System Center Data Protection Manager 2007 Frequently Asked Questions Microsoft Corporation Published: January 2008 Abstract This content includes answers to frequently asked questions about Data Protection Manager 2007.
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Contents Data Protection Manager 2007 Frequently Asked Questions... 7 Getting Started... 7 What is Data Protection Manager?... 7 What's new in DPM 2007?... 7 Changes from DPM 2006... 8 What languages does DPM 2007 support?... 8 Does DPM 2007 support a tape-based backup and archive solution?... 9 Does DPM support protection across forests?... 9 What Exchange Server configurations does DPM 2007 support?... 9 What permissions are required to access DPM Administrator Console?... 9 Does DPM 2007 provide Windows PowerShell Integration?... 9 Can I manage my DPM servers remotely?... 10 How do I determine how many DPM servers my organization will require?... 10 How many snapshots can a DPM server retain?... 10 Upgrading to DPM 2007 RTM... 10 Can I upgrade from a pre-release version of DPM 2007 to DPM 2007 RTM?... 10 Can I install DPM 2007 over an existing version of DPM?... 10 DPM 2007 Licensing... 11 What types of licensing does DPM have?... 11 What license types do I need for the data that DPM protects?... 11 Where can I purchase additional DPM 2007 licenses?... 12 Installation and Setup... 12 What are the system requirements for running DPM 2007?... 12 Security Requirements... 12 Network Requirements... 12 DPM Server Hardware Requirements... 12 DPM Server Requirements... 13 Protected Computer Requirements... 14 What prerequisite software does DPM 2007 install?... 17 What DPM prerequisite software do I need to install?... 18 Can I install prerequisite software manually?... 19 Can DPM 2007 be installed from a network share?... 19 DPM Management Pack... 19 Is there a DPM Management Pack included with DPM 2007?... 19 What is the DPM Management Pack?... 20 Protection Agent Deployment... 20 Can I deploy protection agents and protect data across domains?... 20 Can I deploy protection agents and protect data on a virtual private network (VPN)?... 20 Can I deploy protection agents and protect data on a WAN?... 20
How do I install protection agents on servers behind a firewall?... 21 Data Protection and Recovery... 22 What data types does DPM 2007 protect?... 22 How much data can I protect with DPM 2007?... 23 Can DPM 2007 protect a Web server?... 24 Does DPM 2007 support protection for the Windows Server 2008 operating system?... 24 What is the difference between a replica and a recovery point, and how are they used in data protection and recovery?... 25 What is express full backup technology?... 25 Why does DPM dismount an entire Exchange Server storage group for database recovery while NTBackup does not?... 25 Why does my tape backup size increase after choosing to compress data for the protection group?... 25 Why are recovery point times on the Browse tab different from times on the Search tab for Windows SharePoint Services data?... 26 Clustered Resources... 26 Does DPM 2007 protect clustered servers?... 26 How do I install a protection agent on a clustered server?... 26 How do I protect data sources on a clustered server?... 27 Reports and Notifications... 28 Does DPM 2007 provide reporting functionality?... 28 Can I monitor and analyze data protection trends?... 28 Tape Libraries... 28 What tape libraries does DPM 2007 support?... 28 What do I do if my tape library does not appear in the DPM 2007 Library Management task area?... 29 What do I do if my tape library drives appear as standalone drives instead of appearing under the tape library in the Library Management task area?... 30 What do I do if the physical state of my tape drives do not display correctly in DPM Administrator Console?... 30 End-User Recovery... 30 What is end-user recovery?... 30 What permissions do desktop users need to access earlier versions?... 30 Does end-user recovery work across firewalls?... 31 Storage Pool Configuration... 31 What types of storage can I use with DPM 2007?... 31 What is a custom volume?... 31 When should I use custom volumes?... 31 Can I use mapped network drives?... 31 Disaster Recovery... 31 Can a DPM server back up other DPM servers?... 31 Can you use a DPM server to protect its databases?... 32 Can DPM 2007 protect system state?... 32
What system state components does DPM protect?... 32 Can DPM 2007 support Bare Metal Recovery?... 33 What operating systems support the DPM System Recovery Tool?... 33
Data Protection Manager 2007 Frequently Asked Questions Find answers to frequently asked questions about Microsoft System Center Data Protection Manager (DPM) 2007. Getting Started Upgrading to DPM 2007 DPM 2007 Licensing Installation and Setup DPM Management Pack Protection Agent Deployment Data Protection and Recovery Clustered Resources Reports and Notifications Tape Libraries End-User Recovery Storage Pool Configuration Disaster Recovery Getting Started What is Data Protection Manager? Microsoft System Center Data Protection Manager (DPM) 2007 is a key member of the Microsoft System Center family of management products, designed to help IT professionals manage their Windows environment. DPM is the new standard for Windows backup and recovery delivering seamless data protection for Microsoft application and file servers by using integrated disk and tape media. DPM performs replication, synchronization, and recovery point creation to provide reliable protection and rapid recovery of data for both system administrators and end-users. What's new in DPM 2007? DPM 2007 is a generation ahead of Data Protection Manager 2006. DPM is the new standard in application-integrated continuous data protection. DPM provides unmatched application backup functionality and reliable zero data loss application recovery. Additional features in DPM include: Tape-based backup and archive solutions Protection of: 7
