If you’ve ever had a firewall that’s suddenly on the fritz, you can appreciate the necessity of a regular firewall configuration backup schedule. SolarWinds offers a great product, Kiwi CatTools, targeted for Windows administrators who want to automate some of the more mundane tasks of everyday network and systems administration, including backing up firewall configurations.

Kiwi CatTools – Main console

In this tutorial, we’ll focus on configuring a scheduled backup of a Cisco ASA 5505 firewall using CatTools. You can use the information in this tutorial to schedule other types of edge devices as well.

Configuring your first device

You can download the fully functioning 30-day trialof CatTools. Install it, and then launch CatTools. The first order of business is configuring a device. CatTools comes with many predefined device templates, including the template “Cisco.Firewall.ASA.” You will also need to configure some additional parameters:

• Name: An alias for your device
• Host Address: The IP address of your firewall
• Connect via: Typically direct connect, unless you must connect to another device first (for example, a VPN) before you can connect to the device
• Method: How you connect to the device—typically Telnet (unsecured) or SSH (secured)
• Port: The port your connection method uses; will default to whatever you choose for your connection method

Kiwi CatTools device information

You can test your base configuration by using the buttons at the bottom of the window to ping and telnet/SSH your device. If both of these work, you are ready to move on to the next step of configuring passwords.

Navigate to the Passwords tab. In most cases, this is the last step for configuring your device. The Passwords tab will have different entries depending on the type of device you are configuring. For the ASA 5505, you can expect the following important entries:

• Enable Password: The password for your account
• Privilege Level: Typically 15, but can vary by ASA setup
• Console Password: The password for the Telnet console
• AAA Username/Password: Used in cases where you use AAA authentication to connect via Telnet or SSH

The options at the bottom vary by how you authenticate. For example, if you are not using AAA authentication, you will probably need to check “Initial login requires username/password.” If you are using AAA, you will need to check “Enable mode uses AAA username/password fields.” You will see similar options available for different types of monitored devices.

Configuring your first activity and schedule

In CatTools, an activity is something you do with an open connection to a device. In this tutorial, we are going to focus on backing up the running configuration. Examples of other activity options include:

• Device.CLI.ModifyConfig: Sends commands to modify the running configuration
• Report.ARPTable: Reports the current ARP table on the device
• Device.InterDevice.Ping: Sends a ping, and reports results, from the device to specified hosts

For the purposes of this tutorial, we will focus on the activity Device.Backup.RunningConfig. Create a new scheduled activity. You will need to configure:

• Type: The type of activity (template) you want to use (in this case, it’s Device.Backup.RunningConfig)
• Report File: The location of the report file for the activity
• Client threads: The number of threads you want to devote to this activity; in most cases, unless you have a specific reason to change this option, it should be “Maximum available”

The next task is to configure a schedule for the activity. This is very similar to configuring a schedule in the Windows Task Scheduler, but CatTools actually uses its own timer process. On the Time tab, you should configure:

• Recurring: When you want the schedule to recur; for example, “Now” is a one-time operation, whereas “Daily” would recur daily
• Custom: I configured a custom schedule and selected 2:00 AM run time every day of the week

You will also need to add devices to the activity. A CatTools activity can be associated with multiple devices, which is very useful in case you would like to back up multiple firewalls of the same type. Do so on the Devices tab.

Devices are added to activities; in this case, NC5505 was added

The Email tab allows CatTools to email a report to the address you have defined in your CatTools preferences. You can choose whether or not to send these emails, and you can also define an override email address if errors, such as failures to connect, occur.

Finally, the Options tab lets the administrator define how to configure the actual report. These options include:

• HTML Compare Report: Specifies whether you would like an HTML version of the report
• Text Compare Report: Specifies whether you would like a plain text report
• Only notify by email if configs have changed: Specifies that CatTools should send an email report only if the configurations have actually changed, which is useful for eliminating noisy reports
• Attach reports to email: Specifies which reports to attach to the email
• Zip attachments: Specifies that attachments should be zipped, and lets you specify a file name; typically, you want attachments zipped to conserve email space and simplify downloading of attachments
• Password protect zip file: Specifies the password for protecting the zip file

Report options give the administrator additional flexibility in specifying reporting formats and notifications

Finally, save your new scheduled activity and click “Start Timer.” You are now all set and ready to go! Your ASA device (or other firewall) will now be regularly monitored by CatTools.

SolarWinds Kiwi CatTools

• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)

The raffled license is worth 345 euro and allows you to back up an unlimited number of virtual machines on a Hyper-V host. The deadline of this contest is April 4, 2012. If you want to take part in this contest, please send an e-mail with the subject “Altaro Hyper-V Backup” to .

The interface for Altaro Hyper-V Backup v3 Unlimited Edition is extremely intuitive and inviting. There are so many great products out there that can do a lot for you but require submersing knowledge of the user manual to configure. I was astounded at how easy it was to setup Hyper-V Backup v3. It’s how software interfaces are supposed to work.

Install and setup

To get started, I installed the product on one of my clustered host servers. Being new to the product, I was happy to see that the setup process walked me through making one of my nodes a Master controller and installing the Backup Agent on the other node. After only three steps, Altaro Hyper-V Backup already had my host nodes in the Configure section and provided a list of my virtual machines with checkboxes to enable backup of specific VMs.

Altaro Hyper-V Backup – VM selection

Backup location and mirrored backup location

At this point I decided I should figure out how to configure the location for those backups. By simply clicking Select a Backup Drive, I was able to setup the primary and mirrored locations for my backups. It took me longer to decide where I wanted my backups than to actually configure. I also liked the option of using a UNC path.

Backup schedule

Now I needed to setup a schedule for my backups. This was easily done by clicking Setup a Backup Schedule. By default, two schedules are provided. After the ease of setup so far, I decided to go ahead and configure my own custom schedule. Adding a VM to a schedule was as simple as dragging the VM from the center and dropping it on the schedule in the list on the right.

Altaro Hyper-V Backup -Scheduling backups

Fire drill

In any backup solution, getting data backed up is only half the story. You also need to periodically test recovery to assure you aren’t backing up garbage. If you’re like me, you don’t always have time to go through that process as often as you’d like. That’s why I really like the Fire Drill feature. Fire Drill takes care of doing all those test restores for you.

This can also be done on a schedule. As fire drills are performed, the restored VM is made available in Hyper-V Manager where you can fire it up and check it out.

