0

I have two servers I want to protect with System Center 2012. There might be some hardware differences but they are otherwise equal:

  • Same domain as the DPM server
  • Fresh Windows Server 2012 Datacenter installation.
  • Hyper-V role
  • A wildcard rule in the firewall Group Policy allows all incoming connections on any port from the DPM server and that policy has been applied.
  • I use the Domain Administrator credentials to install the Protection Agent.
  • Remote Administration is enabled
  • I was able to install the Virtual Machine Manager agent remotely without any problems.

Using System Center 2012 Service Pack 1 DPM Administrator Console from a Windows Server 2012 Datacenter to perform the installation.

On one server the remote installation completes with success. On the second one it fails. All Windows Updates has been installed, I've retried and rebooted the server several times. The error message goes like this:

Install protection agent on server.domain.local failed: Error 313: The
agent operation failed because an error occurred while running the
installation program on server.domain.local. Error details: Unspecified
error (0x80004005) Recommended action: Review the log files on
server.domain.local: [windir]\temp\msdpm*.log and take appropriate
action. Retry the operation, and if the error persists, restart the
computer and then retry the operation again.

This is some of the output from the log:

=== Logging stopped: 25.04.2013  09:05:38 ===
MSI (s) (8C:8C) [09:05:38:656]: Note: 1: 1708 
MSI (s) (8C:8C) [09:05:38:656]: Note: 1: 2205 2:  3: Error 
MSI (s) (8C:8C) [09:05:38:656]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1708 
MSI (s) (8C:8C) [09:05:38:656]: Note: 1: 2205 2:  3: Error 
MSI (s) (8C:8C) [09:05:38:656]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709 
MSI (s) (8C:8C) [09:05:38:656]: Product: Microsoft System Center 2012 SP1 DPM Protection Agent -- Installation failed.

MSI (s) (8C:8C) [09:05:38:656]: Windows Installer installed the product. Product Name: Microsoft System Center 2012 SP1 DPM Protection Agent. Product Version: 4.1.3313.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 1603.

MSI (s) (8C:8C) [09:05:38:656]: Deferring clean up of packages/files, if any exist
MSI (s) (8C:8C) [09:05:38:656]: MainEngineThread is returning 1603
MSI (s) (8C:E8) [09:05:38:672]: RESTART MANAGER: Session closed.
MSI (s) (8C:E8) [09:05:38:672]: No System Restore sequence number for this installation.
MSI (s) (8C:E8) [09:05:38:672]: User policy value 'DisableRollback' is 0
MSI (s) (8C:E8) [09:05:38:672]: Machine policy value 'DisableRollback' is 0
MSI (s) (8C:E8) [09:05:38:672]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (8C:E8) [09:05:38:672]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
MSI (s) (8C:E8) [09:05:38:672]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
MSI (s) (8C:E8) [09:05:38:672]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (s) (8C:E8) [09:05:38:672]: Destroying RemoteAPI object.
MSI (s) (8C:A0) [09:05:38:672]: Custom Action Manager thread ending.
MSI (c) (3C:A0) [09:05:38:672]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (3C:A0) [09:05:38:672]: MainEngineThread is returning 1603
=== Verbose logging stopped: 25.04.2013  09:05:38 ===

I also tried to install the protection agent locally and connectin from the DPM server, the install succeeded but attaching the agent fails with "Can not connect".

Any help or tip is appreciated.

Update: Disabled firewall on the target computer. The setup fails with the same error so I don't think this is a firewall problem.

Update II: Got my third server with a fresh Windows Server 2012 installation up and running so the success on the first server was not a coincidence.

1 Answer 1

2

This one saved the day:

http://social.technet.microsoft.com/Forums/en-US/dataprotectionmanager/thread/913e1de9-4b10-4479-9c6a-95c5b504e1d8/

It turns out that I had been a bit too eager when restricting Windows Firewall. After inspecting MSDPMAgentInstall.log I noticed this error:

ConfigureFirewall method return hr =0x80004005

A Google search took me to the link above.

I had deleted some default rules in Windows Firewall and the installer failed when it tried to modify those rules, even if the firewall was off. Copying the answer in here in case the referenced forum topic disappears.


For those looking for the quick solution to “why does setdpmserver.exe fail” you need to first figure out if it’s the Windows Firewall rule set causing the problem. Note: even if you have the firewall turned off you still need specific rules in the rule set in order for setdpmserver.exe to succeed. Run these netsh commands:

netsh advfirewall firewall set rule group=\"@FirewallAPI.dll,-29502\" new enable=yes
netsh advfirewall firewall set rule group=\"@FirewallAPI.dll,-34251\" new enable=yes
netsh advfirewall firewall add rule name=dpmra dir=in program=\"%PROGRAMFILES%\\Microsoft Data Protection Manager\\DPM\\bin\\DPMRA.exe\" profile=Any action=allow
netsh advfirewall firewall add rule name=DPMRA_DCOM_135 dir=in action=allow  protocol=TCP localport=135 profile=Any

If the first two commands result in errors you need to re-add some default FW rules. Copy below to a .reg file and run to add them back. Then restart the Windows Firewall service and try the above netsh again. If they work then setdpmserver.exe should work.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"RemoteSvcAdmin-In-TCP"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=RPC|App=%SystemRoot%\\system32\\services.exe|[email protected],-29503|[email protected],-29506|[email protected],-29502|Edge=FALSE|"
"RemoteSvcAdmin-NP-In-TCP"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=445|App=System|[email protected],-29507|[email protected],-29510|[email protected],-29502|Edge=FALSE|"
"RemoteSvcAdmin-RPCSS-In-TCP"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=RPC-EPMap|App=%SystemRoot%\\system32\\svchost.exe|Svc=RPCSS|[email protected],-29515|[email protected],-29518|[email protected],-29502|Edge=FALSE|"
"WMI-RPCSS-In-TCP"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=135|App=%SystemRoot%\\system32\\svchost.exe|Svc=rpcss|[email protected],-34252|[email protected],-34253|[email protected],-34251|Edge=FALSE|"
"WMI-WINMGMT-In-TCP"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|App=%SystemRoot%\\system32\\svchost.exe|Svc=winmgmt|[email protected],-34254|[email protected],-34255|[email protected],-34251|Edge=FALSE|"
"WMI-WINMGMT-Out-TCP"="v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|App=%SystemRoot%\\system32\\svchost.exe|Svc=winmgmt|[email protected],-34258|[email protected],-34259|[email protected],-34251|Edge=FALSE|"
"WMI-ASYNC-In-TCP"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|App=%systemroot%\\system32\\wbem\\unsecapp.exe|[email protected],-34256|[email protected],-34257|[email protected],-34251|Edge=FALSE|"

Thanks to sonicbum @ social.technet.microsoft.com

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .