I really like Microsoft’s disk based backup software:”Data Protection Manager 2010″. It doesn’t have the fancy features which the grown-ups like backup-exec, ARCserver do have. But these features where hard to manage and use anyway. DPM got all the basic functions and a simple layout and works. I 
have never looked back since i switched from those old fashioned (virtual) tape library backup solutions. I still think it’s a quick hack for them to create a (virtual) tape libary and say it’s a harddisk based backup solution. It needs a architecture changes under the hood to truly use the advantages of disk bases backups.
And for half the cost DPM is a no brainer if you prefer a simple, clean and workable backup solution for a medium sized company.
But we were having some troubles backing up the “system state” of a Windows 2008R2 though our Microsoft DPM 2010 backup server. Our DPM server reported the following error in its console (and eventviewer):
The replica of System Protection on dc1.******.local is inconsistent with the protected data source. All protection activities for data source will fail until the replica is synchronized with consistency check. (ID: 3106)
DPM cannot create a backup because Windows Server Backup (WSB) on the protected computer encountered an error (WSB Event ID: 517, WSB Error Code: 0x80070040). (ID: 30229)
Not a lot to go on, but checking the eventvieuwer on the domain controller revealed a much better clue:
Volume Shadow Copy Service error: Failed resolving account martin with status 1376. Check connection to domain controller and VssAccessControl registry key.
Operation:
BackupComplete Event
Executing Asynchronous Operation
Context:
Current State: BackupComplete
Error-specific details:
Error: NetLocalGroupGetMemebers(martin), 0x80070560, The specified local group does not exist.
Apparently my account can’t be resolved, and it warns about checking te DC connection and the Volume Shadow Copy service Access control registry key.
Searching though the registry on the DC with the keyword “VssAccessControl” revealed a map:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\VssAccessControl
Asking Google about this “VssAccessControl” led me to: MS technet
This article however only mentions Windows 2003, so it started to look like a dead end. I checked the registry map and it contained a key with “domain\martin REG_DWORD 1” , so you would expect that my account was enabled. That specific useraccount is a member of the domain admins (there a no localgroups sinds it’s a DC). I started to think that some port was being blocked by our Cisco firewall but before I would bring this up with the firewall admin I decided to deleted the key (after exporting) and tried again.
Voila!