Altaro Hyper-V Backup – Fire drill

Backup retention

Any good backup solution also includes the ability to proactively control how long backups are kept. This could be because of disk space limitations or even company policy. Backup retention settings are very easy to configure. Each virtual machine can have its own retention policy.

Altaro Hyper-V Backup – Retention

Alerts and Notifications

Alerts and notifications were again very easy to setup. Click Notification Settings and configure alerts for the event log and email notifications for your inbox. I really liked the flexibility here.

Altaro Hyper-V Backup – Notifications

Summary

Altaro Hyper-V Backup v3 is a very solid product. I’m still amazed at how the interface seems to walk you through each portion of the backup configuration. I would highly recommend it to anyone looking to simplify backup of their clustered VMs. Note that Altaro also offers a free version Hyper-V Backup.

• Windows 8 Hyper-V (0)
• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• Hyper-V cluster – Part 7: Custer Shared Volume and manage virtual machines (0)
• Hyper-V cluster – Part 6: Create a cluster (0)
• Hyper-V cluster – Part 5: Quorums and disk configuration (0)

Submitted by David Vella – Blog: Altaro Blog for Hyper-V & Windows Administration

Altaro Hyper-V Backup

Features

• Back up Hyper-V VMs “live” – no need to save, suspend, or shut down
• ReverseDelta ™ technology – the most recent version of files are saved in their entirety for rapid restores. Older versions of files are saved only in differential block-level chunks. This allows for both rapid restoring and reduced space requirements on backup media.
• Restore a Hyper-V VM in only five clicks
• Volume Shadow Copy Service (VSS)-aware applications in virtual machines, such as Microsoft Exchange and Microsoft SQL Server, will commit their databases.

Free edition limitations

• Only two virtual machines can be backed up
• Only stores backups for the past four weeks

Altaro Hyper-V Backup

• Windows 8 Hyper-V (0)
• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• Hyper-V cluster – Part 7: Custer Shared Volume and manage virtual machines (0)
• Hyper-V cluster – Part 6: Create a cluster (0)
• Hyper-V cluster – Part 5: Quorums and disk configuration (0)

DPM 2010 provides the ability to protect servers in workgroup or non-trusted domains, using local accounts and NTLM based authentication. This capability proved less than popular in large enterprises because of the inherent weakness in NTLM, auditing difficulties and local account management. DPM 2012 adds another authentication method (the previous capabilities are still available); certificate based authentication. The following workloads are supported; SQL Server, File Server, Hyper-V and these can be clustered as well as standalone (note the missing pieces here, no Exchange, SharePoint, System State / Bare Metal Recovery or client computers). A secondary DPM server for DR can also use this authentication method.

All protection in DPM is done around the concept of Protection Groups.

The required certificates can’t be self-signed; hence an internal CA needs to be in place. Setting up certificate based protection is quite involved, first each DPM server has to be configured; generate a certificate from the CA for the DPM server, import this certificate on the DPM server and then configure the DPM server to use certificate based protection. For each server you want to protect you’ll need to install the agent and attach to the DPM server, generate a certificate for the server from the CA, import the certificate on the local computer and configure the DPM agent to use certificate based authentication. When the time comes to renew certificates, DPM will issue a warning alert 30 days before expiry and a critical alert one day before expiry.

Conclusion

A glaring problem in DPM 2010 that’s not addressed in DPM 2012 unfortunately is Exchange single item restore. Some competing backup products offer the ability to restore individual items from a mailbox. The fault doesn’t directly lie with the DPM team however as the methods used by third party software aren’t supported by Microsoft.

From a customer’s point of view it’s a bit odd though that DPM is so good at backing up most Microsoft workloads but falls flat in this one area. It’s time for the Exchange team to step up their game and provide a supported method for single item recovery as soon as possible.

A minor problem (compared to the Exchange issue) is that even though DPM recognizes Active Directory as a data source, single item recovery is again not possible. Another irritating issue is that if I select the Hyper-V node of a Hyper-V server one would assume that any VMs that are created after the creation of the Protection Group would be automatically protected but they’re not. Whilst it’s possible to do this with a PowerShell script it’s surprising that this wasn’t incorporated in this new version as default behavior.

Apart from these issues DPM 2012 is an excellent product, following the already successful earlier versions with a product that’s more enterprise friendly, eminently capable whilst still easy to use and administer. The new Central console is going to save many hours in large environments; the streamlined troubleshooting is a real winner and Role Based Access along with numerous other improvements makes this “best for backing up Microsoft products” even better.

Resources

The DPM team blog

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)

In a virtualized environment the issue is whether to backup from inside the guest or from the host. The latter provides “bare metal restore” of an entire VM where something’s gone catastrophically wrong with a VM (or the host) but in general it doesn’t provide granular restore of files / folders. DPM 2010 added Item Level Restore (ILR), allowing you to restore individual files or folders within a VM even though it had only been backed up from the host. But this capability was only available when DPM 2010 ran on physical hardware, if the DPM server itself was in a VM this capability was not available. DPM 2012 fixes this glitch and can now do ILR even when the DPM server is a VM.

Note that in both DPM 2010 and 2012 ILR is only for files and folders, if you’re running a transaction based workload such as SQL, Exchange or SharePoint in a VM you’ll need to install the agent inside the VM for granular protection. Also be aware that the Hyper-V role needs to be installed on the physical server for DPM 2010 in both Windows Server 2008 and 2008 R2, this is also the case when DPM 2012 runs on top of Windows Server 2008 but NOT when running on 2008 R2.

For stand-alone Hyper-V servers DPM 2012 introduces Changed Block Tracking, which transfers only the changed blocks rather than reading the whole VHD file. This improves backup performance as well as enhancing the Hyper-V server performance by reducing the number of IOs required for backup.

The tested scalability limits in DPM 2012 hasn’t changed from DPM 2010 and remains at 80 TB for replica volumes and 40 TB for recovery point volumes for a total of 120 TB.

DPM 2010 supports item level recovery for SharePoint but it’s time consuming as the entire content database has to be transferred to a staging location before items can be recovered. In a move sure to please SharePoint administrators (and stressed users who needs that document NOW) DPM 2012 instead attaches the database files on a recovery point to a SQL Server instance remotely and recovers the item. This can also be done for data in SQL Filestream content databases. Another improvement for SharePoint is farm level protection where new sites added to a farm are automatically protected.

