HP Data Protector A.06.00 Support for Windows Vista and Windows Server 2008 Clients Whitepaper 1
Index Introduction... 3 Data Protector A.06.00 Installation on Windows Vista and Windows Server 2008 systems... 3 Digital Certificate... 3 Support matrix... 3 Data Protector A.06.00 Client... 3 Data Protector A.06.00 Cell Manager... 3 Data Protector A.06.00 Installation Server... 4 Installing Patches on Cell Manager and Installation Server... 4 Client Installation... 5 Prerequisites... 5 Limitations... 5 Remote installation... 5 Windows Firewall Advanced Security... 6 Remote installation from Cell Manager using Data Protector A.06.00 GUI... 12 Uninstalling Data Protector A.06.00 Client on Windows Vista and Windows Server 2008 Systems... 15 Directory Structure for Data Protector A.06.00 on Windows Vista and Windows Server 2008 systems... 15 Data Protector A.06.00 Program Files... 15 Data Protector A.06.00 Data Files... 15 Omnirc template file location... 16 Prerequisites for Backup and Restore... 16 Adding Users... 16 Backup and Restore of Share Information... 16 Sharing Files or Directories within the local system... 17 Sharing directories in the network... 17 Media and Disk agents across different domains... 17 Limitations of System Configuration Objects... 17 Terminal Service Database... 17 Removable Storage Manager Database... 17 Active Directory database restore... 18 Disaster Recovery... 18 Command Line Interfaces (CLI)... 18 New CLI Utilities... 18 Changes in the Data Protector A.06.00 GUI... 19 For More Information... 20 2
Introduction This document describes how to install Data Protector A.06.00 clients on Windows Vista and Windows Server 2008. It also provides the configuration procedure, a description of the installation directory structure and the procedure for backup and recovery process for Windows Vista and Windows Server 2008. Data Protector A.06.00 Installation on Windows Vista and Windows Server 2008 systems This section describes the installation of the Data Protector on Windows Vista and Windows Server 2008 systems. It also provides the prerequisites that must be met before starting the installation procedure. Digital Certificate Windows Vista and Windows Server 2008 hosting security policies require that users can only use digitally certified Data Protector installation files. All Data Protector files or binaries for the supported Windows platforms are digitally signed by Hewlett Packard. Support matrix Data Protector A.06.00 Client Data Protector supports Disk Agent (DA), Media Agent (MA), and Data Protector Graphical User Interface on Windows Vista and Windows Server 2008 systems with the following patches: Platform Patches Patch Number Windows Vista and Windows Server 2008 Core Patch Cell Console Patch DA Patch MA Patch DPWIN_00384 DPWIN_00386 DPWIN_00387 DPWIN_00388 Data Protector A.06.00 Cell Manager Data Protector Cell Manager supports adding and importing Windows Vista and Windows Server 2008 clients with the following patches: Platform Patch Patch Number Windows Core Patch DPWIN_00384 Cell Server Patch Cell Console Patch DPWIN_00385 DPWIN_00386 3
HP-UX (PA-RISC/IA64)* Core Patch PHSS_38402/PHSS_38403 Cell Server Patch Cell Console Patch PHSS_38404/PHSS_38405 PHSS_38406/PHSS_38407 Linux Core Patch DPLNX_00055 Cell Server Patch Cell Console Patch DPLNX_00056 DPLNX_00057 Solaris Core Patch DPSOL_00343 Cell Server Patch Cell Console Patch DPSOL_00344 DPSOL_00345 *Higher patch number is for HP-UX IA64 platforms Data Protector A.06.00 Installation Server Data Protector Installation Server supports installing Data Protector clients on Windows Vista and Windows Server 2008 with the following patches: Platform Patch Patch Number Data Protector A.06.00 supported Windows Installation Servers Core Patch Cell Console Patch Disk Agent Patch Media Agent Patch DPWIN_00384 DPWIN_00386 DPWIN_00387 DPWIN_00388 Installing Patches on Cell Manager and Installation Server Data Protector client support is only available on Windows Vista and Windows Server 2008 systems. For any data protection activity, these clients must be imported to a Cell Manager. To import Windows Vista and Windows Server 2008 clients to a Data Protector A.06.00 Cell Manager, the Cell Manager must be patched with all the patches that contain Windows Vista and Windows Server 2008 client support. See Support Matrix section in this document for all the related Cell Manager patches. To support Windows Vista and Windows Server 2008 clients using an Installation Server, the Installation Server must be patched with all the patches that contain Windows Vista and Windows Server 2008 client support. See Support Matrix section in this document for all the related Installation Server patches. For patch installation procedures on the Data Protector Cell Manager and Installation Server, see the documentation of the respective patches. Installing the Cell Manager patches introduces the following changes: The registry on Windows Cell Manager is updated for DataDir field in the HKLM/SOFTWARE/Hewlett- Packard/OpenView/OmniBackII/Common registry path. This value is equal to the InstallDir path on all non-windows Vista systems. 4
