Share via

Event ID 244 — System State Recovery

  • Article

Applies To: Windows Server 2008 R2

You can use the wbadmin start systemstaterecovery command to recover the system state for a computer.

Event Details

Product: Windows Operating System
ID: 244
Source: Microsoft-Windows-Backup
Version: 6.1
Symbolic Name: SYSTEM_STATE_RESTORE_GENERIC_FAILURE_EVENT
Message: System State Restore started at '%1' failed with errors. Log of files successfully restored '%15'. Log of files not restored successfully '%16'

Resolve

Review event details for solutions for failed recovery

If the system state recovery fails, review the details for the applicable events to find out why the recovery operation failed. Then re-run the recovery.

To do this, follow these general steps:

  1. Find the applicable events in Event Viewer, and then review the details for those events to find out why the recovery operation failed. For more information, see "Review event details in Event Viewer."
  2. Confirm that the location to perform the recovery to is online.
  3. After resolving any errors that you find in performing the steps above, re-run another application recovery. Fore more information, see "Recover the system state using the command line."

To perform these procedures, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority.

Review event details in Event Viewer

To review event details for an application recovery in Event Viewer:

  1. Open Event Viewer. Click Start, click Administrative Tools, and then click Event Viewer.
  2. In the left pane, double-click Applications and Service Logs, double-click Microsoft, double-click Windows, double-click Backup, and then click Operational.
  3. In the right pane, click the Details tab, and then click XML View.
  4. Click an event in the list.
  5. Review <Data Name="WritersInfo"> to see the error code (XML Node: HResult) and detailed error code (XML Node: DetailedHResult), along with other details about the application component whose recovery failed. If HRest corresponds to a Volume Shadow Copy Service (VSS) error, then review the VSS event logs to find more information on the error and how to resolve it.
  6. Review <Data Name="RestoreSuccessLogPath">. If NoOfFilesFailed is greater than zero (>0), then review the failed file log list referred to in the event details to determine what files failed with what system errors.
  7. Review error messages for the error codes, as described in "Review error messages in the Windows Server Backup snap-in."

Recover the system state using the command line

Note: If you are using BitLocker Drive Encryption to protect your server and you need to perform a system state recovery, make sure to reapply BitLocker Drive Encryption. This will not happen automatically—it must be enabled explicitly. For instructions, see the Windows BitLocker Drive Encryption Step-by-Step Guide (https://go.microsoft.com/fwlink/?LinkId=93107).

To recover the system state by using the command line:

  1. Open a command prompt with elevated privileges. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2. At the prompt, type: wbadmin start systemstaterecovery. Use parameters, as needed. (To view the parameters and help for this command, at a command line, type: wbadmin start backup /?).

    For example, to run a system state recovery of the backup from 04/30/2005 at 9:00 A.M. that is stored on the shared resource \\servername\share for server01, type: wbadmin start systemstaterecovery -version:04/30/2005-09:00 -backupTarget:\\servername\share -machine:server01.

Verify

To verify that a system state recovery was successful, after you perform the recovery, look for Event ID 242, which indicates that the recovery completed without errors.

To perform this procedure, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority.

To verify that a system state recovery was successful:

  1. Open Event Viewer. Click Start, click Administrative Tools, and then click Event Viewer.
  2. In the left pane, double-click Applications and Service Logs, double-click Microsoft, double-click Windows, double-click Backup, and then click Operational.
  3. In the Event ID column, look for event 242.
  4. For this event, confirm that the the value in the Source column is Backup.

System State Recovery

File Services