For business with large tape libraries the added control with the new tape retention policies will be very useful.

DPM has had a tape optimization feature for some time which allows data co-location to better utilize available space on tapes. What was lacking in earlier versions was control over what data is housed with what; with only a single global policy for how many days before a tape can be overwritten.

DPM 2012 improves this by allowing you to configure Protection Group sets. Within each set you can control the Write Period which is the length of time that a tape is available for writing new backups as well as Expiration Tolerance which is the time an expired recovery point can remain on a tape until the tape is marked as expired.

Another tape improvement is that a single Protection Group can spawn multiple tape jobs and in DPM 2010 if one of those jobs had an issue, all of the jobs had to be stopped, in DPM 2012 only the job with an issue needs to be killed.

Also new in DPM 2012 is that any workload that comes with a VSS writer can now be recognized and protected by DPM, this is called Generic Data source protection.

In this part three of the four part series on DPM 2012 we covered a slew of different improvements in areas such as Hyper-V, tape management and Item Level Recovery. The next part will cover certificate based authentication along with a look at some areas where DPM could still do with improvement.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)

The scoped DPM console

The Central Console also enables another nifty troubleshooting feature – the scoped DPM console. When an alert is raised in SCOM you can click the Troubleshoot button which will take you to a DPM console which only shows the data sources, backup jobs and agents that are affected by this particular issue. Even better, once you have resolved the underlying cause you can run a test backup with a single click before resuming the entire backup job. It also provides context; the ticket number, alert and DPM server is listed in an area at the top of the scoped console.

Centralizing management inside of SCOM doesn’t just mean an aggregated view of all backups across many DPM servers; it also lets you work on more important issues first, for instance by showing issues that affect multiple data sources. Segregating errors into infrastructure and backup failures enables Tier 1 or 2 support to focus on backup failure alerts, whereas Backup Admins work on infrastructure problems and Tape Admins focus on tape errors.

Smaller environments can use the Remote Administration feature which lets you install the DPM console on a workstation and then connect that console to any remote DPM server.

The Scoped Console will be a real time saver in troubleshooting scenarios.

Role Based Access in DPM 2012

Another sign that DPM is stepping up to the big league is the application of Role Based Access (RBA) similar to how other Microsoft products (Exchange, SCOM) are approaching authorization for particular tasks in big organizations. Be aware that the DPM 2012 RBA model only covers the task itself, i.e. this user can recover data but you can’t further limit this by objects, i.e. this user can only recover Exchange data from these databases.

DPM comes with a set of seven built in roles with descriptive names: Read-Only User, Recovery Operator, Reporting Operator, Tape Operator and Tape Admins as well as the all-powerful DPM admin. The last two are Tier-1 Support (help desk) who can resume backups and take automated recommended action and the Tier-2 Support (escalation) who also can run backups on demand and take corrective actions such as enabling / disabling agents. Note that the roles are respected by the SCOM console and scoped DPM consoles that are opened from within the SCOM console but are NOT respected in the DPM console on the DPM server itself.

Incorporating the DPM user roles using the SCOM user role approach is another great way of integrating DPM into SCOM.

In part three we’ll over other improvements in DPM 2012.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Introduction

Protecting your data and systems running Microsoft workloads is paramount and the best way to do that is with Microsoft Data Protection Manager (DPM). This is an enterprise class product that’s gone from strength to strength over the last few versions. In this review we’ll look at DPM 2012 Release Candidate.

DPM 2012

In this four part article we’ll first look at installation of DPM 2012 RC and the new Centralized Management capability. In part 2 we’ll cover the scoped DPM console as well Role Based Access. Part three will cover other small and large improvements in DPM 2012 whilst the fourth part will look at Certificate Based Protection as well as some concluding remarks.

DPM 2012 installation

The overall installation experience has changed very little from previous versions. As before you can select to install a local instance of SQL Server (2008 R2 in this version) but larger environments are likely to use the option of a remote SQL Server. Multiple DPM servers can share a SQL server; each requires about 2.5 GB of memory so scale your servers accordingly. The underlying OS can be Windows Server 2008 / 2008 SP2 or 2008 R2 with or without SP1.

If you’ve been trying out DPM 2012 beta be aware that it can be upgraded to DPM 2012 RC which in turn will be upgradable to DPM 2012 RTM.

Whilst both DPM 2010 and 2012 servers can share a tape library (provided it’s recognized by device manager in Windows correctly) you can’t have DPM 2010 and 2012 servers talking to the same tape library, something to take into account for your upgrade planning.

The new DPM console has adopted the ribbon at the top as well as following suit with other System Center products with a wunderbar on the left a la Outlook.

Installing DPM 2012 is characteristically smooth and easy.

Centralized management of DPM 2012 and DPM 2010

To really enable DPM 2012 to reach enterprise scalability scenarios, in a manner that can be effectively managed, required a change in the management paradigm. If your company has two or three DPM servers, perhaps in separate locations, managing them independently isn’t a big deal. But if you have tens or even hundreds of DPM servers that approach quickly becomes expensive, notwithstanding the capabilities of PowerShell scripting.

DPM 2012 provides a centralized console for multiple DPM servers but rather than building a separate console it’s integrated with a console that many corporations are already using – Systems Center Operations Manager (SCOM). For businesses that rely on a third party ticketing system the SCOM integration will ensure that DPM alerts flow nicely into those systems as well. DPM 2012 beta supported SCOM 2007 R2 but the Release Candidate only supports SCOM 2012 RC. Both versions might be supported at RTM but we’ll have to wait and see.

To enable the Central Console is a three step process, first you’ll need to have SCOM 2012 RC installed and then run the main DPM installation screen and select to install the Central Console on the SCOM server. Finally the new Management Packs need to be imported into SCOM; if you’re thinking of trying out SCOM 2012 detailed instructions are available here.

Large businesses that have deployed DPM 2010 will be glad to know that the centralized console will manage DPM 2010 servers as well as DPM 2012. The centralized management extends further and lets you perform remote recovery, take corrective actions remotely and consolidate alerts across your entire backup environment. The Actions pane on the right is context sensitive and presents DPM actions appropriate to the object selected in the tree hierarchy. The tested scalability limit for the Central Console is 100 DPM servers or 50 000 protected data sources.

Using Operations Manager as the Central Console for DPM 2012 is an excellent move and it’s also very well implemented.