To remotely add new clients, the installation gives options to choose two locations: the program files and the program data location for Data Protector. Both of these values can be changed. See figure 13 in the Remote Installation section. Client Installation Prerequisites To install a Data Protector client, use the Administrator account. The Windows system that will become the Data Protector Client system must meet the following requirements: Installation of Microsoft Internet Explorer 5.0 or higher. Sufficient disk space for the Data Protector Client software. See the HP OpenView Storage Data Protector Product Announcements, Software Notes, and References for details. Port number 5555 (default) free. The Microsoft implementation of the TCP/IP protocol must be installed and running. The protocol must be able to resolve hostnames. The computer name and the hostname must be the same. For information on the installation and configuration of the TCP/IP protocol, see Setting Up the TCP/IP Protocol on Windows Systems in the installation guide. Cell Manager must be patched with all the patches containing Windows Vista and Windows Server 2008 client support. See Installing Patches on Cell Manager and Installation Server section in this document for more details. Limitations A fresh install of a Data Protector client patch on Windows Vista and Windows Server 2008 must be performed remotely from a patched Installation Server and cannot be performed locally. Because of security restrictions imposed by the Windows operating system, Installation Server can be used to remotely install clients only within the same domain. Remote client installation is not supported if the client is a member of a Workgroup. Remote installation Data Protector Windows Vista and Windows Server 2008 clients must be installed remotely from a patched Installation Server and imported to a patched Cell Manager. Prerequisites: To install Data Protector A.06.00 on Windows Vista and Windows Server 2008 clients must meet the following requirements: Make sure that the Data Protector Installation Server and clients are in the same domain. User must configure the cross-domain rights for Inet to communicate correctly. User must be a member of the administrators group on the remote system to start the remote installation. Configure the Windows firewall on the remote host to be able to do the following: 1. Block the inbound connection and allow outbound connections 2. Enable two ports: Remote Service Administration port (445) and Data Protector port (5555) See Windows Firewall Advanced Security section in this document for more details. 5
Windows Firewall Advanced Security for Data Protector A.06.xx 1. To view the properties of firewall right click Windows Firewall Advanced Security in the Windows Firewall Advanced Security MMC console (Control Panel-> Administrative Tools-> Windows Firewall Advanced Security ) and verify if the inbound connections are blocked and the outbound connections are allowed as shown in figure 1 and 2. Note: The features in this section are valid for Data Protector A.06.xx. Figure 1: Firewall Properties 6
Figure 2: Outbound connections are allowed 2. Enable the Remote Service Administration in the Windows Firewall with Advanced Security MMC console (Control Panel-> Administrative Tools-> Windows Firewall Advanced Security) as shown in the figure 3. Verify if the Remote Service Administration is enabled for All Profiles (Remote Service Administration-> Properties-> Advanced Tab) as shown in the figure 4. 7
Figure 3: Remote Service Administration (NP) is preconfigured in firewall rules Figure 4: Remote Service Administration 3. Create a new inbound rule in the Windows Firewall with Advanced Security MMC console (Control Panel-> Administrative Tools-> Windows Firewall Advanced Security) to enable Data Protector incoming 8
port 5555 as shown in figure 5,6,7,8 and 9. Enter an appropriate name for the new rule as shown in figure 10 and click Finish to create the rule. Figure 5: New rule can be added using context menu Figure 6: Select Port 9
Figure 7: Type in specific port 5555 Figure 8: Allow all connections 10
Figure 9: Profile Settings Figure 10: Appropriate rule name 11
Remote installation from Cell Manager using Data Protector A.06.00 GUI 1. Select Start->Programs->HP Storage Data Protector->Data Protector Manager. In the Data Protector Manager, switch to the Clients context. 2. In the Scoping Pane, right-click Clients and click Add Clients. 3. Type the names of the clients or search for the clients (on Windows GUI only) the user wants to install as shown in figure 11. 4. Click Next. Figure 11: Add Clients 5. Select the Data Protector components (Disk Agent, Media Agent, or Data Protector GUI) the user wants to install as shown in figure 12. If an unsupported Data Protector component is selected, then the remote installation for selected unsupported component will fail and display an error message. 12
Figure 12: Add components to clients 6. To change the default user account and target directories (on Windows only) for the installation, click Options as shown in figure 13. 13
