Category Archives: SCDPM

SCDPM in a tiered infrastructure

November 28, 2016 Kirill Nikolaev Leave a comment

When a company has a secure infrastructure, usually there are several tiers of resources managed by different administrators (or, at least, by same administrators but using different user accounts). For example, one may separate sensitive servers, like PKI Certification Authorities, Hyper-V hosts or file servers containing PII, and mark them as Tier 1 servers, while marking all other servers as Tier 2. Then he sets up permissions in a way that each tier has its own local administrators, and you may even forbid cross-tier logon completely (except network logon – network logon is useful and doesn’t pose a security threat).

In the ideal world you would have separate management solutions for each tier. But we all live in real world and, sometimes, it is impossible to find additional resources to support your infrastructure. In that case, it is more appropriate to designate your management servers, including backup ones, as Tier 1 – this way more secure servers will be able to access resources residing on less secure servers but not vice versa.

What does this mean for SCDPM? DPM wasn’t designed to backup resources from another security tier, but we can bent it to our will.
After you install an SCDPM agent on a server in Tier 2, then you must attach it to an SCDPM server in Tier 1. At this step, a user, which you are using to attach the agent, must be a local administrator at both the server and the client. Considering our tiered infrastructure, this is impossible, as one user cannot be a member of local administrators on machines from different tiers.
Fear not! We shall grant required permissions granularly in two steps:

Step 1

Basically we need to allow following permissions for Tier 1 admin at Tier 2 server’s WMI root and propagate them through the tree:

Enable
MethodExecute
RemoteAccess
ReadSecurity

You may choose to assign these permissions either via GUI, using wmimgmt.msc, or using PowerShell.
For PowerShell way you may use this fixed version of Set-WmiNamespaceSecurity.ps1 script. Original, written by Steeve Lee, suffers from a bug which does not allow to set inheritance flag and throws an error: “Invoke-WmiMethod : Invalid parameter”.
Run PowerShell script at the Tier 2 client as follows:
Set-WmiNamespaceSecurity.ps1 -namespace 'root' -operation 'add' -account 'EXAMPLE\tier1-admin' -permissions 'Enable','MethodExecute','RemoteAccess','ReadSecurity' -allowInherit $true

If you are going to set permissions with a GUI, here’s how it should looks like:

Step 2

This is counter-intuitive one: As we know, SCDPM server requests the time zone from an agent and saves it in the database. Sometimes, somehow, step 1 is not enough for remote non-admin user to request computer’s time zone. As a workaround, execute following WMI query at an SCDPM client: select * from Win32_TimeZone. After that, remote non-admin user will be able to request TimeZone instances for some time.
To utilize PowerShell for the task, execute this: Get-WmiObject -Query 'select * from Win32_TimeZone'

After these two steps, you should be able to add Tier 2 agent under protection of Tier 1 SCDPM server. When you have finished, you may safely remove those permissions by running the following command:
Set-WmiNamespaceSecurity.ps1 -namespace root -operation delete -account 'EXAMPLE\tier1-admin'

PowerShell, SCDPM

How to simplify SCDPM servers maintenance

August 14, 2015 Kirill Nikolaev 2 Comments

Every DPM administrator, ever tried to perform a regular maintenance onto a set of SCDPM servers (monthly updates, for example), knows that the only one way to do it correctly, i.e. without interruption of backup jobs, is to gracefully shutdown the server. To achieve this, you need to disable active SCDPM agents, connected to this server, and wait till every running job will be completed.

The only problem is — there is no quick way to get a list of every computer with an active agent connected to a SCDPM server. One may say, I’m wrong here and there IS a quick way — just use Get-DPMProductionServer cmdlet with “ServerProtectionState -eq ‘HasDatasourcesProtected'” filter. But you forgot about cluster nodes: If we protect clustered resource, but not cluster nodes themselves, we will not see them in an output of Get-DPMProductionServer (with abovementioned filter applied, of course). In addition, the output will contain clustered resources, which are useless in our task to stop every active protection agent.

That’s why I want to present you with a solution to quickly get a list of only real computers with an active SCDPM-agent installed. Just pass names of your SCDPM-servers to it (or don’t pass anything for localhost) and you’ll receive a collection of ProtectedServers in response. You may then pass that collection directly to Enable/Disable-DPMProductionServer cmdlets.

<# MIT License
 
Copyright (c) 2015 Kirill Nikolaev
 
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
 
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
 
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE. #>

<#
.SYNOPSIS
Returns active protected agents connected to an SCDPM server.

