Windows 2000 NTBackup System State Backup Process

This article explains how Microsoft Windows 2000 executes System State backup file creation using the native NTBackup utility. It details the specific system components captured during the process, the internal APIs utilized to handle live files prior to the introduction of Volume Shadow Copy Service (VSS), and the step-by-step mechanism Windows 2000 employs to compile these components into a single backup archive.

Components of the Windows 2000 System State

In Windows 2000, the System State is not a single file, but a logical collection of critical system architecture dependencies. NTBackup treats these dependencies as a single atomic unit, meaning individual sub-components cannot be backed up or restored independently.

On a standard Windows 2000 Professional or Member Server, the System State consists of:

  • The System Registry: All registry hives located in %SystemRoot%\System32\Config.
  • The COM+ Class Registration Database: Component services information stored in %SystemRoot%\Registration.
  • System Boot Files: Core startup files located on the active system partition, including NTLDR, BOOT.INI, NTDETECT.COM, and any required boot drivers.
  • Certificate Services Database: Captured only if the server is configured as a Certificate Authority (CA).

On a Windows 2000 Domain Controller, the System State also includes:

  • Active Directory Directory Service: The database file (NTDS.DIT) and associated log files.
  • The SYSVOL Directory: The shared file structure containing Group Policy objects and logon scripts.
  • Cluster Service Quorum: State information, captured only if the system is an active node in a server cluster.

The Execution Workflow of NTBackup

Windows 2000 executes the backup through ntbackup.exe, which can be initiated via the Graphical User Interface (GUI) or the command line interface using switches such as ntbackup backup systemstate /f "C:\backup.bkf". Because Windows 2000 predates the Volume Shadow Copy Service (VSS) introduced in Windows Server 2003, it relies on dedicated subsystem APIs to capture open, running system files without corrupting data.

1. Invocation and Component Discovery

When the System State backup flag is triggered, NTBackup calls internal Win32 Backup APIs to identify the machine's role. It determines whether the machine functions as a standalone system, a domain controller, or a cluster node to build a dynamic file manifest for the backup operation.

2. Registry Freezing and Export

Because the Windows Registry is actively locked by the operating system kernel, NTBackup cannot copy the hive files directly from the file system. Instead, it interacts with the Configuration Manager using the RegSaveKey API. This function flushes active registry buffers to disk and creates point-in-time copies of each hive into a temporary staging location or directly streams the binary data into the backup pipeline.

3. Active Directory Extraction via ESE APIs

If executed on a domain controller, NTBackup coordinates directly with the Extensible Storage Engine (ESE) via ese.dll and ntdsai.dll. Active Directory runs continuously, so NTBackup initiates an online ESE backup. The database engine coordinates with the backup process to:

  • Stream pages of the ntds.dit database sequentially.
  • Temporarily keep transactional logs open to capture changes occurring during the backup read operation.
  • Package the database along with the corresponding transaction logs (edb.log, edb.chk) to ensure ACID compliance during a future restore.

4. File System Scanning and Path Assembly

For file-based components—such as the SYSVOL directory structure, COM+ registration data, and boot files—NTBackup uses the standard Win32 BackupRead API. This API bypasses normal file-sharing restrictions, reading the raw file data streams along with Alternate Data Streams (ADS) and security descriptors (Access Control Lists).

5. Encapsulation into Microsoft Tape Format (MTF)

As each component is read, the data streams are formatted into the Microsoft Tape Format (MTF-100 specification). Even when saving to an on-disk target rather than a tape drive, NTBackup writes the stream directly into a proprietary tape-image container with a .bkf extension.

6. Completion and Cleanup

Once all streams are compiled, NTBackup writes a catalog entry at the end of the .bkf file detailing the contents and directory paths. If Active Directory was backed up, NTBackup signals the ESE engine that the backup completed successfully, prompting the system to purge committed transaction logs that are no longer needed. Finally, temporary files are removed, and a status entry is recorded in the Windows Application Event Log under the NTBackup source.