This documentation is archived and is not being maintained.

Troubleshooting General Data Protection Issues

Updated: November 1, 2008

Applies To: System Center Data Protection Manager 2007

The following table provides troubleshooting guidance on general protection issues.

Data Protection Issues


Issue Possible Cause Resolution

Protection begins to fail after you promote or demote a protected computer to domain controller.

Uninstall the protection agent and install it again.

Inconsistent drive letter references in the DPM New Protection Group Wizard.

If you change a volume drive letter and then do not restart the computer before creating a protection group for that volume, inconsistent drive letter references may appear in the DPM New Protection Group Wizard.

To display the correct drive letters in the New Protection Group Wizard, you must refresh the drive letters in SQL by performing the following steps:

  1. Remove the volume from the protection group, retaining the replicas.

  2. Read the volume to the protection group.

DPM is no longer able to communicate with its protected computers.

The DPM computer may have been temporarily disjoined from the Active Directory domain to which it previously belonged. For example, the DPM computer could have been disjoined because of a broken workstation-domain trust relationship. When the DPM computer is restarted, it is rejoined to the domain with the same name but is assigned a new Security Identifier (SID). All servers that are being protected by this DPM computer have an agent registry DCOM security setting that contains the obsolete SID. Therefore, the servers are unable to either launch the DPM protection agent or resume communication with the DPM computer.

To restore communication and resume data protection activities, do the following:

  1. Locally uninstall the protection agent from the protected computer.

  2. On the DPM server, in DPM Administrator Console, in the Management task area, on the Agents tab, select the protected computer. In the Actions pane, click Refresh information.

    The agent status changes to Error.

  3. In the Details section, click Remove the record of the server from this DPM computer.

Reinstall the protection agent on the computer. For instructions, in the Operations Guide, see Managing DPM Servers (

After you install a protection agent on the computer and then create a protection group, you cannot access any data sources on the computer.

When you install a protection agent, after the computer restarts and is responsive to the ping command, it can take up to 20 minutes for the protection agent to respond to requests from the DPM New Protection Group Wizard.

Wait 20 minutes after the computer restarts and then run the DPM New Protection Group Wizard again, or try the following:

  • In DPM Administrator Console, in the Management task area, on the Agents tab, in the Actions pane, click Refresh information until the agent status changes to OK.

The recovery point time is not consistent with synchronization time.

When a recovery point is created, it reflects the time of the most recent change to the protected volume.

For example, if a recovery point is scheduled to be created at 11:00 A.M. and the most recent change to the protected volume occurred at 8:30 A.M., the recovery point that was created at 11:00 A.M. will display a time stamp of 8:30 A.M.

No action is required.

Synchronization jobs fail and the details in the application event log include "Unable to connect to Active Directory."

The DPM server may not have access rights to update Active Directory.

To troubleshoot this issue, do the following:

  • Retry the operation.

  • Check for network connectivity between the DPM server and the domain controller.

  • Verify that DPM is a member of the domain and that the domain controller is running.

  • Verify that the DPM server has access rights to update Active Directory:

    1. Open the Active Directory Users and Computers snap-in and verify that Advanced Features is selected in the View menu.

    2. Expand the domain, and then expand System.

    3. Right-click MS-ShareMapConfiguration, and then click Properties.

  • On the Security tab, verify that the DPM server name is listed.

Auto discovery does not discover changes to shares.

If a share on a computer is protected and the computer also contains an unsupported share, then auto discovery will fail to discover changes to shares on that computer, such as new shares, removed shares, and share remappings.

No “pending members” will be discovered by auto discovery for a computer with a protected share if the computer also contains a share that points to a destination in the following list of unsupported shares:

  • FAT volume.

  • CD-ROM drive.

  • USB drive.

  • Mount point located inside another mount point.

  • Special folders: System Volume Information folder, RECYCLER folder.

  • Unsupported reparse point (that is, any reparse point other than a mount point).

  • On a case-sensitive system, a folder that has the same name as another folder inside that folder’s parent, differing only in case (for example, “F:\MarketingDocs” and “F:\marketingdocs”).

  • On a computer containing a share from the list of unsupported shares, we recommend that you protect only volumes and folders for auto discovery to work correctly.

The tape backup size increases after choosing to compress data for the protection group.

Your tape hardware may not allow the tape backup application to turn off compression.

If your tape backup size increases after selecting the Compress Data tape option in the DPM New Protection Group Wizard, check your protection group configuration for the following:

  • Encrypt data. If encryption is enabled, check with your tape hardware vendor to ensure that your tape hardware allows the tape backup application to turn off compression.

  • Compress data. If compression is enabled, check to see if you have files that are compressed that you expect to increase in size, such as media files or encrypted files.

Your long-term tape backup fails because your full tape backup is not available.

- Or -

Your long-term backup does not leverage the latest tape backup that was most recently created.

If you are using tape for both short-term and long-term protection, DPM creates copies of the latest short-term tape full backup to generate your long-term tape backup.

To resolve this issue, when you create your protection group, we recommend that you schedule your short-term protection full backup to run a day prior to your long-term protection. This enables your long-term tape backup to leverage the short-term tape backup that was most recently created.

If you schedule the long-term tape backup to run prior to the short-term tape backup, the long-term backup will use the short-term full backup of the previous week.

Data protection fails when you are protecting two domain controllers.

If you are protecting data on two domain controllers and then uninstall the protection agent from one of the domain controllers, protection will fail.

To restart protection, do the following:

  1. On the protected server, from the command prompt, change the directory (CD) to <drive letter>:\Program Files\Microsoft Data Protection Manager\DPM\bin\.

  2. Type SetDpmServer.exe -dpmServerName <DPM server name>.

Creating or modifying a protection group fails.

If the number of recovery points exceeds the number that DPM has provisioned, creating or modifying a protection group will fail. In addition, you cannot view the number of recovery points in DPM Administrator Console.

To view the number of existing recovery points, do the following:

From the DPM Management Shell prompt, type $dpm = Connect-DPMServer dpmoffice02

Replicas are marked as inconsistent.

Once a volume is marked as Missing, DPM only brings the volume back online during the next disk modification operation, such as Allocate disk space, or after restarting the computer. DPM then marks the replica as inconsistent.

You must perform a manual consistency check. For information about performing a consistency check, see "How to synchronize a replica" in DPM 2007 Help.

Creating a protection group fails when protecting several nodes in a cluster, and the following error is displayed:

"This item cannot be protected because some prerequisite software is missing. Ensure that all prerequisite software is installed and then protect this item."

The software prerequisites may not be present on all nodes in the cluster.

You must install the software prerequisites on all nodes on the cluster that you are protecting. For information about DPM prerequisite software and the servers it protects, see Protected Computer Requirements (

Adding a DPM server to a protection group on the secondary DPM server causes DPMRA service to fail on the primary DPM server.

Unable to see protected data sources on the secondary DPM server.

“DPMRA service has terminated” error in the Event Viewer log on the primary DPM server.

The name given to the protection group on the primary DPM server contains special characters.

Rename the protection group.