Exchange Server 2003 SP2 and Exchange Server 2007 Microsoft SQL Server 2000 SP4, SQL Server 2005 SP1, or SQL Server 2005 SP2 Windows SharePoint Services (WSS) 3.0 and Microsoft Office SharePoint Server 2007 Microsoft Virtual Server 2005 R2 SP1 and its virtual machines Windows Server 2008 operating system (pre-release version) Files on workstations and laptops running Windows XP Professional SP2 and all Windows Vista Editions except the Home Edition. DPM requires that the workstations and laptops that it protects be Active Directory members. Therefore, they must remain connected to the corporate local area network (LAN) at all times using reliable and consistent networks. Files and application data on clustered servers System state for protected file and application servers Tape data encryption Network bandwidth usage throttling configured for protected computers Zero data loss restoration for application data Support for 64-bit protection Protection for SIS-enabled servers Protection across domains Disaster recovery (including DPM protecting a DPM server) DPM Management Shell Changes from DPM 2006 Synchronization frequency has increased from hourly to every 15 minutes. You must be a member of the Administrators group to access DPM Administrator Console. If you are a member of a group other than the Administrators group, such as Backup Operator, you will not have access to DPM Administrator Console. DPM 2007 cannot protect file servers running Windows Server 2000. DPM 2007 supports Redundant Array of Independent Drives (RAID) using the new custom volumes feature. What languages does DPM 2007 support? In addition to English, DPM 2007 has implemented Chinese Simplified, Chinese Traditional, French, German, Italian, Japanese, Korean, and Spanish. 8
Does DPM 2007 support a tape-based backup and archive solution? DPM provides disk-based and tape-based protection for your data, which can be deployed as follows: Disk-to-disk (D2D). A method of backup in which data from one computer is stored on the hard disk of another computer. You can use this method to back up your DPM server using your existing alternative tape product. Disk-to-tape (D2T). A traditional method of backing up data from one computer to a type of storage media, such as tape. Disk-to-disk-to-tape (D2D2T). This method combines D2D and D2T for extra protection. D2D2T provides the rapid recovery benefits of disk-based storage in the short term and archive storage for critical data using tape-based storage in the long term. Does DPM support protection across forests? DPM supports protecting computers across domains within a forest; however, you must establish a two-way trust across the domains. DPM 2007 does not support protection across forests. What Exchange Server configurations does DPM 2007 support? The following table lists the Exchange Server configurations that DPM 2007 supports. Server Exchange Server 2003 with Service Pack 2 (SP2) Exchange Server 2007 Configuration Standalone Shared disk cluster (supports cluster failovers) Standalone Shared disk cluster (supports cluster failovers) Cluster continuous replication (CCR) What permissions are required to access DPM Administrator Console? You must be a domain user with administrator access to use DPM Administrator Console. Does DPM 2007 provide Windows PowerShell Integration? DPM 2007 provides its own set of Windows PowerShell commands that can be used in addition to DPM Administrator Console to perform data protection management tasks. A DPM 9
administrator can use DPM cmdlets to perform many of the administrative tasks that can be performed in the console. You access the DPM cmdlets through DPM Management Shell. Can I manage my DPM servers remotely? DPM Management Shell can be installed on computers other than the DPM server, enabling you to administer multiple DPM servers remotely. You can also install DPM Management Shell on desktop computers running Windows XP or Windows Vista. How do I determine how many DPM servers my organization will require? There is no precise formula for determining the number of DPM servers you will need. The number of servers and the amount of data that a single DPM server can protect will vary based on the following factors: Change rate of the data sources to be protected The amount of space available in the storage pool How often the data will be synchronized Available bandwidth at each protected computer Aggregate bandwidth on the DPM server For more information, in Planning a DPM 2007 Deployment, see Planning the DPM Server Configurations (http://go.microsoft.com/fwlink/?linkid=91850). How many snapshots can a DPM server retain? A DPM server can store up to 9,000 disk-based snapshots, including those retained when you stop protection of a data source. The snapshot limit applies to express full backups and file recovery points, but not to incremental synchronizations. Upgrading to DPM 2007 RTM Can I upgrade from a pre-release version of DPM 2007 to DPM 2007 RTM? Yes, you can upgrade to DPM 2007 RTM from a pre-release version of DPM. For detailed information about upgrading to DPM 2007, see Upgrading Pre-release Versions of DPM 2007 (http://go.microsoft.com/fwlink/?linkid=99140). Can I install DPM 2007 over an existing version of DPM? Yes, you can upgrade from previous versions of DPM. For information about upgrading from DPM V2 Beta 2 to DPM 2007, see Upgrading Pre-release Versions of DPM 2007 (http://go.microsoft.com/fwlink/?linkid=99140). 10
For information about upgrading from DPM 2006 to DPM 2007, see the DPM 2007 Upgrade Guide (http://go.microsoft.com/fwlink/?linkid=66737). We recommend that you upgrade only from a DPM 2006 test/pilot installation to DPM 2007. DPM 2007 Licensing What types of licensing does DPM have? DPM has two license types: standard and enterprise. The standard license entitles you to protect volumes, shares, and folders, as well as computer system state. The enterprise license entitles you to protect application data, such as mailboxes and databases on an Exchange Server, in addition to files. On a server cluster, DPM installs an agent on each node of the cluster. A license is used for each server node. What license types do I need for the data that DPM protects? The following table shows the DPM licenses that are used for each type of protected data. Protected data Files only. Files on a single node of a server cluster. System state. SQL Server. (A DPM protection agent on a computer running SQL Server entitles you to protect databases for all SQL instances on that computer.) Exchange Server. Windows SharePoint Services. (On a Windows SharePoint Services farm, a license is used for each back-end server and one license is used for the front-end Web server.) Virtual Server Another DPM server. Data for bare metal recovery using DPM System Recovery Tool. License type used Standard Standard Standard Enterprise Enterprise Enterprise Enterprise Enterprise Enterprise 11
