DPM 2010 provides the ability to protect servers in workgroup or non-trusted domains, using local accounts and NTLM based authentication. This capability proved less than popular in large enterprises because of the inherent weakness in NTLM, auditing difficulties and local account management. DPM 2012 adds another authentication method (the previous capabilities are still available); certificate based authentication. The following workloads are supported; SQL Server, File Server, Hyper-V and these can be clustered as well as standalone (note the missing pieces here, no Exchange, SharePoint, System State / Bare Metal Recovery or client computers). A secondary DPM server for DR can also use this authentication method.

All protection in DPM is done around the concept of Protection Groups.

The required certificates can’t be self-signed; hence an internal CA needs to be in place. Setting up certificate based protection is quite involved, first each DPM server has to be configured; generate a certificate from the CA for the DPM server, import this certificate on the DPM server and then configure the DPM server to use certificate based protection. For each server you want to protect you’ll need to install the agent and attach to the DPM server, generate a certificate for the server from the CA, import the certificate on the local computer and configure the DPM agent to use certificate based authentication. When the time comes to renew certificates, DPM will issue a warning alert 30 days before expiry and a critical alert one day before expiry.

Conclusion

A glaring problem in DPM 2010 that’s not addressed in DPM 2012 unfortunately is Exchange single item restore. Some competing backup products offer the ability to restore individual items from a mailbox. The fault doesn’t directly lie with the DPM team however as the methods used by third party software aren’t supported by Microsoft.

From a customer’s point of view it’s a bit odd though that DPM is so good at backing up most Microsoft workloads but falls flat in this one area. It’s time for the Exchange team to step up their game and provide a supported method for single item recovery as soon as possible.

A minor problem (compared to the Exchange issue) is that even though DPM recognizes Active Directory as a data source, single item recovery is again not possible. Another irritating issue is that if I select the Hyper-V node of a Hyper-V server one would assume that any VMs that are created after the creation of the Protection Group would be automatically protected but they’re not. Whilst it’s possible to do this with a PowerShell script it’s surprising that this wasn’t incorporated in this new version as default behavior.

Apart from these issues DPM 2012 is an excellent product, following the already successful earlier versions with a product that’s more enterprise friendly, eminently capable whilst still easy to use and administer. The new Central console is going to save many hours in large environments; the streamlined troubleshooting is a real winner and Role Based Access along with numerous other improvements makes this “best for backing up Microsoft products” even better.

Resources

The DPM team blog

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)

In a virtualized environment the issue is whether to backup from inside the guest or from the host. The latter provides “bare metal restore” of an entire VM where something’s gone catastrophically wrong with a VM (or the host) but in general it doesn’t provide granular restore of files / folders. DPM 2010 added Item Level Restore (ILR), allowing you to restore individual files or folders within a VM even though it had only been backed up from the host. But this capability was only available when DPM 2010 ran on physical hardware, if the DPM server itself was in a VM this capability was not available. DPM 2012 fixes this glitch and can now do ILR even when the DPM server is a VM.

Note that in both DPM 2010 and 2012 ILR is only for files and folders, if you’re running a transaction based workload such as SQL, Exchange or SharePoint in a VM you’ll need to install the agent inside the VM for granular protection. Also be aware that the Hyper-V role needs to be installed on the physical server for DPM 2010 in both Windows Server 2008 and 2008 R2, this is also the case when DPM 2012 runs on top of Windows Server 2008 but NOT when running on 2008 R2.

For stand-alone Hyper-V servers DPM 2012 introduces Changed Block Tracking, which transfers only the changed blocks rather than reading the whole VHD file. This improves backup performance as well as enhancing the Hyper-V server performance by reducing the number of IOs required for backup.

The tested scalability limits in DPM 2012 hasn’t changed from DPM 2010 and remains at 80 TB for replica volumes and 40 TB for recovery point volumes for a total of 120 TB.

DPM 2010 supports item level recovery for SharePoint but it’s time consuming as the entire content database has to be transferred to a staging location before items can be recovered. In a move sure to please SharePoint administrators (and stressed users who needs that document NOW) DPM 2012 instead attaches the database files on a recovery point to a SQL Server instance remotely and recovers the item. This can also be done for data in SQL Filestream content databases. Another improvement for SharePoint is farm level protection where new sites added to a farm are automatically protected.

For business with large tape libraries the added control with the new tape retention policies will be very useful.

DPM has had a tape optimization feature for some time which allows data co-location to better utilize available space on tapes. What was lacking in earlier versions was control over what data is housed with what; with only a single global policy for how many days before a tape can be overwritten.

DPM 2012 improves this by allowing you to configure Protection Group sets. Within each set you can control the Write Period which is the length of time that a tape is available for writing new backups as well as Expiration Tolerance which is the time an expired recovery point can remain on a tape until the tape is marked as expired.

Another tape improvement is that a single Protection Group can spawn multiple tape jobs and in DPM 2010 if one of those jobs had an issue, all of the jobs had to be stopped, in DPM 2012 only the job with an issue needs to be killed.

Also new in DPM 2012 is that any workload that comes with a VSS writer can now be recognized and protected by DPM, this is called Generic Data source protection.

In this part three of the four part series on DPM 2012 we covered a slew of different improvements in areas such as Hyper-V, tape management and Item Level Recovery. The next part will cover certificate based authentication along with a look at some areas where DPM could still do with improvement.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)

The scoped DPM console

The Central Console also enables another nifty troubleshooting feature – the scoped DPM console. When an alert is raised in SCOM you can click the Troubleshoot button which will take you to a DPM console which only shows the data sources, backup jobs and agents that are affected by this particular issue. Even better, once you have resolved the underlying cause you can run a test backup with a single click before resuming the entire backup job. It also provides context; the ticket number, alert and DPM server is listed in an area at the top of the scoped console.

Centralizing management inside of SCOM doesn’t just mean an aggregated view of all backups across many DPM servers; it also lets you work on more important issues first, for instance by showing issues that affect multiple data sources. Segregating errors into infrastructure and backup failures enables Tier 1 or 2 support to focus on backup failure alerts, whereas Backup Admins work on infrastructure problems and Tape Admins focus on tape errors.

Smaller environments can use the Remote Administration feature which lets you install the DPM console on a workstation and then connect that console to any remote DPM server.

The Scoped Console will be a real time saver in troubleshooting scenarios.

Role Based Access in DPM 2012

Another sign that DPM is stepping up to the big league is the application of Role Based Access (RBA) similar to how other Microsoft products (Exchange, SCOM) are approaching authorization for particular tasks in big organizations. Be aware that the DPM 2012 RBA model only covers the task itself, i.e. this user can recover data but you can’t further limit this by objects, i.e. this user can only recover Exchange data from these databases.

DPM comes with a set of seven built in roles with descriptive names: Read-Only User, Recovery Operator, Reporting Operator, Tape Operator and Tape Admins as well as the all-powerful DPM admin. The last two are Tier-1 Support (help desk) who can resume backups and take automated recommended action and the Tier-2 Support (escalation) who also can run backups on demand and take corrective actions such as enabling / disabling agents. Note that the roles are respected by the SCOM console and scoped DPM consoles that are opened from within the SCOM console but are NOT respected in the DPM console on the DPM server itself.

Incorporating the DPM user roles using the SCOM user role approach is another great way of integrating DPM into SCOM.

In part three we’ll over other improvements in DPM 2012.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Introduction

Protecting your data and systems running Microsoft workloads is paramount and the best way to do that is with Microsoft Data Protection Manager (DPM). This is an enterprise class product that’s gone from strength to strength over the last few versions. In this review we’ll look at DPM 2012 Release Candidate.

DPM 2012

In this four part article we’ll first look at installation of DPM 2012 RC and the new Centralized Management capability. In part 2 we’ll cover the scoped DPM console as well Role Based Access. Part three will cover other small and large improvements in DPM 2012 whilst the fourth part will look at Certificate Based Protection as well as some concluding remarks.

DPM 2012 installation

The overall installation experience has changed very little from previous versions. As before you can select to install a local instance of SQL Server (2008 R2 in this version) but larger environments are likely to use the option of a remote SQL Server. Multiple DPM servers can share a SQL server; each requires about 2.5 GB of memory so scale your servers accordingly. The underlying OS can be Windows Server 2008 / 2008 SP2 or 2008 R2 with or without SP1.

If you’ve been trying out DPM 2012 beta be aware that it can be upgraded to DPM 2012 RC which in turn will be upgradable to DPM 2012 RTM.

Whilst both DPM 2010 and 2012 servers can share a tape library (provided it’s recognized by device manager in Windows correctly) you can’t have DPM 2010 and 2012 servers talking to the same tape library, something to take into account for your upgrade planning.

The new DPM console has adopted the ribbon at the top as well as following suit with other System Center products with a wunderbar on the left a la Outlook.

Installing DPM 2012 is characteristically smooth and easy.

Centralized management of DPM 2012 and DPM 2010

To really enable DPM 2012 to reach enterprise scalability scenarios, in a manner that can be effectively managed, required a change in the management paradigm. If your company has two or three DPM servers, perhaps in separate locations, managing them independently isn’t a big deal. But if you have tens or even hundreds of DPM servers that approach quickly becomes expensive, notwithstanding the capabilities of PowerShell scripting.

DPM 2012 provides a centralized console for multiple DPM servers but rather than building a separate console it’s integrated with a console that many corporations are already using – Systems Center Operations Manager (SCOM). For businesses that rely on a third party ticketing system the SCOM integration will ensure that DPM alerts flow nicely into those systems as well. DPM 2012 beta supported SCOM 2007 R2 but the Release Candidate only supports SCOM 2012 RC. Both versions might be supported at RTM but we’ll have to wait and see.

To enable the Central Console is a three step process, first you’ll need to have SCOM 2012 RC installed and then run the main DPM installation screen and select to install the Central Console on the SCOM server. Finally the new Management Packs need to be imported into SCOM; if you’re thinking of trying out SCOM 2012 detailed instructions are available here.

Large businesses that have deployed DPM 2010 will be glad to know that the centralized console will manage DPM 2010 servers as well as DPM 2012. The centralized management extends further and lets you perform remote recovery, take corrective actions remotely and consolidate alerts across your entire backup environment. The Actions pane on the right is context sensitive and presents DPM actions appropriate to the object selected in the tree hierarchy. The tested scalability limit for the Central Console is 100 DPM servers or 50 000 protected data sources.

Using Operations Manager as the Central Console for DPM 2012 is an excellent move and it’s also very well implemented.

Raised Alerts are grouped by data source, disk, tape and tape drive, protection groups and replica volumes alerts, which makes it easy to focus on the area you need to troubleshoot. The central console on SCOM also filters alerts to match your SLA; say you have a guarantee to back up a data source every 4 hours but you actually run backups every hour, if these backups fail the DPM console will have an alert for each failure but SCOM will only raise an alert when the SLA is actually breached.

In part 2 we’ll cover the scoped DPM troubleshooting console as well as Role Based Access.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

If your inquiry will be done on a live database, this step of the process is not necessary. However; there are several scenarios where you’d want to perform the inquiry on a snapshot of the mailbox database from a previous point in time.

Exchange 2007

Create Recovery Storage Group

The first step is to use the Database Recovery Assistant to create a recovery storage group. This will provide a place to restore the database from DPM.

In Exchange Management Console (EMC) click Tools, Database Recovery Assistant, and Open Tool. If you have clustered mailbox servers, this should be done from the active node. Click Create Recovery Storage Group and then select a database to associate with and click Next. Specify appropriate file paths for the restored database and click Create the Recovery Storage Group. Review the details and click Go back to task center. There will now be new options available in the Manage Recovery Storage Group category.

Exchange 2007 – Create Recovery Storage Group

Exchange 2007 – Troubleshooting Assistant with additional options in Manage Recovery Storage Group

Restore Database to Recovery Storage Group from DPM

Next, the database with the appropriate information should be restored. In DPM, this can be done by opening DPM Administrator Console and clicking Recovery. Locate the appropriate date and source by selecting the calendar date and backup medium. Right click the database and select Recover. In the Recovery Wizard, choose the option Recover to Recovery Storage Group. Click Browse to select the mailbox server. Type in the name of the storage group and database. Storage group name by default is Recovery Storage Group. Database name will vary but should match the associated database name. On the next screen, disable Mount Database when recovery completes and click next. On the Summary screen click Recover. Recovery time will depend on the size the database.