Figure 13: Specify options for the client installation Options display two target directories: Program Files: Contains all the Data Protector program files. Data Files: Contains all the Data Protector data files. 7. If the user selects more than one client and the user needs to install different components on each client, click I want to customize this option for client systems independently and then click Next. Select the components user wants to install for each client independently. 8. Click Finish to start the installation. 9. When prompted provide the data required (username, password, and the domain on Windows) to access the specific client system. 10. Click OK. 11. After the Data Protector Software is installed on the system and it is added to the Data Protector cell, it becomes a Data Protector client. 12. After the successful remote installation, the following status is reported: The Inet service is started on the client Client is successfully imported onto the Cell Manager or not imported onto any cell. 14
Uninstalling Data Protector A.06.00 Client on Windows Vista and Windows Server 2008 Systems For information about uninstalling the Data Protector Client on Windows Vista and Windows Server 2008 systems, see Uninstalling a Data Protector Client in the installation guide. Directory Structure for Data Protector A.06.00 on Windows Vista and Windows Server 2008 systems This section describes the directory structure on Windows Vista and Windows Server 2008 after a successful Data Protector client installation has been completed. The program files for Data Protector are separated from the User-configurable data files. Data Protector A.06.00 Program Files By default, the Data Protector Program Files are installed in C:\Program Files\OmniBack\. The directory structure of Data Protector Program files is as shown in figure 14 Figure 14: Data Protector Program files Directory Structure Data Protector A.06.00 Data Files By default, the Data Protector Data files are installed in C:\ProgramData\OmniBack\. The directory structure of the Data Protector Data files is as shown in figure 15 15
Figure 15: Data Protector Data Files Directory Structure Omnirc template file location By default the omnirc file, which is used for enabling or disabling specific behavior of Data Protector is located in the Program Data directory on Windows Vista and Windows Server 2008. Prerequisites for Backup and Restore Adding Users To explore the Microsoft Windows Network and search for an existing user to add to the user group, a prior connection to the remote system where the user account resides is required. Because of the strict network security settings in Windows Vista and Windows Server 2008 systems, the host cannot list the users, if there is no existing network connection point has been established. To establish a network connection, execute \\system_name in an administrator s command shell or select run from the Start Menu. Provide the necessary authentication parameters. After the connection is established, the list of users can be viewed and browsed in the Data Protector user-context pane. Backup and Restore of Share Information In Windows Vista and Windows Server 2008, there are two ways of sharing directories; either visible only to local users or visible across the network. (For more information see: http://windowshelp.microsoft.com/windows/en-us/help/e20e6875-7210-47bb-bf19-5c60e6ae86151033.mspx) 16
Sharing Files or Directories within the local system To share Files or directories within the same host for other users in that host, right click on the directory and click on Share. A dialog box for adding permissions and users is displayed. Add appropriate users and permissions. This shared directory is not visible across network and can be verified by trying to access the directory by entering \\system_name\sharename from a different host in the network. This method of sharing adds an additional attribute to the file or directory. Data Protector backs up and restores these attributes as any other file attribute. The option chosen in backup share information is not applicable to these types of shared files or directories. Sharing directories in the network To share directories in the network, right click on the directory and select the properties share tab. Choose Advanced sharing and select Share this folder. Add users and give appropriate permissions. This directory is now accessible from other systems in the network. Data Protector backs up and restores the sharing information as selected in the Backup share information option. Media and Disk agents across different domains HP recommends that both the media and disks agents must be within the same domain. If they are located across different domains, the backup session will fail on Windows Vista and Windows Server 2008 systems, until the firewall policies are modified. By default, Data protector installation enables all Data Protector modules to communicate with other agents within the same domain. The inbound rules of the Windows Vista or Windows Server 2008 will have DOMAIN