Where can I purchase additional DPM 2007 licenses? You can purchase additional DPM licenses through the Microsoft Partner Program (http://go.microsoft.com/fwlink/?linkid=71663). Installation and Setup What are the system requirements for running DPM 2007? Security Requirements You must log on as a domain user who is a member of the local administrators group before you install DPM 2007. After you install DPM, to access DPM Administrator Console you must be a domain user who is a member of the administrators group. If you are a member of a group other than the administrators group, such as backup operator, you will not have access to DPM Administrator Console. Network Requirements The DPM server must be deployed within a Windows Server 2003 Active Directory domain. The domain controllers can be running Windows Server 2000, Windows Server 2003, Windows Server 2003 R2 Server, or Windows Server 2008 operating system (pre-release version). DPM 2007 running on Windows Server 2000 domain controllers does not support the following: Protecting computers across domains. Protecting a child Windows Server 2000 domain controller in a domain where Windows Server 2000 is the primary domain controller. Protecting computers running Exchange Server 2007. DPM supports protecting servers across domains; however, you must establish two-way trust across the domains prior to protecting the servers. The DPM server requires persistent connectivity with the servers and desktop computers it protects. DPM Server Hardware Requirements The following table lists the recommended hardware requirements for the DPM server. For more information about the DPM 2007 hardware requirements, see Hardware Requirements (http://go.microsoft.com/fwlink/?linkid=90633). 12
We recommend that you install DPM on a 64-bit machine. Component Processor Memory Pagefile Disk space for DPM installation Recommended Requirement N/A 2.33 GHz Quad 4 GB RAM 2 3 GB of free space on the program files volume DPM requires a minimum of 300 MB of free space on each protected volume for the change journal. Additionally, before archiving data to tape, DPM copies the file catalog to a DPM temporary installation location; therefore, we recommend that the volume on which DPM is installed contains 2 3 GB of free space. Disk space for storage pool 2 3 times the size of the protected data The storage pool does not support Universal Serial Bus (USB)/1394 disks. Logical unit number (LUN) Maximum of 17 TB for GUID partition table (GPT) dynamic disks 2 TB for master boot record (MBR) disks These requirements are based on the maximum size of the disk as it appears to the Windows Server operating system. DPM Server Requirements The DPM server must be running one of the following operating systems: Windows Server 2003 with Service Pack 2 (SP2) (Standard or Enterprise Edition) 13
To download Windows Server 2003 SP2, see Windows Server 2003 Service Pack 2 (http://go.microsoft.com/fwlink/?linkid=90633). Windows Storage Server 2003 with Service Pack 2 (SP2) To obtain Windows Storage Server 2003 SP2, contact your original equipment manufacturer. Windows Server 2003 R2 SP2 Windows Storage Server 2003 R2 SP2 Windows Server 2008 operating system (pre-release version) Caution This release of DPM 2007 does not support a Windows Server 2008 installation in a production environment. DPM supports 32-bit and x64-bit operating systems. DPM 2007 does not support ia64-bit operating systems. The DPM server must be a dedicated, single-purpose server. The server cannot be either a domain controller or an application server. The server cannot be the Management Server for Microsoft System Center Operations Manager. For detailed information about DPM 2007 software requirements, see DPM Server Software Requirements (http://go.microsoft.com/fwlink/?linkid=100242). Protected Computer Requirements The following table lists the protected computer requirements. Protected volumes must be formatted as NTFS file system. DPM cannot protect volumes formatted as FAT or FAT32. The volume must be at least 1 gigabyte (GB) for DPM to protect it. DPM uses the Volume Shadow Copy Service (VSS) to create a snapshot of the protected data, and VSS will create a snapshot only if the volume size is greater than or equal to 1 GB. Before you install protection agents on the computers you are going to protect, you must apply hotfix 940349. For more details, see Microsoft Knowledge Base article 940349, "Availability of a Volume Shadow Copy Service (VSS) update rollup package for Windows Server 2003 to resolve some VSS snapshot issues" (http://go.microsoft.com/fwlink/?linkid=99034). Protected computer requirements 14
Protected Computers File servers Computer Requirements You can protect file servers on any of the following operating systems: Windows Server 2003 with Service Pack 1 (SP1) or later Windows Server 2003 x64 Windows Server 2003 R2 Windows Server 2003 R2 x64 Windows Storage Server 2003 with SP1 or later To obtain SP1 for Windows Storage Server 2003, contact your original equipment manufacturer. Windows Storage Server 2003 R2 Windows Storage Server 2003 R2 x64 Windows Server 2008 operating system (prerelease version). DPM supports Standard and Enterprise Editions of all the required operating systems. Computers running SQL Server Microsoft SQL Server 2000 with Service Pack 4 (SP4) - OR - Microsoft SQL Server 2005 with SP1 or Service Pack 2 (SP2) DPM supports Standard, Enterprise, Workgroup, and Express Editions of SQL Server. Important You must start the SQL Server VSS Writer Service on computers running SQL Server 2005 SP1 before you can start protecting SQL Server data. The SQL Server VSS Writer Service is turned on by default on computers running SQL Server 2005. To start the SQL Server VSS Writer service, in the 15
