Automate Windows 2000 System State Backups

This article explains how Microsoft Windows 2000 executes automated, scheduled backups of the System State. It covers the underlying architecture, the interaction between the built-in NTBackup utility and the Task Scheduler service, how backup selection scripts are generated, and the step-by-step process the operating system follows when executing scheduled backup jobs.

The Role of System State in Windows 2000

In Windows 2000, the System State comprises critical operating system components that cannot be backed up as standard independent files due to active system locking and dependencies. Depending on the machine's role, the System State includes:

  • The Windows Registry
  • The COM+ Class Registration database
  • System boot files (NTLDR, boot.ini, NTDetect.com)
  • The Certificate Services database (if configured as a Certificate Authority)
  • Active Directory directory service (Ntds.dit) and the SYSVOL directory (on Domain Controllers)
  • Cluster service metadata (on cluster nodes)

Because these components are interdependent, Windows 2000 enforces an all-or-nothing approach: the System State must be backed up and restored as a single unified entity.

Architectural Components

Automated System State backups in Windows 2000 rely on two primary components:

  1. NTBackup (ntbackup.exe): The native backup software licensed from VERITAS. It handles data extraction, file locking, compression, and media writing.
  2. Task Scheduler Service (mstask.exe): The background service responsible for launching scheduled tasks under predefined user credentials and execution triggers.

How Windows 2000 Configures the Scheduled Job

When an administrator schedules a System State backup through the Windows 2000 Backup Wizard, the operating system executes the following preparatory steps:

  1. Selection File Creation: NTBackup generates a Backup Selection Script file with a .bks extension, typically stored in %USERPROFILE%\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\. This file contains instructions designating SystemState as the target.

  2. Task Scheduler Registration: NTBackup registers a new job within the Windows Task Scheduler folder (%SystemRoot%\Tasks).

  3. Command Construction: The scheduled task points to ntbackup.exe appended with specific command-line switches. A typical automated System State command generated by the scheduler resembles:

    ntbackup.exe backup "@C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\BackupJob.bks" /j "System State Backup" /f "D:\Backups\SystemState.bkf" /v:no /r:no /l:s /m normal

    Alternatively, administrators can bypass the .bks file and call the backup directly using the command line:

    ntbackup.exe backup systemstate /j "System State Backup" /f "D:\Backups\SystemState.bkf" /m normal

  4. Security Context Assignment: The administrator provides an account name and password (typically a member of Administrators or Backup Operators). Task Scheduler stores these credentials as encrypted LSA (Local Security Authority) secrets.

Execution Process at Runtime

When the scheduled trigger is reached, Windows 2000 executes the backup workflow in the following sequence:

  1. Service Trigger: The Task Scheduler service evaluates the system time against the trigger schedule, retrieves the stored credentials, and launches a new process for ntbackup.exe in the background (non-interactive mode).
  2. Accessing Locked Files: Because Windows 2000 predates the Volume Shadow Copy Service (VSS, introduced in Windows Server 2003), NTBackup uses proprietary APIs and internal OS hooks to access active system files. It interfaces with the Registry APIs to create a temporary backup copy of the registry hives, and coordinates with the Directory Services API on domain controllers to freeze writes to the Active Directory database while a consistent snapshot is copied.
  3. Packaging the Data: The components are assembled into Microsoft Tape Format (MTF) stream data.
  4. Writing to Target Media: The stream is written directly to the target destination specified in the job parameters, such as a local .bkf file on a separate physical volume or a dedicated tape drive managed through Removable Storage Manager (RSM).
  5. Log Generation: Upon completion, ntbackup.exe writes a summary report containing file counts, errors, and completion status to an .out or .log file in the user's NTBackup data folder, updates the Task Scheduler job status, and terminates the process.