Use Database Recovery Assistant to mount restored database

At this point the database has been restored to the Recovery Storage Group and is ready to be mounted. In Database Recovery Assistant, click Mount or Dismount Databases in the Recovery Storage Group. Select the dismounted database and then click Mount Selected Database. Click Go Back to Task Center.

Create mailbox for the search results

At this point, you’re nearly ready to begin searching the database to move email based on keywords. Prior to doing so, we need to complete the final preparation of designating which mailbox will contain the results of the search. I’ve seen some literature in the past that suggests a folder be created in the designated user’s mailbox that will be reviewing the results. This would be appropriate for internal investigations that may not lead to the need for eDiscovery. However; when legal discovery is necessary, I feel it’s best to have a dedicated mailbox and possibly even a dedicated mailbox database for storing nothing else.

Exchange 2010

Create Recovery Database

Similar to Exchange 2007, a place needs to be prepared to restore the database from DPM. Creating the recovery database can be done through Exchange Management Shell (EMS). Type in the following command all on one line to create a place for the recovered database. New-MailboxDatabase -Recovery -Name RDB2 -Server vEx2010 -EdbFilePath “E:\Recovery\RDB2\RDB2.EDB” -LogFolderPath “E:\Recovery\RDB2″

Restore Database to Recovery Database from DPM

Restoring the Exchange 2010 database as a Recovery Database is nearly identical to the process described earlier for Exchange 2007. The wizard in DPM only has different labeling of options. Choose Recovery Database as the restore option and otherwise follow the same directions and discussed earlier for Exchange 2007.

DPM 2010 Recovery Wizard

DPM Mailbox Server and Database Name specification

Mailbox for Search Results

Exchange 2010 has a built in Discovery Mailbox meant for doing legal discovery. It is no longer necessary to create a special mailbox to act as a secure place to store email matching eDiscovery search parameters.

At this point, the recovered database is ready to be searched. In the next post I’ll discuss how to perform the search by keyword and ultimately provide those search results to another party.

• Exchange 2010 Administrative Audit Logging (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)
• DPM 2012 – Part 1: Installation and Console (0)

PS Congratulations on becoming Technical Product Manager for Systems Center Operations Manager, you’re sort of straddling three products now. That would be a pretty big load?

JB The Systems Center teams in Microsoft have been hearing for a while that Management and Security, people want to deal with them as one kind of goal. So internally we’ve reorganised our teams to better align with how customers consume those technologies. So the management team which you saw in Systems Center and the security team which you saw in the Forefront line formally merged the organisations together. Different people picked up different products, to make it more organised around how customers leverages those products in data centre scenarios and client scenarios. The integration you see between Systems Center Configuration Manager and Forefront as a way to deliver antivirus and malware protection to the end user; that’s a client scenario. There’s Systems Center, a bit of Forefront but it’s there to meet the client’s needs. As opposed to, I’m a datacentre guy, I’ve always been a raised floor guy so in my space I think about servers. Monitoring your infrastructure and protecting it are really two sides of the same coin. So yes, I picked up Operations Manager, I’m really, really excited because we’re at 2007 R2 right now, we’ve been there for a while so you can imagine this is going to be a very exciting year.

PS vNext is coming

JB Yes, vNext is coming

PS I’ll be writing a review on that. I have already written the reviews on SCE and DPM 2010 so I don’t have any deeply technical questions as such. I sat in your yesterday afternoon session and I also sat in on most of your Disaster Recovery session today. I picked up quite a few things I didn’t know. So the first question, will there be a DPM 2010 plug in for SBS Aurora? You know how the Aurora console is extensible, and what we all want to add is backup? There needs to be a button in SBS Aurora, saying yes, that’s cool, I’ve got my local backup. Now I want a cloud backup as well.

JB I want that button too. So in general we’re not ready to tell you what will be there as far as that feature set goes. But if you look at what we’ve done so far DPM already has a story for SBS 2008. As for the features for products that haven’t been released yet, that’s absolutely a priority, although it might not appear as a button. Let me unpack this for you a little. The primary goal of DPM wasn’t being number one in the market, although certainly we want to be a trusted, market leading backup solution. When you’re looking at what we’re trying to solve it wasn’t necessarily being the number one backup solution. The core focus in general is around supportability and reliability of Exchange, SQL, SharePoint, Hyper-V, Windows and the client. Whenever there’s a new platform coming out, one of the things we sometimes hear from our customers is “hey I really want these features of this platform but my legacy backup solution doesn’t support it yet so I’m going to wait for that, until my legacy stuff catches up”. So one of the design goals of DPM is always making sure that our customers don’t have to wait. They know that as soon as those platforms come out there’s going to be a wholly supported and reliable backup and recovery solution for those workloads. There shouldn’t be a blocker for adopting new technology. As you can imagine, every new platform that comes out we’re always looking at making sure it’s got a reliable backup and recovery solution.

PS That sounds good. Except it’s not committing to actually putting the button in there but that’s fair enough, you work for Microsoft, you can’t talk about the things that aren’t there yet. So what’s your role in the DPM and SCE teams now that you’ve taken on SCOM?

JB By definition I’m what’s called a Technical Product Manager. In DPM I own basically “how we talk about the product” so how do we translate the features and products and help customers understand the business value? So to me it’s not about the check box, we have Live Migration support on Clustered Shared Volumes; to me it’s about helping the customer understand if you’re going to be leveraging Microsoft’s virtualization platform, and you really want to do that leveraging the High Availability components of that with features like site to site Live Migration, you need to know that there’s a reliable backup and recovery solution for it.