Protected Computers Computers running Exchange Server Computer Requirements Services console, right-click SQL Server VSS writer, and then click Start. Exchange Server 2003 with SP2 - OR - Exchange Server 2007 DPM supports Standard and Enterprise Editions of Exchange Server. Before you can protect Exchange Server 2007 data, you must install hotfix 940006. For more details, see Knowledge Base article 940006, "Description of Update Rollup 4 for Exchange 2007" (http://go.microsoft.com/fwlink/?linkid=99291). Computers running Virtual Server Microsoft Virtual Server 2005 R2 SP1 To protect virtual machines for online backups, we recommend that you install version 13.715 of Virtual Machine Additions (http://go.microsoft.com/fwlink/?linkid=84271). Windows SharePoint Services Windows SharePoint Services 3.0 Microsoft Office SharePoint Server 2007 Before you can protect Windows SharePoint Services (WSS) data, you must do the following: Install Knowledge Base article 941422, "Update for Windows SharePoint Services 3.0" (http://go.microsoft.com/fwlink/?linkid=100392). Start the WSS Writer service on the WSS Server and then provide the protection agent with credentials for the WSS farm. For more information, see "Starting and Configuring the WSS VSS Writer Service" in Configuring DPM 2007 (http://go.microsoft.com/fwlink/?linkid=91852). Update the instance of SQL Server 2005 to SQL Server 2005 SP2. 16
Protected Computers Shared disk clusters Computer Requirements File servers SQL Server 2000 with SP4 SQL Server 2005 with SP1 Exchange Server 2003 with SP2 Exchange Server 2007 Non-shared disk clusters Exchange Server 2007 Workstations Windows XP Professional SP2 All Windows Vista editions except Home (must be a member of a domain) DPM 2007 supports using any of the following sources for server storage capacity: Direct attached storage (DAS) Fibre Channel storage area network (SAN) Internet SCSI (iscsi) storage device or SAN; the iscsi target must have received Windows Hardware Certification The storage pool supports most disk types, including Integrated Drive Electronics (IDE), Serial Advanced Technology Attachment (SATA), SCSI, and supports both the master boot record (MBR) and GUID partition table (GPT) partition styles. DPM 2007 does not support USB/1394 disks What prerequisite software does DPM 2007 install? DPM Setup installs the following software before installing the DPM application: Windows Deployment Services (WDS) on Windows Server 2003 Service Pack 2 (SP2) servers. -OR- SIS on Windows Storage Server 2003 R2. If WDS and SIS are not already installed, DPM Setup prompts you for the Windows Server 2003 product CD during the installation. Microsoft.NET Framework 2.0. Internet Information Services (IIS) 6.0 for Windows Server 2003. (IIS 6.0 is not installed on Windows Server 2003 by default.) 17
IIS 7.0 for Windows Server 2008 (Pre-Release version). (IIS 7.0 is not installed on Windows Server 2008 by default. If IIS is not installed before installing SQL Server 2005, SQL Server will not install SQL Server Reporting Services.) Caution This release of DPM 2007 does not support a Windows Server 2008 installation in a production environment. Important In addition to the default components that IIS 7.0 installs, DPM requires all IIS 7.0 components. For more information, see "Installing the Required Components for Windows Server 2008" in Manually Install Required Windows Components (http://go.microsoft.com/fwlink/?linkid=100603). Microsoft SQL Server 2005 Workstation components. You can use an existing remote instance of SQL Server for your DPM database. If you choose to use a remote instance of SQL Server, you must install sqlprep.msi. To use an instance of SQL Server on a remote computer, run sqlprep.msi, which is located on the DPM product DVD in the DPM2007\msi\SQLprep folder. Verify that the user account you will be using to run the SQL Server service and the SQL Server Agent service has read and execute permissions to the SQL Server installation location. The remote instance of SQL Server cannot be on a computer that is running as a domain controller. Microsoft SQL Server 2005 with Reporting Services. If SQL Server Reporting Services is installed on the remote SQL Server, DPM Setup will use that Reporting Service. If SQL Server Reporting Services is not installed on the remote computer running SQL Server, you must install and configure the service on the remote computer running SQL Server. DPM 2007 contains the Standard Edition of SQL Server 2005. Microsoft SQL Server 2005 Service Pack 2. What DPM prerequisite software do I need to install? Before you install DPM, you must install the following prerequisites: Knowledge Base article 940349, "Availability of a Volume Shadow Copy Service (VSS) update rollup package for Windows Server 2003 to resolve some VSS snapshot issues" (http://go.microsoft.com/fwlink/?linkid=99034). Windows PowerShell 1.0 from http://go.microsoft.com/fwlink/?linkid=87007. 18
Single Instance Storage (SIS) on Windows Server 2008 operating system (Pre-release version). For information about installing SIS on Windows Server 2008, see Manually Install Required Windows Components (http://go.microsoft.com/fwlink/?linkid=100603). If you choose to manually install the required prerequisite software, you must follow the steps detailed in Manually Install Required Windows Components (http://go.microsoft.com/fwlink/?linkid=100603). Can I install prerequisite software manually? Yes, if you want to use retail copies of one or more of the prerequisite products for your DPM installation, or in the event that automatic installation of one or more of the DPM prerequisite software products fails, you can install the prerequisite software manually. If you choose to manually install the prerequisite software, we recommend that you use the settings in the information provided in Manually Installing Prerequisite Software (http://go.microsoft.com/fwlink/?linkid=100602). Can DPM 2007 be installed from a network share? Yes. You can run DPM Setup from a network share by using a Universal Naming Convention (UNC) path. However, you cannot run DPM Setup by using a drive that maps to a network share. If you experience errors when running DPM Setup from a network share by using a UNC path, follow these steps: 1. Exit DPM Setup. 