Taking an image of a remote machine (whilst it's running!)

Now, this is damned cool I have to say.

I was tasked with coming up with a way of taking an image of a remote machine.  At first I just suggested they buy Ghost Server or some equivalent but they were reluctant to spend money so I started hunting around the Net for other solutions.  I figured that there MUST be a way of doing it with Volume Shadows and the ImageX tool from Vista/Windows 7.

I eventually stumbled across this 4 year old blog entry

http://blogs.msdn.com/b/adioltean/archive/2006/09/18/761515.aspx#comments

Great!  I can assign drive letters to a Shadow Volume.  That means I can do anything with it that I would normally be able to do on a normal drive.  ImageX proved to be a bit flaky however when trying to back this up.  It kept bombing out at random intervals.  So, a bit more hunting and I found SMARTWIM

http://www.smartdeploy.com/products/downloads.aspx

Essentially, a COM wrapper for ImageX but a lot more stable and performant.

So, now I had a way of creating a Shadow Volume of the C: drive AND taking an image of it.  It was then a simple matter of knocking up a small batch file to lump all this together.

This is the batch file.  It has to copy the required files to the C: drive as I simply could not get it working from a UNC path.  The files required are

DOSDEV.EXE (from the Windows Resource Kit).  This is what allows us to assign drive letters to VSS volumes
VSHADOW.EXE (from the VSS SDK).  http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0b4f56e4-0ccc-4626-826a-ed2c4c95c871
WIMGAPI.DLL (from the WAIK - required by SMARTWIM) http://www.microsoft.com/downloads/en/details.aspx?FamilyID=c7d4bc6d-15f3-4284-9123-679830d629f2&displaylang=en
SmartWIM.dll & SmartWIM.vbs - http://www.smartdeploy.com/products/downloads.aspx
VSS-EXEC.CMD - the batch file executed by VShadow.EXE and contains the commands you want to execute on the VSS volume (see below)

CreateImage.CMD

   
 c:   
 cd \   
 md imagex   
 xcopy \\SERVER\c$\script\imagex\*.* c:\imagex\ /Y   
 cd imagex   
 regsvr32 /s smartwim.dll   
 vshadow.exe -script=vss-setvar.cmd -exec=vss-exec.cmd c:   
 regsvr32 /s /u smartwim.dll   
 cd..   
 rd imagex /S /Q   
 

So, what does this do?  Well, firstly, it copies the files over to a folder on C:  Then, it registers the SmartWIM dll needed by the SmartWIM.vbs. 

Then, the really cool bit ;)

It runs VSHADOW to create a VSS volume.  But, crucially, as it does this it first creates a batch file called vss-setvar.cmd which, if you look at it, creates some environment variables related to the VSS volume just created.  VSHADOW then executes vss.exec-cmd which first runs the vss-setvar.cmd so it can reference the environment variables it created to assign the drive letter (using DOSDEV). 

VSS-EXEC.CMD

   
 call %~dp0\vss-setvar.cmd   
 
 :: Define temporary drive letter   
 dosdev Q: %SHADOW_DEVICE_1%   
 
 :: Try to execute some commands on the snapshot device   
 
 cscript c:\imagex\smartwim.vbs /capture q: w:\C_driveBackup.wim "Drive C"   
 :: Delete temporary drive letter   
 dosdev -r -d q:   
 

Pretty neat huh?  I can now take an image of any remote machine in about 45 minutes and the user is not impacted at all.