So I do the webcasts, I’m privileged sometime to be invited to do live speaking and this was a blessing for me, I enjoy doing this part of the job. I also write a lot of whitepapers and I manage the blogs. I do pretty much all of the evangelism from the top down about the products and because DPM and SCE has just finished their release cycles, those products, their content is pretty much complete. Their product teams are now blogging about operational issues and best practises, those kinds of things, which gives me a chance to take a deep breath. So it’ll be a few months before we start revving up for DPM vNext and SCE vNext, and what the plan is and then the TAP (Technology Adoption Program), the beta, and the RTM ship; so during this time, instead of just maintaining those products, now is the time to say, let me have something else and because Operations Manager is in a different part of its lifecycle I said yes. Operations Manager vNext will actually be the fifth Systems Center product I’ll be involved in the launch of; I’ve been with three generations of DPM, I managed file services in Windows Server 2008 and 2008 R2, components of certainly much bigger products within Microsoft, and now Operations Manager. The nice thing of course is that SCE has parts of Operations Manager within it so it’s leveraging the management packs, the auto discovery, the diagrams, and the knowledge that’s already embedded there. Those are all things I’m already familiar with from SCE so getting up to speed on the rest of Operations Manager for the Enterprise is going to be fine.

PS You didn’t hear it in the session this morning, you were talking about disaster recovery and site recovery and site resiliency. You said “we have a datacentre here and we have a datacentre here and we replicate from here to there to there, try to do that with tape” and somebody yelled out, “try do to that with the bandwidth in Australia”. And I laughed a bit because it’s true here, some of those scenarios do assume a certain amount of bandwidth that you can get at a reasonable cost elsewhere and I think that in some parts of Australia (at least) they’re going to have to stick with that courier guy with the van and the tapes because the cost per gigabyte is simply that much cheaper.

JB They might. The first design of DPM v1 (version 2006), its only job was centralised backup of branch offices. When we built it there was actually testers in Europe, which has a lot of bandwidth limitations, more constrained than the US but not quite as bad as Australia, something in the middle of the ground when DPM 2006 first came out it’s only goal was to centralise file backups so we assumed we had very thin pipes between your remote sites and back. And when I say that we really assumed a thin pipe, 56Kbps, really next to nothing. Because we could build it from the ground up, because we didn’t have this legacy architecture of taking tape and converting it to disk and that be our replication, the fact that we were just plucking blocks as they changed all really helped. Actually in most cases customers were telling us that they were happy with the bandwidth requirements. You are normally changing a lot less data than you think you are. So in some environments, it won’t work, you can’t put a golf ball through a garden hose, you need some bigger pipes to get that done.

And it may be something were you say that the majority of your data, is going to go by courier. You put the whole datacentre on tape and you use a courier to get that offsite but there’s an operational cost that comes along with that. You might translate that into some bandwidth connections and bolster that up. Moreover if you’re looking at true disaster recovery it’s not 100% of your data, I don’t care about Fred’s word documents, except for the ones you’ll be sending to my boss, so I don’t need all that stuff on day one. If I truly had a site level crisis I would argue that if you reached for the tapes from last Monday’s courier, missing some word documents might be OK. So if you focus on the top 20% of your data which truly is mission critical; now I can afford real time or near real time replication of that portion of the data and then I’ll go ahead and tolerate up to five business days loss of data on tape / disk from courier. That way the savings on those operational costs for daily courier can be used and the stuff that I actually need to resume business I can afford to put on the wire.

It’s hard for me to sign up for “you can’t use the WAN”, I don’t subscribe to that.

PS I agree, you can choose what gets replicated. You outline in your book very clearly the difference between synchronous and asynchronous replication and the costs involved. I work in the small business space running my own business. None of my customers will ever come to me and say “we want a synchronous data replication and site resiliency solution”. That’s just not going to happen.

JB Unless they read it in a book and read it out aloud; “I want a synchronous replication solution”.

PS And I’d say, that’s no problem, here’s the price tag and they’ll just go no thank you, we didn’t want that actually. We’ll buy something else.

JB And that’s what I talk about in the book, calculate the cost of lost data. If you’re a small business, the data that can’t be humanly recreated and the value of that data is enough then the cost justifies a pipe. And if it doesn’t the cost does not justify having a pipe, which was exactly the premise for that chapter: don’t buy more than you need but have an empirical way to figure out what ballpark you’re in, go out and buy it suitable solution.

PS I really like that approach, it’s good. It brings it down to the business level and that’s where you’ve got to talk about it.

JB I actually had that chapter as a hidden download PDF, so if you ever want your readers to get a taste of that, I’ll send you the PDF of just that chapter, if that’s something that they might find interesting.

PS Yes, I can think of at least one client of mine that would actually read that and have an understanding. I can think of another couple that wouldn’t have a clue but that’s alright. This is a side question but I’ll throw it in there anyway, I use Cristalink Firestreamer at one site. What do you hear about that in production? It’s running on a DPM 2007 box and I keep getting weird errors about tapes being cleaning tapes. The virtual tapes that are on the hard drive and I’m like no it’s not a cleaning tape, I promise you. It isn’t a cleaning tape because it’s just a file on a hard drive. Have you ever seen something like that?

JB No I haven’t but recognise that DPM 2007 was our first entry into automated tape management. Automated tape management wasn’t ever part of Windows, and it wasn’t part of DPM 2006 so there were a couple of things that were really quirky in our tape handling in DPM 2007. Tape management was an investment scenario in DPM 2010 so do that in-place upgrade and you might find that experience goes away along with the improvements of everything else.

PS Except I’d need Server 2008 to run it on and they run it on Server 2003,

JB The big things in DPM 2010 weren’t really about widening what we protect. It was really about how we protect it: better tape handling, better scalability, experiences like the SQL self service restore. Stuff that I talked about in the last session, better Disaster Recovery scenarios, better handling of Hyper-V, it was really about improving the experience and performance, auto healing, auto grow, a lot of “auto”.

PS I like the “auto” features.