2. Copy the DPM installation folder to a local folder on the DPM server. 3. Restart the DPM installation from the local installation folder. DPM Management Pack Is there a DPM Management Pack included with DPM 2007? Yes. DPM provides Management Packs for Microsoft Operations Manager 2005 (MOM) and System Center Operations Manager 2007. For information about centrally monitoring your DPM servers, see: DPM 2007 Management Pack Guide for Microsoft Operations Manager 2005 (http://go.microsoft.com/fwlink/?linkid=66735) DPM 2007 Management Pack Guide for System Center Operations Manager 2007 (http://go.microsoft.com/fwlink/?linkid=100474) The DPM Management Pack is not included with the DPM product. To deploy the DPM Management Pack, you must first install (MOM) or Microsoft System Center Operations Manager 2007. To download the DPM Management Packs, see the Management Pack Catalog (http://go.microsoft.com/fwlink/?linkid=47215). 19
What is the DPM Management Pack? By using the Microsoft System Center Data Protection Manager (DPM) Management Pack for MOM 2005 or Operations Manager 2007, you can centrally monitor the state of data protection and recovery for multiple DPM servers and the servers that they protect. The DPM Management Pack also monitors key health and performance indicators on DPM servers. From the MOM or Operations Manager Console, you can monitor DPM and network infrastructure at the same time, analyzing data protection failures in the context of other network failures. From the same console, you can monitor other mission-critical applications, such as Microsoft SQL Server. For DPM servers, the DPM Management Pack monitors the state of the DPM database and service health, server performance, and key indicators such as disk availability and configuration changes to servers protected by DPM. For protected servers, the DPM Management Pack monitors the state of connectivity with DPM, data recovery operations for protected servers, and replicas and recovery points that are stored on the DPM server. Protection Agent Deployment Can I deploy protection agents and protect data across domains? Yes. DPM 2007 supports protecting servers across domains, as long as you establish two-way trust across the domains. Can I deploy protection agents and protect data on a virtual private network (VPN)? Yes, if you have continuous connectivity. Can I deploy protection agents and protect data on a WAN? Yes. However, this creates the potential for performance issues. When protecting data over a wide area network (WAN), you should consider doing the following: Enable on-the-wire compression. Set synchronization to occur only before snapshots to avoid using up valuable bandwidth. Enable network bandwidth usage throttling. Reduce the schedule for express full backups when protecting application data such as Exchange storage groups or SQL Server databases. If you are protecting data over a wide area network (WAN), there is a minimum network bandwidth requirement of 512 kilobits per second (kbps). 20
How do I install protection agents on servers behind a firewall? If you want to install protection agents on servers that reside behind a firewall, DPM provides an executable file (DPMAgentInstaller.exe) that performs the following: Installs the protection agent prerequisites and the DPM protection agent. Configures the target computer to receive commands from the specified DPM computer name. Configures the firewall to allow communication with the protected servers. For more information about installing protection agents behind a firewall, see Installing Protection Agents behind a Firewall (http://go.microsoft.com/fwlink/?linkid=101313). To help with firewall configuration, the following table provides details about the protocols and ports used by DPM. Protocols and Ports Used by DPM Protocol Port Details DCOM TCP 135/TCP Dynamic 5718/TCP 5719/TCP The DPM control protocol uses DCOM. DPM issues commands to the protection agent by invoking DCOM calls on the agent. The protection agent responds by invoking DCOM calls on the DPM server. TCP port 135 is the DCE endpoint resolution point used by DCOM. By default, DCOM assigns ports dynamically from the TCP port range of 1024 through 65535. However, you can configure this range by using Component Services. For more information, see Using Distributed COM with Firewalls (http://go.microsoft.com/fwlink/?linkid=46088). The DPM data channel is based on TCP. Both DPM and the protected computer initiate connections to enable DPM operations such as synchronization and recovery. DPM communicates with the agent coordinator on port 5718 and with the protection agent on port 5719. DNS 53/UDP Used between DPM and the domain controller, and between the protected computer and the domain controller, for host name resolution. Kerberos 88/UDP 88/TCP Used between DPM and the domain controller, 21
Protocol Port Details and between the protected computer and the domain controller, for authentication of the connection endpoint. LDAP NetBIOS 389/TCP 389/UDP 137/UDP 138/UDP 139/TCP 445/TCP Used between DPM and the domain controller for queries. Used between DPM and the protected computer, between DPM and the domain controller, and between the protected computer and the domain controller, for miscellaneous operations. Used for SMB directly hosted on TCP/IP for DPM functions. Data Protection and Recovery What data types does DPM 2007 protect? The following table shows the types of data that DPM 2007 protects and the level of data that you can recover using DPM. DPM 2007 Protectable and Recoverable Data Product Protectable Data Recoverable Data Microsoft Exchange Server 2003 with Service Pack 2 (SP2) Exchange Server 2007 Microsoft SQL Server 2000 with Service Pack 4 (SP4) SQL Server 2005 with Service Pack 1 (SP1) or later Microsoft Office SharePoint Server 2007 Microsoft Windows SharePoint Services 3.0 Windows Server 2003 with SP1 Windows Storage Storage group Database Farm Volume Share Storage group Database Mailbox Database Farm Database Site File or list Volume Share 22
