Configuring Volume Shadow Copy on Windows Server 2008
| Previous | Table of Contents | Next |
| Auditing Windows Server 2008 File and Folder Access | Building a Windows Server 2008 Network Load Balancing Cluster |
Windows Server 2008 Volume Shadow Copy is a mechanism whereby the contents of shared folders can be automatically backed up at pre-determined intervals to a shadow volume. Once implemented, shadow copy will backup the previous 64 versions of each file in the shadowed volume and provide users with the ability to restore files from any of the previous 64 versions without administrator intervention, enabling users to independently restore deleted, damaged or overwritten files from the shadow copy. In addition to restoring individual files to a previous version, shadow copy also provides the ability to restore an entire volume from the shadow copy.
Another use for shadow copy is to enable the backup of locked or open files. Ordinarily, if a file is currently open or locked by an application, tools such as Windows Backup will fail to backup the file. Shadow copy aware backup tools are, however, able to avoid this problem by using the Volume Shadow Copy Service API.
Shadow Copy Considerations
There are a number of issues that need to be considered when implementing shadow copy for shared folders. First and foremost, the shared folders which are to shadowed need to be identified. Secondly, a location for the shadow to be stored must be allocated. This can reside either on the same volume as the shared folders, or on a completely different volume or disk drive. Even before any data is shadowed, the shadow copy system requires 300MB of available space. The total amount of space required will depend on the size of the shared folder which is to be shadowed and the frequency and extent to which the files are likely to change (since shadow copy will only take new snapshots of files which have changed since the last snapshot). Finally, the time and frequency of the volume snapshots needs to be defined. By default, Shadow Copy performs a snapshot twice a day at 7:00am and 12:00pm.
Once the Shadow Copy system has been configured the shadow copy client needs to be set up on the systems of any users that are likely to need to be able to restore files in shared folders.
Using Computer Management to Enable and Configure Volume Shadow Copies
Shadow Copy is enabled on a per volume basis. Once configured on a volume, all shared folders residing on that volume will automatically be shadowed. Shadow Copy can be configured either graphically using the Computer Management tool or via the command prompt. Command-line configuration of Shadow Copy will be covered in a later section of this chapter. This section will focus on Computer Management configuration.
The first step is to launch the Computer Management configuration tool (Start -> All Programs -> Administrative Tools -> Computer Management). Once invoked, select Storage -> Disk Management from the tree in the left panel to display the disk and volume information for the local system. In the graphical view, right click on a volume and select on Properties to launch the properties dialog. In the properties dialog, select the Shadow Copy tab to display the Shadow Copy properties as illustrated in the following figure:
<google>ADSDAQBOX_FLOW</google>
A useful shortcut to access the Shadow Copy property panel is to run vssuirun from a command prompt with elevated privileges.
The Select a volume section of the properties dialog lists the volumes present on the local system. Select the volume in this list for which Shadow Copy is to be enabled. With the volume selected click on the Settings button to display the following Shadow Copy Settings dialog box:
In the Located on this volume specify the volume on which the shadow copies are to be stored. This can be either the current volume or a different volume on the system. The Details button displays free and total disk space information for the currently specified volume. Once a suitable volume for the shadow copies has been selected the maximum size to be made available for the shadow copies may be defined. This can either be set to Maximum size which will use all available space on the specified volume, or capped to a specific size (keeping in mind that a minimum of 300MB is required for the shadow storage volume even before any snapshots are taken). Shadow Copy uses a differential approach to backing up files in that only files that have changed since the last snapshot are copied. For certain files, Shadow Copy also only copies the part of the file that has changed, rather than the entire file. As such, it is not necessary to reserve 64 times the size of the volume to be copied since only parts of the volume will be copied with each snapshot.
Schedule the shadow copy snapshots by clicking on the Schedule... button. By default, Windows configures two snapshots each day (at 7:00am and 12:00pm respectively). To remove a currently defined snapshots select it from the drop down list and click on Delete. To modify a run, select it from the drop down list, modify the settings in the lower section of the dialog and click on OK.
To specify additional schedules, click on the New button and specify the days and time of the snapshot. Note that snapshots can also be configured to occur at user logon, system startup and even when the system is idle. In fact, Windows Server 2008 provides considerable flexibility in terms of scheduling shadow copies. It is important to keep in mind, however, that there are disadvantages to running a shadow copy too frequently. Firstly, shadow copies are resource intensive tasks, especially on large volumes where many files are subject to frequent changes. Repeated snapshots during periods when the server is heavily utilized may well degrade overall system performance. Secondly, it is important to keep in mind that Shadow Copy retains the last 64 versions of a file. Therefore, if a snapshot is run every hour, the oldest restore point available to a user will be approximately two and half days in the past. If, on the other hand, snapshots are taken twice a day, the user will have the luxury of restoring a file from a point as much as 32 days ago. Tt is important, therefore, to strike a balance between longevity and frequency.
The following screenshot illustrates the Shadow Copy scheduling dialog:
Once the schedules have been configured, click on OK to dismiss the scheduling dialog. Click OK once again in the Settings dialog to return to the Shadow Copy properties panel. At this point, the volume for which a schedule has been defined will have a small clock image superimposed over the the volume icon and will indicate that 0 bytes of shadow copy storage have been used. The next step is to enable shadow copies on the volume by selecting the volume from the list and clicking on the Enable button. The volume in the list will update to display the date and time of the next scheduled copy and provide a summary of the current level of storage space used for the shadow copies.
To initiate a manual shadow copy now, or at any other time, simply select the volume to be copied from the list in the Shadow Copy properties panel and click on the Create Now button.
Restoring an Entire Volume
To restore an entire volume, access the Shadow Copy property panel either from Computer Management as outline above, or by running vssuirun from a command prompt with elevated privileges. Once loaded, select the desired volume followed by a snapshot from which to restore from the Shadow copies of selected volume list and click on the Revert Now... button. This will revert all shared folders on the selected volume to their state at the point that the selected shadow copy was made.
It is important to note that restoration of entire volumes is not possible on system volumes since this would, in all probability, severely interfere with the current system state.
Configuring and Enabling Shadow Copy from the Command Line
A significant amount of Shadow Copy functionality can be accessed via the command line using the vssadmin tool, which is the focus of this section.
In order to obtain information about shadow copies configured on a system, use vssadmin list shadows:
C:\Windows\system32>vssadmin list shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Contents of shadow copy set ID: {67f25a62-12f1-4e34-b14a-3b57cb03f4f8}
Contained 1 shadow copies at creation time: 8/22/2008 12:29:56 PM
Shadow Copy ID: {bee54c7f-22a4-4bd0-b6c4-20bc51a8cded}
Original Volume: (E:)\\?\Volume{9fa5f191-6554-11dd-9ce6-000c295707db}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2
Originating Machine: winserver-2
Service Machine: winserver-2
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessible
Attributes: Persistent, Client-accessible, No auto release, No writers,
Differential
Contents of shadow copy set ID: {24c56736-d082-4fa5-ac97-961bd708b4d2}
Contained 1 shadow copies at creation time: 8/22/2008 1:00:04 PM
Shadow Copy ID: {e5a5d032-5449-4375-b4c2-5adf12fedc5d}
Original Volume: (E:)\\?\Volume{9fa5f191-6554-11dd-9ce6-000c295707db}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3
Originating Machine: winserver-2
Service Machine: winserver-2
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessible
Attributes: Persistent, Client-accessible, No auto release, No writers,
Differential
Contents of shadow copy set ID: {95618a5e-b9f2-4d5c-9654-7fcab5be2c5d}
Contained 1 shadow copies at creation time: 8/23/2008 7:00:03 AM
Shadow Copy ID: {012d8105-ab39-4b17-89c9-bb7dfbeeb1f8}
Original Volume: (E:)\\?\Volume{9fa5f191-6554-11dd-9ce6-000c295707db}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4
Originating Machine: winserver-2
Service Machine: winserver-2
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessible
Attributes: Persistent, Client-accessible, No auto release, No writers,
Differential
To obtain information about how shadow copy storage is allocated to shadow copies, use the vssadmin list shadowstorage:
C:\Windows\system32>vssadmin list shadowstorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Shadow Copy Storage association
For volume: (E:)\\?\Volume{9fa5f191-6554-11dd-9ce6-000c295707db}\
Shadow Copy Storage volume: (C:)\\?\Volume{f0c004b0-58c1-11dd-a1fe-000c295707
db}\
Used Shadow Copy Storage space: 1.344 MB
Allocated Shadow Copy Storage space: 301.078 MB
Maximum Shadow Copy Storage space: 818 MB
The above command is particularly useful for comparing used and available space for shadow copy storage.
Shadow Copy for a volume may also be enabled from the command-line using vssadmin, the syntax for which is:
vssadmin add shadowstorage /for=volume /on=storevolume
where volume represents the volume on which shadow copy is to be enabled and storevolume is the volume on which the shadow copies are to be stored, for example:
vssadmin add shadowstorage /for=d: /on=e:
The maximum storage size may also be specified using the /maxsize= command-line option:
vssadmin add shadowstorage /for=d: /on=e: /maxsize=8GB
A manual shadow copy of an enabled volume may be triggered from the command prompt at any time by running vssadmin as follows:
C:\Windows\system32>vssadmin create shadow /for=e:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Successfully created shadow copy for 'e:\'
Shadow Copy ID: {c9235d96-4ea3-4bc2-b2ee-77397a124914}
Shadow Copy Volume Name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy7
Specific shadow copies may also be deleted from the command line either by specifying that the oldest snapshot is to be deleted, or by referencing the specific snapshot by its Shadow Copy Id (which can be obtained from the vssadmin list shadows command). For example, to delete the oldest shadow snapshot:
C:\Windows\system32>vssadmin delete shadows /for=e: /oldest vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp. Do you really want to delete 1 shadow copies (Y/N): [N]? y Successfully deleted 1 shadow copies.
Similarly, to delete a specific snapshot from a volume:
C:\Windows\system32>vssadmin delete shadows /shadow={879318ea-2f28-4d0c-b58b-5df5cd761984}
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Do you really want to delete 1 shadow copies (Y/N): [N]? y
Successfully deleted 1 shadow copies.
The restoration of a shadow from a specific snapshot can be achieved from the command line using the vssadmin revert command combined with the Shadow Copy ID of the required snapshot. Note that the revert cannot be performed if open file handles exist on the volume (the /ForceDismount parameter is available but its use is not recommended since it can result in lost data:
C:\Windows\system32>vssadmin revert shadow /shadow={bf7e3df8-b4f9-4068-b208-3c67
8bc85053}
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.
Do you really want to revert to this shadow copy (Y/N): [N]? y
Finally, Shadow Copying on a volume may be disabled via the command prompt using the vssadmin delete shadowstorage command, although the command will only work once all snapshots associated with the volume have been deleted from the shadow storage. Assuming there are no existing shapshots, the following example will disable shadow copy on the volume represented as the e: drive:
vssadmin delete shadowstorage /for=e:
Restoring Shadow Copy Snapshots from Clients
Once shadow copy has been configured for volumes on the server, the next step is to learn how to access the previous version of files from client systems. This is achieved using a feature of Windows Server 2008 and Windows Vista called Previous Versions.
To access previous versions of a file on a client, navigate to the shared folder (or subfolder of a shared folder) or network drive using Start -> Network. Once the desired network drive or shared folder is visible, right click on it and select Restore Previous Versions (or just Previous Versions on Windows Vista). Once selected, the Properties dialog box will appear with the Previous Versions tab pre-selected as illustrated in the following figure:
As shown the the previous figure, the Previous Versions property page lists the previous versions of the shared folder that are available for restoration. A number of options are available for each shadow copy snapshot listed in the properties dialog. Open will open the folder in Windows Explorer so that individual files and sub-folders can be viewed and copied. The Copy... button allows the snapshot of the folder and its contents to be copied to a different location. Finally, Restore... restores the folder and files to its state at the time of the currently selected shadow copy snapshot. As outlined in the warning dialog, this action cannot be undone once performed.