Raised Alerts are grouped by data source, disk, tape and tape drive, protection groups and replica volumes alerts, which makes it easy to focus on the area you need to troubleshoot. The central console on SCOM also filters alerts to match your SLA; say you have a guarantee to back up a data source every 4 hours but you actually run backups every hour, if these backups fail the DPM console will have an alert for each failure but SCOM will only raise an alert when the SLA is actually breached.

In part 2 we’ll cover the scoped DPM troubleshooting console as well as Role Based Access.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Submitted by Cindy Su

EASEUS Todo Backup Free is free for home and business users and offers many features that usually only commercial backup solutions have. The easy-to-use backup program doesn’t come with spyware or the need to install a browser toolbar.

Main features

• Restore or deploy system images to dissimilar hardware configuration for hardware replacement
• Windows PE and Linux based bootable disk for backup & recovery
• Incremental disk/file backup for saving disk space
• Network shared file backup
• Automated schedule backup

Additional features

• Back up system state and files, including the operating system, installed applications on-the-fly, and specified file types under Windows 2000/XP/Vista/Windows 7
• Clone hard drive disk or transfer data onto another to upgrade hard drive without the time consuming reinstalling of operating systems and applications
• Explore, copy and recover files directly from backup image in Windows Explorer
• Automatically delete old images to save disk space according to one’s own time-setting

EASEUS Todo Backup Free

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

If you are using any of the snapshot-based backup solutions for your virtualized machines—Veeam Backup & Replication and vRanger being the two most popular—then from time to time you are probably going to see a failed backup. This is a common occurrence even with traditional backup solutions, but in this situation it can have a drastic effect on your production environment.

While I can only directly speak for the effect with Veeam, as it is the only one I’ve used, the situation described here as I understand it is common to all of the VMware-centric backup systems. What happens is specific to situations where bandwidth is constrained, like when you are replicating over the WAN to off site. Backup job A runs and successfully completes. The last stage of the backup process is removing the temporary snapshot that is used to create the backup; this can be a time-intensive process depending on how large the backup (and thus the snapshot) is. During this process, backup job B attempts to create a snapshot and begins backing up the same virtual machine. When this happens, the VMware helper that was trying to merge the original snapshot (<disk>-delta.vmdk) back into the disk file (.vmdk) becomes orphaned. Furthermore, VMware still believes the snapshot to be locked by the original process.

In my experience, there are four steps to troubleshooting this issue and getting the delta files to roll back up into the disk files. You hopefully will not have to complete all four, as they are steps for “this fix isn’t working.” The first two can be done on a running VM, so you incur no downtime; the second two require you to take down the VM.

Step 1: Unlock the snapshot

The first step is to get the snapshot unlocked. The trick to this is to migrate the VM from the host it is on to another and then back again. Those of you using a vCenter-based infrastructure should know all about this. Just vMotion the machine, not the datastore, from one host to another.

It is important to vMotion the machine back to the original host. If you don’t, you get introduced to another error. Once the process is finished, you should be able to go into Snapshot Manager and click the “Delete All” button to clear them all out. Don’t be alarmed if the process of “Remove all snapshots” seems to hang on 95%; this is normal operation and, depending on the size and quantity of the snapshots, this process can take many, many hours.

Step 2: Trick vCenter

In some cases, after you perform the migration and you open Snapshot Manager, it appears that the VM has magically gotten rid of all of its snapshots. If you browse the datastore where the VM resides, using either the GUI VI Client or the CLI via SSH, you will still see the delta files there. If this is the case, you can trick vCenter into showing you the snapshots again by creating another snapshot manually (right-click VM, choose snapshot, “Take Snapshot”). When done, all of your Consolidate Helpers will reappear. After that, try to Delete All from the Snapshot Manager again.

Step 3: Migrate the datastore

If you have gotten to this point, I hate to tell you but you are now looking at some down time from here on out. If the snapshots still haven’t moved, the next step in my process is to shut down the virtual machine and migrate the datastore. Yes, I know, you are probably screaming at the screen about the fact that, with ESX 4, you don’t have to shut down to migrate the data any more. However, if you have reached this step, there are most likely more delta files than the VI client could handle before reaching the timeout limit, and shutting down makes the process faster and more robust. Migrating the datastore will have the effect of rolling the deltas back up if the process completes successfully.

Step 4: Convert the virtual machine

This step is for those of you (myself included) who ignore the problem too long. ESX is only capable of handling 32 snapshots for any given VM. Beyond that, trying to Delete All will not work. Neither will migrating the datastore. In this case, you need to install VMware’s standalone Converter tool on the VM and perform what’s referred to as a v2v, or virtual to virtual, conversion. I’ve seen reference to just using the VI client to clone the VM, but this process was defined to me by VMware support, so I’ll trust their judgment.

I have only reached this step once, and I hope to avoid it from here on. Current Windows activation will not survive this process, so at the least you will have to reactivate. At worst, you might actually have to call Microsoft and have them manually activate your server.

• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)

When responses were correlated with the total number of employees, it turned out that the smaller the organization, the less likely it was to have implemented an email archiving solution, while larger companies were more likely to have done so.

While the results indicated almost 2 in three of respondents had not implemented an email archiving solution, the survey also revealed that only 33.2% of respondents were familiar with the regulatory and compliance standards in the US that imply the need for email archiving. As before, the larger the business, the more likely the respondent was to have knowledge of email archiving and compliance.

Of particular interest is the fact that more than half of all respondents indicated that they have found it necessary to search for and/or restore deleted emails in response to an end user request, to meet an audit or compliance issue, or in response to a lawsuit. A third of all respondents have to do this on at least a monthly basis. This means that a good amount of the participants know the headache they need to go through if they don’t use an email archiving solution, and yet 38% of respondents have neither an email archiving solution, nor even a backup solution in place. For more than one of every three participants, a server failure could directly lead to a catastrophic loss of data.

The results show that more awareness on the benefits of having an email archiving solution is needed. Organizations need to understand that the benefits are numerous for systems admins, end users, and the business as a whole. While the business will be protected through its ability to meet compliance requirements and reduce the risk of data loss, systems admins, as well as the users themselves, will be able to search for any email, and to have a copy of all emails stored separately from their email system – reducing the load on email systems and on local machines. End users will also benefit from having mailboxes of virtually unlimited size, and being able to find any old email without having to request a restore from the systems administrators.