as one of the flags. If this is changed to PUBLIC, then the agents can communicate. HP recommends the agents within the same domain. Limitations of System Configuration Objects The limitations of the System Configuration Objects are mentioned below: Terminal Service Database Under configuration objects, the Terminal Service Database is listed only when the client has the terminal licensing server installed. On Windows Vista hosts, terminal licensing is not available as one of the installable Windows components. Back up of the terminal service database can be taken only if the licensing server is installed on that host. There is no system data to backup when the licensing server is not available. Removable Storage Manager Database By default, Removable Storage Manager (RSM) is not installed on Windows Vista and Windows Server 2008 systems. Removable Storage Manager can be enabled from the Programs and Features in the Control panel. Data Protector does not list Removable Storage Manager Database under Configuration objects when the Removable Storage Manager is not installed. If Boot Configuration Data (BCD) is configured on Removable Storage media drive like floppy drive, thumb drive, or flash card reader and CD/DVD ROM, Data Protector cannot backup BCD registry entries. 17
Active Directory database restore In Windows Server 2008, restoring of Active Directory database requires the host to be booted in Directory Service Restore Mode (DSRM). To boot the Windows Server 2008 in DSRM mode the server must meet the following requirements: 1. Set the registry value DSRMAdminLogonBehavior (HKLM\System\CurrentControlSet\Control\Lsa\ DSRMAdminLogonBehavior) to 2. 2. Reboot the server. 3. Press F11 key till a list of boot option is displayed. 4. Press F8 key to select the server boot option in DSRM mode. Disaster Recovery Data Protector A.06.00 patch for Windows Vista and Windows Server 2008 does not support disaster recovery. Hence Data Protector cannot backup the System Recovery Data during the backup of configuration files. Command Line Interfaces (CLI) All Data Protector command line interfaces (CLI) must be executed from within an administrator command shell. In Windows Vista or Windows Server 2008, each user, including Administrator user, has a personalized command shell. This shell utilizes the user directory under users. To access the Data directories of Data Protector Installation, the CLIs must run with Administrative privileges in an administrator command shell. New CLI Utilities Omniinetpasswd This command manages local Data Protector Inet configuration on Windows Vista and Windows Server 2008 systems where the Inet process must be run under a specific user account. Following is the syntax for the command: omniinetpasswd version help omniinetpasswd add {User@Domain Domain\User...} [Password] omniinetpasswd delete {User@Domain Domain\User...} omniinetpasswd modify {User@Domain Domain\User...} omniinetpasswd list [Domain] omniinetpasswd clean On specific Windows operating systems, the Data Protector Inet process must be run under a specific operating system user account rather than under the local user account SYSTEM. The omniinetpasswd command provides functionality for management of Inet configuration on the local system. Use command options -add, -delete, -modify, -list, and -clean for local Inet configuration management. 18
Note that omniinetpasswd does not add, remove, or change user accounts in the operating system configuration. OPTIONS version Displays the version of the omniinetpasswd command. help Displays the usage synopsis for the omniinetpasswd command. add {User@Domain Domain\User} [Password] Adds the specified user account from the local Inet configuration. Omniinetpasswd prompts for the password if not specified in the command line. delete {User@Domain Domain\User} [Password] Removes the specified user account from the local Inet configuration. Omniinetpasswd prompts for the password if not specified in the command line. list Domain Lists user accounts from the local Inet configuration: either all or only the accounts belonging to the specified domain. modify {User@Domain Domain\User} [Password] Changes the password for a configured user account. Omniinetpasswd prompts for the password if not specified in the command line. clean Domain Removes all operating system user accounts from the local Inet configuration. Changes in the Data Protector A.06.00 GUI The Data Protector GUI is changed in the Options tab in the Add Clients context to remotely install Data Protector client on Windows Vista and Windows Server 2008 systems on paths specific to Program Files and Data Files. See figure 13 in the Remote Installation section. On all other Windows platform, only the Program Files path is taken for remote installation. 19
For More Information HP Data Protector software www.hp.com/go/dataprotector Copyright 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Linux is a U.S. registered trademark of Linus Torvalds. Microsoft and Windows are U.S. registered trademarks of Microsoft Corporation. UNIX is a registered trademark of The Open Group. 20