JB A lot of “fire and forget”, makes DPM truly an Enterprise solution. What we saw in DPM 2007, customers were really excited about this whole “one throat to choke” experience, backup Microsoft with Microsoft but it didn’t scale as well as some of our larger customers wanted it to and in a couple of cases you had to continually go back and manage storage instead of DPM handling that itself. In DPM 2010 we wanted to have that reliability experience, a truly exceptional, “fire and forget”, lights out experience that gave the confidence that I’m using Microsoft to backup Microsoft and those were the business drivers. So having better tape handling is one of those things that DPM 2010 will take care of. The reason we went to Windows Server 2008 only was partly to ensure that higher ability to scale, you just can’t scale your back end backup servers on Server 2003, especially disk, it just doesn’t scale as well. And with Windows Server 2008 we get some capabilities from their disk management with storage handling. In Windows Server 2003 you could grow a volume but you couldn’t shrink it. So if you over allocated your space you just had to wait until you had consumed it. In Windows Server 2008 the shrinking of a volume is now possible. So now you can actually tune the storage which gives a couple of benefits on the operational level which Windows Server 2008 brings to the table.

PS Yes, I think most people can move forward with 2008.

JB And having a back end backup server running Windows Server 2008 with production servers on Windows Server 2003 is entirely possible. We don’t expect everyone to upgrade their entire infrastructure we just need to have the backup server up to date.

PS That’s probably not an issue for most small business customers, in this particular case all their servers are running Windows Server 2003 and there was no budget to actually buy a server for DPM 2007 so it had to be installed on an existing Iomega storage server running 2003.

JB I used to manage Storage Server.

PS Yes I know. Here’s something I’ll throw out to both of you since you’re working on Systems Center products, vNext etc. I’ve written a couple of reviews on Systems Center as a suite and it’s obviously a major focus for Microsoft. A lot of people come to you and say “management is critical”, we’ll give the hypervisor away, that’s great, the competition does as well but it’s the management, that’s where the crunch is. As soon as you’ve got more than five VMs on a single host you’ve got to start managing it. How do you manage it, whether it’s virtualization, whether it’s physical boxes, whatever. So there’s obviously a lot of focus on Systems Center, but one of the things that I found when I wrote the review, this was a while ago now, is that Systems Center Suite is still in most ways separate products. There’s a bit of overlap, like PRO packs linking SCOM to Systems Center Virtual Machine Manager and there’s a few connectors but essentially they are still more or less separate products. Is this something that’s going to alter in the future?

JB So a couple of points, the connectors are a good example, also if you look at how DPM and SCE were developed, there was no accident that those products were released within days of each other, their beta was 24 hours apart, their Release Candidates were about a week apart and the RTMs came within a week of each other. That was not an accident. Based on where those products were in their lifecycle we wanted to align their arrival to market because it made sense. When we synchronize the release cycle it makes it much easier to co-develop. Here’s one thing; remember your hands on experience with SCE? If you ever download the evaluation software for SCE 2010 it’s about 5 GB. There’s no other component in Systems Center that’s 5 GB. And the reason is that if you go to the directories for that install you actually find that there’s a build of Operations Manager 2007 R2 in it, there’s most of Virtual Machine Manager 2008 R2 and there’s all the installable bits of the distribution of WSUS 3.x in it and the fun part of it is that it’s one UI. It’s one UI that pulls the inventory information from WSUS, pulls the management packs from Operations Manager to show you a single pane of glass; this is how everything is doing. And your software distribution, you might do with your WSUS, monitoring which you might do with Operations Manager and the overview of your virtual infrastructure which is done through VMM, all of those are there for you in this single pane of glass. And that’s there today for our mid sized business customers.

So you can see that as our technologies come more into alignment and you can have that single UI framework that we have in Essentials. I don’t have any inside perspective about vNext, whether they all magically plug in or whether that’s coming in the version after vNext, but we’re telling one story in Essentials and little by little the products are talking more to each other. The management packs are also starting to be geared towards tasks, the DPM management pack has tasks embedded in it which lets you use Operations Manager as the central console to manage DPM. In some cases a lot of behaviours are in Management Packs, including Opalis by the way, you can use either Operations Manager to aggregate the actions or you can use Opalis to initiate new actions and not actually having to go to the DPM UI for them.

FD Systems Center is still a platform with a cohesive story. And sometimes you have to pick the information from different parts but it still provides the information. I’m curious to see if you’ve noticed how Systems Center has been received at Tech Ed this year, a few people mentioned it to me but pretty much everywhere regardless of the starting point of the conversation, everyone looks at what Systems Center means in terms of maximising your investment, for your platform as a whole.

JB What’s the most value of the platform, and you don’t have to stop at Systems Center itself, take a look at Forefront, Forefront Endpoint Protection is deliberately integrated into Configuration Manager. It doesn’t even have its own console per see. Configuration Manager is the back end, it’s pushing out the updates, it’s pushing the configuration for how often the clients should scan and check, what jobs to do, how often to update. Configuration Manager, as a part of Systems Center, is actually managing and controlling Forefront whose job it is to protect the whole Windows infrastructure. So little by little you’ll see more integration between the products.

PS I really like Systems Center; I really like Systems Center Virtual Machine Manager. I’ve always liked the fact that you manage VMWare with VMM. It’s cool, it’s quite competitive, and I’m just waiting for Citrix management in the next version.

Just to clarify, today if I have a Small Business Server 2008 at a client and I’m sitting back in my office I have to setup a VPN to do the backup over wire?

JB Yes, that’s correct, there has to be some form of connectivity. If you’re only protecting the files on that Small Business Server we can actually do it in an untrusted way because DPM 2010 can protect non-domain joined machines. There are a couple of other scenarios to consider there, we have a channel partner who have lots of small business clients and one of the things they’re looking at is dropping in a small appliance, a small white box into their customers environment, the white box is actually just a Hyper-V host, with one VM and that VM is a virtualized DPM server. The DPM server joins the domain of that client so that has full, trusted communications with the small business server and can backup all the workloads on that server as well as all the clients. So now we have all that data backed up to the DPM server. The host is not part of the client’s domain; it’s actually part of the reseller’s domain, so now I have a Hyper-V host with a DPM agent on it. So now I get this capability as a channel partner where I can remotely control the backups of all my customer’s sites as a service. More importantly I’m protecting the DPM server without necessarily being able to see into it so that gives me the ability to protect their data without violating the privacy of that data.

