Secondary DPM Agent tab shows all Protected Servers

Hello,
This is the second time I have posted this and I am hoping to get some 
answers.  For the second time in a few weeks,On the agents tab of my 
secondary DPM Server it shows all the Servers protected by the Primary DPM 
server in our office.  It also shows the PrimaryDPM but has an error on the 
agent status.  Yesterday was my first successful Tape Backup using 
Firestreamer.  But this morning all PS's are in Secondary agent tab list.  

The first time this happened I had to unstall all agents from primary UI and 
reinstall on all Production Servers.  I then uninstalled and re-installed DPM 
on the Secondary DPM Server and re-created all of the secondary protection 
replicas from scratch.  All went well for a couple more weeks until yesterday 
when I used Firestreamer to create restore to "tape" [external HD].

I have now manually removed the SecondaryDPM permissions from the DPMRA 
Service in DCOM Config from all Production servers.  Then uninstalled the 
agent from primarydpm from within the SecondaryDPM UI.  When I re-install the 
agent from the secondary to the primary, I get agent error.  I have checked 
in the PrimaryDPM DCOM Config and DPMRA service has SecondaryDPM listed with 
all permissions but the agent still fails and event viewer shows DCOM errors 
for SecondaryDPM.

I can manually give the group DCOMRADmTrustedMachines permissions in the 
DPMRA Service and that makes the agent "OK" on the secondary UI agent
tab.  
But now if I enable any secondary protection to a certain server [say FTP], 
then the FTP server agent shows an error in the PrimaryDPM UI.

Sorry for the long post, but I can anyone help?

Thanks

Hello Madhan and thank you for the reply!,
I installed all agents from PrimaryDPM.  then installed agent to primary 
from secondary UI.  Then selected "PrimaryDPM" from Secondary UI and
clicked 
link below to "modify Settings".  From there I enabled Secondary
protection 
by entering username, Password, domain info.  All went well for a couple 
weeks.  This morning, on the Secondary UI in the agents tab, Instead of 
seeing just "PrimaryDPM" in the "protected computers with
protection agent" 
list, I see every Production Server in the list that is protected by the 
primaryDPM and I also see the "PrimaryDPM".  The status of all agents
from 
secondary UI are "OK" and the status of the "PrimaryDPM"
agent is "error".

I don't have the exact error messages right now but I will get them.  Soon 
after seeing this problem, in event viewer on the PrimaryDPM, there is a DCOM 
Error stating that SecondaryDPM doesn't have permission to run the DPMRA 
Service remotely.  When I go to DCOM config, SecondaryDPM does in fact have 
that permission, but it is still being blocked.

At this point the only way to get the PrimaryDPM agent to be "OK" from

SecondaryDPM UI, I have to either make DPMRADmtrustedmachines group a member 
of the administrators group on the PrimaryDPM, or add the 
DPMRADmTrustedMachines group to the DPMRA Service in DCOM config on the 
PrimaryDPM.  I know this isn't the correct thing to do, but it is the only 
way to get the PrimaryDPM agent to be show "OK" on the SecondaryDPM.

I have since disabled all protection on the SecondaryDPM and have been 
uninstalling and reinstalling agents from the PrimaryDPM as I can.  they are 
all production servers so I cannot do them all.

The only thing I can think of is that I have been trying to incorporate 
Firestreamer into my strategy and yesterday I successfully created a Recovery 
Point to tape using firestreamer.  the last time this happened to me I was 
trying to figure out Firestreamer also.

Thanks again,

Rob

"Madhan S[MSFT]" wrote:

> Ideally, servers protected by Primary DPM should not show up in the agents

> tab of Secondary DPM. How did you install agents on the protected servers?

