Installing CIM agent for Windows - IBM

Exchange 2003 VSS-Based
Backup/Restore Solution for IBM
TotalStorage DS8000 and DS6000
with Veritas NetBackup 6.0
Configuration and „best practices‟ whitepaper.

Authors
Roland Mueller i , Kent Swalin ii , David Hartman iii , Rob Wilde iv
Created on: November 29th, 2005
Latest update: March 7 th , 2007, Revision 0.06I
Trademarks
© Copyright IBM Corporation 2007
IBM Systems and Technology Group
Route 100
Somers, NY 10589
Produced in the U.S.A.
May 2006
All Rights Reserved
IBM, the IBM logo, the eServer logo, Enterprise Storage Server, xSeries,
TotalStorage, TotalStorage, FlashCopy, Power5, PowerPC, Virtualization Engine, AIX,
are trademarks or registered trademarks of International Business Machines
Corporation in the United States, other countries or both.
UNIX is a registered trademark of The Open Group in the United States and other
countries.
Microsoft, Windows and Windows NT are registered trademarks of Microsoft
Corporation in the United States, other countries, or both.
Symantec, the Symantec logo, Veritas, the Veritas logo and NetBackup are
trademarks or registered trademarks of Symantec Corporation or its affiliates in the
U.S. and other countries
Other company, product and service names may be trademarks or service marks of
other companies.
All other trademarks are property of their respective owners.
Copyright © 2007 Veritas Corporation. All rights reserved.
No part of this document may be reproduced or transmitted in any form without
written permission from IBM Corporation.
Any statements regarding IBM‟s future direction and intent are subject to change or
withdrawal without notice, and represent goals and objectives only. Product data has
been reviewed for accuracy as of the date of initial publication. Product data is
subject to change without notice. This information could include technical
inaccuracies or typographical errors. IBM may make improvements and/or changes
in the product(s) and/or programs(s) at any time without notice. References in this
document to IBM products, programs, or services does not imply that IBM intends to
make such products, programs or services available in all countries in which IBM
operates or does business. Any reference to an IBM Program Product in this
document is not intended to state or imply that only that program product may be
used. Any functionally equivalent program, that does not infringe IBM‟s intellectually
- 2 -

property rights, may be used instead. It is the user‟s responsibility to evaluate and
verify the operation of any non-IBM product, program or service.
DISCLAIMER
This document could include technical inaccuracies or typographical errors. IBM may
make changes, improvements or alterations to the products, programs and services
described in this document, including termination of such products, programs and
services, at any time and without notice. Any statements regarding IBM‟s future
direction and intent are subject to change or withdrawal without notice, and
represent goals and objectives only. The information contained in this document is
current as of the initial date of publication only, and IBM shall have no responsibility
to update such information.
Performance data for IBM and non-IBM products and services contained in this
document was derived under specific operating and environmental conditions. The
actual results obtained by any party implementing and such products or services will
depend on a large number of factors specific to such party‟s operating environment
and may vary significantly. IBM makes no representation that these results can be
expected or obtained in any implementation of any such products or services.
THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS-IS” WIHTOUT ANY
WARRANTY, EITHER EXPRESS OR IMPLIED. IBM EXPRESSLY DISCLAIMS ANY
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR
INFRINGEMENT.
References in this document to IBM products, programs, or services does not imply
that IBM intends to make such products, programs or services available in all
countries in which IBM operates or does business. Any reference to an IBM program
or product in this document is not intended to state or imply that only that program
or product may be used. Any functionally equivalent program or product, that does
not infringe IBM‟s intellectually property rights, may be used instead. It is the user‟s
responsibility to evaluate and verify the operation of any non-IBM product, program
or service.
The provision of the information contained herein is not intended to, and does not
grant any right or license under any IBM patents or copyrights. Inquiries regarding
patent or copyright licenses should be made, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.
- 3 -

CONTENTS
EXECUTIVE SUMMARY 7
WHY THIS SOLUTION MATTERS 7
Cost of downtime 7
Target environment 7
IBM TOTALSTORAGE DS8000 SERIES 8
IBM TOTALSTORAGE DS6000 SERIES 9
INSTALLING CIM AGENT FOR WINDOWS 10
Installation overview for Windows 10
Installing the CIM agent on Windows 12
Verifyinbg the CIM agent installation on Windows 20
Configuring the CIM agent for Windows 21
Configuring the CIM agent to run in unsecure mode 24
Verifying the CIM agent connection on Windows 24
DS OPEN API SUPPORT FOR MICROSOFT VOLUME SHADOW COPY AND
VIRTUAL DISK SERVICES FOR WINDOWS 29
DS Open API support for Microsoft VSS and VDS overview 29
DS Open API support for Microsoft VSS and VDS installation overview 30
DS Open API support for Microsoft VSS and VDS installation requirements 31
Installing the DS Open API support for Microsoft VSS and VDS on Windows 32
Verifying the DS Open API support for Microsoft VSS and VDS Windows installation 39
Creating the VSS_FREE and VSS_RESERVED pools for Microsoft VSS 40
Verifying DS Open API support for Microsoft VSS and VDS Windows configuration 41
DS Open API support for Microsoft VSS and VDS reconfiguration commands 41
- 4 -

Error codes returned by Microsoft VSS and VDS 44
INSTALLING VERITAS NETBACKUP 45
NetBackup Server Installation Requirements 46
Additional Requirements for Remote and MSCS Cluster Installations 49
NetBackup License Key Requirements 49
Installing NetBackup Server Software 50
INSTALLING NETBACKUP CLIENT SOFTWARE 57
Installation Overview 57
User-Directed Operations for Windows Systems 57
System Requirements 58
Installation Instructions 58
NetBackup Client Configuration 60
A Note Regarding Service Packs 61
HOW TO CONFIGURE NETBACKUP FOR OFFHOST BACKUP OF
MICROSOFT EXCHANGE 61
How to Make the Master Server Recognize the Media Server 62
How to Create a Disk Storage Unit on the Media Server 64
How to Create a Backup Policy for Microsoft Exchange 66
How to Customize the Backup Policy for Offhost Backups 72
How to Perform a Manual Backup 77
How to Perform a Restore 78
USING NETBACKUP FOR MICROSOFT EXCHANGE WITH ADVANCED
CLIENT 82
NetBackup Advanced Client Overview 82
Supported Platforms 82
How Does Advanced Client Work? 83
Choosing a Backup Option 83
- 5 -

What Is Backed Up? 83
Limitations 84
Consistency Checks on Database and Log Files 84
Configuring a Snapshot Backup 84
Configuration Requirements 84
Configuration Tips for Exchange 85
Configuration Steps 85
Configuring an Advanced Client Policy for NetBackup for Exchange Server 85
Performing User-Directed Backups of Exchange Server 87
Restoring Snapshot Images 88
Restore Options 89
Performing a Snapshot Restore 90
Manually Mounting a Database After a Restore 92
Redirecting a Restore to a Different Client 92
RECOMMENDATIONS 93
Restrictions 93
Conclusion 93
APPENDIX 94
Solution component information 94
Hardware Configuration 94
Host Configuration 94
HBA Configuration 94
Storage Subsystem Configuration 94
Switch Configuration 95
Software Configuration 96
Exchange 2003 Server installed patches 97
- 6 -