.DESCRIPTION
Returns every computer with installed SCDPM agent, connected to the chosen SCDPM server and having protected any datasource at this SCDPM server.

.PARAMETER DPMServerName
A single name (FQDN ot NetBIOS) of an SCDPM server or a collection of such.

.EXAMPLE
C:\PS> .\Get-DPMProtectedAgents.ps1 -DPMServerName bckpsrv1.example.com
WARNING: Connecting to DPM server: bckpsrv1.example.com

.EXAMPLE
C:\PS> 'bckpsrv1.example.com','bckpsrv2.example.com' | .\Get-DPMProtectedAgents.ps1
WARNING: Connecting to DPM server: bckpsrv1.example.com

ServerName                                      ClusterName                                     Domain                                          ServerProtectionState
----------                                      -----------                                     ------                                          ---------------------
SRV1                                                                                            example.net                                     HasDatasourcesProtected
SRV2                                            CL1.example.com                                 example.com                                     HasDatasourcesProtected
WARNING: Connecting to DPM server: bckpsrv2.example.com
SRV3                                                                                            example.net                                     HasDatasourcesProtected
SRV4                                            CL2.example.com                                 example.com                                     HasDatasourcesProtected
SRV5                                            CL2.example.com                                 example.com                                     HasDatasourcesProtected

.EXAMPLE
C:\PS> .\Get-DPMProtectedAgents.ps1 | %{ Disable-DPMProductionServer $_ -Confirm:$false }
C:\PS>

.INPUTS
System.String[]. An array of names of SCDPM servers.

.OUTPUTS
System.Object[]. A collection of Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.ProductionServer
#>

[CmdletBinding()]
[OutputType([System.Object[]])]
Param(
	[Parameter(Mandatory=$false,
	ValueFromPipeline=$true)]
	[string[]]$DPMServerName = 'localhost' #We need something in $DPMServerName for the cycle to work.
)

PROCESS {
    foreach ($Name in $DPMServerName) {
        Disconnect-DPMServer
        if ($Name -eq '' -or $Name -eq 'localhost') {
	        $ProductionServers = Get-DPMProductionServer #Execution of DPM cmdlets with given server name doesn't work in PSSessions. So, we have to use two branches of code here.
        }
        else {
	        $ProductionServers = Get-DPMProductionServer -DPMServerName $Name
        }

$ProtectedServers = $ProductionServers | where {$_.ServerProtectionState -eq 'HasDatasourcesProtected'}
        Write-Debug "ProtectedServers at $Name"
        if ($ProtectedServers) {
            Write-Debug ([string]$ProtectedServers)
        }
        else {
            Write-Debug 'No ProtectedServers found'
        }

$ProtectedServersStandAlone = $ProtectedServers | where {$_.ClusterName -eq ''}
        Write-Debug "ProtectedServersStandAlone at $Name"
        if ($ProtectedServersStandAlone) {
            Write-Debug ([string]$ProtectedServersStandAlone)
        }
        else {
            Write-Debug 'No ProtectedServersStandAlone found'
        }

$ProtectedServersClustered = $ProtectedServers | where {$_.ClusterName -ne ''} #Need to split clustered resources and cluster nodes from stand-alone servers, because if we don't protect cluster node itself, it will not shows up in $ProtectedServers and we'll find it through properties of the clustered resource.
        Write-Debug "ProtectedServersClustered at $Name"
        if ($ProtectedServersClustered) {
            Write-Debug ([string]$ProtectedServersClustered)
        }
        else {
            Write-Debug 'No ProtectedServersClustered found'
        }

$ClusteredResouces = $ProtectedServersClustered | where {$_.PossibleOwners} #Select only clustered resources, not nodes itself.
        Write-Debug "ClusteredResouces at $Name"
        if ($ClusteredResouces) {
            Write-Debug ([string]$ClusteredResouces)
        }
        else {
            Write-Debug 'No ClusteredResouces found'
        }

$ClusterNodesDNSNames = @()
        $ClusteredResouces | %{$ClusterNodesDNSNames += $_.PossibleOwners}
        Write-Debug "ClusterNodesDNSNames at $Name"
        if ($ClusterNodesDNSNames) {
            Write-Debug ([string]$ClusterNodesDNSNames)
        }
        else {
            Write-Debug 'No ClusterNodesDNSNames found'
        }

$ClusterNodesDNSNames = $ClusterNodesDNSNames | Select-Object -Unique
        Write-Debug "Unique ClusterNodesDNSNames at $Name"
        if ($ClusterNodesDNSNames) {
            Write-Debug ([string]$ClusterNodesDNSNames)
        }
        else {
            Write-Debug 'No ClusterNodesDNSNames found'
        }