Product Protectable Data Recoverable Data Server 2003 with SP1 Folder Folder File data Microsoft Virtual Server 2005 R2 SP1 All computers that can be protected by DPM 2007 except computers running Windows Vista or Windows Server 2008 Workstations running Windows XP Professional SP2 Windows Vista operating systems, except the Windows Vista Home Premium operating system (the computer running Windows Vista must be a member of a domain) DPM does not support file protection on portable computers running Windows XP Professional SP2 and Windows Vista operating systems. Virtual server host configuration Virtual machines Data for applications running in virtual machines System state Volume Share Folder File data Virtual server host configuration Virtual machines Data for applications running in virtual machines System state Volume Share Folder File data How much data can I protect with DPM 2007? Following are the data source limits that DPM 2007 can protect and the recommended disk space required per DPM server. These recommendations assume that you meet the DPM server minimum hardware requirements. 23
Platform Data Source Limit Recommended Disk Space 32-bit computers 64-bit computers 150 data sources We recommend approximately 30 to 40 servers fanning into a single DPM server. 300 data sources Data sources are typically spread across 50 to 75 physical servers. 10 TB There is a Volume Shadow Copy Service (VSS) non-paged pool limitation on x86 32-bit operating systems. If you are protecting data using a secondary DPM server, the recommended disk space is only 6 TB. 40 TB The actual number of computers and how much data DPM can protect will vary depending on the total amount of data you want to protect, and the change rate of the data. For example, a single DPM server could potentially protect 300 servers with single volumes and low change rates. In the Data Protection and Recovery section of this FAQ, the DPM 2007 Protectable and Recoverable Data table lists the data sources that DPM protects. Can DPM 2007 protect a Web server? Yes, DPM 2007 protects files on a computer that is configured as a Web server. Does DPM 2007 support protection for the Windows Server 2008 operating system? Yes, DPM 2007 supports protection for the Windows Server 2008 operating system (pre-release version). DPM 2007 does not support the following on Windows Server 2008: Protection of system volume or data on the system volume for the servers running Windows Server 2008. Protection of symbolic links. 24
What is the difference between a replica and a recovery point, and how are they used in data protection and recovery? Replicas are full copies of a selected data source that the DPM server creates and maintains to provide data protection. To provide continuous protection of current data, DPM synchronizes the replica with the changes that occur on the protected servers on a recurring schedule. DPM creates the replica once, and thereafter it is only updated with the changes from the protected server. Synchronization is the process by which DPM transfers data changes from a protected server to a DPM server, and then applies the changes to the replica of the protected data. DPM automatically validates the replica against the production server to ensure that the replication is consistent and has occurred as planned. To provide you with more versions of your data from which to recover, DPM creates point-in-time copies of the replica known as recovery points on a recurring schedule. You access recovery points to recover previous versions of your protected data. When you select a recovery point, DPM provides you with estimates for retention range and maximum data loss. These estimates help you specify a recovery point schedule that provides adequate data protection and helps you meet you recovery goals. What is express full backup technology? An express full backup is a synchronization operation in which the protection agent transfers a snapshot of all blocks that have changed since the previous express full backup (or initial replica creation, for the first express full backup). The express full backup is used in application data protection. An express full backup of an application server contains multiple recovery points as intervening incremental backups that are saved with the full backup on the DPM server. Why does DPM dismount an entire Exchange Server storage group for database recovery while NTBackup does not? Exchange Server has two technologies for backup and recovery; streaming application programming interfaces (APIs) and the Volume Shadow Copy Service (VSS). Streaming APIs allow you to recover a database without taking the entire storage group offline. The Microsoft Exchange Server writer uses VSS, which requires the entire storage group to be offline, even for a single database recovery. Exchange Server 2007 recommends that you use one database per storage group. Why does my tape backup size increase after choosing to compress data for the protection group? If your tape backup size increases after selecting the Compress Data tape option in the Create New Protection Group Wizard, check your protection group configuration for the following: 25
Encrypt data. If encryption is enabled, check with your tape hardware vendor to ensure that your tape hardware allows the tape backup application to turn off compression. Compress data. If compression is enabled, check to see if you have files that are compressed that you expect to increase in size such as media files or encrypted files. Why are recovery point times on the Browse tab different from times on the Search tab for Windows SharePoint Services data? If you browse or search for Windows SharePoint Services data that you want to recover, the Search tab lists the correct recovery point time for sites, documents, and folders. The Browse tab displays the backup time for the Windows SharePoint Services farm. Clustered Resources Does DPM 2007 protect clustered servers? Yes. DPM 2007 supports the following shared disk clusters: File servers SQL Server 2000 SP4 SQL Server 2005 SP1 Exchange Server 2003 SP2 Exchange Server 2007 (both non-shared disk clusters and shared disk clusters) Only one Network Name resource can exist for the resource group that DPM is protecting. If more than one Network Name resource exists for a single resource group, DPM can support this configuration only if all resources are associated with the same Network Name resource. For example, if you attempt to protect a SQL shared disk cluster, the physical disk resource that SQL Server uses must be associated with the same Network Name resource as the computer running SQL Server and the SQL Server Agent. End-user recovery (both clustered and nonclustered resources on clustered file servers) How do I install a protection agent on a clustered server? Use the Install Agents wizard to install the protection agents on all the nodes of the cluster. When you select a server that is a cluster node, other nodes in the cluster will automatically be selected for the agent installation. 26