Executive Summary
Customers rely on Microsoft Exchange, SQL Server, and various internet/intranet
applications as key business applications. Even short periods of unexpected downtime
can have a serious impact. The capability of backing up and restoring data quickly and
consistently is essential. The problems in backing up data, such as backup jobs
frequently overflowing their backup time window, and having open files and open
applications issues, led to the development of snapshots.
The capability to take snapshots has been around for several years. Snapshots allow
administrators to “snap” a copy of data while allowing applications to continue running.
Applications would pause just long enough to allow the disk system to create the snap
copy. These volumes could then be mounted to another server for backing up to various
storage devices. Snapshots, however, depended on hardware and software compatibility
which was problematic, inducing errors that were difficult to track and resolve. In
addition, the vendors needed to support various versions of SQL Server, Microsoft®
Exchange, Windows® files and applications.
Microsoft developed VSS (Volume Shadow copy Service) as a common framework to
resolve these issues. Available in Windows Server 2003, software and hardware vendors
now have a common interface model for generating snapshots. The VSS framework
specifies how three distinct components should interact. The three different components
are the requestor, writer, and provider. The requestor is typically the backup software.
The writer is the application software such as SQL server or Exchange that would pause
to allow the snapshot to be taken. The provider is the specific hardware/software
combination that will generate the snapshot volume.
Why this solution matters
Businesses have grown to rely on access to their Microsoft Exchange servers to address
the increasing demands of mobile computing, global business and electronic commerce.
They depend on Exchange e-mail, group scheduling, and calendars for critical business
communication and key business processes. E-mail also supports vital applications
needed for functions such as workflow, collaboration, and knowledge management.
According to Microsoft, nearly 45 percent of business-critical information is housed in email
and e-mail-attached documents.
Cost of downtime
When a critical system like an Exchange server goes down, data, productivity, and money
may be lost. For a typical business that has 500 active users on an Exchange server, if
access to that server is lost for two hours the company may experience a productivity
loss of as much as 1000 employee hours, which can equate to tens of thousands of
dollars. That doesn‟t consider other losses, such as missed communications from
partners, damaged customer relations, or simply lost deals.
Target environment
The IBM® TotalStorage® DS6000 and DS8000 series storage arrays target medium to
large size customers seeking enterprise level reliability, availability, and serviceability
(RAS), combined with support of advanced copy features such as FlashCopy®, Metro &
- 7 -

Global Mirror. In a large environment, it is not uncommon to have multiple DS6000 and
DS8000 arrays deployed in a complimentary fashion. The DS8000 series is designed to
scale to the needs or the largest enterprise data centers.
Customers deploying these arrays for Exchange-based solutions will typically have
installations that range from several servers hosting a thousand or more users on a
DS6000 at a single site, to a fully-loaded DS8000 multi-node array hosting tens of
thousands of users. Usually, the latter types of deployments include geographically
dispersed clusters with multi-site data replication enabled.
This initial version of NetBackup 6.0 for Microsoft Exchange does not have instant
recovery capabilities enabled, though future releases may support this functionality.
Therefore, this solution may not be ideal for customers seeking the absolute lowest
recovery time objective (RTO). During lab testing of this solution, average recovery time
for a single Storage Group with a 50GB database was ~20 minutes (vs. ~ 5 minutes for
instant recovery). However, this solution may be suitable for many installations of the
DS6000 or DS8000 with VSS and Veritas NetBackup.
While faster than tape-based recovery methods, this should be considered against RTOs
and service level agreements (SLA) if applicable.
IBM TotalStorage DS8000 Series
Created specifically for medium and large enterprises, the IBM TotalStorage® DS8000
series offers high-capacity storage systems that are designed to deliver a generationskipping
leap in performance, scalability, resiliency and value.
The DS8000 series is designed to provide exceptional performance while adding
virtualization capabilities that can help you allocate system resources more effectively and
better control application quality of service. The DS8000 series also offers powerful
functions that are designed to help protect data from unforeseen events and maintain
data availability, which can benefit businesses that must have round the clock access to
information.
� Exceptional flexibility and scalability. The current physical storage capacity of the
DS8000 series system can range from 1.1TB to 192TB, and it has an architecture
designed to scale to over a petabyte.
� Significant addressing enhancements, IBM TotalStorage FlashCopy, Global and
Metro Mirror functions, and streamlined configuration and management
capabilities through the easy to use IBM DS Storage Manager are just some of the
many additional advanced features of the DS8000 series.
� Innovative design creates impressive performance. The DS8000 models are as
much as six times faster than the IBM TotalStorage Enterprise Storage Server®
(ESS) Model 800.
� Utilizing IBM POWER5 processor technology, the DS8000 series delivers the first
use of the IBM Virtualization Engine, which is designed to bring to a disk storage
system the logical partition flexibility usually reserved for servers.
- 8 -

IBM TotalStorage DS6000 Series
The IBM TotalStorage DS6000 series is a member of the family of DS products and is
built upon 2 Gbps fibre channel technology that provides RAID-protected storage with
advanced functionality, scalability, and increased addressing capabilities.
The DS6000 series is designed to offer a high reliability and performance midrange
storage solution through the use of hot-swappable redundant RAID controllers in a space
efficient modular design. The DS6000 series provides storage sharing and consolidation
for a wide variety of operating systems and mixed server environments.
The DS6000 series is designed to offer high scalability while maintaining excellent
performance. With the DS6800 (Model 1750-511), you can install up to 16 disk drive
modules (DDMs). The minimum physical storage capability with 4 DDMs is 292 GB. The
maximum physical storage capability with 16 DDMs for the DS6800 model is 4.8 TB.
If you want to connect more than 16 disks, you use the optional DS6000 expansion
enclosures (Model 1750-EX1) that allow a maximum of 128 DDMs per storage system and
provide a maximum physical storage capability of 38.4 TB.
The DS6800 measures 5.25-in. high and is available in a 19-in. rack mountable package
with an optional modular expansion enclosure of the same size to add capacity to help
address your growing business needs.
The DS6000 series addresses business efficiency needs through its heterogeneous
connectivity, high performance and manageability functions, thereby helping to reduce
total cost of ownership.
The DS6000 series offers the following major features:
� PowerPC® 750GX processors
� Dual active controllers are designed to maintain operations through the use of two
processors that form a pair to back up the other
� A selection of 2 GB Fibre Channel (FC) disk drives, including 73 GB, 146 GB, and
300 GB sizes with speeds of 10,000 or 15,000 revolutions per minute (RPM)
� 2 GB Fibre Channel and FICON host attachments of up to 8 ports, which can be
configured with an intermix of Fibre Channel Protocol (FCP) and FICON
� Fibre Channel Arbitrated Loop (FC-AL) switched device attachment of up to 2 dual
loops
� Battery backed mirrored cache
� Redundant power and cooling system
� Disaster Recovery and Copy Service solutions
You can also view the DS6000 e-learning overview from the DS6000 Storage Manager
Welcome page or at http://www-
1.ibm.com/support/docview.wss?rs=1112&uid=ssg1S7001165. The e-learning overview
provides an animated presentation about installation and configuration, service and
support, and management tasks.
- 9 -

Installing CIM agent for Windows
The CIM Agent for DS Open (API) is middleware that provides a CIM-compliant interface
for applications that require it or can make use of it. Elsewhere you may see this (and
other interfaces into DS Open) referred to generically as the DS Open API. The Agent
code provides a CIM API into the IBM TotalStorage DS8000.
This section includes an overview of the installation process and instructions for installing
and configuring the CIM agent on a Windows 2000 or later, operating system. It should
be noted that although this solution places the CIM agent on a separate Windows 2000 or
later server, that is not a requirement. The CIM agent can actually be installed on any
server (including the Exchange or NetBackup servers), as well as on Linux® & AIX®
hosts.
Installation overview for Windows
This section provides an overview of the installation and configuration of the CIM agent
on a Windows 2000 or later, operating system. Ensure that you have knowledge of how
to administer a Windows 2003 (or later) operating system before you install the CIM
agent. Also be familiar with the commands that you use during installation and
configuration of the CIM agent. The following list of installation and configuration tasks is
in the order in which they should be performed:
- 10 -

1. Before you install the CIM agent for Windows, check the hardware and software
requirements.
2. If you are managing ESS storage units, you must install the prerequisite ESS CLI
level 2.4.0.236 (or higher) software. The ESS CLI must be installed first because
the CIM agent sets the path information in shell scripts for you based on the
location of the ESS CLI. The CIM agent installation wizard checks your system for
the existence of the ESS CLI, and the wizard displays a warning message if ESS
CLI is not installed. For ESS CLI installation instructions, see the IBM TotalStorage
Enterprise Storage Server Command-Line Interfaces User’s Guide. This guide is
available at http://publibfp.boulder.ibm.com/epubs/pdf/f2bcli04.pdf
Attention: If you are upgrading from a previous version of the CIM agent, you
must upgrade the ESS CLI software to the new level required which is a minimum
level of 2.4.0.236.
3. You can choose to install the CIM agent either in graphical mode with the help of
an installation wizard or in unattended mode (also known as silent mode), which
involves customizing a response file and issuing a command.
4. Verify the CIM agent Windows installation.
5. Configure the CIM agent for Windows. You might want to revisit the configuration
section in the future as you add, change, or delete CIMOM authentication and
storage unit information.
6. Verify the connection to your storage unit.
7. Optionally, remove the CIM agent. You only need to perform this optional task if
you get errors during installation verification or if the CIM agent did not set the
environment variables.
- 11 -

