Re: Backing up protected system files

Hi Mehrdad,

Am 20.11.2025 um 16:54 schrieb Mehrdad Ravanbod:
> Hi guys
> 
> I have encountered  problem and was wondering if anyone knows how to get 
> around this
> 
> I am trying to have bacula do a backup on "Windows/system32/config/" 
> folder, this is a protected system folder where windows saves all the 
> files which has to do with the registry.

Have you had a look at the registry key
Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup
which is used to tell backup applications which file to *not* back up?

A similar setting called FilesNotToSnapshot might also be relevant.

If I recall correctly, we have some functionality to honor those 
settings, although my (admittedly dim) recollection is that this was 
only done with the VSS plugin (which should be Bacula Enterprise only).

> Windows system restore can do 
> this (it is a part of the restoration points that get created) and since 
> bacula uses the VSS writer I thought that bacula should be able to read 
> protected system files.
> But apparemtly not, bacula sees the folder, sees the folder structure 
> and creates all the sub-folders in the backp, but none of actual files 
> are backed up.
> Anyone knows why and how can this be fixed??

> Btw, client is running windows 7 if that makes a diff, bacula-fd and 
> bacula-sd are installed on the client and both are running under "local 
> system account"  so it should have enough privileges

I'm not having any Windows 7 system available to check, but on the 
remaining Windows 10 host I'm currently using, the directory is rather 
empty and does not, in fact, seem to contain any registry backups:

C:\Windows\System32\config>dir
  Volume in Laufwerk C: hat keine Bezeichnung.
  Volumeseriennummer: 1669-28AE

  Verzeichnis von C:\Windows\System32\config

25.11.2025  09:27    <DIR>          .
25.11.2025  09:27    <DIR>          ..
21.11.2025  04:51         1.310.720 BBI
18.05.2020  21:26            28.672 BCD-Template
25.11.2025  09:27        41.418.752 components
21.11.2025  04:51         1.572.864 default
19.11.2025  02:32        10.596.352 drivers
15.02.2024  09:52            32.768 ELAM
07.12.2019  10:14    <DIR>          Journal
07.12.2019  10:14    <DIR>          RegBack
21.11.2025  04:51           262.144 sam
21.11.2025  04:51            65.536 security
21.11.2025  04:51        99.876.864 software
21.11.2025  04:51        22.282.240 system
03.07.2021  12:47    <DIR>          systemprofile
15.10.2023  14:05    <DIR>          TxR
13.05.2023  19:04             1.607 VSMIDK
               11 Datei(en),    177.448.519 Bytes
                6 Verzeichnis(se), 76.653.162.496 Bytes frei

C:\Windows\System32\config>tree /F
Auflistung der Ordnerpfade
Volumeseriennummer : 1669-28AE
C:.
│   BBI
│   BCD-Template
│   components
│   default
│   drivers
│   ELAM
│   sam
│   security
│   software
│   system
│   VSMIDK
│
├───Journal
├───RegBack
├───systemprofile
│   └───Contacts
└───TxR


> Appreciate any and all advice

You could try to create a snapshot manually, mount it and check if the 
files in question are actually included. I have no idea which tools were 
available in Windows 7, but in general, once you have a snapshot you can 
identify, a link to its "real" path might be enough:

mklink /d \mount \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2

for example works on this host.

Good luck,

Arno

> Sincerely /Mehrdad
> 
>   --
> ________________________________________________________
> 
> Ampfield Aktiebolag
> Mehrdad Ravanbod
> System administrator
> 
> 
> 
> 
> _______________________________________________
> Bacula-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/bacula-users

-- 
Arno Lehmann

IT-Service Lehmann
Sandstr. 6, 49080 Osnabrück



_______________________________________________
Bacula-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bacula-users