> Did you push agents from Primary DPM or Secondary DPM? Did you enable 
> protection for all protected servers using Secondary DPM? (This option will

> be available in agents tab of Secondary DPM when you click on Primary DPM 
> entry. You should see 'Modify' link in the details pane). Do you see all 
> servers protected by Primary DPM in this dialog?
> 
> And we do not recommend configuring security groups manually. Cleanest way

> would be to uninstall/reinstall agents using DPM Server UI.
> 
> Can you post in detail, the error that you see in PrimaryDPM for the FTP 
> server after you enable protection through Primary DPM?
> 
> -- 
> Thanks
> Madhan S
> 
> This posting is provided "AS IS" with no warranties, and confers
no rights
> "robbied31" <robbied31@discussions.microsoft.com> wrote in
message 
> news:7E7B9FCE-5AA9-4464-ABC1-06563CC877EC@microsoft.com...
> > Hello,
> > This is the second time I have posted this and I am hoping to get
some
> > answers.  For the second time in a few weeks,On the agents tab of my
> > secondary DPM Server it shows all the Servers protected by the Primary
DPM
> > server in our office.  It also shows the PrimaryDPM but has an error
on 
> > the
> > agent status.  Yesterday was my first successful Tape Backup using
> > Firestreamer.  But this morning all PS's are in Secondary agent tab
list.
> >
> > The first time this happened I had to unstall all agents from primary
UI 
> > and
> > reinstall on all Production Servers.  I then uninstalled and
re-installed 
> > DPM
> > on the Secondary DPM Server and re-created all of the secondary
protection
> > replicas from scratch.  All went well for a couple more weeks until 
> > yesterday
> > when I used Firestreamer to create restore to "tape"
[external HD].
> >
> > I have now manually removed the SecondaryDPM permissions from the
DPMRA
> > Service in DCOM Config from all Production servers.  Then uninstalled
the
> > agent from primarydpm from within the SecondaryDPM UI.  When I
re-install 
> > the
> > agent from the secondary to the primary, I get agent error.  I have 
> > checked
> > in the PrimaryDPM DCOM Config and DPMRA service has SecondaryDPM
listed 
> > with
> > all permissions but the agent still fails and event viewer shows DCOM

> > errors
> > for SecondaryDPM.
> >
> > I can manually give the group DCOMRADmTrustedMachines permissions in
the
> > DPMRA Service and that makes the agent "OK" on the secondary
UI agent tab.
> > But now if I enable any secondary protection to a certain server [say

> > FTP],
> > then the FTP server agent shows an error in the PrimaryDPM UI.
> >
> > Sorry for the long post, but I can anyone help?
> >
> > Thanks
> >
> > Rob 
> 
> 

Here is the agent error from the ftp server scenario above......

Protection agent version:	2.0.5820.0
Error:	Data Protection Manager Error ID: 270
	The agent operation failed on nas1.huff.win2000.com because DPM could not 
communicate with the DPM protection agent. The computer may be protected by 
another DPM server, or the protection agent may have been uninstalled on the 
protected computer.
Recommended action:	Check the following to troubleshoot this issue: 
1)If the agent is no longer installed on the computer, remove the protected 
data sources on this computer from active protection. Then, remove the entry 
of this computer from the Agents tab in the Management task area.
2)If the agent is not installed on nas1.huff.win2000.com, run 
DpmAgentInstaller.exe with this DPM computer as a parameter. For details, see 
the DPM Deployment Guide.
3)To attach the computer correctly to this DPM server, run the SetDpmServer 
tool on the computer. Refer to Help for details. If the computer is protected 
by another DPM server, or if the protection agent has been uninstalled, you 
can remove the record of the computer from this DPM server.
4)You can uninstall the DPM agent using Add or Remove Programs on the 
selected computer. 
Then remove the record of the computer on the Agent tab in the Management 
task area of DPM Administrator Console.

After I disable secondary protection, I then get agent "OK" message in

PrimaryDPM.  When I uninstall each agent then reinstall from Primary DPM UI, 
It all seems to start working correctly. I don't know for sure yet as I need 
to finish uninstalling and reinstalling tonight.

I just need to know what is causing this to happen.