Installing the CIM agent on Windows
This section includes the steps to install the CIM agent in your Windows environment.
You must satisfy all prerequisites before you begin the CIM agent installation.
After the completion of installation, you must verify the installation of the CIM agent.
Before you install the CIM agent on Windows, verify that your system meets the
hardware and software requirements.
1. Log on to your system as the local administrator.
2. Insert the CIM agent CD into the CD-ROM drive. The CIM agent program should
start within 15 - 30 seconds if you have autorun mode set on your system. If the
LaunchPad window does not open, perform the following steps:
a. Use a Command Prompt or Windows Explorer to change to the Windows
directory on the CD.
b. If you are using a Command Prompt window, type: LaunchPad
c. If you are using Windows Explorer, double-click on the LaunchPad.bat
file.
Note: If you are viewing the folder with Windows Explorer with the option
selected to hide file extensions for known file types, find the LaunchPad file
with the file type of MS-DOS Batch File.
3. The following options are displayed when the LaunchPad window opens:
CIM Agent overview
Offers information about the CIM agent
Readme file
Offers any last minute product information that did not make it into this
installation guide
Installation guide
Offers instructions on how to install the CIM agent (a softcopy of this
document)
License agreement
Offers information about the license for the CIM agent
CIM Agent Web site
Offers information from the product Web site
MOF Documentation
Offers information about MOF documentation
Installation wizard
Starts the CIM agent installation program
Post installation tasks
Offers information about configuring users and storage unit communication
Exit
Exits the CIM agent LaunchPad program
- 12 -

4. Click the Readme file from the LaunchPad window or from the README.txt file
located in the doc or Windows directory on the CIM agent CD to check for
information that might supersede the information in this guide.
5. Click Installation wizard from the LaunchPad window to start the installation.
The LaunchPad window remains open (behind the wizard) during the installation.
You can access product information after the installation has started. The
LaunchPad returns to the foreground when the installation is complete. You can
click Exit to close the LaunchPad.
6. There might be a slight delay while the software loads on your system. After the
software loads a DOS prompt window opens to display the following message:
Initializing InstallShield Wizard... Preparing Java (tm) Virtual Machine……………..
7. The Welcome window opens suggesting what documentation you should review
prior to installation. Click Next to continue, or click Cancel to exit the installation.
- 13 -

8. The License Agreement window opens. Read the license agreement information.
Select I accept the terms of the license agreement, then click Next to accept
the license agreement. Otherwise, keep the selection I do not accept the terms
of the license agreement (it is the default) and click Cancel to exit the
installation.
9. If the installation wizard detects a prior installation of the CIM agent, the Product
Installation Check window opens. Check the Preserve Configuration check box if
- 14 -

you want to preserve your configuration settings. Follow any specific instructions
in the window. For example, the figure below shows a warning to stop running
services. Once you have followed all instruction, select Next.
10. The IBM ESS CLI Check window opens. The wizard verifies that you have the IBM
ESS CLI installed if you are managing ESS storage units.
Note: The window is not displayed if you have the required version of the ESS CLI
already installed.
- 15 -

11. The Destination Directory window opens. Click Next to accept the default directory
where setup will install the files, or click Browse to select a different directory for
installation and then click Next.
Note:
a. The Destination Directory window is displayed only if a version of CIM
agent is not already installed. Otherwise, the CIM agent is reinstalled or
upgraded to the same install location.
- 16 -

. If the program detects insufficient space for the CIM agent installation in
the chosen destination, an error message is displayed. You can free some
space on the destination drive and then click Next or you can stop the
installation program by clicking Cancel. You can also go back by clicking
Back, and choose another destination directory for the product.
12. The Updating CIMOM Port window opens. Click Next to accept the default port. If
the default port is the same as another port already in use, modify the default port
and click Next. Use the following command to check which ports are in use:
netstat -a
a. Either accept HTTPS as the communication protocol or select another
protocol.
b. Click Next to continue with installation, or click Cancel to exit the wizard.
13. The Installation Confirmation window opens. Click Install to confirm the
installation location and file size. You can click Cancel to exit the installation
wizard or go back to the previous window by clicking Back.
- 17 -

14. The Installation Progress window opens indicating how much of the installation has
been completed. Installation usually takes 3 - 10 minutes depending on the
configuration of your machine. You can click Cancel to exit the installation wizard.
Note: If you click Cancel, a popup window opens asking you to confirm the
cancellation of the installation wizard: “Cancel the current operation? Yes No”. Be
aware that if you confirm the cancellation by clicking Yes, the information you
entered or selected in previous windows is not saved. You must start the
installation again from the first step.
- 18 -

15. When the Installation Progress window closes, the Finish window opens. You can
choose to view the post installation tasks by selecting the View post installation
tasks checkbox, or you can deselect the checkbox and continue with the post
installation tasks described in this manual. Click Finish to exit the installation
wizard.
Note: Before proceeding, you might want to review the log file for any possible
error messages. The log file is located in xxx\logs\install.log, where xxx is the
destination directory where the CIM agent for Windows is installed. The install.log
contains a trace of the installation actions.
- 19 -

16. Exit the LaunchPad program by clicking Exit on the LaunchPad window. If you
have not done so already, continue with the post installation tasks for the CIM
agent using the instructions in the following sections.
Note: Ordinarily, you do not need to restart your system during or after the
installation of the CIM agent. However, the installation wizard might determine
that a restart is necessary. Restart your system if required. After you restart the
system, the installation wizard continues with the installation.
Verifying the CIM agent installation on Windows
This task verifies that your CIM agent is installed correctly on your Windows operating
system.
Steps:
Perform the following steps to verify your CIM agent installation on your Windows
operating system:
1. Verify the installation of the Service Location Protocol (SLP).
a. Verify that SLP is started. Select Start -> Settings -> Control Panel.
Double-click the Administrative Tools icon. Double-click the Services icon.
b. Find Service Location Protocol in the Services window list. For this
component, the Status column should be marked Started and the Startup
Type column should be marked Manual. If those conditions are not met,
right-click on the SLP and select Start from the pop-up menu. Wait for the
Status column to be changed to Started
c. Do not close the Services window because you will also use it to verify the
CIM object manager (CIMOM) service.
2. Verify the installation of the CIM agent.
a. Verify that the CIMOM service is started. If you closed the Services window,
select Start -> Settings -> Control Panel. Double-click the
Administrative Tools icon. Double-click the Services icon.
b. Find CIM Object Manager - DS Open API in the Services window list. For
this component, the Status column should be marked Started and the
Startup Type column should be marked Automatic. If those two conditions
are not met, right click on the CIM Object Manager - DS Open API and
select Start from the pop-up menu. Wait for the Status column to change
to Started.
c. Close the Services window.
d. Close the Administrative Tools window.
- 20 -

If you are able to perform all of the verification tasks successfully, the DS CIM agent has
been successfully installed on your Windows system. Next, perform the required
configuration tasks.
Configuring the CIM agent for Windows
This task configures the CIM agent after it has been successfully installed. This section
repeats the instructions in the Post Installation Tasks option that you open from the
LaunchPad window.
You can also use the modifyconfig command to change the configuration of some of the
parameters that were configured during installation. You can change the CIM agent port
value, protocol (HTTP/HTTPS), and enable or disable the debug option.
Steps:
Perform the following steps to configure the CIM agent:
1. Ping each ESS and DS that the CIM agent will manage by typing the following
command:
a. Open a command prompt window and issue a ping command; for example:
ping 9.11.111.111
where 9.11.111.111 is and ESS or DS IP address
b. Check that you can see reply statistics from the IP address. The following is
example output:
c. Pinging 9.11.111.111 with 32 bytes of data: Reply from 9.11.111.111: bytes=32 time