To install a protection agent on a clustered server 1. In DPM Administrator Console, click Management on the navigation bar, and then click the Agents tab. 2. On the Actions pane, click Install. The Install Agents wizard starts and displays a list of available servers in the DPM server domain. 3. On the Select Servers page, select one or more clustered servers from the Server name list, click Add, and then click Next. 4. On the Enter Credentials page, type the user name and password for a domain account that is a member of the local administrators group on all selected servers. 5. On the Choose Restart Method page, select the method you want to use to restart the clustered servers. DPM will not restart a server that belongs to Microsoft Cluster Server (MSCS). You must manually restart a server in an MSCS cluster. 6. On the Summary page, click Install Agents to proceed with the installation. The results appear on the Task tab to indicate if the installation is successful. 7. On the Installing page, click Close. How do I protect data sources on a clustered server? Use the Create New Protection Group Wizard to select the data sources to protect on a clustered server. For more information about protecting data sources, in Deploying DPM 2007, see Creating Protection Groups (http://go.microsoft.com/fwlink/?linkid=100248). To select the data to protect on a clustered server 1. In the Create New Protection Group Wizard, on the Select Group Members page, verify that the clustered server that stores the data you want to protect is displayed in the Available members box. If there are servers that are missing, click Add Servers, and then follow the instructions. 2. In the Available members box, expand the server nodes to display the available data sources on the clustered server. After you set up protection groups for non-clustered resources on the physical node, you may not be able to find and select the non-clustered resources under the physical server name. To find the non-clustered resources, expand the network name resources for the cluster, and then search for the resources under the network name. 3. Select and expand the virtual name of the clustered server to view the clustered 27
resources that you want to include in the protection group. You must select the virtual name of the clustered server, not the physical node as you would for a server that is not clustered. 4. After you have selected the members for the protection group, click Next. On planned failover of a protected cluster node, DPM continues protection. On unplanned failover, DPM alerts the administrator that a consistency check is needed. For additional information about protecting clustered resources, in the DPM 2007 Planning Guide, see "Clustered Resources" in Planning Protection Groups (http://go.microsoft.com/fwlink/?linkid=91849). Reports and Notifications Does DPM 2007 provide reporting functionality? Yes. DPM 2007 provides a comprehensive set of reports that provide data about protection success and failures, recovery success and failures, and disk and tape utilization. You can also identify common errors and manage circulation of tapes. Can I monitor and analyze data protection trends? Yes. DPM provides scheduled DPM reports delivered as e-mail attachments so that you can monitor data protection trends and analyze data protection statistics. Tape Libraries What tape libraries does DPM 2007 support? DPM 2007 supports a number of tape libraries for backup, recovery, and archive of businesscritical data. For a list of tape libraries that DPM supports, see DPM 2007 Tested Hardware (http://go.microsoft.com/fwlink/?linkid=92833). DPM has tested the tape libraries listed in the DPM 2007 tested hardware list. However, you can attempt to use any tape library that includes an inbox driver that supports it, or a Microsoft Windows Hardware Quality Labs (WHQL) qualified driver available from the Independent Hardware Vendor (IHV). 28
What do I do if my tape library does not appear in the DPM 2007 Library Management task area? If your tape libraries do not appear in the Library Management task are of DPM Administrator Console, do the following: 1. In the Management task area, on the Libraries tab, in the Actions pane, click Rescan. If the Rescan operation fails, do the following: Verify that the tape library is connected properly and powered on, and then perform the Rescan operation again. In Device Manager, scan for hardware changes, and then perform the Rescan operation again. 2. In Device Manager, verify that the Medium-changer and the library tape drives appear as devices. If the library tape drives do not appear, do the following: In Device Manager, scan for hardware changes. DPM will not detect a tape library if the devices do not appear in Device Manager. 3. If the devices appear in Device Manager as Unknown Medium Changer or Unknown Tape Drive, the proper drivers are not installed. Contact your hardware vendor for updated drivers and verify that your hardware has been tested for compatibility with DPM 2007. Your tape library drives may appear as standalone drives when another application such as Removable Storage Manager (RSM) holds the library device handle. In this case, DPM 2007 stops and disables the RSM automatically. If the RSM is enabled and/or started, disable or stop the RSM service. Important If you have verified that no third-party application enabled the RSM service, after you disable or stop the RSM Service, we recommend that you file a bug in Microsoft Connect. If your tape libraries do not appear in the DPM 2007 Library Management task area in DPM Administrator Console, but drives appear as standalone drives, do the following: If the RSM is enabled, in Administrative Tools, open Services, and then right-click the Removable Storage service, and then click Stop. Any third-party application other than DPM 2007 that is using the library can cause similar kinds of issues. The tape library Medium-changer device is an exclusive resource; therefore you must verify that no other application is using the tape library. 29
