This recipe will cover the news in the DPM 2012 R2 release.

As the market develops, Microsoft understands the new challenges that companies and organizations face and therefore constantly develops its product stack to be able to meet the new requirements.

Microsoft has made some improvements and added some more architectural functions to DPM 2012 R2 release. The following list presents and explains the enhancements made to the product:

The new releases in the R2 version of the DPM software will make it possible for companies to meet some of the new challenges they are facing.

With the constant releases of Update Roll-ups (UR), Microsoft is meeting the new challenges that companies are struggling with.

This recipe will cover the architecture of the DPM software and explain the local security groups like DCOM objects and others, to make your understanding of the product more clear.

There are some parts of DPM that are very important to have knowledge about. They are:

The following are some catalogs under %systemdrive%\Microsoft System Center 2012 R2\DPM\DPM that are important to the DPM server functionality:

The End-User Recovery catalog contains the MS file for the active directory schema extension and configures the DPM server to enable the feature End-User Recovery.

Protection Agents contains two catalogs, which are AC and RA. The AC catalog is used by the DPM agent coordinator when pushing new DPM agents to the server hosting the data sources that it needs protection for. The RA catalog holds the binaries for the DPM agent and can also be used as a remote repository when manually installing the DPM agent.

DPM provides a lot of logs that you can read to gain an understanding of what has happened and why. All logs that the DPM server software produces are stored in the Temp catalog.

For DPM to be able to continually provide data source protection, even if protected virtual machines are making an outer-cluster migration that also includes the migration of storage, DPM needs to integrate with SCVMM. The catalog VMMHelperService contains the binaries and DLL files for creating the integration between the DPM server and VMM server.

The catalog Volumes actually contains four catalogs, and three of them are important to know about. The DiffArea catalog contains shortcuts to the recovery point volumes in the DPM disk pool. The Replica catalog contains shortcuts to the replica volumes in the DPM disk pool. The ShadowCopy catalog contains the catalog Database Backups, which will hold the backed up DPMDB when you trigger a DB backup using the DPMBackup executable.

Last but not least is the XDS catalog, which contains all the XML schema files for the DPM software.

The DPM 2012 R2 software depends on both local security groups that are referred to when the DCOM object that controls the DPMRA service is used to initiate a VSS Request for the protected data source. If there is a problem with rights in the DCOM object, the DPMRA will not be able to provide a snapshot since the chain of configuration is broken.

Since the local security groups are critical, it is important that their purpose is explained. The local security groups are:

The members of the Distributed COM Users group are the computer accounts that the current DPM server has access to. You will also find specific service accounts here regarding your SQL server hosting the DPMDB as well as user accounts.

DPMDRTrusedMachines members are the other DPM servers that provide a DPM-DPM-DR configuration and via the membership of this group, have access to listing the protected data sources on the primary DPM server and take usage of the DPM writer.

The group DPMRADCOMTrustedMachines contains the primary and the secondary DPM server computer accounts.

DPMRADmTrustedMachines contains the computer accounts that have an associated DPM agent with the DPM server.

The group DPMSCOM contains the computer account for the SCOM management server that is used for monitoring and management of the DPM server via SCOM and the Central Console feature.

MSDPMTrustedMachines contains the computer accounts that have an associated DPM agent for the DPM server.

The last group is MSDPMTrusedUsers and this group is used by the centralized management features.

With the introduction of VSS, the purpose of making a full copy of the production data is obsolete. Using the VSS as a starting point, DPM provides an extremely fast and reliable change identification process.

DPM 2012 R2 relies on the VSS architecture and provides advanced change tracking functionality based on the mini-filter driver stack along with a DPM file filter.

The change identification process relies on VSS as the core component. Within the VSS architecture, there are three different snapshot technologies that you can use:

The Copy-on-write technique is the one that provides the possibility of making online snapshots during production hours. This technique identifies the block-level changes and "freezes" the blocks making them ready to be copied. If there are other blocks that were changed during that process, the VSS identifies those. Once the initial identification has finished, the VSS starts managing the changed blocks.

Describing the whole picture, there is more to it than just using the standard VSS architecture. Not only is Microsoft DPM dependent on the VSS functionality but it also uses parts from the mini-filter driver stack and a dedicated file filter named DPM file filter to make the change tracking process of block-level changes fully supported, as well as optimal and fast for a DPM protection scenario.