The following is example output:
A provider entry for IP 9.11.111.111 successfully added
b. Type the following command for each ESS configured for Copy Services or
for each DS server the CIM agent will access:
>>> addessserver 9.11.111.111 essuser esspass 9.22.222.222
where
– 9.11.111.111 represents the IP address of the ESS or DS server
– essuser represents a user name for the server
– esspass represents the password for the user name
– 9.22.222.222 represents the alternate IP address of the server
Note: Specifying an alternate IP address is optional. The alternate IP
address is used if a connection cannot be made using the primary IP
address. The following is example output:
An essserver entry for IP 9.11.111.111 successfully added
3. Repeat step for each additional storage unit that you want to configure.
4. Close the setdevice interactive session by typing exit.
5. Once you have defined all the servers, you must stop and restart the CIMOM to
make the CIMOM initialize the information for the servers. Because the CIMOM
collects and caches the information from the defined servers at startup time, the
starting of the CIMOM might take a longer period of time the next time you start
it.
Perform the following steps to use the Windows Start Menu facility to stop and
restart the CIMOM:
a. Stop the CIMOM by selecting Start -> Programs -> CIM agent for IBM
DS Open API -> Stop CIMOM service. A command prompt window
opens to track the stoppage of the CIMOM.
Note: You might see an error message pop-up window that is labeled
“java.exe - Application Error”. You must click OK to close that window to
continue.
If the CIMOM has stopped successfully, the following message is displayed:
The CIM Object Manager for DS Open API service was stopped successfully. Press any key to
close the command prompt window.
b. Restart the CIMOM by selecting Start -> Programs -> CIM agent for
IBM DS Open API -> Start CIMOM service. A command prompt window
opens to track the progress of the CIMOM start process. The restarting of
the CIMOM can take a while because it is connecting to the defined servers
and is caching that information for future use. If the CIMOM has started
successfully, the following message is displayed:
- 22 -

The CIM Object Manager for DS Open API service was started successfully.
Press any key to close the command prompt window.
6. Use the setuser interactive tool to configure the CIMOM for the users with
authority to use the CIMOM.
Note: The users you configure to use the CIMOM are uniquely defined to the
CIMOM software and have no required relationship to operating system user
names, the DS Storage Manager user names, or the Copy Services user names.
Upon installation of the CIM agent, the provided default user name is “superuser”
with a default password of “passw0rd”. The first time that you use the setuser
tool, you must use this user name and password combination. Once you have
defined other user names, you can start the setuser command by specifying other
defined CIMOM user names.
Note: The CIMOM must be running before you can use the setuser command.
a. Open a Command Prompt window and change directory to the CIM agent
directory; for example:
C:\Program Files\IBM\cimagent
b. Type the following command at the command prompt to start the setuser
interactive session to identify users to the CIMOM:
setuser -u superuser -p passw0rd
c. Type the following command in the setuser interactive session to define
new users:
>>>adduser cimuser cimpass
where
� cimuser represents the new user name that can access the CIM
agent CIMOM
� cimpass represents the password for the new user name that
can access the CIM agent CIMOM
The following is example output:
An entry for user cimuser successfully added where cimuser is the new user name.
7. Repeat step 6c for each additional user name that you want to configure.
8. You can change the default password for “superuser” by starting the setuser
command and by providing a user name and password. Issue the setuser
interactive session command to change the password for the superuser:
>>>chuser superuser newpasswd
where newpasswd is the new password for the superuser.
- 23 -

You can also delete the superuser by issuing the following setuser interactive
session command:
>>>rmuser superuser
9. Close the setuser interactive session by typing exit.
Note: Unlike the setdevice actions, you are not required to stop and restart the
CIMOM to make the setuser actions take effect.
If you were able to perform all of the configuring tasks successfully, the CIM agent
has been successfully installed and configured on your Windows system.
Configuring the CIM agent to run in unsecure mode
Some vendor software might not be capable of communicating with the CIM agent in a
secure fashion. You can still use this vendor software by configuring the CIM agent to run
with only basic user and password security. Perform the following steps to configure the
CIM agent to run in unsecure mode:
1. Using the Windows Start Menu facility, stop the CIMOM by selecting Start ->
Programs ->CIM agent for IBM DS Open API-> Stop CIMOM service.
2. Using the Windows Services facility, stop and start the Service Location Protocol
(SLP) service by selecting Start -> Settings -> Control Panel. Double-click
Administrative Tools and double click Services. Right click Service Location
Protocol in the Name column and select Stop in the menu. After the SLP stops,
start it again by right-clicking on Service Location Protocol in the Name column
and selecting Start in the menu. After the SLP starts, close the Services Window
and the Administrative Tools Window.
3. Find the cimom.properties file and edit it with a tool such as notepad, setting the
properties as shown in the following example:
Port=5989 ServerCommunication=HTTP DigestAuthentication=False
Once the CIMOM starts, it accepts requests over HTTP using basic authentication.
Note: To completely disable security checking, set “Authorization=False” in the
cimom.properties file.
4. Using the Windows Start Menu facility, restart the CIMOM by selecting Start ->
Programs -> CIM agent for IBM DS Open API-> Start CIMOM service. The
CIMOM registers itself with SLP using the revised attributes.
5. Close this window by pressing any key when you are prompted by the following
display:
The CIM Object Manager service is starting .....
The CIM Object Manager service was started successfully
Press any key to continue ...
Verifying the CIM agent connection on Windows
- 24 -

During this task, the CIM agent software connects to the storage unit that you identified
in the configuration task.
If you are managing an ESS, perform the following steps to verify that the configuration
file for the ESS CLI (CLI.CFG) is set correctly and that you have a connection. If you are
not managing an ESS, skip to step 4 to verify that you have a connection.
1. Verify that you have network connectivity to the ESS from the system where the
CIM agent is installed. To do this, perform the following steps:
a. Open a command prompt window.
b. Issue a ping command to the ESS; for example:
ping 9.11.111.111
where 9.11.111.111 is the ESS IP address
c. Check that you can see reply statistics from the ESS IP address. The
following is example output:
Pinging 9.11.111.111 with 32 bytes of data:
Reply from 9.11.111.111: bytes=32 time

c. Verify that the CLI.CFG file is set correctly. From the command prompt
window, issue the following command:
rsTestConnection.exe /s /v primaryservername
where
� /s primaryservername represents the IP address or the complete
host name of an ESS Copy Services server.
� /v designates that all responses from the server be displayed.
Note: In some cases the ESS CLI does not work correctly unless the system has been
rebooted following the new installation of the ESS CLI.
3. Using the Windows Services Facility, verify that the SLP is active by selecting
Start -> Settings -> Control Panel. Double-click the Administrative Tools
icon. Double-click the Services icon.
a. Find the Service Location Protocol (SLP) in the Name column. For this
component, the Status column should be marked Started and the Startup
Type column should be marked Manual. If either of those conditions are
not met, right click on Service Location Protocol and click Start from the
pop-up menu. Wait for the Status to change to Started
b. Do not close the Services window, because you use it in the next step to
verify that the CIMOM is started.
4. Verify that the CIMOM is active by finding CIM Object Manager - DS Open API
in the Name column of the Services window. For this component, if the Status
column is not marked Started, right click on CIM Object Manager - DS Open
API and click Start from the pop-up menu. Wait for the Status to change to
Started.
5. Verify CIMOM registration with SLP by selecting Start-> Programs-> CIM agent
for IBM DS Open API-> Check CIMOM Registration. The window closes when
you press any key, as instructed in the output:
service: wbem:http://tpc035/ 5989, 65535
press any key to continue...
Note: If the verification of the CIMOM registration is not successful, stop and
restart the SLP and CIMOM services.
6. Use the verifyconfig command to locate all WBEM services in the local network.
This command verifies that you have configured the CIM agent and can connect to
at least one ESS. Type the verifyconfig command in another command prompt
window in the directory where the CIM agent was installed; for example:
c:\program files\ibm\cimagent verifyconfig -u -p
where username is the user name and password is the password for the user
name that you configured to manage the CIMOM.
If the command is successful, output similar to the following is displayed:
C:\program files\ibm\cimagent>verifyconfig -u guest -p guest
- 26 -

Verifying configuration of CIM agent for the IBM TotalStorage
DS Open Application Programming Interface...
Communicating with SLP to find WBEM services...
3 WBEM services found
host=9.11.111.111, port=5989
host=9.11.111.112, port=5989
host=9.11.111.113, port=5989
Connecting to CIM agent, host=9.11.111.112, port=5989
Found 2 IBMTSESS_StorageSystem instances:
2107.AZ123x
2105.2223x
Internal Server at 9.11.111.122 configured for 2107.AZ123x
Internal Server at 9.11.111.119 configured for 2105.2223x
Verification Successful
You might run into the following errors:
� Error Type 1. E CMMOM0002E CIM_ERR_ACCESS_DENIED
If you enter CIMOM user name or password that is not valid or forget to
type the CIMOM user name or password when you issue the verifyconfig
command, the following message series is displayed near the end of the
output messages:
E CMMOM0002E CIM_ERR_ACCESS_DENIED
at com.ibm.http.HTTPClient.sendRequest(Unknown Source)
at com.ibm.http.HTTPClient.sendRequest(Unknown Source)
at com.ibm.xml.XMLOperationGeneric.intrinsicMethod(Unknown Source)
at com.ibm.xml.XMLOperationGeneric.intrinsicMethod(Unknown Source)
at com.ibm.xml.XMLEnumerateInstances.enumInstances(Unknown Source)
at com.ibm.xml.CIMOMHandleXML.enumInstances(Unknown Source)
at com.ibm.cim.CIMClient.enumInstances(Unknown Source)
at com.ibm.cimom.install.VerifyConfig.enumInstances(Unknown Source)
at com.ibm.cimom.install.VerifyConfig.enumInstances(Unknown Source)
at com.ibm.cimom.install.VerifyConfig.main(Unknown Source)
FAILED requesting IBMTSESS_StorageSystem instances
� Error Type 2. CIM agent not correctly configured If any of the following are
true:
– You have never used the setdevice tool to define a storage unit to
the CIMOM
– You made an error in the IP address, user name, or password
– You did not restart the CIMOM after adding the ESS
The following message series is displayed near the end of the output
messages:
Connecting to CIM agent, host=1.11.111.111, port=5989
Found 0 IBMTSESS_StorageSystem instances
CIM agent not correctly configured
You can find more information about the possible cause of this error
message by examining the cimomx.log (where x can be a number from 1 -
9).
If you have a network connection problem or you have set an incorrect IP
address for the ESS using the setdevice tool, the ESS CLI cannot connect to
the ESS. A message pair similar to the following can appear in the log:
- 27 -

2003-10-30 08:37:03,PST-08:00 CIMOM[com.ibm.provider.ess.EssCLICmdHandler.
outputEssCliError(Unknown Source)]: ESSCLI Error
[java.lang.Object{esscli 204: The connection to the specified server was
not established.}]
2003-10-30 08:37:03,PST-08:00 E CIMOM[com.ibm.provider.ess.EssProvider.initialize
(Unknown Source)]: esscli list server failed for 9.11.111.112,
trying again... [java.lang.Object{Operation Failed. RC=2}]
If you have entered an incorrect user name or password for the ESS using
the setdevice tool, the ESS CLI can connect to the ESS but cannot
authenticate. A message pair similar to the following can appear in the log:
2003-10-30 10:32:53,PST-08:00 E CIMOM[com.ibm.provider.ess.EssCLICmdHandler.
outputEssCliError(Unknown Source)]: ESSCLI Error [java.lang.Object{esscli 510: Access was
denied by the server.}]
2003-10-30 10:32:53,PST-08:00 E CIMOM[com.ibm.provider.ess.EssProvider.initialize (Unknown
Source)]: esscli list server failed for 9.11.111.112, trying again... [java.lang.Object{Operation
Failed. RC=5}]
If you did not reboot after you installed the ESS CLI or before you ran the
CIM agent verifyconfig program, the ESS CLI will have a problem finding
an environmental variable. A message similar to the following can appear in
the log:
2003-10-29 17:26:02.608-08:00 [java.lang.Object{esscli: No value is specified for the
system variable.}] I CIMOM[com.ibm.provider.ess.EssProvider.initialize(Unknown Source)]:
store01.storage.sanjose.ibm.com IP esscli list server failed, trying again...
� Error Type 3. E CMMOM0001E CIM_ERR_FAILED(E CMMOM0001E
CIM_ERR_FAILED)
�
If you have not installed the ESS CLI on your system, the following
message series is displayed near the end of the output messages:
Connecting to CIM agent, host=1.11.111.11, port=5989 E CMMOM0001E CIM_ERR_FAILED(E
CMMOM0001E CIM_ERR_FAILED)
at com.ibm.xml.XMLOperationGeneric.processReturnStream(Unknown Source) at
com.ibm.xml.XMLOperationGeneric.intrinsicMethod(Unknown Source)
at com.ibm.xml.XMLOperationGeneric.intrinsicMethod(Unknown Source)
at com.ibm.xml.XMLEnumerateInstances.enumInstances(Unknown Source)
at com.ibm.xml.CIMOMHandleXML.enumInstances(Unknown Source)
at com.ibm.cim.CIMClient.enumInstances(Unknown Source)
at com.ibm.cimom.install.VerifyConfig.enumInstances(Unknown Source)
at com.ibm.cimom.install.VerifyConfig.enumInstances(Unknown Source)
at com.ibm.cimom.install.VerifyConfig.main(Unknown Source)
FAILED requesting IBMTSESS_StorageSystem instances
� Error Type 4. No CIM agent running or registered with SLP on current host
If the CIM agent is not started or it has not registered with SLP on the
current host, the following message is displayed in the output messages in
the Command Prompt window:
No CIM agent running or registered with SLP on current host
This completes the verification of the connection to the ESS.
- 28 -

DS Open API support for Microsoft Volume Shadow Copy
and Virtual Disk Services for Windows
This chapter includes an overview of DS Open API support for Microsoft Volume Shadow
Copy and Virtual Disk Services along with an overview of the installation process and
instructions for installing and reconfiguring Microsoft Volume Shadow Copy and Virtual
Disk Services on a Windows Server 2003 operating system. Instructions for uninstalling
Microsoft Volume Shadow Copy and Virtual Disk Services are also provided.
DS Open API support for Microsoft VSS and VDS overview
The following information provides an overview of Microsoft Volume Shadow Copy Service
and Virtual Disk Service.
Microsoft Volume Shadow Copy Service
DS Open API Support for Microsoft Volume Shadow Copy and Virtual Disk Services
controls storage units using a CIM client query.
You must install the CIM agent, a middleware application that provides a CIM-compliant
interface, before installing Microsoft Volume Shadow Copy and Virtual Disk Services. The
Microsoft Volume Shadow Copy and Virtual Disk Services use the CIM technology to
manage proprietary devices as open system devices through storage management
applications.
- 29 -

DS Open API support for Microsoft Volume Shadow Copy Service enables users to quickly
back up and restore large amounts of data on Windows Server 2003. Microsoft Volume
Shadow Copy Service coordinates with a provider and the storage unit to create a
consistent shadow copy of a volume or group of volumes at a point-in-time. Point-in-time
shadow copies ensure consistency for Microsoft Volume Shadow Copy Service-aware
writers, and also work with applications that do not support Microsoft Volume Shadow
Copy Service technology. The shadow copy can be created while the volume is mounted
and files are in use.
In order to accomplish this fast backup, a backup application initiates a shadow copy
backup. Microsoft Volume Shadow Copy Service then coordinates with the Microsoft
Volume Shadow Copy Service writers to briefly hold writes on the databases, applications,
or both. Next, Microsoft Volume Shadow Copy Service flushes the file system buffers and
asks a provider to initiate a FlashCopy of the data. Once the FlashCopy is logically
complete, Microsoft Volume Shadow Copy Service allows writes to resume.
The volumes are then mounted hidden and read-only, to be used when rapid restore is
necessary. Alternatively, the volumes can be mounted on a different host and used for
application testing or backup to tape.
Microsoft Virtual Disk Service
DS Open API Support for Microsoft Virtual Disk Service provides a single vendor and
technology neutral interface designed to manage block storage virtualization, whether
done by OS software, RAID storage hardware, or other storage virtualization engines.
Microsoft Virtual Disk Service is designed to enable the management of heterogeneous
storage systems, by using both client and provider APIs. The service is designed to allow
you to perform the following functions:
� List Information about:
o Providers
o Subsystems
o Controllers
o LUNs
o Drives
� Create or delete LUNs
� Configure LUNs automatically, which facilitates dynamic reconfiguration by
hardware in response to load or fault handling.
DS Open API support for Microsoft VSS and VDS installation
overview
- 30 -

This section provides an overview of the installation and configuration of Microsoft Volume
Shadow Copy and Virtual Disk Services on a Windows Server 2003 operating system. You
should have some knowledge of how to administer a Windows Server 2003 operating
system before you install Microsoft Volume Shadow Copy Service or Virtual Disk Service.
You should also become familiar with the installation tasks and gather all of the
information you will need for installation ahead of time.
Steps:
The following installation tasks are presented in the order that they must be performed:
1. Before you install Microsoft Volume Shadow Copy or Virtual Disk Services, check
the hardware and software requirements.
2. Install the prerequisite CIM agent software.
3. Run the InstallShield Wizard for Microsoft Volume Shadow Copy and Virtual Disk
Services to install the CIM agent.
4. Verify the installation.
5. Create free and reserved volume pools.
6. Reconfigure the services. Perform this optional task if you would like to change the
configuration that you established during installation.
DS Open API support for Microsoft VSS and VDS installation
requirements
Ensure that your system satisfies the following prerequisite for installing Microsoft Volume
Shadow Copy and Virtual Disk Services on a Windows Server 2003 operating system
before you start the installation.
You must install the CIM agent before you install Microsoft Volume Shadow Copy and
Virtual Disk Services. You can install the CIM agent on the same machine as Microsoft
Volume Shadow Copy and Virtual Disk Services or on a different machine.
Hardware
The following minimum hardware is required:
� For Volume Shadow Copy Services: a DS8000, DS6000, or ESS storage unit (with
FlashCopy Version 1 or 2)
� For Virtual Disk Services: a DS8000 storage unit. Note: If you are using ESS Fxx
models, at least one ESS in the environment must be a model 800.
� A system capable of running Windows Server 2003
� 133 – 733+ megahertz CPU
- 31 -

� 128 – 256+ megabytes of random access memory
� 1.5+ gigabyte disk space
� Supported QLogic or Emulex Fibre Channel host bus adapter (HBA)
Software
The following software is required:
� Windows Server 2003 operating system. The following editions of Windows Server
2003 are supported:
o – Enterprise Edition, 32-bit version
o – Datacenter Edition, 32-bit version
� Common Information Model (CIM) agent. The CIM agent can be installed on the
same machine as Microsoft Volume Shadow Copy Service or on a different
machine. You can find this software on the CIM agent for IBM TotalStorage DS
Open Application Programming Interface CD.
� Microsoft Volume Shadow Copy Service compliant backup software
Installing the DS Open API support for Microsoft VSS and VDS on
Windows
This section includes the steps to install the DS Open API support for both Microsoft
Volume Shadow Copy and Virtual Disk Services on your Windows system.
You must satisfy all prerequisites that are listed in the installation requirements section
before you start the installation.
1. Log on to your system as the local administrator.
2. Run the InstallShield Wizard by inserting the IBM DS Open Application
Programming Interface support for Microsoft Volume Shadow Copy and Disk
Services CD into the CD-ROM drive.
3. The Welcome window opens. Click Next to continue with the InstallShield Wizard.
You can click Cancel at any time while using the wizard to exit the installation. To
move back to previous screens while using the wizard, click Back.
- 32 -

4. The License Agreement window opens. Read the license agreement information.
Select whether you accept the terms of the license agreement and click Next. If
you do not accept, you cannot continue with the installation.
5. The Edit Data window opens. In order to connect to the CIM agent, Microsoft
Volume Shadow Copy and Disk Services must obtain some information about the
server that the CIM agent is installed on. Type the required CIM agent port, host,
and user information and click Next.
- 33 -

Note:
a. If these settings change after installation, you can use the ibmvcfg.exe tool
to update Microsoft Volume Shadow Copy and Virtual Disk Services with the
new settings.
b. If you do not have the CIM agent port, host, or user information, contact
your CIM agent administrator.
6. The Password window opens. Enter your CIM agent password and click Next.
- 34 -

7. The Setup Type window opens. Select whether you want to use Secure Sockets
Layer (SSL) to connect to the CIM agent and click Next.
Note:
1. You can set the SSL using the ibmvcfg.exe configuration tool.
2. If you are not sure whether to use SSL to connect to the CIM agent,
contact your CIM agent administrator.
- 35 -

8. The Edit Data window opens. Type the location of the CIM agent truststore file.
This truststore file is generated during CIM agent installation. You must copy this
file to a location accessible by Microsoft Volume Shadow Copy and Virtual Disk
Services. Then type the truststore password and click Next.
Note: The default CIM agent truststore password is “ibmstore”. If the CIM agent
truststore password has been changed from the default and you do not have this
information, contact your CIM agent administrator. You can change the CIM agent
truststore password using the ibmvcfg.exe configuration tool.
- 36 -

9. The Choose Destination Location Window opens. Click Next to accept the default
directory where the setup will install the files, or click Change to select a different
directory and then click Next.
10. The Ready to Install the Program window opens. Click Install to begin the
installation. To exit the wizard and end the installation, click Cancel.
- 37 -

The Setup Status window opens. Wait for the setup to complete, or click Cancel if
you want to stop the setup.
11. The InstallShield Wizard Complete window opens. The installation is complete.
Click Finish to exit the wizard.
12. The installation program might prompt you to reboot your system.
- 38 -

If you are able to perform all of the installation tasks successfully, Microsoft
Volume Shadow Copy Service has been successfully installed on your Windows
system.
Verifying the DS Open API support for Microsoft VSS and VDS
Windows installation
This task verifies that the services that you selected to install are correctly installed on
your system. During installation, you had the option to install Microsoft Volume Shadow
Copy Service, Microsoft Virtual Disk Services, or both.
Steps:
Perform the following steps to verify the installation of the services that you selected to
install:
1. If verifying Microsoft Volume Shadow Copy Service installation, select Start -> All
Programs -> Administrative Tools -> Services
2. Ensure that there is a service named IBM DS Open API Support for Microsoft
Volume Shadow Copy that is listed, and that the Status is Started and the Startup
Type is Automatic.
3. Open a command prompt window and type the following command to verify that
DS Open API Support for Microsoft Volume Shadow Copy and Virtual Disk Services
is installed:
vssadmin list providers
Ensure each service that you installed is listed as a provider.
If you are able to perform all of these verification tasks successfully, either
Microsoft Volume Shadow Copy, Virtual Disk Services, or both, have been
successfully installed on your Windows system.
- 39 -

Creating the VSS_FREE and VSS_RESERVED pools for Microsoft
VSS
This task allows you to create the VSS_FREE and VSS_RESERVED pools.
Before using the IBM DS Open API support for Microsoft Volume Shadow Copy for the first
time, you must designate which volumes that the services can use as FlashCopy target
volumes. This designation is done by creating a VSS_FREE pool and a VSS_RESERVED
pool, represented by virtual hosts that are created on the storage unit. Once the virtual
hosts are created, volumes can be added to the free pool by simply assigning a volume to
the virtual host.
Perform the following steps using the IBM DS Storage Manager or DSCLI to create the
VSS_FREE and VSS_RESERVED pools:
Note: If you are using the DSCLI you must perform these steps in order.
Steps:
1. Create a volume group with the name ″VSS_FREE″ or another name, of the same
type as your Windows Server 2003 host, for example: SCSI Map 256.
2. Create a virtual hostconnect on the storage unit named ″VSS_FREE″ or another
name, with the following parameters:
a. -profile ″Intel - Windows 2003″
b. -addrdiscovery LUNPolling
c. -volgrp Where volgrp is volume group created in step 1.
d. -wwname 5000000000000000
3. Create a volume group with the name ″VSS_RESERVED″ or another name, of the
same type as your Windows Server 2003 host, e.g. SCSI Map 256.
4. Create a virtual hostconnect on the storage unit named ″VSS_RESERVED″ or
another name, with the following parameters:
a. -profile ″Intel - Windows 2003″
b. -addrdiscovery LUNPolling
c. -volgrp Where volgrp is volume group created in step 3.
d. -wwname 5000000000000001
5. Create and assign free volumes to the VSS_FREE volume group.
- 40 -