Thanks again

rob


"robbied31" wrote:

> Hello Madhan and thank you for the reply!,
> I installed all agents from PrimaryDPM.  then installed agent to primary 
> from secondary UI.  Then selected "PrimaryDPM" from Secondary UI
and clicked 
> link below to "modify Settings".  From there I enabled Secondary
protection 
> by entering username, Password, domain info.  All went well for a couple 
> weeks.  This morning, on the Secondary UI in the agents tab, Instead of 
> seeing just "PrimaryDPM" in the "protected computers with
protection agent" 
> list, I see every Production Server in the list that is protected by the 
> primaryDPM and I also see the "PrimaryDPM".  The status of all
agents from 
> secondary UI are "OK" and the status of the
"PrimaryDPM" agent is "error".
> 
> I don't have the exact error messages right now but I will get them.  Soon

> after seeing this problem, in event viewer on the PrimaryDPM, there is a
DCOM 
> Error stating that SecondaryDPM doesn't have permission to run the DPMRA 
> Service remotely.  When I go to DCOM config, SecondaryDPM does in fact have

> that permission, but it is still being blocked.
> 
> At this point the only way to get the PrimaryDPM agent to be "OK"
from 
> SecondaryDPM UI, I have to either make DPMRADmtrustedmachines group a
member 
> of the administrators group on the PrimaryDPM, or add the 
> DPMRADmTrustedMachines group to the DPMRA Service in DCOM config on the 
> PrimaryDPM.  I know this isn't the correct thing to do, but it is the only

> way to get the PrimaryDPM agent to be show "OK" on the
SecondaryDPM.
> 
> I have since disabled all protection on the SecondaryDPM and have been 
> uninstalling and reinstalling agents from the PrimaryDPM as I can.  they
are 
> all production servers so I cannot do them all.
> 
> The only thing I can think of is that I have been trying to incorporate 
> Firestreamer into my strategy and yesterday I successfully created a
Recovery 
> Point to tape using firestreamer.  the last time this happened to me I was

> trying to figure out Firestreamer also.
> 
> Thanks again,
> 
> Rob
> 
> "Madhan S[MSFT]" wrote:
> 
> > Ideally, servers protected by Primary DPM should not show up in the
agents 
> > tab of Secondary DPM. How did you install agents on the protected
servers? 
> > Did you push agents from Primary DPM or Secondary DPM? Did you enable

> > protection for all protected servers using Secondary DPM? (This option
will 
> > be available in agents tab of Secondary DPM when you click on Primary
DPM 
> > entry. You should see 'Modify' link in the details pane). Do you see
all 
> > servers protected by Primary DPM in this dialog?
> > 
> > And we do not recommend configuring security groups manually. Cleanest
way 
> > would be to uninstall/reinstall agents using DPM Server UI.
> > 
> > Can you post in detail, the error that you see in PrimaryDPM for the
FTP 
> > server after you enable protection through Primary DPM?
> > 
> > -- 
> > Thanks
> > Madhan S
> > 
> > This posting is provided "AS IS" with no warranties, and
confers no rights
> > "robbied31" <robbied31@discussions.microsoft.com>
wrote in message 
> > news:7E7B9FCE-5AA9-4464-ABC1-06563CC877EC@microsoft.com...
> > > Hello,
> > > This is the second time I have posted this and I am hoping to get
some
> > > answers.  For the second time in a few weeks,On the agents tab of
my
> > > secondary DPM Server it shows all the Servers protected by the
Primary DPM
> > > server in our office.  It also shows the PrimaryDPM but has an
error on 
> > > the
> > > agent status.  Yesterday was my first successful Tape Backup
using
> > > Firestreamer.  But this morning all PS's are in Secondary agent
tab list.
> > >
> > > The first time this happened I had to unstall all agents from
primary UI 
> > > and
> > > reinstall on all Production Servers.  I then uninstalled and
re-installed 
> > > DPM
> > > on the Secondary DPM Server and re-created all of the secondary
protection
> > > replicas from scratch.  All went well for a couple more weeks
until 
> > > yesterday
> > > when I used Firestreamer to create restore to "tape"
[external HD].
> > >
> > > I have now manually removed the SecondaryDPM permissions from the
DPMRA
> > > Service in DCOM Config from all Production servers.  Then
uninstalled the
> > > agent from primarydpm from within the SecondaryDPM UI.  When I
re-install 
> > > the
> > > agent from the secondary to the primary, I get agent error.  I
have 
> > > checked
> > > in the PrimaryDPM DCOM Config and DPMRA service has SecondaryDPM
listed 
> > > with
> > > all permissions but the agent still fails and event viewer shows
DCOM 
> > > errors
> > > for SecondaryDPM.
> > >
> > > I can manually give the group DCOMRADmTrustedMachines permissions
in the
> > > DPMRA Service and that makes the agent "OK" on the
secondary UI agent tab.
> > > But now if I enable any secondary protection to a certain server
[say 
> > > FTP],
> > > then the FTP server agent shows an error in the PrimaryDPM UI.
> > >
> > > Sorry for the long post, but I can anyone help?
> > >
> > > Thanks
> > >
> > > Rob 
> > 
> > 

