Secondary Backup Issues

[Ros]

Hello,

I have a fully functioning primary DPM 2007 server. I'm now in the process
of trying to configure a secondary DPM 2007 server which will reside at a
different site and be used to backup the backups on my primary server. I
have come across a couple of issues that I hope someone can help me with.

(1) I have enabled Secondary Protection on all the servers that have the
Protection Agent installed and are being backed up by my primary server. I
am able to add everything from these servers into a Protection Group on the
secondary server except for two DCs. When I try and add items from either of
the two problem DCs I encounter the following error:

'This item cannot be protected because some prerequisite software is
missing. Ensure that all prerequisite software is installed and then protect
this item. (ID: 31008)'

I have four DCs in total in my environment - two in a forest root domain and
two in a child domain. It is one DC in each domain that is seeing the error
- the other DC in each domain is working fine. All four DCs are being backed
up successfully by the primary DPM server so they obviously all have all the
prerequisite software installed.

I have found a few other people with the same issue but can't find a clear
resolution. Both my primary and secondary DPM server have the Feature Pack
(KB949779) installed.

(2) My second issue is that the System State of the primary DPM server
doesn't appear for me to add it into the Protection Group on the secondary
DPM server. Is this by design? I am backing up the DPMDB of the primary
server - is that all I need to do a restore of the primary DPM server in the
event of a disaster?

Thanks in advance for any help,

Ros

[Riaz]

Hi Ros,

I have the exact same situation as you. I have tried numerous suggestions
from this forum and others to no avail. It will be interesting to see what
the final resolution is.

Riaz...

[Madhan S [MSFT]]

Please refer to blog:
http://blogs.technet.com/dpm/archive/2008/07/11/known-issues-and-recommended-solutions-on-secondary-protection-disaster-recovery.aspx
for Secondary DPM related issues.

--
--
Thanks
Madhan S

This posting is provided "AS IS" with no warranties, and confers no rights
"Riaz" <Ri...@discussions.microsoft.com> wrote in message
news:CF35007D-52A8-47D1...@microsoft.com...

[Ros]

Thank you for your response. However all the blog says regarding the issue
I'm encountering is:

'You get prerequisite not installed error while adding datasources for
secondary protection. This might happen if the production server is a domain
controller. Please contact Microsoft support if this is the case.'

Does this mean that you have a fix at Microsoft? If so, why is it not being
made publically available?

Many thanks,

Ros

[Madhan S [MSFT]]

We are considering this fix in SP1. Meanwhile, you can connect to Microsoft
support for a work-around solution.

--
--
Thanks
Madhan S

This posting is provided "AS IS" with no warranties, and confers no rights

"Ros" <R...@discussions.microsoft.com> wrote in message
news:1A583127-70E1-40C1...@microsoft.com...

[Riaz]

Just an Update.

On one protected server, the only difference between it and the other
servers was that the CD drive was shared. So I unshared the CD drive, Logged
into the Protected server and removed the agent using add/remove programs,
and rebooted. Then I copied the agent executables from c:\Program
Files\Microsoft DPM\DPM\Agents\RA\2.0.5820.0\i386 to the protected server and
ran DPMAgentInstaller.exe {primary-dpmserver-name} e.g.
DPMAgentInstaller.exe dpm-server.domain.local

Then on the Secondary DPM server, I went to the DPM managent panel, clicked
on the primary DPM server, disabled and re-enabled protection of the
protected server that was having problems. After I did this I no longer got
the ID 31008 error!

For another server, I ran this recently release Hotfix and this corrected
the other problematic server.

(x86)
http://www.microsoft.com/downloads/details.aspx?FamilyID=f80129c7-1754-4ea0-9cf3-425f87b9ebd1&DisplayLang=en
(x64)
http://www.microsoft.com/downloads/details.aspx?FamilyID=8eefde76-1a94-4096-ba3a-829eb954e422&DisplayLang=en

[Madhan S [MSFT]]

A CD drive shared is a known issue. Thanks for the update.

--
--
Thanks
Madhan S

This posting is provided "AS IS" with no warranties, and confers no rights
"Riaz" <Ri...@discussions.microsoft.com> wrote in message

news:EE714388-E097-4BAB...@microsoft.com...

[Ros]

Hello,

Thank you for the link to the rollup package KB954641 Riaz.