Note: If you already have volumes that are created for the VSS_FREE virtual host,
you must assign those volumes to VSS_FREE.
Verifying DS Open API support for Microsoft VSS and VDS Windows
configuration
This task verifies that Microsoft Volume Shadow Copy and Virtual Disk Services are
configured correctly on your Windows system.
Steps:
After you have created the VSS_FREE and VSS_RESERVED pools for Microsoft Volume
Shadow Copy Service, perform the following steps to verify your configuration:
1. Issue the following command:
ibmvcfg listvols
All of the volumes on your storage unit are listed with the worldwide port names
(WWPNs) that they are assigned to.
2. If the volumes are not listed, check the connectivity of your CIM agent. Then,
check your DS Open API support for Microsoft Volume Shadow Copy and Virtual
Disk Services configuration. You can reconfigure using the commands that are
listed in the next section. The IBMVSS.log provides more detailed information on
which of the settings is incorrect. DS Open API support for Microsoft Volume
Shadow Copy and Virtual Disk Services do not work if this command does not
complete successfully.
Result:
If you are able to perform all of the verification tasks successfully, Microsoft Volume
Shadow Copy and Virtual Disk Services have been successfully configured on your
Windows system.
DS Open API support for Microsoft VSS and VDS reconfiguration
commands
After installation, you can use several commands on the ibmvcfg.exe tool to change or
correct parameters that you used to install the Microsoft Volume Shadow Copy and Virtual
Disk Services. To do this, you must use the utility ibmvcfg.exe. You do not have to set
many of the settings because there are defaults that are provided for them in Microsoft
Volume Shadow Copy and Virtual Disk Services. The following table shows the commands
that you can use for reconfiguration.
Note: If you do not know which settings to provide (for example, passwords or user
names) for the following commands, contact your system administrator.
Command Description Example
- 41 -

ibmvcfg showcfg Provides the current settings.
ibmvcfg set
username
ibmvcfg set
password
ibmvcfg set
trustpassword
ibmvcfg set
truststore
ibmvcfg set
usingSSL
ibmvcfg set
cimomPort
ibmvcfg set
cimomHost
ibmvcfg set
namespace
CIMOM settings
Sets the CIMOM user name. ibmvcfg set
username johnny
Sets the CIMOM user password. ibmvcfg set
password
- 42 -
mypassword
Sets the CIMOM trust password. ibmvcfg set
trustpassword
trustme
Specifies the truststore file location. ibmvcfg set
truststore
c:\truststore
Specifies whether to use Secure
Socket Layers to connect to the
CIMOM.
Specifies the CIMOM port number. The
default value is 5989.
ibmvcfg set
usingSSL yes
ibmvcfg set
cimomPort 5989
Sets the name of the CIMOM server. ibmvcfg set
cimomHost
Specifies the namespace value that
CIMOM is using. The default value is
\root\ibm.
Volume Shadow Copy Service
settings
ibmvcfg listvols Lists the volumes that are currently in
the freepool, unassigned, or all
volumes. By default, without any
additional parameters, this command
lists all of the volumes.
cimomserver
ibmvcfg set
namespace
\root\ibm
ibmvcfg listvols
ibmvcfg listvols free
ibmvcfg listvols
unassigned
ibmvcfg listvols all

ibmvcfg listvols free Lists the volumes that are currently in
the freepool, unassigned, or both.
ibmvcfg listvols
unassigned
Lists the volumes that are currently in
the freepool, unassigned, or both.
ibmvcfg add Adds a volume or volumes to the
freepool.
ibmvcfg rem Removes a volume or volumes from
the freepool.
ibmvcfg set
vssFreeInitiator
ibmvcfg set
vssReservedInitiator
Specifies the WWPN that designates
the freepool. The default value is
5000000000000000. Modify this value
only if there is a host already in your
environment with a WWPN of
5000000000000000.
Specifies the WWPN that designates
the reservedpool. The default value is
5000000000000001. Modify this value
only if there is a host already in your
environment with a WWPN of
5000000000000001.
- 43 -
ibmvcfg listvols free
ibmvcfg listvols
unassigned
ibmvcfg add
12312345
32112345
ibmvcfg rem 512
ibmvcfg rem
51212345
ibmvcfg set
vssFreeInitiator
5000000000000000
ibmvcfg set
vssFreeInitiator
5000000000000001

ibmvcfg set
FlashCopyVer
None
Sets the FlashCopy version that is
available on the storage unit. The
default value is 1.
Virtual Disk Service settings
Error codes returned by Microsoft VSS and VDS
- 44 -
ibmvcfg set
FlashCopyVer
The following table lists Microsoft Volume Shadow Copy and Virtual Disk Services error
codes.
Note: These errors are logged in the Windows Event Monitor and in the Microsoft Volume
Shadow Copy and Virtual Disk Services log file that is located in the directory chosen
during installation.
Symbolic Name Code Definition
ERR_JVM 1000 JVM Creation failed.
ERR_CLASS_NOT_FOUND 1001 Class not found: %1.
ERR_MISSING_PARAMS 1002 Some required parameters are
missing.
ERR_METHOD_NOT_FOUND 1003 Method not found: %1.
ERR_REQUIRED_PARAM 1004 A missing parameter is required.
Use the configuration utility to set
this parameter: %1.
ERR_RECOVERY_FILE_CREATION_FAILED 1600 The recovery file was not created.
ERR_ARELUNSSUPPORTED_IBMGETLUNINFO 1700 ibmGetLunInfo failed in
AreLunsSupported.
ERR_FILLLUNINFO_IBMGETLUNINFO 1800 ibmGetLunInfo failed in FillLunInfo.
ERR_GET_TGT_CLEANUP 1900 Failed to delete the following temp
files: %1
ERR_LOG_SETUP 2500 Error initializing log.
ERR_CLEANUP_LOCATE 2501 Unable to search for incomplete
Shadow Copies. Windows Error: %1.
ERR_CLEANUP_READ 2502 Unable to read incomplete Shadow
Copy Set information from file: %1.
ERR_CLEANUP_SNAPSHOT 2503 Unable to cleanup snapshot stored
in file: %1.
ERR_CLEANUP_FAILED 2504 Cleanup call failed with error: %1.
ERR_CLEANUP_OPEN 2505 Unable to open file: %1.
ERR_CLEANUP_CREATE 2506 Unable to create file: %1.
ERR_HBAAPI_LOAD 2507 HBA: Error loading hba library: %1.
ERR_ESSSERVICE_EXCEPTION 3000 ESSService: An exception occurred.
Check the ESSService log.

ERR_ESSSERVICE_LOGGING 3001 ESSService: Unable to initialize
logging.
ERR_ESSSERVICE_CONNECT 3002 ESSService: Unable to connect to
the CIM agent. Check your
configuration.
ERR_ESSSERVICE_SCS 3003 ESSService: Unable to get the
Storage Configuration Service.
Check your configuration.
ERR_ESSSERVICE_INTERNAL 3004 ESSService: An internal error
occurred with the following
information: %1.
ERR_ESSSERVICE_FREE_CONTROLLER 3005 ESSService: Unable to find the
VSS_FREE controller.
ERR_ESSSERVICE_RESERVED_CONTROLLER 3006 ESSService: Unable to find the
VSS_RESERVED controller. Check
your configuration.
ERR_ESSSERVICE_INSUFFICIENT_TARGETS 3007 Unable to find suitable targets for all
volumes.
ERR_ESSSERVICE_ASSIGN_FAILED 3008 ESSService: The assign operation
failed. Check the CIM agent log for
details.
ERR_ESSSERVICE_WITHDRAW_FAILED 3009 ESSService: The withdraw
FlashCopy operation failed. Check
the CIM agent
Installing Veritas NetBackup
This section prepares you for the installation of your NetBackup product by providing
system requirements, license key information, and step-by-step instructions.
By definition, your NetBackup server is also a NetBackup client. When you installed the
NetBackup server software, both the NetBackup server and NetBackup client software
were installed on the server.
- 45 -

NetBackup Server Installation Requirements
Installing the server software takes approximately 10 minutes (additional time may be
required to set up the product for your environment). Before installing, note the following
requirements:
Caution: Before installing your NetBackup product, make sure you have the most current
operating system patches and updates applied to your system. If you are not certain of
your operating system level, contact your operating system vendor and request the latest
patches and upgrades.
Note: It is important that you ensure all NetBackup servers have a release level installed
that is at least equal to the version level installed on the clients. (Older versions of server
software can encounter problems with newer clients.)
Requirements for Local Installations
The following list identifies requirements and notes to ensure you are able to install
NetBackup without error.
� Remove any other vendor‟s backup software currently configured on your system
before installing NetBackup. The backup software of another vendor can negatively
affect how NetBackup installs and functions.
- 46 -