Email archiving solves many problems, protects companies from data loss, enhances the user experience, and is a critical add on to any email system. If you don’t already have an email archiving solution in place, add it to your road map now. You’ll be glad you did.

This guest post was provided by Ed Fisher on behalf of GFI Software Ltd. GFI is a software developer that provides a single source for network administrators to address their network security, content security and messaging needs..

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

DHCP is one of those essential services that can knock out a network if problems come up. That is why it is important to back up the DHCP server regularly and—even more important—to know how to restore a DHCP server.

Every Windows system backup contains a backup of the DHCP server with the database DHCP leases and the DHCP settings. However, many backup solutions only allow you to restore the complete system state but not specific system data such as those of the DHCP server. If you only have problems with the DHCP server, restoring a complete system state is usually not what you would want because it might affect other services.

You have to follow a different procedure to back up a Windows DHCP server. Windows stores the DHCP data in a database located at %SystemRoot%\System32\backup. The most important file is dhcp.mdb, which can’t just be copied with backup software because it is open while the DHCP server is running. Using the Volume Shadow Copy Service to secure the data is usually not a good idea for any kind of database system.

Automatic DHCP server backup

However, Windows automatically creates a backup of the DHCP database in %SystemRoot%\System32\dhcp\backup every 60 minutes; this backup can be copied by your backup software. The backup time interval can be changed in the Windows Registry in HKLM\System\CurrentControlSet\Services\DHCPServer\Parameters through the BackupInterval parameter. Sixty minutes is usually sufficient, but if you use a CDP backup solution to secure your server, you might want to configure a shorter backup interval.

Manual DHCP server backup

You can also run backups manually through the DHCP management console. This feature can be useful if you intend to make major changes to your DHCP settings. You can back up the database to a location other than the default folder. Note that this won’t change the location of the regular automatic backups. This setting can only be changed in the Windows Registry with the BackupDatabasePath parameter.

DHCP restore

To restore the DHCP server, you have to first restore the DHCP backup folder %SystemRoot%\System32\dhcp\backup with your backup software, and then restore the DHCP database with the DHCP management console. This will restore all DHCP leases, reserved IP addresses, and configured DHCP options. I wouldn’t use the RSAT DHCP management console for this purpose. It is safer to log on to the server to do this kind of work.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

In my last post, I explained why I am strictly against scheduling backups. However, when it comes to restores I am a big fan of schedules. Another golden rule that belongs in every backup strategy is the backup of backups rule.

Schedule restores

Now before you check whether your backup software has a feature for scheduling restores, read on to see what I mean by “scheduling restores.” Most backup experts recommend verifying regularly that backups are working properly. However, in my view, this is not enough. Just like manual backups are not a professional way to secure data, checking every now and then if the backed up data is really on the disks or tapes is certainly insufficient.

First of all, it is not very likely that you will really do it regularly. Be honest. When did you check your backups the last time? Second, it is not enough to check if the data was backed up. You really have to test the restored data in an environment that you prepared for this purpose.

The statistical data of failed restore attempts vary depending on who hired the analysts, but, I think, 50% is a reasonable working hypothesis. One thing is for sure—the main reason for failed restore attempts is because restores haven’t been tested regularly.

Thus, my advice is to schedule a disaster recovery day in your IT department every two months, or at least every six months depending on the importance of your data. On this disaster recovery day, you can simulate a worst case scenario where a virus or a fire wipes out all your data. Try to restore your Active Directory, your Exchange servers, your databases, and user files in a virtual test environment. Just like a fire department needs regular training with real fires, an IT department needs to practice restoring data on real virtual servers. You will be surprised how you burn your fingers when you try this the first time.

Such a disaster recovery day has a nice side effect. Your management will realize that your IT department has more work to do than resetting user passwords. And if someone from management asks if this is really necessary, you can ask back if anyone has ever calculated the chances for the company to survive a full data loss because of a virus outbreak.

Offsite backups

Please don’t think that I am paranoid, but backing up backups is indeed essential. Of course, I don’t recommend installing a second backup solution that secures the data for your regular backup system. What I mean are offsite backups. While big companies have always done this by storing tapes at secure places far away from the company site, small organizations often neglect the risk of data loss as a result of a fire.

Offsite backups has become a new trend for two reasons. Firstly, the rise of CDP solutions has increased the likelihood that a virus not only destroys the data on all live systems but also the backups on storage systems. Erasing data in a tape library is much more difficult for malware than manipulating the disks on a server or storage system. Perhaps this is the main downside of CDP compared to traditional tape backups.

Secondly, new online backup solutions made offsite backups affordable for small companies. However, I don’t recommend replacing your on-premises backup system with a cloud backup solution. I wouldn’t hand over control of such a vital component of your company. But backing up backups in the cloud is an easy and affordable way to secure your backups from fires. And since special software is required to access the cloud storage, it is highly unlikely that a virus would be able to take this hurdle.

The good news is that CDP (contrary to tape backups) is perfectly suitable for offsite backups via online backups. Since your CDP solutions already collected all the data in your network at your central storage system, it is the ideal source for your second-level backup.

And just in case you worry about handing over all your organization’s data to a third party, encryption technology can perfectly protect your data before it leaves your company site. You can use the encryption feature of the cloud backup software, or you can use your on-premises backup software to encrypt your data before the cloud backup software touches it.

What about using tapes for offsite backups? To be honest, in my opinion, working with tape backups is another no-no. I had so many troubles in my IT career with the reliability of backup tapes and tape libraries that I now think that tape backups are not even a good solution for offsite backups. But I know that this point is highly disputed, and so I had better wait another year or two until “Don’t use tape backups” becomes my fifth golden backup rule.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Data backups are one of the most important tasks for any IT department. In my view, they are even more important than security. It can get nasty if a virus knocks down your network for a few hours. However, if you lose essential data, it could knock down your whole company forever. If you need some more motivation to read on, check out these statistics according to which 60% of companies that have lost their data will shut down within 6 months.

The problem is that admins are often busy with keeping the network running or meeting project deadlines. Backup management is often the first task that is neglected when admins are under time pressure because daily operations are usually not affected by a faulty backup strategy. But this is only true until a backup is really needed.

I have quite some experience with backup strategies and different kinds of backup software. While it is impossible to cover all relevant topics in two blog posts, I’ve outlined my four golden backup strategy rules. You’ll notice that some of them are perhaps a bit uncommon.