What do I do if my tape library drives appear as standalone drives instead of appearing under the tape library in the Library Management task area? If your tape library appears in the Library Management task area of DPM Administrator Console, but your tape drives only appear as standalone drives, do the following: If the tape library is connected using a Small Computer Systems Interface (SCSI) drive, connect the drives to the same bus as the tape library, and then perform the operation again. If your tape library is in the DPM 2007 Tested Hardware (http://go.microsoft.com/fwlink/?linkid=92833) table that lists the tape libraries that DPM 2007 supports, verify that you are using the drivers that are specified in the table. If the above recommendations do not work, DPM 2007 does not support the tape libraries you are using. What do I do if the physical state of my tape drives do not display correctly in DPM Administrator Console? When the physical state of your tape drives do not display correctly in DPM Administrator Console, you need to remap the tape drive information. For information about remapping tape drives, in the DPM Operations Guide, see "Remapping Tape Drives" in Managing Tape Libraries (http://go.microsoft.com/fwlink/?linkid=91964) End-User Recovery What is end-user recovery? You can enable end users to recover previous versions of files and folders that are protected by DPM. Users select an earlier version of a file or folder by using the familiar Windows Explorer interface or any one of the Microsoft Office 2003 applications. This capability increases productivity and significantly lowers administrative costs. What permissions do desktop users need to access earlier versions? When you enable end-user recovery by using DPM Administrator Console, the configuration process updates the required permissions in Active Directory. To view an earlier version of a file, users need Read permission. To recover an earlier version to its original location, users need Read and Write permissions. To recover an earlier version to an alternate location, users need Read permission on the file and Write permission on the alternate location. 30
Does end-user recovery work across firewalls? Yes. End-user recovery uses Common Internet File System (CIFS), the same protocol that clients use to access shared folders on the file server. Storage Pool Configuration What types of storage can I use with DPM 2007? DPM 2007 supports use of any of the following sources for server storage: Direct attached storage (DAS). Fibre Channel storage area network (SAN) Internet SCSI (iscsi) storage device or SAN, providing that the iscsi storage device has received Windows Hardware Certification. What is a custom volume? You can assign a custom volume to a protection group member, in place of the DPM storage pool. A custom volume is a volume that is not in the DPM storage pool and is specified to store the replica and recovery points for a protection group member. Any volume that is attached to the DPM server can be selected as a custom volume, except the volume that contains the system and program files. To use custom volumes for a protection group member, two custom volumes must be available: one volume to store the replica and one volume to store the recovery points When should I use custom volumes? The DPM-managed storage pool is sufficient for most business needs; however, you might want a greater amount of control over storage for specific data sources. For example, you have critical data that you want to store using a high-performance logical unit number (LUN) on a storage area network. Can I use mapped network drives? No, you cannot add mapped drives to a storage pool. Disaster Recovery Can a DPM server back up other DPM servers? Yes. However, you can protect only one primary DPM server (the DPM server that protects data sources directly) with another DPM server. DPM 2007 does not support a primary server and a 31
secondary server protecting each other. Additionally, DPM does not support protection using chaining (when a third DPM server is used for protecting a secondary DPM server). Can you use a DPM server to protect its databases? Yes, a DPM server can protect its own databases by backing the databases up to tape. We recommend that you use a unique protection group to back up the DPM server databases, make at least two copies of the backup tapes, and then store each of the backup tapes in a different remote location. For more information, in the DPM 2007 Operations Guide, see the "Preparing for Disaster Recovery" in Disaster Recovery (http://go.microsoft.com/fwlink/?linkid=91860). Can DPM 2007 protect system state? Yes. DPM 2007 can protect the system state for any computer on which a DPM protection agent can be installed. However, it cannot protect system state on computers running Windows Vista Editions or Windows Server 2008. What system state components does DPM protect? The following table shows the protected components for each system state that DPM backs up: System State Member Server Domain Controller Certificate Services Cluster Server Protected Components The boot files The COM+ class registration database The registry System files that are under Windows File Protection Active Directory Domain Services (NTDS) The boot files The COM+ class registration database The registry The system volume (SYSVOL) Certificate Services is protected in addition to the member server or domain controller system state components. The cluster service metadata is protected in addition to the member server system state components. 32