Knowledge Base: BACKUP : Backup of Windows System State
 
Backup of Windows System State
Creation Date: February 12, 2010
Revision Date: September 10, 2015
Product: DS‑Client (Windows)
Summary
To back up a Windows computer’s System State, you must be an administrator or have administrator-level permissions. Starting from Windows VISTA, there are additional special requirements: see “Special Requirements: Windows VISTA and later versions”.
Details
System State data contains most elements of a Windows computer’s configuration, and it must be backed up along with the boot and system volume(s) of any target computer you want to recover from serious failure or disaster.
Therefore, it is recommended that you create a Bare Metal Restore backup set to cover all restore possibilities for any important server. This means that, you create a single backup set to back up all boot and system volumes, including the System State and Services Database which appear as separate objects. They can be selected from the Shares & Directories List (Set Properties Items Tab or New Backup Set Wizard).
See “Backing up Windows for Bare Metal Restore (BMR)”.
Special Requirements: Windows VISTA and later versions
The default Microsoft installation settings will not allow you to browse and select the System State of any remote target machine (even if you are using Administrator-level credentials). The error message “Access denied” is displayed when you try to select the System State.
This behavior is due to the User Access Control (UAC) introduced by Microsoft beginning with Windows VISTA. By default, UAC denies all users access to the administrative shares (i.e. System State), except for the built-in administrator user. The built-in administrator user is disabled by default.
The following workarounds must be performed on each target computer whose System State you want to back up:
Enable built-in administrator account and specify its credentials when defining the backup set.
-OR-
Disable UAC.
-OR-
Enable access to the administrative shares.
This is equivalent to disabling UAC but only for network access. You can do this by adding / editing the DWORD “LocalAccountTokenFilterPolicy” registry value under:
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system\registry key
Set it to “1”.
A reboot may be required.