a Windows 2008 R2 / 7 x64 automatic repair and the system started to boot but obviously BSOD'd itself from lack of drivers for the new storage devices.

The Windows DVD could not repair any further and so we therefore had to add the storage device drivers manually using:

DISM /image:C:\ /add-driver /driver:G:\ /recurse
(C is my OS partition and G is the DVD drive where the driver DVD is inserted.)

This added the files from the X4150 drivers\storagetek\windows\2008\ and drivers\storagetek\windows\2008\amd64\ 

The system then booted OK but the drive letters had changed. After re-assigning the drive letters the system appeared to be back to normal.

Just for anyone still having difficulty, sometimes we are unable to run the repair from the DVD until we have repaired the bootcfg folder using bootrec /rebuildbcd after which we can run the DVD repair and start Windows successfully which on 7/2008 R2 or later will then install the required drivers to boot from there.

If you still have BSOD difficulties then use the DISM command above to add necessary drivers.

After installing Office 365 as per the post below the Windows 2012 R2 Remote Desktop VM the system indicated that it had to restart to activate office 365 and so this is what I did.

The system then decided it had to perform updates during the restart which was fine and it continued to get to 30% where it stayed for 24hrs. Assuming that there was no choice the machine was restarted again and this time the whole system got to configuring updates at 6% and stayed there for 3 days.

Every time the server was reset this was the outcome. 

Having looked through a few suggestions I performed the following:

1. Amended the 'Automatic Start action' on virtual machine settings so that secure boot was disabled

2. Started up the troubleshooting option from the startup repair and chose the command prompt whereupon I performed the following:

3. Renamed the softwaredistribution folder to softwaredistribution.old on the assumption that a new folder will be created when the windowsupdate service next tries a download.

4. Searched for all pending.xml.* files in Windows\WinSXS and deleted them

5. Ran 'dism /image:C:\ /cleanup-image /revertpendingactions' to clear any awaiting updates.

6. Created a blank pending.xml file in WinSXS (not sure if this made a difference but it was a piece of advice seen here: https://social.technet.microsoft.com/Forums/en-US/7364c2ff-1d52-4767-bfec-d97d42921d5c/interrupted-vm-stuck?forum=winserverhyperv) which they did using 'echo > pending.xml' whilst in Windows\WinSXS\ and then rebooted.

The VM undid all of the updates and started up and the Office 365 on Remote Desktop Virtual Machine asked for an email address with which to activate - only took 6 days then!!!

Well it's not the finest of conditions for working with but sometimes you don't know what you will find until you get there....

When I arrived in Kent the other week to perform some data recovery I showed up in a suit jacket and trousers and a shirt etc. I was slightly concerned when the people on site pointed me in the direction of a couple of shipping containers and especially when the security guard smiled at what I was wearing. The shipping containers were full of a fine black powder which had been mixed with rainwater and had subsequently become a fascinating black sludge which seemed to be able to travel invisibly through the air as well as remain attached to anything it came in contact with until the end of time. The smell was what can only be described as incredible and the items to be removed were all unwrapped on the floor of the container in a sort of shallow swamp. It is a testimony to modern technology that we were able to recover data from the hard disks that were contained in the desktop PCs in the swamp and in the most part the data was recovered completely. When you are looking for incriminating data on a company or person(s) then you are usually prepared to scour every PC in the company on the off-chance you may find something. 

The company we were examining was of particular interest to government agencies as well as the Police and so all of these PCs were worth investigating. The PCs in the most part had nothing too interesting on as the data was stored on the network servers but the local email PST files and internet cache held interesting data. You never know were data will show up as in all of these cases you do not know what systems they are using (especially if they find out in advance you are are coming to site) as software and or data is often deleted or removed. Sometimes cases arrive at our door where the client has not even bothered to remove the file shredding software when we find the PCs as there is nothing to be proved by the presence of such software, just a possible intent.

Well the data recovered gave rise to a new lead but the most important realisation of the day was definitely to always have overalls in the car just in case...