Don’t schedule backups

If you open a book about data backup, the first thing you usually read is that it is essential to not run backups manually and, therefore, it is essential that you schedule backup tasks. While the antecedent in this sentence is true, the conclusion is wrong.

It is true that backups should always run automatically without the need for human intervention. However, if you are still working with a backup strategy where terms such as full, incremental, or differential backups appear, then you missed an important technological development of the last years. I am talking about Continuous Data Protection (CDP).

With CDP, you don’t schedule backup because the data is secured at the moment it is created. The important difference from conventional backups is that you don’t lose the data that has been created between the last backup and the time when you need to restore the data.

While it might have been sufficient to run backups once per day, ten years ago, it is, in my opinion, grossly negligent to continue to pursue such a backup strategy. Most businesses now depend a lot more on digitally stored data, and any kind of data loss is no longer acceptable. A backup strategy that allows for possible data loss is what I call a “data loss strategy.”

I think, CDP is now ready for prime time. The teething troubles of the first years have been solved. Thus I see no reason why anyone would still need to schedule backups.

Don’t configure backup jobs

Backup software that relies on scheduled backups has another important downside. Depending on the size of your organization, managing backup jobs can be quite complicated. Backup solutions of major vendors have become quite bloated over the years with myriad features that appear to be quite useful at first but, if not properly configured, only increase the likelihood that restores will fail.

While I am in general a fan of bloated, feature-rich software, backup software is an exception. The difference from other software is that you can usually easily verify whether your setup works properly or not. However, with backups you often only realize that something must have been wrong with your configuration once you try to restore data.

Of course, you also have to configure CDP software. However, the configuration of CDP software is much simpler than that of conventional backup solutions because you essentially only have to configure which servers or clients you want to back up and some general settings such as retention periods. This leaves less room for mistakes and increases the probability that restores really work when you need them.

Some vendors of conventional backup software have added CDP features because they don’t want to miss the trend. However, they still need to sell the legacy code of their old software; since CDP and scheduled backups don’t really fit together well, things often get even more complicated if you use a conventional backup tool for CDP. Hence, I recommend moving to a CDP specialist and saying goodbye to your beloved backup software that you have been using for the last ten years or so.

In my next post I will discuss offsite backups and disaster recovery.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Comodo recognized the shortcomings of an easy-to-use system restore utility in the Windows world and released a system restore tool with a nice user interface. Named after the Apple pendant Time Machine, Comodo’s Time Machine tool is simple to use. The only configuration task you have to do during installation is specify the hard drives for which you want to enable Time Machine.

When you launch Time Machine, you see a window with six tabs (View Snapshots, Take Snapshots, Scheduled Tasks, Restore System, Recover Files, and Reset Baseline), a link to the application settings, and a link to update the software.

The View Snapshots tab shows a history of all snapshots; this history represents the time line in which you can go back to a certain point in your computer’s past. When you want to “travel in time,” you can restore the whole system or just single files. You can create these points in time by either taking a snapshot manually or by scheduling a snapshot task. This gives you all the flexibility you need. This system restore utility has a lot more features, such as a CLI interface, but there are just too many to cover all of them in this article.

When you take many snapshots and make a lot of changes to your computer’s data, you will sooner or later run into storage and performance problems because Time Machine logs every change on your computer. To avoid having more and more space consumed by the snapshots, you can define a new baseline, which means that a new snapshot is taken and all previous snapshots are deleted.

These snapshots do not dissolve the need to back up your data, though. The snapshots are stored on the same hard disk as your data; in case of a hard disk failure, not only is your data destroyed but also the snapshots. The solution to this might be the Comodo Time Machine Enterprise Server, but it isn’t available yet.

All in all, Time Machine is a very nice system restore utility. It has only one major drawback: It doesn’t work together with TrueCrypt. This is no issue if you don’t use TrueCrypt, but for me TrueCrypt is an essential tool that is installed on every computer I own.

Comodo Time Machine

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Continuous data protection for Active Directory

If you require a more recent backup, you want to determine the point in time of the backup more precisely. In most cases, you will just need the last available state; with real-time CDP, this is the state right before the corresponding directory objects have been modified.

To enable CDP you will need to deploy a data handler to every domain controller to capture all of the changes from a continuous change log to rollback unwanted changes.

Blackbird auditor is one of the modules of the Blackbird Management Suite. This module is not included when you buy Blackbird recovery. However, the free version, Blackbird auditor express, is probably sufficient for backups in most environments. The main limitation of auditor express is that you can only audit object changes of the last two days and 100 events. For restores that are older than two days, you can use scheduled backups.

Scheduled backups

CDP allows you to rollback unwanted changes or deletions but you may want to revert to previous point in time, say if a scripted update has done a large update with incorrect data.

To configure a scheduled backup job, you have to create a so-called Collector. Here you specify the domain, the naming context (Default, Configuration, Schema), and the scope (for instance, object only or object and child objects). You also have to schedule when the collector has to run. You can configure hourly, daily, weekly, and monthly backups. Because of Blackbird recovery’s efficient architecture it is no problem to run hourly backups in most environments. That way, Blackbird’s Collectors offer what is usually called near CDP.

Collectors are comparable to incremental backups in conventional backup tools. This backup method is fast because it only stores changes since the last backup. But restores are usually slow because the data has to be rebuilt from multiple backup jobs. However, since Blackbird recovery leverages the speed of SQL Server, restores are quick anyhow.

In my next post, I will show you how you can restore Active Directory objects with Blackbird recovery.

To participate in the competition for a chance to win a Blackbird recovery license, worth $1,800 USD, please send an email to:

with the subject line:

Blackbird recovery.

You can also use this contact form.

The deadline of this contest is August 31, 2010.

• Raffle: Blackbird Auditor for Active Directory – Real-time Active Directory auditing (0)
• FREE: ManageEngine Free Active Directory Tools (0)
• Microsoft Exam 70-640 – Operations Masters – Sample question (3)
• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)

Data handler

The diagram above gives you an overview of Blackbird recovery’s architecture. As you can see, you have to install an agent, the Blackbird Data Handler, on all your domain controllers to enable the collection of a continuous change log. This agent is not only for Blackbird continuous recovery but for all the other modules of the Blackbird Management Suite. The agent collects the data and directly stores it into a Microsoft SQL Server (or SQL Server Express) database.

