none
DPM2007 to 2010 Upgrade - End User Recovery Permissions Error RRS feed

  • Question

  • Hi, and thanks in advance!

    Recently did an in-place upgrade on our DPM2007 SP1 server to DPM2010. Everything worked as intended once the new agents were deployed and sync / verify was completed.

    However the only error that i have not managed to prevent reoccuring is "End-user recovery permissions update failed".

    I have already performed the Schema extension again on the DC with the new 2010 client incase there were any changed, I thought about attempting to do the "Configure Active Directory" option again, however it is greyed out. The message on that page states "The Active Directory Schema is extended for end-user recovery".

    I have restarted all the machines multiple times, but this error re-occurs every 30 minutes (backup interval on the protection group).

    Any ideas on how to resolve this issue?

    Many thanks,

    Simon Roberts

    Thursday, July 1, 2010 10:59 AM

Answers

  • Well i have still not resolved this issue, however i am virtualising the server enviroment at current, and will attempt a fresh install of the DPM server and install an agent inside the VM for the 2 servers affected and start over.
    Wednesday, July 14, 2010 11:34 AM

All replies

  • I think this may have been answered in this thread Simon.

    http://social.technet.microsoft.com/Forums/en-US/dataprotectionmanager/thread/59fe6ce2-cfad-436b-a808-f509431c0a59


    Thanks, Chris Bu - MSFT This posting is provided "AS IS" with no warranties, and confers no rights
    Thursday, July 1, 2010 2:39 PM
    Moderator
  • Chris,

    I have read that thread, and as mentioned in my first post, I have ran the DPM Schema tool on both of my DC's after performing the in-place upgrade and recieving this error message.

    I think the user in that thread has a new DPM server set up, i have performed an in-place upgrade of the existing DPM2007 server and have this error.

    I still have not got this issue resolved.

    Regards,

    Simon

    Friday, July 2, 2010 9:50 AM
  • Any ideas?

    I had over 500 DPM messages in the inbox this morning.

    Regards,

    Simon

    Monday, July 5, 2010 7:55 AM
  • Just a thought here...

    The DPM schema extension tool does 4 things:

    Extending the schema
    Creating a container
    Granting the DPM server permissions to change the contents of the container
    Adding mappings between source shares and shares on the replicas

    Could you check and see if the DPM server still has access to that container?  Maybe something went wrong here.  I used to had this with a customer but afterwards he told me that he changed these settings manually (never got a decent reason though ;-)).

    Again, just a thought

    Cheers,

    Mike Resseler


    Visit System Center User Group Belgium @ http://scug.be and http://scug.be/blogs/scdpm
    Monday, July 5, 2010 8:18 AM
    Moderator
  • Could you inform me of the container location and name please?

    Regards,

    Simon Roberts

    Monday, July 5, 2010 10:54 AM
  • CN=System -> CN=MS-ShareMapConfiguration

    The rights for the servername$ should be:

    - Create/delete ms-srvShareMapping Objects

    - List Contents

    Cheers,

    Mike


    Visit System Center User Group Belgium @ http://scug.be and http://scug.be/blogs/scdpm
    Monday, July 5, 2010 10:59 AM
    Moderator
  • Many thanks,

    The server already has permissions to that container as you have mentioned above.

    Create/delete ms-srvShareMapping Objects / This object and all descendant objects

    List Contents / This object and all descendant objects

     

    Simon

    Monday, July 5, 2010 11:12 AM
  • That are exactly the settings that you should have...

    I noticed that you mentioned that you used the schema tool on both your DC's.  In that case, you have extended the schema twice.  Is that correct?  Maybe something went wrong there?

    If nobody else knows an answer then maybe you should open a call with MS.  I've tried to simulate this in a test environment I have, but I don't get these errors

    Sorry I can't help you anymore

    Cheers,

    Mike


    Visit System Center User Group Belgium @ http://scug.be and http://scug.be/blogs/scdpm
    Monday, July 5, 2010 12:19 PM
    Moderator
  • @Mike: I doubt DC allows a Duplicate Schema Extension, in the sense that it has an unique attributeID associated with each extended column/class.

     

    @Simon: Is your DC a Win 2k8 R2? Though that again should not be an issue. May be extra security provided by a 2k8 R2 server prevents AD updates.

     

    --Paggi

    This posting is provided "AS IS" with no warranties, and confers no rights


    Monday, July 5, 2010 12:31 PM
    Moderator
  • Parag,

    My DCis a 2008R2 however this was the case when i installed DPM2007 without any issues.

    Simon

    Tuesday, July 6, 2010 8:57 AM
  • Well i have still not resolved this issue, however i am virtualising the server enviroment at current, and will attempt a fresh install of the DPM server and install an agent inside the VM for the 2 servers affected and start over.
    Wednesday, July 14, 2010 11:34 AM