Extend DPM Schema manually

In one of the project, somehow or rather, not be able to use DPM management console to extend the schema. Lots of people is looking for the manual way to extend DPM schema. There is also a time why you need to do so, to extend this feature to other trusted domain users to have end user recovery.

Steps:

Copy the following file in DPM server \Program Files\Microsoft Data Protection Manager\DPM\End User Recovery\DPMADSchemaExtension.exe. Run it in your forest. (Note: you will need to have schema admin and domain admin on the forest)

In the Enter Data Protection Manager Computer Name dialog box, type the name of the computer for which you want end-user recovery data in Active Directory Domain Services, and then click OK.

Type the DNS domain name of the DPM computer for which you want end-user recovery data in Active Directory Domain Services, and then click OK.

In the Active Directory Configuration for Data Protection Manager dialog box, click OK.

Wait for a while, it will then show you the result.

Once extended, you can then enable the end user recovery by:

In DPM Administrator Console, on the Action menu, click Options.

In the Options dialog box, on the End-user Recovery tab, select the check box for the Enable end-user recovery option, and then click OK.

DPM Error 324

Recently, we are doing a DPM Proof of Concept with Microsoft.

Everything works fine with DPM Server installation, DPM Agent push. However, the second day, the agent is not be able to communicate with DPM Server with an error 324.

The detail of the error sounds like:

The agent operation failed because the DPM Agent Coordinator service did not respond.
To troubleshoot this, according to Microsoft website, you will need to:

1) Check the recent DPMAC source records in the application event log on .

2) Verify that the DPM server is remotely accessible from.

3) If a firewall is enabled on the DPM server, verify that it is not blocking requests from .

4) Verify that the time on the DPM server and the selected computer is synchronized with the domain controller. At a command prompt, type "net time /set" to synchronize the time with the domain controller.

However, it is not the case of ours, what we found out:
It is because of Windows 2003 SP2...

We will need to verify that the DPM server is a member of the Distributed COM Users group and that the group has DCOM Launch and Access permissions.

1) In Computer Management, expand System Tools, expand Local Users and Groups, and then click Groups.

2) In the Details pane, double-click the Distributed COM Users group.

3) Verify that the computer account for the DPM server is a member of the group.

For DCOM Launch and Access permission:

1) In Administrative Tools, open Component Services, Expand Component Services, expand Computers, right-click My Computer, and then click Properties.

2) On the COM Security tab, under Access Permissions, click Edit Limits. Verify that the Distributed COM Users group is allowed both Local Access and Remote Access permissions.

3) On the COM Security tab, under Launch and Activation Permissions, click Edit Limits. Verify that the Distributed COM Users groups is allowed the following permissions:

• Local Launch
• Remote Launch
• Local Activation
• Remote Activation
  

Wait for sometime, the DPMA now be able to communicate with DPM Server.

It tooks us about 1-2 hours to solve it together with the customer.