Update: I think I've identified the moment of the problem in procmon on the primary server and have put a small chunk of the procmon output here.
We've set up an offsite DPM server to act as a secondary server to our onsite DPM server.
We set up some protection groups, recovered the appropriate data and shipped the USB drive with that data to the offsite box.
All of the protection groups are now synchronising except the group that has the system state /BMR image of our domain controller.
The protected domain controller is running as a VM on vmware ESXi with the vm files stored on a NAS.
The configuration protection fails with "Access is denied"
Affected area: Computer\System Protection(computer.domain.local) Occurred since: 07/09/2011 19:48:04 Description: DPM could not start a recovery, consistency check, or initial replica creation job for System Protection Computer\System Protection(computer.domain.local) on onsite-dpm.domain.local for following reason: (ID 3170) An unexpected error occurred while the job was running. (ID 104 Details: Access is denied (0x80070005)) More information Recommended action: Retry the operation. Run configure protection job again... Resolution: To dismiss the alert, click below Inactivate alert
Since other groups (including system and BMR cover) are working and were set up in the same way I'm guessing there's some unwritten fangling that needs to be fangled.
When the error occurs the offsite server records
Log Name: DPM Alerts Source: DPM-EM Date: 09/09/2011 12:34:36 Event ID: 3170 Task Category: None Level: Error Keywords: Classic User: N/A Computer: offsite.domain.local Description: DPM could not start a recovery, consistency check, or initial replica creation job for System Protection(computer.domain.local) on onsite.domain.local for following reason: (ID: 3170) An unexpected error occurred while the job was running. (ID: 104)
The onsite server doesn't record anything in any event log around the time of the error
Any assistance or advice gratefully received!