DPM agents not functioning on Server 2008 DCs
I recently rebuilt two domain controllers in a remote site to be Windows Server 2008 SP2 64-bit. They were previously running Windows Server 2003 SP2 R2 64-bit and were in DPM 2007 SP1 with no issues. The build for the 2008 installation from bare metal: the old DCs were demoted, kicked out of the domain and then rebuilt as new with 2008.
When trying to install a DPM agent to the new DC installations now, error 337 was received in the DPM console: the agent did install, but the service does not start and the agent is in an error condition in the DPM console. Looking at a relevant DCOM article in TechNet to verify security for error 337 provided no help. Attempting to manually install and register the DPM agents resulted in the same error. Either way, not good…no protection groups can be configured and no backups can occur.
I could find no documentation specific to what might need to be done to get this working.
Here’s the solution as provided by PSS (with minor edits by me):
*** Problem Description ***
In a 2003 domain that is upgraded to a 2008 domain (native mode) DPM agents on the 2008 domain controllers will never communicate to the DPM server. The agent in DPM will show a red x on it. You can remove the agent and then reinstall the agent with the same results.*** Resolution ***
DPM requires access to AD keys that only have the Builtin “Users” with permissions on them. During the upgrade of the domain, it removes the NT Authority “Authenticated Users” group from the Builtin “Users” group and thus breaks the DPM server from getting access to these keys. To fix this problem, add the NT Authority “Authenticated Users” group to the Builtin “Users” group in Active Directory Users and Computers and wait for replication to occur (in the event of DPM in a remote site), refresh the DPM agent information in the DPM console and you should be green and good.
Strange.
Data Protection Manager 2007 error ID 998
I’m currently doing some testing with Exchange Server 2007 and Data Protection Manager 2007 on Hyper-V. As I needed several VMs for the testing, I just installed one and then used NewSID to change the VM SID and name before joining each one to my test domain. Later, upon attempting to configure a new protection group on DPM for one of the Exchange servers I got this error:
The operation failed because of a protection agent failure.
Retry the operation.
ID: 998
Details: Unknown error (0×80042318) (0×80042318)
After checking the usual suspects, including the required VSS patch on the Exchange server to be protected and examining the Event Logs on the Exchange Server I found lots of VSS errors with Event ID 12302 on the Exchange server.
Tt turns out the problem is actually with using NewSID…it doesn’t play well with VSS. The solution’s pretty simple once you find it–here’s one place it resides. The steps are as follows:
- Stop the Microsoft Shadow Copy Provider & Volume Shadow Copy Service.
- Export the contents of the HKLM\Software\Microsoft\EventSystem key to a .reg file (as a backup).
- Delete the HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions key. (Just delete the Subscriptions subkey; leave the EventClasses key.)
- Restart the server.
- Run the “VSSADMIN LIST WRITERS” command, which should procude output similar to that shown below.
This causes the VSS entries in the HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions key to be rebuilt when the writers initialize.
If that does not resolve the problem, check the Sysinternals forum link mentioned above for more steps.
Protecting Exchange with Data Protection Manager 2007
There’s a small (though important) typo in the TechNet article Protected Computer Software Prerequisites in regards to the required steps to protect Exchange Sever 2007 (or Exchange Server 2003) databases.
To properly protect Exchange Server data, you’ll need to have the current version of the eseutil.exe and ese.dll files available to the DPM server. This article proposes to do that via a file system hardlink, although the file paths listed are incorrect. If you go this route (versus manually copying the files into the DPM bin directory), you’ll want to use the correct paths.
Incorrect (as specified in the article):
fsutil hardlink create “c:\program files\microsoft\dpm\bin\eseutil.exe” “c:\program files\microsoft\Exchange\bin\eseutil.exe”
Correct:
fsutil hardlink create “C:\Program Files\Microsoft DPM\DPM\bin\eseutil.exe” “C:\Program Files\Microsoft\Exchange Server\Bin\eseutil.exe”
Oddly enough, the TechNet article does not address the ese.dll file, which is also required. Use this command to hardlink it.