But I can still restore that DPM server so if they have a site crisis, if they’re a small business they’re not going to have a disaster recovery site, that’s grandiose for a small business. More importantly, if you’re a small business, and something goes wrong, your trusted reseller is the first people you’re going to call to get your business back up and running. Wouldn’t it be nice if they already had your data? Then the only thing they have to do is to drop in some kind of virtualisation platform and have DPM pushing data back onto it and start reconstituting it. From a phone call they can start and within 15 minutes they can have that VM server restored and be starting to put data back into that environment. If we’ve got a hotel or a conference room someplace, drop in some PCs, arrange data connectivity, we can have you back up and running. And that’s not something that a small business had access to three years ago. Certainly not five years ago. You’ve got your trusted provider, you’ve got software at a cost that’s certainly not astronomical for a mainstream small business, especially if you do it via VL pricing or for an educational customer. Now you actually get disk to disk and long distance vaulting and you get it at for a fairly small total cost.

As a service provider, one of the other things Microsoft has is something called Service Provider Licensing Agreement (SPLA) licensing where even the reseller doesn’t have to purchase the software outright, they can, I think the term is amortise, the license over time and resell that as a service which makes it even more attractive for that local reseller to become that local DR provider for their small business clients. I’m excited about that because, for our large customers, large companies they go to IronMountain, or they go to i365 or locally here in Australia there are other companies; so you’ve got options for disaster recovery to the cloud if you’re a large company. For a small company, I wouldn’t say that you don’t know who IronMountain is but you don’t have that same kind of recognition intuitively but you do know who “Paul’s reseller” is so let them provide that recovery service locally. There are some neat things that are starting to come out in this space this year.

PS I like that scenario, it’s given me something to think about. A colleague of mine who also runs his own business he’s actually doing this, he’s setting up a DPM server in his office to protect a DPM server at one of his clients and then they don’t have to worry about tapes or hard drives or anything else going offsite because it’s already going over the wire.

JB This works in small offices, let’s say you have a collaborative relationship with another business. Using IPSec you set up a tunnel between the two sites and you own the DPM server that backs up his environment and he owns the DPM server that backs up your environment. As far as you’re concerned it’s 2U somewhere in the back closet but now you have two self-standing environments that are symbiotic. In a true small business I wouldn’t be opposed to going with a small server, put it at the owner’s house, in the US at least he can write of the expense of that WAN connection (“this is part of my business infrastructure”), and now your DR site is at the owner’s house so if something happens to the office, the owner is going to want the data. I’ve been in backup for 20 years, and to me it’s always been number one goal, get the data out of there. That’s my primary passion, the data has to survive. And these days there are a lot of options for how to set that up.

PS Well if we get National Broadband Network here, if they actually build it that opens up a whole different set of scenarios. They’re talking gigabit, they already have 100 Mbps and that’s both ways.

JB I have cable to my house in the states so I think I’m like 30 Mbps down and 5 up. Sometimes I’m actually thinking that webpages are changing on their own but boy it’s fast.

PS That’s all the questions I had, it’s been great seeing you finally, after talking to each other on the phone for a couple of years and over email. Thank you also for your book, it’s a good book, this is clearly someone speaking from a lot of experience. I also work part time as a teacher so I’ll be bringing quite a few of the lessons in this book back to my students when I start teaching them about DPM 2010 in a couple of months.

FD Where do you teach?

PS Sunshine Coast TAFE, on the other side of Brisbane.

FD Has it been a good TechEd for you?

PS Yes, it’s been a great Tech Ed. This is my fourth TechEd and it’s a great way of learning but more importantly it’s a great way of networking with people. I meet a lot of really smart people here. The ability to create community and a communal buzz around products is not that easy to do but once you’ve got it going it’s one of your biggest assets.

JB I couldn’t agree more. You know when I come down for events, I would come down just to do the speaking because I love Australia but I don’t come just for the speaking. I come for the connections, I come for the “lets grab coffee”, that’s really great, we were talking earlier about my job description I’m also empowered to be the voice of community so you’ll see that I blog a lot and tweet a lot. But you’re absolutely right, the best voice we can have is not the Microsoft one, not to mention it doesn’t scale. What does works is; there were a few gentlemen in the front row of the session on DR you were in, one of them is Matt Marlor from AU Techheads and the other one is Orin Thomas who’s written books on like 20 different certifications and I met with them to find out what I can do to accelerate them here. That’s what I come for.

I can hit almost the same size audience as a webcast but I can’t connect that way.

PS Thanks guys, I really appreciate your time.

Paul started in IT back in the day of 286 PCs and DOS, he’s now a teacher, technical journalist and IT consultant in Australia. He’s an MCT, MCSE, MCSA, MCITP, and MCTS. Read more on his blog at http://tellITasITis.com.au.

• System Center 2012 – Orchestrator 2012 – Integration Packs (0)
• System Center 2012 – Orchestrator 2012 – Runbooks best practices (0)
• System Center 2012 – Orchestrator – Creating Runbooks (0)
• System Center 2012 – Orchestrator – Installation (0)
• System Center 2012 – Orchestrator Review (0)

DPM 2007 SP1 (32bit)

DPM 2007 SP1 (64bit)

And here some more useful links:

What’s New in DPM 2007 Service Pack 1

You might know the first of these three TechNet Edge videos already from my earlier blog post about DPM 2007 SP1.

Introduction to DPM 2007 SP1

What is new in DPM 2007 SP1 for protecting SharePoint

DPM 2007 SP1 licensing

Fabricem, a Technet blogger, has some more information about the changes.

• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)
• DPM 2012 – Part 1: Installation and Console (0)
• eDiscovery in Exchange – Part 4: Restoring a mailbox database with DPM 2010 (0)

Some days ago, the IT forum published a presentation from Jason Buffington, Senior Technical Product Manager for storage solutions at Microsoft, about the new features of Data Protection Manager 2007 Service Pack 1. The video also introduces DPM 2007 and the recently released Feature Pack. The most interesting part is certainly about the enhancement that SP1 will bring. I copied here the main parts of the presentation:

SQL Server backup

• SQL Server 2008 Protection for mirrored databases now includes backup on failover
• Ability to backup databases in parallel within same instance

SharePoint 2007 backup

• Index and catalog protection within SharePoint setup, increased of manual inclusion
• Unified protection of mirrored SQL databases within SharePoint farm

Hyper-V backup

• New Hyper-V VSS writer enables online backup of guests with DPM 2007 SP1
• Local Data source backup
• DPM can now protect its own file shares and virtualization guests for branch office solution

General Enhancements

• Support for Cross-Forest protection
• Scale and Performance Enhancements

Note that in the diagram the text in yellow is not only about the new features in SP1, but also includes the features that are already available with the Feature Pack. Some bloggers misunderstood that.