Backup data storage

It is important to note that Blackbird recovery leverages a very efficient gather and store mechanism. Objects are stored in binary format in the database requiring very little space. The first scheduled collection gathers every object that is configured as part of the collection. On subsequent scheduled collections only objects that have changed are gathered and stored minimizing the traffic on the wire and the backend storage requirements.

This allows for the recovery of Active directory objects and the continuous coverage allows the rollback of any unwanted change without losing all of the changes since the last backup as with other solutions. Moreover, Blackbird recovery is able to restore Active Directory objects very quickly because it doesn’t store the backup in a flat file like conventional backup tools, no need to find what file or files have the correct information and waiting for them to uncompress before you can perform the recovery.

The SQL Server doesn’t have to be on the same physical server as the Blackbird Server, the core of the Blackbird Management Suite, but it also doesn’t hurt if you run them on the same machine.

Backup data objects

Blackbird recovery supports backups of domain-specific data such as users, groups, OUs, DNS data, and GPOs. You can back up forest-wide data including Active Directory Sites and Services data and schema classes and attributes.

Please note that rollback of GPOs and certain DNS deletions can’t be undone with continuous data protection (CDP) they will need to utilize scheduled backups. I will discuss the difference between CDP and scheduled backups in my next post.

Also notice that only schema changes can be restored, but not schema extensions. The reason for this is that removing schema extensions is not supported by Microsoft. So, for example, if you install Exchange in your domain you wouldn’t be able to roll back the corresponding Active Directory schema extensions.

User interface

The Blackbird client in the diagram is the front end of the suite. It is a Microsoft Management Console (MMC) snap-in which allows you run the Blackbird’s user interface together with Microsoft’s own management tools in one console. In addition, some of the Blackbird features are integrated in Microsoft’s RSAT tools.

For instance, you can restore objects directly from the Active Directory User and Computer (ADUC) interface. (I will explain this in more detail in another post.) This also means that you can manage Blackbird recovery from your desktop without logging on to the Blackbird server via RDP. Likewise, the tight integration with Microsoft’s management tools helps you to learn very quickly how to use the Blackbird recovery.

In my next post, I will explain how Blackbird recovery for AD has to be configured.

To participate in the competition for a chance to win a Blackbird recovery license, worth $1,800 USD, please send an email to:

with the subject line:

Blackbird recovery.

You can also use this contact form.

The deadline of this contest is August 31, 2010.

• Raffle: Blackbird Auditor for Active Directory – Real-time Active Directory auditing (0)
• FREE: ManageEngine Free Active Directory Tools (0)
• Microsoft Exam 70-640 – Operations Masters – Sample question (3)
• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)

Blackbird recovery is a module of the Blackbird Management Suite, which consists of Blackbird auditor for AD (real-time auditing for Active Directory), Blackbird auditor for Windows File System (real-time file system auditing), Blackbird privilege explorer for Windows File System (access rights reporting), Blackbird protector (protection against AD modifications), and Blackbird privilege manager (workflow based management of AD privileges).

This suite is not just a collection of Active Directory and Windows file system tools. Essentially, it is one big management tool with different modules that are tightly integrated. Each module can be purchased separately. In this article series, I will only cover Blackbird recovery, the Active Directory backup module.

Today, I will outline why it makes sense to have a specialized Active Directory backup tool. Most organizations secure their Active Directory data with a common backup tool that is also used to back up file systems, databases, E-Mail, etc.

Blackbird recovery does not really compete with these solutions because they usually have a different purpose. While the AD agents of common backup solutions are often only for disaster recovery—that is, the recovery of a whole Active Directory domain or forest—Blackbird recovery’s main purpose is for restoring individual or multiple AD objects and attributes in case of a user error or an application malfunction.

Even if a conventional backup tool supports granular recovery, you usually can only restore the data from the last backup. In comparison, Blackbird recovery allows you to restore the previous state of a particular object at any point in time. That is, the backup software supports continuous data protection (CDP) for Active Directory.

In my experience, AD disaster recoveries are rare because Active Directory is very robust. Even if one of your domain controllers goes down because of a hardware malfunction, you still have “backups” of your directory database on other domain controllers.

On the other hand, Active Directory is an essential service in every Windows network. Not only does Windows rely on it, but many third-party applications depend on it as well. And this is where the problems begin. Applications, admins, and even end users store data into the directory all day. This is why errors are inevitable. As with file system backups, most restores are required not because of hardware malfunctions but because of user mistakes or application errors.

Of course, you don’t want to restore your whole Active Directory just because your great new PowerShell script that was supposed to automate a tedious administration task wreaks havoc and “automatically” destroyed half of your directory. An Active Directory disaster recovery, where the complete database has to be restored, is quite complicated and usually shuts down your whole IT infrastructure for the time of the recovery process.

Furthermore, even if your backup software supports restores of individual objects without downtime, you will most often only get one-day-old data. This might still prevent a disaster, but it could also mean that you will lose essential data and most certainly your brilliant automation efforts won’t stay unnoticed.

Lucky you if you have a backup tool at hand that allows you to restore Active Directory to the point in time when you hit the enter key on the PowerShell prompt, with just a few mouse clicks and without the hassle of an authoritative Active Directory restore. This is where Blackbird recovery comes into play. In my next post I will describe Blackbird recovery’s architecture.

To participate in the competition for a chance to win a Blackbird recovery license, worth $1,800 USD, please send an email to:

with the subject line:

Blackbird recovery.

You can also use this contact form.

The deadline of this contest is August 31, 2010.

• Raffle: Blackbird Auditor for Active Directory – Real-time Active Directory auditing (0)
• FREE: ManageEngine Free Active Directory Tools (0)
• Microsoft Exam 70-640 – Operations Masters – Sample question (3)
• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)

SharePoint is a big success for various reasons; one of them is certainly the ease of administration. Once you have internalized the structure of SharePoint, it is very straightforward to use. Almost too straightforward: because it is so easy to create new websites and lists, web applications often grow too fast and unstructured. Keeping the content ‘findable’ often requires the taming of the rank growth. It is a difficult task, but doable.

But, SharePoint is deployed not only to make content more findable. Granting and denying users the privileges to access certain data is another major job of SharePoint. Most SharePoint administrators may raise an eyebrow now, because SharePoint seems to have no mechanics to deny access. And that’s right. This is a huge drawback, because it makes the administration of user privileges pretty hard. The only choice, besides building a perfect SharePoint hierarchy, is to micro manage the access rights for every item in SharePoint.