For further and deeper information regarding how Volume Shadow Copy Service works, refer the MSDN website http://msdn.microsoft.com/en-us/library/windows/desktop/bb968832(v=vs.85).aspx.

When DPM creates a recovery point, there are a number of underlying technologies that make it possible. As mentioned earlier in this chapter, the DPM server can take advantage of a system that uses transactional logs and adapt to the change journal. Creating a recovery point in DPM is a part of what Microsoft calls Express-Full. The Express-Full operation is the function that is triggered when the backup job is initiated from the DPM sever.

The Express-Full consists of the following:

There are a lot of questions that must be sorted out before you start planning your DPM server deployment. First is the classification process of the data sources that you would like to protect. A very common strategy that many companies that are still providing traditional IT to the company or organization are using is to back up everything they can backup once a day. However, this is not a good approach. There are, of course, several servers within your data center that need a high frequency of backups but not all the servers are equally important. It is essential that you adapt your business continuity plan before you have any implementation done. Start by identifying your services and then break down the services into components to clearly see how or why they are of importance to your business.

Use the different classes and sort the components that build up the service into these three categories:

As you may realize, the Gold class is more important than the Silver and the Bronze ones. Use these classes to differentiate your data and services so you get a clearer view.

From a more technical perspective, there are some considerations that need to be addressed:

To be able to understand the number of DPM servers that you need to deploy, you must first know:

Every DPM server can manage 120 TB of storage for its disk pool. For example, 40 TB of those could be addressed to the file workload or 25 TB could be addressed to the SharePoint workload. In the scenario where you are managing multiple domains that you need to provide protection for, you can create a two-way transitive trust between the domains. In that case, the DPM server will operate in both domains without any limitations. This, however, comes with a security risk and if you have not created a two-way transitive trust between the untrusted domains you should think twice before you go for it. If you are able to set up a two-way transitive trust without causing any security risk, follow this blogpost to learn how to do it: http://robertanddpm.blogspot.se/2011/09/backing-up-cross-domains.html.

For the other scenario, to provide restore capabilities for untrusted domains, refer to Chapter 10, Workgroup Protection and CBA.

DPM can be deployed and provide a global restore capability strategy for your company or organization. If your bandwidth is greater than 512 kb then DPM will be able to provide its services. However, you should always include the restore scenarios when you are building up your backup strategies that reflect your business continuity plan. In many cases, you should deploy a DPM server on-site or build up your BaaS service using Windows Server Backup feature and have that integrated with Azure for archiving purposes, if you don't have the funding. Nevertheless, you are able to both throttle the DPM agents that are installed in the remote office protecting data sources and enable the on-the-wire compression for optimizing network consumption.

The SQL Server is no longer a part of the installation media for DPM 2012 R2, which is a good thing. Now you need to think before you act. A majority of the consultant companies needs to understand SQL more and also realize that if you have a poorly set up SQL, you will have a bad experience with the product hosting its database on that SQL server. Remember to set up your SQL server using service accounts, dedicate a RADI 1+0 for the DPM and monitor the SQL performance using System Center Operations Manager with a proactive monitoring approach.

With the release of the UR3, DPM 2012 R2 can be completely virtualized in all thinkable scenarios. You have the ability to use Synthetic Fiber Channel for accessing and using a physical tape library and also the ability to provide deduplication of the DPM disk pool using the SOFS architecture. When building a BaaS, RaaS, or DRaaS for a modern data center or a data center that still adopts the traditional IT approach, it is crucial that the DPM server is running on Hyper-V and is of instances that build up the service. Since a service in a modern data center is highly resilient and highly automated, you will benefit in many ways by building your BaaS, RaaS, and DRaaS using virtual DPM servers.

When it comes to archiving possibilities, there are currently three different solutions:

You should not just consider one of these three as an option. Focus instead on the requirements of the BaaS, RaaS, and DRaaS. Some protected data sources should be provided as archiving possibilities but maybe only once per month, go with Azure. Where protected data sources need an archiving solution but should also be able to restore quickly, go with VTL. In case the data sources need an off-site secure solution, go with physical tapes.

