Skip Ribbon Commands
Skip to main content

Protecting Systems with Data Protection Manager 2007 - Our Experiences

 

Andrew Walman

10/01/2009

We've been using Data Protection Manager 2007 to protect our internal and hosting environments for several months now, and undertaken a few customer deployments. We've learned a few things about it during this time, and as there's relatively little about it on the internet at the moment, have decided to write up what we've found here.
 
Firstly, How we use DPM. DPM is essentially a backup and recovery tool, using a combination of disk-based backups, with tape archiving. We use it to protect all of our systems, where previously we had to use several different backup technologies - Exchange 2007, SharePoint (MOSS and WSS), SQL, Virtual Servers (Hyper-V and Virtual Server 2005) and Files. It also protects our Active Directories through system state backups. By having one centralised backup system, we have greatly reduced the administration and management involved in protecting our systems. Integration with System Center Operations Manager also means we get a much better view of our protection state.
 
Disk Based Backups
Originally we deployed DPM on Windows 2003 x64, using a PowerEdge 1850 connected to a SAN via iSCSI. Although this configuration worked, eventually the iSCSI support in Windows 2003 was unable to cope with the number of partitions that DPM created (mostly small ones for each SQL database we had, meaning there were over 300 partitions on each virtual disk). So we upgraded to Windows 2008 - big problem. Although iSCSI support is much better in Windows 2008 (and Microsoft will support DPM in this configuration), there was a memory leak in the virtual disk service, that meant after a couple of days, DPM would fall over. That was fixed by this hotfix at the beginning of December. This fixed the VDS problem, but a few weeks later a new problem began - DPM's SQL server began crashing every time the tape backup job began...
 
Tape Based Backup
Our PowerEdge is connected to a Dell TL2000 tape library, an LTO autoloader with 24 slots. We've also deployed DPM with TL4000s and standalone tape drives. It is essential to get the correct driver for your tape libary when using DPM. It took us several attempts to find the correct driver from Dell and get our TL2000 to install correctly. Make sure you uninstall the drivers correctly if you pick the wrong one - you'll know it's the wrong one if DPM doesn't see the library. With the Dell drivers, we found the library has to be in random mode (not sequential) and the drivers have to allow non-exclusive access mode (unlike for other backup products such as Backup Exec).
 
Once you've bar-coded your tapes and loaded them into your library (and set up auto-cleaning), you have to do very little with DPM. It takes care of the tapes itself - no need for media groups, labelling or anything like that. We use the DPM inteface to remove weekly/monthly tapes from the library, and to pop in new/required tapes, but other than that, it manages itself.
 
Recovery
By far the biggest advantage of DPM is the ease of recovery. Recovering an Exchange Mailbox or SharePoint document library has become as easy as recovering a file, thanks to tight integration with the protected system. Here's some notes on what we've found with each type of recovery:
 
Files: Files are by far the easiest to recover, as with DPM they require no intervention from the IT department. DPM essentially takes over from the file server's own volume snapshots (otherwise known as "previous versions"), and redirects the user's view of these to the DPM snapshot volumes.  So when a user needs to recover a file, all they do is right click the folder/drive it use to belong in (or the file itself if they need a previous version) and they get a long list of all the DPM disk based recovery points available. So end users can recover files from DPM in about three clicks. We retain 3 snapshots a day for at least 5 days using DPM, wheareas the files servers coldn't keep anywhere near that much many snapshots themselves. Things to bear in mind: FIle servers need to be patched with the DPM/VSS pre-requisites for this to happen; DPM needs to update AD to get permissions to the end-users; and you need to turn off "previous versions" on the DPM protected file servers. 
 
SQL: DPM uses the same backup technology that SQL uses natively, so SQL is aware of the backups taking place, and you'll see this reflected in Enterprise Manager. However, this doensn't mean your SQL team will be able to recover databases using Enterprise Manager in the same way that file users can. You have to use the DPM manager to do this - however you do get the ability to recover to different instances, or copy the backup to a new location. In practice, we've found it's best to protect production databases through DPM, whilst development ones are best left to SQL management for ease - you can still backup the backup files through DPM if needed.  Ensure also that DPM is the only application backing up a particular database - if you have maintenance plans doing the same job, neither DPM or Enterprise Manager will be able to sort out the resulting mess.
 
If you need to restore to alternate location, don't choose the "latest" recovery point, otherwise this option will be unavailable, so if you're using DPM to move databases, do a recovery point first.
 
Exchange: This is where DPM really pays for itself. Recovering Exchange, even Exchange 2007, is usually a long and difficult operation, requiring recovery databases, a strict sequence to be followed and lots of time. DPM makes it a simple wizard-led operation, requires no operations on the Exchange server, and can be used to recover an entire organisation, single mailbox, or item. Again you can restore to the original location, or redirect to a alternate location - even a .PST file. As with SQL and files, DPM for Exchange integrates completely with the Exchange backup API, taking care of truncating log files and meaning you can have multiple backup points available throughout the day without disrupting service.
 