fsutil hardlink create “C:\Program Files\Microsoft DPM\DPM\bin\ese.dll” “C:\Program Files\Microsoft\Exchange Server\Bin\ese.dll”
Data Protection Manager 2007 error ID 31309
To protect a server using Data Protection Manager 2007, you must install two prerequisite software items:
- The DPM agent (see my previous post about the Visual C++ 2008 Redistributable cleanup issue), and
- The VSS hotfix from MS KB 940349
If you attempt to protect data on a server immediately after it reboots following the hotfix installation, you may get an error message with ID 31309 stating that you must install the required prerequisite software…which of course, you’ve already done. Fortunately, the fix to this annoyance is the same as for error ID 31008 as discussed in MS KB 947470. The issue is that the agents don’t update the DPM server immediately. The updates occur approximately every 20 - 30 minutes.
Just complete these steps and you should be on way to protecting that server:
- Start the Data Protection Manager 2007 Administrator Console, and then click the Management tab.
- Click the Agents tab, and then click Refresh information in the Action pane.
- Verify that OK appears in the Agent Status column for each protected server.
- Click the Protection tab, and then follow these steps:
- Create a new protection group, or modify an existing protection group.
- Select a data source.
- Verify that you can add a data source to the protection group successfully.
Data Protection Manager 2007 Management Pack updated
Version 2.0 of the Data Protection Manager 2007 management pack for Operations Manager 2007 was recently released.
This is is not a converted version, so installation is easy. Be sure to remove the previous version if you had it installed.
On the DPM side of things, make sure that you have SP1 or the Feature Pack in KB949779 installed before importing the management pack. As usual, get your management packs in the Catalog.
This management pack offers end-to-end monitoring of both the DPM servers and clients.
Cleanup after DPM 2007 SP1 installation
You might have noticed, if you’ve installed SP1 for Data Protection Manager 2007, that it leaves behind the Visual C++ 2008 Redistributable package contents in your root directory. Tsk, tsk. How did that slip through beta, but yet be specifically called out in the Release Notes?
DPM 2007 SP1 setup leaves Microsoft Visual C++ Redistributable Package installation files in the root directory. You can manually delete the installation files.
Anyhow, here’s a quick and dirty batch (.bat) file that you can run on the local machine to delete the files.
Get it here:
Visual_C_2008_Redist_cleanup.zip (325 bytes, 929 hits)
Data Protection Manager 2007 SP1 turns off Reporting?
Although it’s been reported in the past that you might sometimes see Data Protection Manager 2007’s error 3013 on a Windows Server 2008 system, whereby SQL Reporting Services is not available, it seemed to be rare.
Now it appears that perhaps error 3013 is making a comeback with the installation of DPM 2007 SP1. On a fresh install of Windows Server 2008 x64, DPM 2007 x64 was installed and then SP1 for DPM 2007 x64 was applied. The Reporting feature was verified working before SP1 was installed, but stopped working after SP1 was applied.
The error text:
DPM could not connect to SQL Server Reporting Services server because of IIS connectivity issues.
On the computer on which the DPM database was created, restart the World Wide Web Publishing Service. On the Administrative Tools menu, select Services. Right-click World Wide Web Publishing Service, and then click Start.
ID: 3013
Unfortunately, the guidance given in the error dialog as well in Troubleshooting Reporting Issues page in Technet don’t really accomplish anything. Trust me, I’ve tried. The solution, as others have verified and reported, is almost provided in MSKB 938245…almost, except for one small typo in the instructions and the fact that you really wouldn’t know to get from point A (error 3013 as shown previously) to point B (following the steps in the KB article). Perhaps the DPM team will see to it to have the documentation updated again for Windows Server 2008.
Anyhow, you should be able to get your Reporting functionality working again by completing these steps.
- Close the DPM 2007 Administrator Console.
- Open the Internet Information Services (IIS) Manager, be sure you didn’t accidentally open the Internet Information Services (IIS) 6.0 Manager.
- Expand Web Sites, expand the Default Web Site, and then click the virtual directory for the report server. By default, this would be ReportServer$MS$DPM2007$.
- In the middle pane, while in Features View, double-click Handler Mappings in the IIS section.
- In the right pane, under the Actions section, click Edit Feature Permissions.
- Click to select the Scripts check box, and then click OK.
- Open the DPM 2007 Administrator Console and get some reporting done!
-
Translator
