Backup/restoring system state

[siddyp]

Just after some advice please.

Would I be right in thinking that if I backup the system state I am only backing up Active Directory?

The reason I ask is that I have just taken over a server for a customer that is in a REALLY bad way. Problems include if you try to start internet explorer it will hang and freeze up the desktop preventing me from doing any windows updates, althought I was able to install firefox and use that ok to download internet explorer 6 sp1 (which still failed). I am unable to run SP4 from CD. There has never been a backup as far as I can tell, and can not do one at the moment as the tape drive is not working!

The short of it is that I want to do a backup to a PC on the network of their data and accounts, rebuild the server and restore it minus the problems.

Question: Would I be better off recreating the accounts (15-20) and shares from scrath rather than risking recreting the problem all over or is there no system files backed up in system state.


Thanks for any help

 

[Davetoo]

It sounds to me like the system has a virus. Have you run a full system scan with a current virus def program?

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[siddyp]

Thank you, but I made of a mistake in not mentioning that there was no virus protection on the server, and that I was unable to install it on there.

The reason I was there in the first place was to replace some virus software that had expired in their PC's. Had been previously installed by another company that had installed the "network", since then they have fallen out with with them after problems kept coming up. Anyway back to the point when I got to the server I noticed that they hadn't installed any on there (maybe because of the problem, and chose not to mention it).

The best I could do was run a scan of the C drive from a PC that had it mapped. I relise that this could be the problem but I don't know how to it if the server freezes if you so much as breath on it! All PC's on the network came up clean.

If you can come up with some ideas for me to try that don't involve rebuilding I would be very greaful.

Sorry to go on and miss out important information like that.

 

[paulha]

Try

http://www.pandasoftware.com/activescan

This will scan then delete/cure any virus/spyware/malware free of charge

Paul

 

[siddyp]

Many thanks for your help and quick response. I will give this a go, before ruin a pefectly good weekend rebuilding it.

Let you know how it goes.

 

[robbieguy2003]

If you can get hold of a copy of Norton/Symantec you can put a Bootable CD in and run an offline scan of the HDD (which should allow you to scan it unless thats ready to fail).

Just get any data off that server though as it sounds like the worst could happen.

I wish someone would just call me Sir, without adding 'Your making a scene'.

Rob

 

[ITPangaeaArchitect]

your going to need to rebuild...

the system state contains the AD database, com+ databases, registry, reparse point to sysvol (but not the data), blah blah blah

if you take a backup of junk, you will restore junk...

as soon as you restored that system state and rebooted, you would be in teh exact same situation...

what you could do to make things easier is take a ldifde or csdve dump of users and groups, then save the files to disk somewhere for later use...after that, you can rebuild and just import the accounts back in...anything like exchange, sms, etc. will have to be completely reinstalled and disaster recovery performed on those as well...

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[siddyp]

Many thanks every one for your suggestions. I decided to do a full rebuild in the end and just recreate the domain and accounts, as I didn't wish to restore the problems back in to the system again. They don't run exchange so it wasn't too difficult a task. The only problems I came across was the accessing the roaming profiles they had. I also forgot that I would have to remove the PC's from the domain and re-register them again. Doing this though caused problems with the users profiles o the PC. Instead of using joe_bloggs directory that was already there it created a joe_bloggs.domain_name this was obvoiusly to do with ecurity ID's.

If any one knows a way to get round this, for the process I used to do this I would be initerested to hear.

Thanks all.