SharePoint: DPM is rapidly becoming our recommended backup product for SharePoint. Of all the wokloads that DPM can protect, this is the one that requires the most configuration, and has given us the most problems, but once it's up and running, its easily the easiest to use of all the SharePoint recovery products we've used. 3 things you'll need to do to get SharePoint running with DPM:
1: Patch DPM, SQL and SharePoint with all the latest service packs and several hotfixes. As a minimum, we've needed SQL 2005 rollup 11, DPM SP1, and the SharePoint infrastructure update together with this hotfix which enables DPM to catalog SharePoint items that are not approved - without all these we were getting the error below from DPM:
 
"DPM failed to obtain catalog information as part of the backup for SharePoint farm Sharepoint Farm\SQL Server\WSS_Config on SharePointAgentServer. Your recovery point is valid, but you will be unable to perform item-level recoveries using this recovery point. (ID 3103)"
 
2: Create a "recovery farm". We use a virtual server that has MOSS and SQL installed, patched to the same level as the live enviroment. You need to configure SharePoint, and create a single site named DPMRecoveryWebApplication. Further details are here. You will need to ensure your recovery farm has enough disk space to hold your SharePoint databases - we attach our virtual server to a iSCSI disk for this purpose. 
 
3: Deploy the DPM agent to both your production and recovery SharePoint servers (if you have multiple front-end procduction servers, only one needs the agent). The run "configuresharepoint.exe" from the DPM\bin directory on each server. In DPM SP1 there are a few new options to this command, so with SP1 you'll need to enter as a minimum "configuresharepoint.exe -enableshareppointprotection" (you can use other options to support protecting indexes now, and if you have SQL mirroring - see here).
 
You'll now be able to add the SharePoint farm to a protection group, and choose the recovery farm during recovery operations. Make sure you havn't protected any SQL databases that form part of the farm using SQL protection through DPM, otherwise you won't be able to select the farm for protection.
 
 
 
 
​​

 About us

Fuse Collaboration Services is a Cloud Solution Provider and Microsoft Gold Partner specialising in delivering SharePoint, Skype for Business, and Azure cloud-based solutions. Based in Northampton, UK.

Microsoft Gold Partner Logo showing 5 competencies

Read more

 Latest Tweets

 Latest Blog

 

 