This is time consuming and, for bigger installations, impossible to do. So, you often have to deal with the inheritance of access rights. For sites with only a few sub sites, it is possible to keep the overview. The more the sites are nested, the more complex it becomes to deviate the current access rights, because there is no way to see which rights were passed down by the site’s parent.

That’s the time for SUSHI to enter the stage. It can display what permissions a specified user has on a site, the permissions inheritance for site collections, and list group memberships for users. You only have to choose the site and the user, and click on “Run security report”. This function is tremendously helpful if you want to prevent some users accidently seeing the wages of all your company’s employees.

Besides that, SUSHI offers quite a wide range of other useful options. For example, it provides an easy way to back up your farm or site collection. It isn’t more sophisticated than the stsadm command, but having a GUI for it doesn’t hurt at all.

You can find a full feature list here and the program can be downloaded here.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Agent configuration

I already mentioned in the first post of this series that the agent basically is GFI Backup Home. That is, end users have a full-fledged backup tool on their desktops. Please read my review of GFI Backup’s free edition for a detailed description of how users can manage backups with this free tool. In this article, I will describe only the additional features that come with the business edition.

First of all, you should know that admins can disallow access to the agent’s user interface. Actually, this is the default setting. With this configuration users will only be informed whenever a backup job starts or if errors have occurred.

Of course you can also disable these messages. Moreover, GFI Backup allows you to control in detail what users can do with the agent. For example, you can allow users to only view backup jobs and stop them. See the screenshot for all settings.

Admin tasks and user tasks

GFI Backup distinguishes between admin tasks and user tasks. Admin tasks are those backup jobs that are configured at the Administration Console, whereas user tasks are created with the agent’s user interface (see screenshot below).

Admins can configure tasks that store backups at a central location on a server, or they can use local destinations (for example, a local drive at the user’s desktop). GFI Backup supports backups to local disks, network shares, CD/DVDs, and tapes. User tasks basically offer the same options as admin tasks.

The advantage of local destinations is that users always have access to their backups even if their laptops are not connected to the company network. However, in this case the laptop should have at least two disk drives. Another option would be to store backups locally and at a central store. GFI Backup offers remarkable flexibility here. The only feature it lacks is that admins can’t predefine central backup destinations for user tasks, which requires users to know the location of the network share.

All tasks, including those that are created locally by end users, are displayed in the Administrator Console (see screenshot below). Admins can view the configuration of local backup jobs but they can’t modify them in the Administrator Console. In the same way, users can only view the configuration of admin tasks (if allowed by the admin).

User restores

It is certainly helpful in some environments for users to be allowed to create their own backup jobs. However, most interesting is that users can restore data through the agent’s user interface without the help of an admin. This is possible for user and admin tasks alike. Of course, admins can also restore backups with the Administrator Console to the user’s PC. However, this only works for admin tasks. Backups of user tasks can only be restored through the agent user interface.

GFI Backup supports item-level and full-backup restores. With item-level restores you can only access the last backup from either the Administrator Console or the agent user interface. However, since the backup destination can also be accessed through Windows Explorer, it is possible to restore single files of older backups without GFI Backup’s user interface. Older backups of full-backup restores can be accessed through the agent and the Administrator Console.

Conclusion

I have tested numerous backup programs in my IT career. The popular solutions have become quite bloated over the years, with many features that are simply overkill for small- and mid-sized organizations. This makes these tools difficult to administer, which increases the risks of incorrect configurations. GFI Backup targets mostly small- and mid-sized organizations, and it comes with all the features for this target group. In particular the features that allow end users to restore backups without admin intervention are awesome. Even though my description of user and admin tasks might sound a bit complicated, you’ll find that GFI Backup’s user interface is quite easy to use.

To participate in the competition for a chance to win a copy of an Asus netbook worth 328 USD and a license of GFI Backup Business Edition for 500 workstations and 50 servers worth 7,100 EUR, send an email to:

with the subject line:

GFI Backup.

You can also use this contact form.

The deadline of this contest is July 16, 2010.

Disclaimer: Any warranty issues regarding the netbook have to be addressed with the netbook vendor. Neither I nor GFI can offer any support for the netbook.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Last time I mentioned that new backup clients are added automatically to the GFI Backup Administrator Console. In some environments the backup admin might prefer to authorize new backup clients. For this you can disable auto-approve in GFI Backup’s settings.

Automatic data backup job configuration

However, automatically adding new backup clients has its advantages in environments with many desktops. GFI Backup is a specialized solution for this situation because it can also configure the backup jobs automatically for new clients.

GFI Backup allows you to configure backup jobs for a domain or workgroup. Whenever a new client joins, the corresponding job configuration is automatically applied to its agent. Thus if you have to add new server, desktop or laptop you only have to deploy the agent and you are done.

This also limits the number of necessary backup job definitions, which is essential for desktop and laptop data backup. Important to note is that the corresponding backup jobs run independently. This way, the job won’t fail just because some clients are not online at the scheduled start time.

Data Backup task monitoring

When a backup job starts, the corresponding definition blinks; when the job runs through for all available clients, the blinking stops. Unfinished jobs can be monitored in GFI Backup’s command queue. Once a client comes online the job definition starts blinking again in the Administrator Console. The Agents tab gives you an overview of the clients that are online and offline and when they were last active.

Desktop and laptop data backup scheduling

In addition, GFI Backup has schedule types that address the problem of unavailable desktops or laptops. Aside from schedules that allow you to run the backup at specific times, you can start jobs when clients boot up or when they shut down. Moreover, it is possible to reschedule missed data backups and wake up computers from standby/hibernate before running the backup. Once the backup job is finished GFI Backup can shut down the computer.

GFI Backup has quite a few interesting features to solve the problem of unavailable clients, which is quite common for desktop and laptop data backup. In my next post, I will discuss some additional interesting features that help reduce the work of admins—that is, the GFI Backup features that enable end users to configure backup and restore jobs without bothering you.

To participate in the competition for a chance to win a copy of an Asus netbook worth 328 USD and a license of GFI Backup Business Edition for 500 workstations and 50 servers worth 7,100 EUR, send an email to:

with the subject line:

GFI Backup.

You can also use this contact form.

The deadline of this contest is July 16, 2010.

Disclaimer: Any warranty issues regarding the netbook have to be addressed with the netbook vendor. Neither I nor GFI can offer any support for the netbook.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)