$ClusterNodesNames = @()
        $ClusterNodesDNSNames | %{$_ -match '(.+?)\..+' | Out-Null; $ClusterNodesNames += $Matches[1]} #Extract hostnames from DNS names to pass them to SCDPM cmdlets.
        Write-Debug "ClusterNodesNames at $Name"
        if ($ClusterNodesNames) {
            Write-Debug ([string]$ClusterNodesNames)
        }
        else {
            Write-Debug 'No ClusterNodesNames found'
        }

$ClusterNodes = @()
        $ClusterNodes += $ProtectedServersClustered | where {$_ -notin $ClusteredResouces} #Select only clustered nodes.
        foreach ($NodeName in $ClusterNodesNames) {
	        $ClusterNodes += $ProductionServers | where {$_.ServerName -eq $NodeName}
        }
        Write-Debug "ClusterNodes at $Name"
        if ($ClusterNodes) {
            Write-Debug ([string]$ClusterNodes)
        }
        else {
            Write-Debug 'No ClusterNodes found'
        }

$ProtectedAgents = $ProtectedServersStandAlone + $ClusterNodes | Select-Object -Unique
        Write-Debug "ProtectedAgents at $Name"
        if ($ProtectedAgents) {
            Write-Debug ([string]$ProtectedAgents)
        }
        else {
            Write-Debug 'No ProtectedAgents found'
        }

Write-Output $ProtectedAgents
    }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

<# MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy

of this software and associated documentation files (the "Software"), to deal

in the Software without restriction, including without limitation the rights

to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

copies of the Software, and to permit persons to whom the Software is

furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

SOFTWARE. #>

.SYNOPSIS

Returns active protected agents connected to an SCDPM server.

.DESCRIPTION

Returns every computer with installed SCDPM agent, connected to the chosen SCDPM server and having protected any datasource at this SCDPM server.

.PARAMETER DPMServerName

A single name (FQDN ot NetBIOS) of an SCDPM server or a collection of such.

.EXAMPLE

C:\PS> .\Get-DPMProtectedAgents.ps1 -DPMServerName bckpsrv1.example.com

WARNING: Connecting to DPM server: bckpsrv1.example.com

ServerName ClusterName Domain ServerProtectionState

---------- ----------- ------ ---------------------

SRV1 example.net HasDatasourcesProtected

SRV2 CL1.example.com example.com HasDatasourcesProtected

.EXAMPLE

C:\PS> 'bckpsrv1.example.com','bckpsrv2.example.com' | .\Get-DPMProtectedAgents.ps1

WARNING: Connecting to DPM server: bckpsrv1.example.com

ServerName ClusterName Domain ServerProtectionState

---------- ----------- ------ ---------------------

SRV1 example.net HasDatasourcesProtected

SRV2 CL1.example.com example.com HasDatasourcesProtected

WARNING: Connecting to DPM server: bckpsrv2.example.com

SRV3 example.net HasDatasourcesProtected

SRV4 CL2.example.com example.com HasDatasourcesProtected

SRV5 CL2.example.com example.com HasDatasourcesProtected

.EXAMPLE

C:\PS> .\Get-DPMProtectedAgents.ps1 | %{ Disable-DPMProductionServer $_ -Confirm:$false }

C:\PS>

.INPUTS

System.String[]. An array of names of SCDPM servers.

.OUTPUTS

System.Object[]. A collection of Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.ProductionServer

[CmdletBinding()]

[OutputType([System.Object[]])]

Param(

[Parameter(Mandatory=$false,

ValueFromPipeline=$true)]

[string[]]$DPMServerName = 'localhost' #We need something in $DPMServerName for the cycle to work.

)

PROCESS {

foreach ($Name in $DPMServerName) {

Disconnect-DPMServer

if ($Name -eq '' -or $Name -eq 'localhost') {

$ProductionServers = Get-DPMProductionServer #Execution of DPM cmdlets with given server name doesn't work in PSSessions. So, we have to use two branches of code here.