In my opinion, Hyper-V support is the most important new feature. One of the biggest advantages of server virtualization is that it enables you to move VMs to another host in case of a hardware malfunction. However, if you can’t afford a fancy Live Migration environment (supported in Windows Server 2008 R2), continuous data protection might be another option. In case of a hardware failure, you can restore a relatively fresh backup to another host.

Microsoft is a bit late, though. Symantec Backup Exec 12.5 already supports Hyper-V backups. However, I am not sure whether the Hyper-V agent also supports continuous protection. Please let me know, if you know more about this.

• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)
• DPM 2012 – Part 1: Installation and Console (0)
• eDiscovery in Exchange – Part 4: Restoring a mailbox database with DPM 2010 (0)

I tested the predecessor DPM 2006 thoroughly and interviewed Microsoft’ product manager, also because I wrote a review for the German magazine iX. It was one of the first affordable CDP solutions and I already hoped at that time that we could give up our old fashioned archive-bit-based backup solution. Even though I liked DPM 2006 as such, we couldn’t make this move because backups of the Windows system state, Exchange, and SQL Server were not supported. Symantec’s Continuous Protection Server (CPS) which was integrated later in Backup Exec 10d and Backup Exec 11d was better, but I don’t like this mixture of conventional and CDP backup.

So I appreciate it that Microsoft has come out with a new version in just two years containing all the features we need. I reviewed DPM 2007 Beta 1 some time ago. Although a couple of important features such as brick-level backups for Exchange mailboxes and online backups of Virtual Server VMs were not working yet, I started to like Microsoft’s new backup software. New in this release is document-level restore for SharePoint and bare metal recovery.

I am quite curious now to try the final and I also want to check how reliable it is. Another thing I didn’t test yet is how well it supports backups to tape libraries. I only made backups to a single tape drive with the beta which worked quite well. But working with a tape library is something different. I am going to blog about my tests soon. You might want to check out DPM’s Technet site meanwhile.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

From this it follows that DPM 2007 won’t be able to protect Windows 2000 since it doesn’t support VSS. The advantage of this move is that DPM 2007 can secure Windows XP and Windows Vista which wasn’t possible with DPM 2006.

It certainly makes sense to rely more on VSS. However, I think that for many the lack of Windows 2000 support will be a knock down argument against DPM 2007. If you have just one Windows 2000 server left in your datacenter, you probably won’t give up your current backup software and move to Microsoft’s solution.

We got rid of our Windows 2000 systems already shortly after Windows 2003 was released. We have only about 30 servers, so it was not such a big deal. For us the better VSS integration is a plus. I am particularly interested in backing up Virtual Server 2005 with DPM 2007 which also relies on VSS.

If you are interested in how DPM 2007 secures data, you should check out this Microsoft video. It is quite interesting and well-explained.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Like most CDP solutions, DPM 2006 is a disk-based backup tool. DPM v2, its successor, is still disk-based, but you can indeed backup data directly to tapes. I tried it with an old Dell SDLT drive. DPM v2 had no problem storing and retrieving data from it.

Disk-based backups are becoming more and more popular. However, for long-term storage, tapes are still the better solution. With DPM v2, you can easily combine both types of storage media. You simply tell DPM that you want to use disks for short-term backup and tapes for long-term storage when you create a Protection Group, i.e., a backup job.

You can separately configure the retention ranges and the backup synchronization frequency for both types. So, for example, you could set a retention time of five days for disk-based backups and a year for tape-based backups. DPM allows a minimum synchronization frequency of 15 minutes for disk-based backups. You can run tape backups daily, but with a five-day retention range for the disk backups, you could work with weekly tape backups.

What I like about this solution is that you only have to configure one backup job for each server. With conventional backup software, you usually have separate job definitions for disk and tape backups and you have separate jobs for daily, weekly, and monthly backups. So all in all, you have six backup jobs for each server. With DPM v2, there is just one, thereby making the setup of backup jobs not only less time consuming, but helpful in keeping a better overview of your backup jobs.

I also ran backups of an Exchange 2003 Server with DPM v2. The DPM agent recognized automatically that Exchange was installed on the server. You can select each Exchange storage group separately as the backup source. DPM v2 supports restores of singular mailboxes, but you can’t restore single items like individual e-mails. That means DPM v2 Beta 1 doesn’t support so-called brick-level backups.

I wasn’t able to restore a single mailbox to the Exchange Server. DPM always complained that the user was still connected to the mailbox, which wasn’t really the case. Okay, I understand this is just beta software. I’ll try this feature again when the next version is out.

Restoration of the complete database was no problem, though. DPM dismounts the Exchange storage group during the restore process. However, this only works for the latest backup. If you want to restore older backups, you have to restore the database files to a separate location and then mount them with Exchange.

Apart from the tape support and the aforementioned possibility to backup SQL Server and SharePoint, I didn’t find any other big changes when compared to DPM 2006 SP1. The user interface looks pretty much the same. I didn’t try any backups of SQL Server or SharePoint. I’ll probably do that when the final is available.

In the introduction, I said that DPM v2 Beta1 has a major shortcoming. Like DPM 2006, it doesn’t support backups of Windows system files. This, at least, is true for the Beta 1. Therefore, DPM v2 Beta 1 can’t be used for disaster recovery. However, a Microsoft employee told me that Beta 2 will be able to backup the Windows system state.

So I am looking forward to Beta 2 to see if this is really true. Beta 1 is also a bit unstable. I had to reinstall it once since the management console (MMC) wasn’t able to load the DPM user interface anymore. I’ll test DPM v2 more thoroughly as soon as a better version comes out.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Support for 64-bit Protection Updated System Requirements Support for Clustered Servers Protection for SIS-enablsed Servers Microsoft Update Opt-in Change to Disk Allocation Formula Other Changes in SP1

• Exchange 2010 Administrative Audit Logging (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)
• DPM 2012 – Part 1: Installation and Console (0)

We were about to buy Lucid8 Digivault as a CDP solution for Exchange and Continuous Protection Agent for Backup Exec 10d from Symantec. I like Symantec’s CDP solution more than DPM. However, Exchange support is a great plus now for DPM. I suppose that Symantec will follow Microsoft soon with a new version of Backup Exec offering similar features.

