Today we were doing a Disaster Recovery for a client. Well not so much as a Disaster Recovery, but a recovery of old data from an old tape. The tape was from April 2011. The data we wanted to recover was from an NTBACKUP of Exchange 2003. We needed to recover the CEOs Mailbox as he’d “lost” certain emails that were now considered important.
Anyway – we had a server similar to the original server and we commenced the rebuild of the server from tape. The engineer I had working on it restored the entire C: drive as well as the other volumes needed. Upon reboot we were faced with an error below.
Security Accounts Manager initialization failed because of the following error: Directory Service cannot start. Error Status 0xc000000f.
Ok – we checked the C:\Windows\NTDS folder and found that it was empty. Which is to be expected as we’d not done a system state restore. So we rebooted into DSRM mode and commenced a System State restore. All looked good and we rebooted…. sadly we got this error message.
Security Accounts Manager initialization failed because of the following error: Directory Service cannot start. Error Status 0xc00002e1.
A little investigation revealed this Microsoft KB article. Unfortunately we got to step 9 in the procedure and ntdsutil files integrity command reported that the database was in fact corrupt. Hmm we thought – let’s try an older tape, so we did another system state restore, which unfortunately failed with the same result.
Ok – so at this point I took a few steps back… I tried a few things that I probably should not have all of which did not work. Then it dawned on me… tombstones… the backup we were restoring was nearly 9 months old. The default tombstone period is 60 days… I’d never tried to restore such an old backup before and I wondered if the problem might in fact be the date now being 9 months later.
The easy way to verify this was to jump into the BIOS and we set the date to 1 month AFTER the original backup. We then rebooted into DSRM mode once more and did another system state restore. Rebooted and crossed our fingers. Yippee – it came up without an issue. That must have been it.
So the take away from this is that when you are restoring older tapes, consider the date that the backup was done as well as the date that the machine has set in the BIOS. This is one I won’t forget for a while now