How shares and share permissions may be restored for a data drive or individual folder

Problem

How shares and share permissions may be restored for a data drive or individual folder in Veritas System Recovery or Backup Exec System Recovery.

Cause

In NTFS, user defined shares of volumes and folders are not held on the actual volume or folder itself.  Shares and their permissions are kept in the computer's registry at the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares

If a share is deleted from the computer prior to when a restore of a data volume or individual folder is performed, the share is not recreated on the restored data volume or folder because the registry value was not also restored to a time when the share existed.

Solution

If a share is still defined in the registry which applies to the data volume or folder being restored, the share will automatically be applied to the restored data.  After the restore completes, reboot the computer.  When the computer boots back up, the share will be back in place with no further user intervention required.

Shares are also put back into place when performing a full system restore since a full system restore will restore the registry back to the way it was at the time of the backup.  If a share is deleted from the registry and it a full system restore is not possible, individual share information may be manually recreated on the data volume or individual folder which was restored.  In addition, it is possible to extract the registry key from a restored copy of the registry by taking the following steps:

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

1.  Restore the SYSTEM hive of the registry from a backup to a temporary location.  By default this will be the file called SYSTEM located in c:\windows\system32\config\.  Make sure to restore the SYSTEM file to a temporary location and not the original location as that would overwrite the working copy of the registry.

2.  Run REGEDIT by going to Start > Run.  Type REGEDIT and click OK

3.  Highlight the HKEY_LOCAL_MACHINE portion of the registry by clicking on it once

4.  Go to the File menu and select "Load Hive..."

5.  Browse to the temporary location that the backup copy of the SYSTEM file was stored and select . Select the SYSTEM file and click Open

6.  There will be a prompt for a key name.  Provide a unique temporary name such as TEMP_RESTORE

7.  Browse to the following location in the registry (assuming the key name given was TEMP_RESTORE:
HKEY_LOCAL_MACHINE\TEMP_RESTORE\ControlSet001\Services\lanmanserver\. 

8.  Select the Shares registry key under lanmanserver by clicking on it once.  Then, right-click on Shares and select Export.  Specify a unique file name such as RESTORE_SHARES.reg, browse to a location to place the file, and click Save.  The .reg file may be saved anywhere on the computer.

9. Right click the expanded selection on 'Shares' and select 'Export' and save the export to a suitable location and file name.

10. Browse back up in the registry and select the TEMP_RESTORE key by clicking on it once.

11.  Go to the File menu and select "Unload Hive..."

12.  Close REGEDIT

At this point, edit the RESTORE_SHARES.REG file in a plain text editor like Notepad.  Within the file, make the following changes:

a.  Change the line that reads:

[HKEY_LOCAL_MACHINE\TEMP_RESTORE\ControlSet001\Services\lanmanserver\Shares]

to read:

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\Shares]

b.  Change the line that reads:

[HKEY_LOCAL_MACHINE\TEMP_RESTORE\ControlSet001\Services\lanmanserver\Shares\Security]

to read:

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\Shares\Security]

Save and close the RESTORE_SHARES.REG file from the text editor.  Then, double-click the RESTORE_SHARES.REG file.  Click "Yes" on the prompt confirming the addition to the registry.  Then, click OK on the confirmation screen.  This will add the missing share definitions back to the current registry.