Ideally, servers protected by Primary DPM should not show up in the agents 
tab of Secondary DPM. How did you install agents on the protected servers? 
Did you push agents from Primary DPM or Secondary DPM? Did you enable 
protection for all protected servers using Secondary DPM? (This option will 
be available in agents tab of Secondary DPM when you click on Primary DPM 
entry. You should see 'Modify' link in the details pane). Do you see all 
servers protected by Primary DPM in this dialog?

And we do not recommend configuring security groups manually. Cleanest way 
would be to uninstall/reinstall agents using DPM Server UI.

Can you post in detail, the error that you see in PrimaryDPM for the FTP 
server after you enable protection through Primary DPM?

-- 
Thanks
Madhan S

This posting is provided "AS IS" with no warranties, and confers no
rights
"robbied31" <robbied31@discussions.microsoft.com> wrote in
message 
news:7E7B9FCE-5AA9-4464-ABC1-06563CC877EC@microsoft.com...
> Hello,
> This is the second time I have posted this and I am hoping to get some
> answers.  For the second time in a few weeks,On the agents tab of my
> secondary DPM Server it shows all the Servers protected by the Primary DPM
> server in our office.  It also shows the PrimaryDPM but has an error on 
> the
> agent status.  Yesterday was my first successful Tape Backup using
> Firestreamer.  But this morning all PS's are in Secondary agent tab list.
>
> The first time this happened I had to unstall all agents from primary UI 
> and
> reinstall on all Production Servers.  I then uninstalled and re-installed 
> DPM
> on the Secondary DPM Server and re-created all of the secondary protection
> replicas from scratch.  All went well for a couple more weeks until 
> yesterday
> when I used Firestreamer to create restore to "tape" [external
HD].
>
> I have now manually removed the SecondaryDPM permissions from the DPMRA
> Service in DCOM Config from all Production servers.  Then uninstalled the
> agent from primarydpm from within the SecondaryDPM UI.  When I re-install 
> the
> agent from the secondary to the primary, I get agent error.  I have 
> checked
> in the PrimaryDPM DCOM Config and DPMRA service has SecondaryDPM listed 
> with
> all permissions but the agent still fails and event viewer shows DCOM 
> errors
> for SecondaryDPM.
>
> I can manually give the group DCOMRADmTrustedMachines permissions in the
> DPMRA Service and that makes the agent "OK" on the secondary UI
agent tab.
> But now if I enable any secondary protection to a certain server [say 
> FTP],
> then the FTP server agent shows an error in the PrimaryDPM UI.
>
> Sorry for the long post, but I can anyone help?
>
> Thanks
>
> Rob 

Hello Madhan,
Thanks for the info.  I have since uninstalled all agents from within 
primarydpm and reinstalled and then reinstalled agent from secondarydpm to 
primarydpm and then re-enabled all secondary protection.  Am now running 
through all the consistency checks.  I will keep this in mind if it happens 
again.  Does firestreamer use this cmdlet?  Shoule I only be using 
firestreamer on Primarydpm?  Not secondarydpm?  I have never heard of the 
cmdlet nor tried to use it.  Everytime it happens I lose a coupld days.