Having all the information presented in an organized manner, you can now start designing the structure of the BaaS service. A piece of advice here—take small steps towards your goal and never rush an implementation. You will probably bump into a challenge or two, so it is of key importance to work using a well-defined structure.

For more information regarding the setting up of SQL as a part of the prerequisites, please read Chapter 2, Installation and Upgrade, which also provides you a walk-through guide of the steps for DPM 2012 R2 installation.

The best way to start the planning phase for the DPM disk pool is to have the initial amount of data that you would like to protect and also a theoretical data churn. With these two components, you can easily determine the exact storage needed for your DPM disk pool.

System Center Data Protection Manger is able to use any type of disk that is presented as local attached storage in Disk Management.

From the UR3 release, you can now build a total virtual solution for the DPM server technology using Hyper-V. This also comes with the great possibility of building a virtual disk pool with VHDX files that could be stored on a Scale Out File Server (SOSF) and enabled for deduplication. With the approach of making a virtual solution you can save and optimize disk consumption very easily.

DPM 2012 R2 is able to use:

A very important fact is that iSCSI should not be considered your primary choice due to some challenges that often occur when leveraging that technology. The most common challenge is that the initiation of the iSCSI target fails and therefore the entire DPM disk pool fails. iSCSI will work in smaller deployments with DPM but if your ambition is to provide a more stable solution, you should consider SOFS. If your company does not provide an SOFS, you should use a DAS and provision VHDX files to the virtual DPM servers. As you can clearly see, the recommendation is to build as much virtually as possible.

Keeping track of the storage performance is also of key importance. Providing a decent proactive monitoring and performance approach is something that you will benefit from in the long run. Build up a proactive monitoring concept using System Center Operations Manager and see how the impact of the performance will change according to the number of backup jobs, workloads and synchronization frequency of the DPM servers.

Microsoft recommendations regarding how to determine the actual size of the DPM disk pool are from a minimal perspective. Multiply the total amount of protected data size by 1.5. For instance, if you want to protect 10 TB of data you need 15 TB of storage from a minimal perspective. The recommended approach is to multiply the total amount of the protected data size by three. So if you want to protect 10 TB of data, you need 30 TB of storage. These calculations will, of course, generate a lot of overhead in the DPM disk pool since there are several factors that are not presented in the equation.

If you want to determine a more exact number for the size of the disk pool, you can use the following formulas.

Replica volumes:

Recovery Point volumes:

The log change is:

As you can understand, you will get a nearly exact estimation but the downside is that it will take a long time to calculate.

If you are protecting just Exchange, Hyper-V, and SharePoint you should use the storage calculators that are available for download at this site: http://www.microsoft.com/en-us/download/details.aspx?id=24375.

Providing decent hardware that hosts the DPM disk pool is very important. You don't need premium disk solutions for the DPM disk pool but can use decent hardware that can easily scale out.

Adding the DPM disk pool could be done via the DPM console or via PowerShell. For more information regarding the subject, please read the Adding disks to the DPM disk pool recipe in Chapter 3, Post-installation Tasks.

It's important to know the limitations of the Windows Server operating system. DPM 2012 R2 has the following limitations that you should keep in mind while designing BaaS, RaaS, and DRaaS:

Opening just the right amount of firewall ports with the right direction of communication will provide you a more high-end security approach. DPM uses Microsoft standard communication ports, but for some features, there are a few other TCP ports that need to be opened.

Having the Windows firewall enabled would be considered the most natural thing. However, many companies rely on a physical firewall as their first line of defense meaning that their Windows firewalls are disabled.

An easy approach is to create a Group Policy Object (GPO) that holds the configuration for the Windows firewalls. Use the Advanced mode for firewall configurations so you can easily provide the necessary configurations.

One important thing regarding the direction of communication is to understand who is initiating the communication. When DPM is protecting server workloads, the DPM server will call for the DPM agent to start its VSS request, but when DPM is protecting clients, the DPM server will wait for the DPM agent present on the client to call in.

You could also limit the actual port range for the high-end ports to a specific port range. For instructions on how to do this, you can refer to this article: http://blogs.technet.com/b/dpm/archive/2011/06/28/how-to-limit-dynamic-rpc-ports-used-by-dpm-and-protected-servers.aspx.