How to use SaaS solutions to identify sensitive data1497<p class="lead">​​​​​​​​​​​This article is going to look specifically at how we implement the use of software (SaaS) to enable your organisation to become ready for the GDPR quickly and easily, without interruption to your end users.</p><p> <strong>The first step in getting ready for the GDPR is to know what data your organisation holds</strong>. At the time of writing this article, the new legislation is only <strong>268 </strong>days away and the four main questions you n​eed to be able to answer to ensure your organisation is ready are&#58;</p><ul><li>What data does your organisation hold?</li><li>Where is the data kept?</li><li>Why do you need to use or keep the data?</li><li>Do you have consent to use the data?​</li></ul><div class="thumbnail"> <img class="img-responsive" alt="A padlock on a background of binary data" src="/ourblog/PublishingImages/Pages/How-to-use-SaaS-solutions-to-identify-your-data,-ensuring-your-organisation-is-ready-for-the-GDPR/shutterstock%20Data%20protection%20GDPR%20blog.jpg" style="max-width&#58;500px;" />​</div>​ <h3>What is defined as sensitive data under the GDPR?</h3><p>In terms of the GDPR, sensitive data is defined as personal data, but goes further than the Data Protection Act and includes online identifiers such as an IP address. The GDPR applies to both automated personal data and manual filing systems. You can be held responsible for breaching the GDPR by allowing personal data to be compromised either by&#58;</p><p>Misuse - using data for purposes other than that defined and recorded&#160;consent given for;</p><p>or </p><p>for data breaches, even if the breach was a malicious act (hacking), if you can't prove you had adequate data security measures and processes.&#160;​</p><div class="row"><div class="col-md-6"><h4>Will my company have GDPR sensitive data?</h4><p>Data that can identify any individual, such as a name, National Insurance number, passport, IP address or even biometric data - a soon as this is recorded in any system, in a file, a database record, or even on paper - that data then falls under the remit of the GDPR. As every organisation has staff records, every company will be affected by GDPR to some extent. </p><p>However, the more individuals you deal with, and the longer you hold that data for, the more prone you are to breaches of the legislation. Companies that perform data processing, even on behalf of other companies, and particularly those that use personal data records for multiple purposes (for example re-marketing) are at most exposure to GDPR.</p></div> <div class="col-md-6"><h4>​Examples of who will be most affected&#58;&#160;</h4><ul><li>Retailers – High street shops and online retailers storing customer profiles</li><li>Health Sector -&#160; Hospitals, doctor’s surgeries, scientific research organisations, pharmaceutical companies, with patient records</li><li>Education sector - Schools, colleges and universities, storing current and past student records</li><li>Financial sector – Banks, mortgage and insurance providers, with customer accounts</li><li>Recruitment companies - candidate records</li><li>Charity organisations - records of donors and recipients</li><li>Estate Agents - vendor and client records </li><li>Legal profession – Solicitors, CPS and courts - client records.</li></ul> ​</div></div><hr />​ <h3>​How to identify data and ensure all your data is GDPR compliant?&#160;</h3><p>There is an easy and quick way to find out what data you hold and you will be relieved to know we work alongside companies that are currently releasing SaaS solutions that are designed purely to scan, discover and analyse your data, to ensure you only hold data that is GDPR compliant.&#160;&#160;<br></p><p>Our Partners have solutions that use metadata to scan and analyse data which has enabled the migration of data to SharePoint for some time. It’s this technology that’s enabled these new solutions to be <strong>created specifically for the use of identifying what data you have and if it is GDPR compliant</strong>. Using NPL (Natural programming language) such as “name”, “address” or “credit card number”) this process can be done in days not months and can easily identify documents in unstructured databases, file shares and SharePoint. </p><p>The discovery phase of the SaaS tool is an important part of the new solutions as they are designed around common datatypes that can be tagged easily e.g. names, addresses, age of document, author of document, credit card numbers, postcodes IP addresses. The solution we use comes with predetermined taxonomies which can be edited easily, to reflect the sector that your organisation works within. Dashboards are then accessed with detailed data analysis which identifies the data that will not be compliant with the GDPR. Additional columns appear alongside your files with a “true” or “false” label showing whether the files are compliant with the GDPR and our team of consultants are experienced in using this technology and can advise you depending on your specific IT infrastructure.</p><hr /><h3>Hype around the GDPR&#160;</h3><p>There is a lot of hype around the new GDPR coming out in May which appears to be fairly negative but instead of viewing it as a tiresome challenge that your organisation must overcome, I would advise viewing it as an excellent opportunity to gain a competitive edge within the market. Whatever your opinion is and I doubt there are many companies that relish the additional resources that will be needed to comply; from a customer’s perspective, it <strong>must </strong>be a good thing. The trust in any business relationship is one of the fundamental reasons why you have a successful company. In an age where we frequently see headlines describing yet another data breach, damage to a business’s brand and reputation is an expensive result of avoiding being compliant with the new regulations.</p><hr /><h3>What to do right now!&#160;</h3><p>The key decision makers in your organisation need to be made aware of the GDPR. They need to know that the first thing they need to do is to find out what data their organisation holds. This is where we come in.</p><p>Although GDPR isn’t an IT issue as it will ultimately fall to the responsibility of who is currently responsible for your Data Protection E.g. Compliance Managers, Data Protection Officers, Data Controllers and Office Managers, the team at Fuse will be able to provide a technical solution to determining what data is held.</p><p>Before any amendments to existing internal procedures, policies or customer facing documentation such as websites and application forms can be changed they must know what is relevant to the GDPR. It may be the case that a lot of the data you hold is ROT and this can simply be deleted. If you have a completely unstructured filing system and want to take the opportunity to improve the efficiency of your business we don't just offer technical expertise, we are experienced in developing proofs of concept, functional and technical specifications. We can either then take responsibility for delivering the project or work alongside your IT departments providing a technical lead.</p><p>It doesn’t matter whether you have an inhouse IT department or not as we can work alongside existing IT managers, Compliance or HR managers. An IT consultancy needs to be your first port of call as they can advise you as to which is the best SaaS solution for your business depending on the size of your business and your budget. Having expert knowledge of your IT infrastructure and how it works is important to ensure that the right solutions are used. The benefits of using SaaS is that your end users are not interrupted and your IT departments are not impacted either. </p><p>You need to weigh up the cost of using an IT consultancy who can implement the right tools against the extra resources it will take to trawl through and analyse your data manually. This can seem daunting, but it’s a great opportunity to get your data in order and have confidence that your organisation can be proud of its commitment to protecting the data of its employees, customers and suppliers.​</p><div class="well well-lg"><p class="lead">If you want further advice or a quote on how we can help you get ready for the GDPR call Fuse today on 01604 797979 or <a href="/_layouts/15/FIXUPREDIRECT.ASPX?WebId=4fc45909-2b6d-48b9-bcf9-a446e9d472d6&amp;TermSetId=c98895cd-d37f-4406-9cff-5480b4f829b6&amp;TermId=218eb0be-10f6-490a-82a7-a7fd47c8de90">contact us​</a></p></div>​l.ozier@fusecollaboration.com | Louise Ozier | 693A30232E777C6675736563735C6C2E6F7A696572 i:0#.w|fusecs\l.ozier28/08/2017 23:00:002017-08-28T23:00:00Z Ensuring your organisation is ready for the GDPR19/09/2017 23:16:251671htmlFalseaspx

 Contact us

Our address
12-14 Brookfield, Duncan Close
Moulton Park, Northampton
NN3 6WL
P: +44(0)1604 797979
Contact Us