Thanks for the help

Rob

"Madhan S[MSFT]" wrote:

> The only reason I could think of is that you might have run
> Switch-Protection CmdLet on the Secondary DPM server. Note that this is a
> mandatory step for running a recovery from Secondary DPM server to
> production server.
> 
> To get out of this issue, you can try following
> - Run Switch-Protection.PS1 on the PowerShell window on Primary DPM. Give
> the protection type as Primary
> - Run Switch-Protection.PS1 on the Secondary DPM server. Here, give the
> protection type as Secondary
> 
> This should solve your issue
> -- 
> Thanks
> Madhan S
> 
> This posting is provided "AS IS" with no warranties, and confers
no rights
> "robbied31" <robbied31@discussions.microsoft.com> wrote in
message
> news:078E991C-09B9-44F8-9EBA-954488C3A265@microsoft.com...
> > Here is the agent error from the ftp server scenario above......
> >
> > Protection agent version: 2.0.5820.0
> > Error: Data Protection Manager Error ID: 270
> > The agent operation failed on nas1.huff.win2000.com because DPM could
not
> > communicate with the DPM protection agent. The computer may be
protected
> > by
> > another DPM server, or the protection agent may have been uninstalled
on
> > the
> > protected computer.
> > Recommended action: Check the following to troubleshoot this issue:
> > 1)If the agent is no longer installed on the computer, remove the
> > protected
> > data sources on this computer from active protection. Then, remove
the
> > entry
> > of this computer from the Agents tab in the Management task area.
> > 2)If the agent is not installed on nas1.huff.win2000.com, run
> > DpmAgentInstaller.exe with this DPM computer as a parameter. For
details,
> > see
> > the DPM Deployment Guide.
> > 3)To attach the computer correctly to this DPM server, run the
> > SetDpmServer
> > tool on the computer. Refer to Help for details. If the computer is
> > protected
> > by another DPM server, or if the protection agent has been
uninstalled,
> > you
> > can remove the record of the computer from this DPM server.
> > 4)You can uninstall the DPM agent using Add or Remove Programs on the
> > selected computer.
> > Then remove the record of the computer on the Agent tab in the
Management
> > task area of DPM Administrator Console.
> >
> > After I disable secondary protection, I then get agent "OK"
message in
> > PrimaryDPM.  When I uninstall each agent then reinstall from Primary
DPM
> > UI,
> > It all seems to start working correctly. I don't know for sure yet as
I
> > need
> > to finish uninstalling and reinstalling tonight.
> >
> > I just need to know what is causing this to happen.
> >
> > Thanks again
> >
> > rob
> >
> >
> > "robbied31" wrote:
> >
> >> Hello Madhan and thank you for the reply!,
> >> I installed all agents from PrimaryDPM.  then installed agent to
primary
> >> from secondary UI.  Then selected "PrimaryDPM" from
Secondary UI and
> >> clicked
> >> link below to "modify Settings".  From there I enabled
Secondary
> >> protection
> >> by entering username, Password, domain info.  All went well for a
couple
> >> weeks.  This morning, on the Secondary UI in the agents tab,
Instead of
> >> seeing just "PrimaryDPM" in the "protected
computers with protection
> >> agent"
> >> list, I see every Production Server in the list that is protected
by the
> >> primaryDPM and I also see the "PrimaryDPM".  The status
of all agents
> >> from
> >> secondary UI are "OK" and the status of the
"PrimaryDPM" agent is
> >> "error".
> >>
> >> I don't have the exact error messages right now but I will get
them.
> >> Soon
> >> after seeing this problem, in event viewer on the PrimaryDPM,
there is a
> >> DCOM
> >> Error stating that SecondaryDPM doesn't have permission to run the
DPMRA
> >> Service remotely.  When I go to DCOM config, SecondaryDPM does in
fact
> >> have
> >> that permission, but it is still being blocked.
> >>
> >> At this point the only way to get the PrimaryDPM agent to be
"OK" from
> >> SecondaryDPM UI, I have to either make DPMRADmtrustedmachines
group a
> >> member
> >> of the administrators group on the PrimaryDPM, or add the