}

else {

$ProductionServers = Get-DPMProductionServer -DPMServerName $Name

}

$ProtectedServers = $ProductionServers | where {$_.ServerProtectionState -eq 'HasDatasourcesProtected'}

Write-Debug "ProtectedServers at $Name"

if ($ProtectedServers) {

Write-Debug ([string]$ProtectedServers)

}

else {

Write-Debug 'No ProtectedServers found'

}

$ProtectedServersStandAlone = $ProtectedServers | where {$_.ClusterName -eq ''}

Write-Debug "ProtectedServersStandAlone at $Name"

if ($ProtectedServersStandAlone) {

Write-Debug ([string]$ProtectedServersStandAlone)

}

else {

Write-Debug 'No ProtectedServersStandAlone found'

}

Write-Debug "ProtectedServersClustered at $Name"

if ($ProtectedServersClustered) {

Write-Debug ([string]$ProtectedServersClustered)

}

else {

Write-Debug 'No ProtectedServersClustered found'

}

$ClusteredResouces = $ProtectedServersClustered | where {$_.PossibleOwners} #Select only clustered resources, not nodes itself.

Write-Debug "ClusteredResouces at $Name"

if ($ClusteredResouces) {

Write-Debug ([string]$ClusteredResouces)

}

else {

Write-Debug 'No ClusteredResouces found'

}

$ClusterNodesDNSNames = @()

$ClusteredResouces | %{$ClusterNodesDNSNames += $_.PossibleOwners}

Write-Debug "ClusterNodesDNSNames at $Name"

if ($ClusterNodesDNSNames) {

Write-Debug ([string]$ClusterNodesDNSNames)

}

else {

Write-Debug 'No ClusterNodesDNSNames found'

}

$ClusterNodesDNSNames = $ClusterNodesDNSNames | Select-Object -Unique

Write-Debug "Unique ClusterNodesDNSNames at $Name"

if ($ClusterNodesDNSNames) {

Write-Debug ([string]$ClusterNodesDNSNames)

}

else {

Write-Debug 'No ClusterNodesDNSNames found'

}

$ClusterNodesNames = @()

$ClusterNodesDNSNames | %{$_ -match '(.+?)\..+' | Out-Null; $ClusterNodesNames += $Matches[1]} #Extract hostnames from DNS names to pass them to SCDPM cmdlets.

Write-Debug "ClusterNodesNames at $Name"

if ($ClusterNodesNames) {

Write-Debug ([string]$ClusterNodesNames)

}

else {

Write-Debug 'No ClusterNodesNames found'

}

$ClusterNodes = @()

$ClusterNodes += $ProtectedServersClustered | where {$_ -notin $ClusteredResouces} #Select only clustered nodes.

foreach ($NodeName in $ClusterNodesNames) {

$ClusterNodes += $ProductionServers | where {$_.ServerName -eq $NodeName}

}

Write-Debug "ClusterNodes at $Name"

if ($ClusterNodes) {

Write-Debug ([string]$ClusterNodes)

}

else {

Write-Debug 'No ClusterNodes found'

}

$ProtectedAgents = $ProtectedServersStandAlone + $ClusterNodes | Select-Object -Unique

Write-Debug "ProtectedAgents at $Name"

if ($ProtectedAgents) {

Write-Debug ([string]$ProtectedAgents)

}

else {

Write-Debug 'No ProtectedAgents found'

}

Write-Output $ProtectedAgents

}

Exchange Server 2010, SCDPM

SCDPM: Fail to Modify Disk Allocation after Exchange DAG Switched

August 18, 2014 Kirill Nikolaev Leave a comment

Symptoms:

Suppose, you have an Exchange 2010 installation with one or more Database Availability Groups with 2 or more servers in each DAG. You setup backup for one of these DAGs using DPM 2010 UR? or newer (incl. 2012 R2 UR2). Later you change active status for protected copy of mailbox database (for example, you switch active copy to another mailbox server). After that, for database copies which status has changed, you’ll receive following error at Review Disk Allocation page at New/Modify protection group master at DPM console:
"The operation failed because the data source VSS component {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7} is missing. Check to see that the protected data source is installed properly and the VSS writer service is running.

ID: 915
Details: The operation completed successfully (0x0)”

If you’ll try to add such DB to secondary DPM server, you’ll receive same error at a disk size calculation step.

This problem is known by Microsoft and will not be fixed.

Why does this happen?

DPM stores information about protected resources into tbl_IM_DataSource and tbl_IM_ProtectedObject tables in DPMDB. If you look into ApplicationPath, LogicalPath or PhysicalPath cells, you find an XML-document describing protected resource. Here is one for Exchange mailbox database in DAG:

<?xml version="1.0" encoding="utf-16"?>

</InquiryPathEntryType>

</InquiryPathEntryType>

</ArrayOfInquiryPathEntryType>

DAGNODE2.example.com – DAG-node from which database is protected.
MAILDB01 – name of protected DB
Microsoft Exchange Server\Microsoft Information Store\Replica\DAGNODE2 – path to a copy of protected DB at a DAG node which we are protect. Mind “Replica” element of the path – it means we protect passive (not active) copy of DB. In case of active copy, this part of path won’t exist.