I have installed the KB954641 rollup package on both my primary and
secondary DPM servers and have updated all the Agents on my protected
computers and I can now select items on the two DCs that were having issues
for secondary backup. However, I am now encountering the following error
when the 'Modify Protection Group' wizard tries to calculate the disk space
required:

'DPM cannot browse <production DC FQDN> because access is denied. On the
Agents tab in the Management task area, check the status of the agent. Also,
verify that the system times on the DPM server and the protected computer are
synchronized with the system time on the domain controller. ID:32 Details:
Access is denied (0x80070005)'

I have tried removing and re-enabling secondary protection on the two DCs
but this has not made any difference. The Agents say OK on both my primary
and secondary DPM servers and the system times all seem to be fine too. It's
still just the two original DCs that I was having problems with the are
causing this error - I have successfully managed to add items from another
server for secondary backup.

This error means that I cannot continue with the Modify Protection Group
wizard so I am still not able to perform secondary backups of the two DCs.

I also still can't see 'System State' for my primary DPM server.

Does anyone have any ideas what the problem might be now?

Thanks in advance for any help,

Ros

[Riaz]

Hi Ros,

I also am getting the access denied, ID32 error after installing KB954641!
For the heck of it, I went onto a Production Machine and ran:

"SetDpmServer.exe -dpmservername secondary.domain.local"

My secondary DPM server started working, but then my Primary DPM started
failing. So I ran "SetDpmServer.exe -dpmservername primary.domain.local" then
my Primary DPM started working again, but my Secondary started failing. :(

I was hoping that the setdpmserver utility could allow multiple servers, but
it appears as though it is an either/or situation. Any ideas Madhan? Thanks!

Riaz...

[Ros]

Hello Riaz,

Sorry to hear you're still having issues too. I have submitted an incident
regarding this issue with Microsoft PSS. I will update you here if I get a
resolution.

Kind regards,

Ros

[Madhan S [MSFT]]

You need to do this:

Run "SetDpmServer.exe -dpmservername primary.domain.local" on the production
server
Run "SwitchProtection.ps1" on Secondary DPM server with ProtectionType as
Secondary

The second step above will stop protection for all datasources and put them
into inactive state.

--
--
Thanks
Madhan S

This posting is provided "AS IS" with no warranties, and confers no rights
"Riaz" <Ri...@discussions.microsoft.com> wrote in message

news:0FF625C7-FF8A-4EDD...@microsoft.com...

[Riaz]

Hi Madhan,

Thanks for your help, unfortunately this did not work.

On The Production server, I ran 'SetDpmServer.exe -dpmservername
primary.domain.local'

On Secondary DPM server, I ran: 'Switch-Protection.ps1 -DPMServerName
secondary -PSName server -ProtectionType secondary"

But am still getting the error message. Anything else that you can think of
that I can try? Thanks again for your help!

Riaz...

[Madhan S [MSFT]]

Another way of doing this:
On the Primary DPM server run
Switch-Protection.ps1 -DPMServerName <Primary DPM Server Name> -PSName <PS
Name> -ProtectionType primary

On the Secondary DPM server run
"Switch-Protection.ps1 -DPMServerName <Secondary DPM Server Name> -PSName
<PS Name> -ProtectionType secondary"

If the above doesnt work, try Disable protection for the PS and Enable
protection again (from the Management-->Agents tab on Secondary DPM server)

Please open a support case with Microsoft if none of the above works.

--
--
Thanks
Madhan S

This posting is provided "AS IS" with no warranties, and confers no rights
"Riaz" <Ri...@discussions.microsoft.com> wrote in message

news:A97367E9-A30D-4182...@microsoft.com...

[Riaz]

Hi Madhan,

Thanks for your suggestions, but unfortunately they did not work.
I will open a case with MS support. Thanks.

Riaz..

[Riaz]

Hi Guys,

I opened up a case with MS support and got this resolved. We had to
basically re-apply the permissions for 2 DPM related security groups.

The trick was to run the SetAgentCfg.exe utility.
The Parameters were:

SetAgentCfg.exe a dpmra {domain}\{secondary-dpm-sever}
DPMRADCOMTrustedMachines DPMRADmTrustedMachines

On the non working production server, I mapped a drive to the secondary DPM
server, e.g Z: or X:, then on the non working production server, I ran:
Z:\Program Files\Microsoft DPM\DPM\Setup>SetAgentCfg.exe a dpmra
domain.local\secondary-server.domain.local DPMRADCOMTrustedMachines
DPMRADmTrustedMachines

Then I restarted the DPMRA service on the Protected Server and tried to add
the protected server to the secondary server and Voila! It worked. Hope this
helps you.

Riaz...