> >> DPMRADmTrustedMachines group to the DPMRA Service in DCOM config
on the
> >> PrimaryDPM.  I know this isn't the correct thing to do, but it is
the
> >> only
> >> way to get the PrimaryDPM agent to be show "OK" on the
SecondaryDPM.
> >>
> >> I have since disabled all protection on the SecondaryDPM and have
been
> >> uninstalling and reinstalling agents from the PrimaryDPM as I can.
 they
> >> are
> >> all production servers so I cannot do them all.
> >>
> >> The only thing I can think of is that I have been trying to
incorporate
> >> Firestreamer into my strategy and yesterday I successfully created
a
> >> Recovery
> >> Point to tape using firestreamer.  the last time this happened to
me I
> >> was
> >> trying to figure out Firestreamer also.
> >>
> >> Thanks again,
> >>
> >> Rob
> >>
> >> "Madhan S[MSFT]" wrote:
> >>
> >> > Ideally, servers protected by Primary DPM should not show up
in the
> >> > agents
> >> > tab of Secondary DPM. How did you install agents on the
protected
> >> > servers?
> >> > Did you push agents from Primary DPM or Secondary DPM? Did
you enable
> >> > protection for all protected servers using Secondary DPM?
(This option
> >> > will
> >> > be available in agents tab of Secondary DPM when you click on
Primary
> >> > DPM
> >> > entry. You should see 'Modify' link in the details pane). Do
you see
> >> > all
> >> > servers protected by Primary DPM in this dialog?
> >> >
> >> > And we do not recommend configuring security groups manually.
Cleanest
> >> > way
> >> > would be to uninstall/reinstall agents using DPM Server UI.
> >> >
> >> > Can you post in detail, the error that you see in PrimaryDPM
for the
> >> > FTP
> >> > server after you enable protection through Primary DPM?
> >> >
> >> > -- 
> >> > Thanks
> >> > Madhan S
> >> >
> >> > This posting is provided "AS IS" with no
warranties, and confers no
> >> > rights
> >> > "robbied31"
<robbied31@discussions.microsoft.com> wrote in message
> >> > news:7E7B9FCE-5AA9-4464-ABC1-06563CC877EC@microsoft.com...
> >> > > Hello,
> >> > > This is the second time I have posted this and I am
hoping to get
> >> > > some
> >> > > answers.  For the second time in a few weeks,On the
agents tab of my
> >> > > secondary DPM Server it shows all the Servers protected
by the
> >> > > Primary DPM
> >> > > server in our office.  It also shows the PrimaryDPM but
has an error
> >> > > on
> >> > > the
> >> > > agent status.  Yesterday was my first successful Tape
Backup using
> >> > > Firestreamer.  But this morning all PS's are in
Secondary agent tab
> >> > > list.
> >> > >
> >> > > The first time this happened I had to unstall all agents
from primary
> >> > > UI
> >> > > and
> >> > > reinstall on all Production Servers.  I then uninstalled
and
> >> > > re-installed
> >> > > DPM
> >> > > on the Secondary DPM Server and re-created all of the
secondary
> >> > > protection
> >> > > replicas from scratch.  All went well for a couple more
weeks until
> >> > > yesterday
> >> > > when I used Firestreamer to create restore to
"tape" [external HD].
> >> > >
> >> > > I have now manually removed the SecondaryDPM permissions
from the
> >> > > DPMRA
> >> > > Service in DCOM Config from all Production servers. 
Then uninstalled
> >> > > the
> >> > > agent from primarydpm from within the SecondaryDPM UI. 
When I
> >> > > re-install
> >> > > the
> >> > > agent from the secondary to the primary, I get agent
error.  I have
> >> > > checked
> >> > > in the PrimaryDPM DCOM Config and DPMRA service has
SecondaryDPM
> >> > > listed
> >> > > with
> >> > > all permissions but the agent still fails and event
viewer shows DCOM
> >> > > errors
> >> > > for SecondaryDPM.
> >> > >
> >> > > I can manually give the group DCOMRADmTrustedMachines
permissions in
> >> > > the
> >> > > DPMRA Service and that makes the agent "OK" on
the secondary UI agent
> >> > > tab.
> >> > > But now if I enable any secondary protection to a
certain server [say
> >> > > FTP],
> >> > > then the FTP server agent shows an error in the
PrimaryDPM UI.
> >> > >
> >> > > Sorry for the long post, but I can anyone help?
> >> > >
> >> > > Thanks
> >> > >
> >> > > Rob
> >> >
> >> >
> >> >
> 
> 
>