When you change status of mailbox database in DAG, the actual LogicalPath changes, but DPM knows nothing about it and keeps an inconsistent data in DPMDB.

Resolution:

There are two workarounds (choose which suits you best):

At DPM side:

Stop protection of problematic DB with retaining its data.
Add the DB back into an appropriate protection group. DPM will update tbl_IM_DataSource and tbl_IM_ProtectedObject tables.
When consistency check completes, you’ll be able to manage allocated disk space for this DB and setup secondary protection for it.

At Exchange side:

Restore active state for problematic DB as it was when you added it into DPM:
1. If the DB was in an active state – make it active again.
2. If the DB was in a passive state – make it passive.

If you require so, you can reinstate DB’s state after modifying disk allocation / setup secondary protection – it doesn’t interfere with synchronization / recovery points creation – it just makes impossible to calculate size of a DB.

SCDPM

Moved protected server between primary DPM servers – cannot add secondary protection

March 2, 2014 Kirill Nikolaev Leave a comment

SYMPTOMS:

You have one secondary DPM-server (DPM3) and 2 primary connected to it (DPM1 and DPM2). You have a server (PS1) protected by DPM1 and DPM3. You decide to move protection of PS1 from DPM1 to DPM2. You stop protection of PS1 at DPM1 and DPM3. You connect PS1 to DPM2. You wait until first replica is created, then you try to add PS1 back to DPM3 but from DPM2 this time.

In that case you cannot see PS1 at DPM3 in the list of data sources protected by DPM2.

CAUSE:

This happens because each protected server has a single record in a table of protected servers at DPM configuration database. One of the attributes of this record is an ID of DPM server protecting that data source. Since secondary DPM knows nothing about you moving data sources between primary servers, it doesn’t update that record with an ID of a new primary DPM server.

RESOLUTION:

You can fix this by manually updating DPMServerId attribute of migrated protected server with an ID of new primary DPM server.

WARNING! This scenario IS NOT supported by Microsoft. Use instructions below at one’s own risk, except and only when you are specifically instructed by Microsoft technical support specialist to do this.

Be sure to backup your DPMDB database before run any T-SQL command!

Connect to DPMDB of your secondary server (You can find more about it here).
Get a list of DPM-servers and their IDs:
SELECT ServerId, ServerName, DPMServerId FROM [dbo].[tbl_AM_Server] WHERE IsDPM = 1
Write down IDs of DPM1 (<OLD-ID>) and DPM2 (<NEW-ID>).
Determine which primary DPM-server protects PS1 according to the knowledge of DPM3:
SELECT DPMServerId FROM [dbo].[tbl_AM_Server] WHERE ServerName = '<Protected Server's FQDN>'
Make sure it equals <OLD-ID>, otherwise this instruction is not for you — contact Microsoft Support instead.
Update protected server record with ID of new primary server:
UPDATE [dbo].[tbl_AM_Server] SET DPMServerId = '<NEW-ID>' WHERE ServerName = '<Protected Server's FQDN>'
Run new/modify protection group master and press “Clear cache” button.
You are now able to protect moved resource at secondary DPM again.
Never ever move protected servers between primary DPMs connected to the same secondary server, since it is NOT supported by Microsoft.

SIMILAR ISSUES:

SCDPM

How to connect to DPM SQL database (DPMDB)

February 26, 2014 Kirill Nikolaev 1 Comment

Connection parameters for System Center Data Protection Manager configuration database are located into registry key HKLM\SOFTWARE\Microsoft\Microsoft Data Protection Manager\DB on the computer where DPM server is installed. You can quickly determine essential parameters by running following PowerShell commands:

SQL server name:
(Get-ItemProperty 'HKLM:SOFTWARE\Microsoft\Microsoft Data Protection Manager\DB').SqlServer
>DPMSRV

Database name:
(Get-ItemProperty 'HKLM:SOFTWARE\Microsoft\Microsoft Data Protection Manager\DB').DatabaseName
>DPMDB_DPMSRV

SQL server instance:
(Get-ItemProperty 'HKLM:SOFTWARE\Microsoft\Microsoft Data Protection Manager\DB').InstanceName
>MSSQLSERVER

Use SQL Server Management Studio to connect to DPM database using values from above. If SQL server instance name is “MSSQLSERVER”, you should omit it while connecting to SQL server.
Only local administrators group is alowed to access DPMDB by default. If you run SSMS on a DPM server locally, don’t forget to run it as administrator.