It seems that DPM Version 2 has another interesting new feature that Microsoft calls “Seamless Disk and Tape Integration”. With DPM 2006, you need third party software to back up data to tapes. I wonder what this feature is supposed to be. Unfortunately, the “marketing text” doesn’t give any hint about it.

I am probably going to have a closer look at the Beta 1 which is already available for download at Microsoft Connect.

• Exchange 2010 Administrative Audit Logging (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)
• DPM 2012 – Part 2: Role Based Access and scoped console (0)
• DPM 2012 – Part 1: Installation and Console (0)

The main issue with any backup strategy is the so called RPO (Recovery Point Objective). Basically, the RPO specifies the time to which you plan to recover data. Other considerations are: how many different versions of a certain file you want to secure, and how long the maximum time difference between two versions should to be. The most well known backup scheme is the grandfather-father-son strategy where you have daily incremental or differential backups, and weekly plus monthly full backups.

Such backup strategies are difficult to achieve with CDP solutions. The DPM, for example, allows no overwrite protection for backed-up data. It can only predict the time when a certain shadow copy will be overwritten. The time to which you can recover depends on the amount of changes of your data. Therefore, it is not possible to specify an exact RPO.

Another problem is that a file can only be in one so called Protection Group, the equivalent to backup jobs in traditional backup systems. Therefore, you can’t configure a backup policy like the grandfather-father-son strategy with DPM.

The DPM was not designed for long term data archiving anyway, as it doesn’t support tape-based backups. Additionally, the DPM only allows a maximum of 64 shadow copies. Hence, even if you have large amounts of disk space available, long term archiving is not doable.

Third party vendors like Symantec (Backup Exec) and Yosemite can help to remedy these shortcomings. They offer agents which allow integrating DPM in an overall backup strategy that supports long time archiving and staging. For instance, one can use Symantec Backup Exec to backup DPM’s shadow copies to a tape system. To restore the data you don’t need DPM anymore. You can restore it directly to the original backup source. Computer Associates (Acrserve) and Caumvault (QiNetix) also have announced similar agents for their backup solutions.

DPM is Microsoft’s first professional backup solution. Thus, it lacks many important features that are a matter of course for other backup tools. The biggest shortcoming, and I must admit that I was quite surprised when I first heard about it, is that DPM can’t secure the Windows System State. This implies that even small companies can’t use the DPM as its sole backup solution. You always need a second backup software for disaster recovery. Microsoft recommends using the backup tool that comes with Windows to secure the Windows System State. Well, if you only have one or two servers in your company this might be a solution for you. You probably know that one has to configure this backup tool separately for every server.

I had an interview with Microsoft officials for my German article about the DPM. For sure, the next version will have this feature according to them. They also said that the DPM will then probably be able to backup Microsoft Back Office products like SQL Server or Exchange. I don’t have to mention that systems of competing software companies won’t be supported so fast. So I wouldn’t expect agents for other database system as SQL Server in the near future. If you also have a bunch of UNIX or Linux systems in your network DPM most likely will never be your favorite backup software.

This article only covers the major shortcomings of the DPM. I will compare DPM with its main rival, Symantec’s Continuous Protection Server for Backup Exec, soon. You will learn about more problems of DPM then.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Maybe the DPM is not a good example to use in discussing the advantages of CDP, since it only supports “near continuous data protection”. There has to be at least one hour time difference between two scheduled shadow copies and DPM can only create eight shadow copies a day. Thus, on average the time difference between two backups will be even greater than one hour.

Of course you can also have eight disk-based backups a day with any other professional backup software. So why do you need DPM after all? The point is that DPM specializes on frequent backups:

1. Continuous Backup

The DPM agent logs continuously all changes on the file sever. This causes an extra load on the server of about 5% which is comparable to an on-access virus scanner. If you backup a file server eight times a day with conventional backup software, you will have much more additional load on the file server. A traditional backup tool scans the whole server for files where the archive bit has changed. This reduces the performance of any read/write access to the hard disk noticeably.

2. Data block replication

The DPM agent doesn’t copy the whole file to the backup server, if only some bytes have changed. Only those data blocks, which changed since the last creation of a shadow copy, will be replicated. This saves network bandwidth and backup space.

3. Manual shadow copy creation

DPM only allows scheduling of eight shadow copies a day. However, the data replication to the backup server can be scheduled hourly. An administrator can use the replicated data to create a shadow copy manually any time. Therefore, if you realize early enough that a restoration is necessary; you only will lose the data a maximum of one hour. To achieve the same RPO (Recovery Point Objective) with conventional disk-based backup software you have to run a backup job every hour.

4. Server state restoration

With conventional backup software you usually work with a combination of full and incremental/differential backups. If you have to restore a folder or the whole file server, you usually will restore files which were deliberately deleted by the users after the full backup. The DPM agent logs all changes on the file server. Hence, it also recognizes if a file is deleted. This change will be replicated to the backup server and the deleted file will not be a part of the next shadow copy. Therefore, if you restore the complete file server you will get the exact state of the file system at the time where the shadow copy was created.

5. End-user recovery

This feature of the DPM is not directly related to the CDP technology. I am mentioning it here because it is an advantage of the DPM over most conventional backup solutions and it is also typical for other CDP systems. End-user recovery with the DPM is quite user-friendly. One uses the Windows explorer to navigate to the file or folder. The properties of the file show the older versions. One can then preview the file before restoring it. The procedure is exactly the same as with the shadow copy feature of Windows Server 2003. Actually, one can combine shadow copy for file shares with the DPM. For the end-user, there will be no difference whether the file is restored from the file server or from the DPM server.

This post only covers the advantages of the DPM over conventional backup systems. In the next article in this series I will discuss some of its problems and disadvantages. Stay tuned!

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)