� System configuration necessary to install NetBackup on a Windows-based server
for this solution:
o An Intel Pentium system running Microsoft Windows 2003 with a minimum
of 256 MB of memory and service pack 2 installed.
o Requires a minimum browser level of Internet Explorer 5.0 for NetBackup
and Internet Explorer 6.0 for NetBackup Operations Manager (NOM)
o The minimum screen resolution configuration is 1024X768 256 colors.
o An administrator account and password for the server.
� Adequate disk space: Veritas recommends that you have a total of 1 GB of storage
space to accommodate the NetBackup server software and NetBackup catalogs.
The following items provide a basic itemization of the disk space requirements.
o NetBackup server software requires approximately 512 MB.
o NetBackup catalogs contain information about your backups and will
increase in size as you use the product. The amount of disk space the
catalogs require depends primarily on the number of files backed up, the
frequency of your backups, and the amount of time you chose to retain
your backup data. Veritas suggests that you allow a minimum of 512 MB.
o During an upgrade process, you must have an additional 500 MB of disk
space on the drive where Windows is installed. After the upgrade is
complete, this additional space is no longer needed.
o Veritas suggests an NTFS partition.
� Peripherals, such as robotic devices and stand-alone tape drives, installed
according to the manufacturers‟ instructions and recognized by the Windows
software.
� The network is configured so the computers recognize and communicate with one
another. Generally, if you can reach the clients from the server by using the ping
command, the setup will work with NetBackup.
� NetBackup 6.0 contains features that are dependent on a new Common Services
Framework (CSF) called, Veritas Private Branch Exchange (PBX).
PBX limits the number of TCP/IP ports used by many new features in NetBackup.
In addition, it allows all socket communication to take place while connecting
through a single port. The PBX port number is 1556. For more information about
PBX and configuring NetBackup ports, refer to the NetBackup System
Administrator’s Guide, Volume I. Because PBX is required for all NetBackup
products, its installation is part of NetBackup installation procedure unless it is
already present on the system.
When you do a typical installation of NetBackup on a Windows server, the
NetBackup installation process determines if a version of PBX is already installed
- 47 -

on your system. Whether PBX is already installed causes one of the following
situations:
� If a version of PBX exists, the installation process determines if the current
version is newer than the version included in the NetBackup installation. If the
version included in the NetBackup installation is newer, it is installed, and the
same default conditions that had existed are maintained. If the version
included with the NetBackup installation is earlier, no changes are made. The
latest version is always the one used.
� If no version of PBX exists, one is installed silently with NetBackup. A default
port number is used, along with a default configuration.
If you chose to do a custom installation of NetBackup, the installer determines if a
version of PBX already exists. The following occurs based on whether a version of
PBX already exists:
� If a version of PBX already exists, the installation process determines if the
current version is newer than the version included in the NetBackup
installation. If the version included in the NetBackup installation is newer, it is
installed, and the same default conditions that had existed are maintained. If
the version included with the NetBackup installation is earlier, no changes are
made.
In addition, you cannot change the port number because changing the port
number would likely cause other Veritas products to fail.
� If no version of PBX exists, one is installed silently with NetBackup. A default
port number is used, along with a default configuration.
In addition, you have the ability to change the port number.
When uninstalling NetBackup, PBX is uninstalled with NetBackup if no other Veritas
product is dependent on it. If there is a dependency from another product, PBX is
not uninstalled.
� NetBackup services and port numbers must be the same across the network.
Veritas suggests that you use the default port settings for NetBackup
services and Internet service ports. If you modify the port numbers, they
must be the same for all NetBackup systems that communicate with each
other (that is, all master servers, media servers, and clients). The port
entries are in the following file:
%SYSTEMROOT%\system32\drivers\etc\services
To change the default settings, you must perform a Custom Installation of
NetBackup or manually edit the services file.
� NetBackup client software installation
- 48 -

Installing NetBackup server software also installs client software on the
server system. However, installing NetBackup on client systems is done
separately. Refer to “Installing NetBackup Client Software”.
� Remote Administration Console installation
If you install NetBackup Remote Administration Console(s), the master
server must have the system names of all NetBackup Administration
Consoles in its server list to allow them access.
Additional Requirements for Remote and MSCS Cluster Installations
In addition to the local installation requirements, the following points apply to remote and
cluster installations:
� The source PC (or primary node) must have Windows 2003 server installed.
� The destination PC (or clustered nodes) must have Windows 2003 server
installed.
� The account used to perform the remote or clustered installation must have
Administrator privileges on all the remote systems or nodes in the cluster.
Veritas recommends that the person performing the installation keeps a record
of all nodes included in the cluster. This list may become important when
remembering which nodes to upgrade or uninstall.
� All clustered nodes must be running the same operating system, service pack
level, and version of NetBackup. Mixing server versions is not supported.
Additional Requirements for Access Controlled Environments
� You must install the Veritas Security Software (VxSS) either before or after you
install or upgrade NetBackup on your server. The order does not matter, however
it is important that you install this software before you use NetBackup, to benefit
from an access controlled environment.
� The Authorization broker must reside on the master server.
NetBackup Storage Device Requirements
Currently the IBM VSS Hardware Provider requires all disks involved in a backup to be in
the array.
NetBackup License Key Requirements
- 49 -

When installing a NetBackup master or media server, you must enter a NetBackup base
product license key during installation. Check your order to make sure that you have
license keys for all the NetBackup servers, clients, options, and agents that you
requested. During the installation process you will also be given an opportunity to enter
your remaining license keys. Because all product license keys must be entered on the
master server, Veritas recommends that you enter all of your product license keys at this
time.
Installing NetBackup Server Software
This section describes how to perform a basic installation of NetBackup server software.
When installing NetBackup for the first time, Veritas recommends that you install
NetBackup in the following order:
1. Master servers
2. NetBackup Enterprise Server only: Media servers, if any
3. NetBackup Remote Administration Console, if any
4. NetBackup clients
5. Any NetBackup Add-on products
- 50 -

To install NetBackup server software
Steps:
1. Log on as Administrator on the server where you will be installing NetBackup.
2. Insert the NetBackup installation CD in the drive. On Windows systems with
AutoPlay enabled for CD-ROM drives, the Veritas NetBackup installation browser
starts automatically. If AutoPlay is disabled, run Launch.exe in the top-level
directory on the CD.
3. The NetBackup browser displays the following information and options:
a. Links on the left side of the browser that displays information relating to
NetBackup, Database Agents, and Additional Products.
b. Browse the CD
c. The NetBackup link selected (by default) and these available options:
- 51 -

i. NetBackup Installation
ii. Veritas Technical Support
iii. Veritas e-Learning
4. Click NetBackup Installation.
5. Click Install Server Software. The Welcome to the NetBackup Setup Wizard
appears. Click Next.
6. To proceed with the installation, you must check the I accept the terms of the
license agreement option, and click Next.
- 52 -

7. Select Install to this computer only and Typical and click Next to perform a
local installation.
8. On the NetBackup License Key and Server Type window perform the following:
a. Enter the base product license key that you received when you purchased
your product
b. Select the icon next to the software you want to install, such as
NetBackup Master Server
The license key determines which components you can select. For example,
NetBackup Master Server is only available if you enter a master server key.
- 53 -

Click Next.
9. On the NetBackup System Names screen, enter the name of the master server
and any additional servers that are allowed to access this server.
Note: NetBackup Enterprise Only: If you are installing a media server, the
NetBackup System Names screen has an additional line with the local media
server filled in. You must enter the name of the master to which the media server
is configured.
Click Next.
10. On the NetBackup Enterprise Media Manager screen, enter the name of the server
you want to use as the repository for global device configuration information
stored in the EMM database.
- 54 -

By default, the server that hosts the EMM database is the master server you are
installing. You can allow each server to have its own EMM server, or each remote
system can use the same server.
Note: If the NetBackup system shares drives with the Shared Storage Option
(SSO), all NetBackup servers must use the same host for storing device
information.
For more information on EMM servers and EMM databases, refer to the NetBackup
Media Manager System Administrator‟s Guide.
Click Next.
11. If you do not need to make any changes to the installation settings, click Install
on the Ready to Install the Program screen.
After you click Install, the installation process begins and a screen appears that
shows you the progress of the installation. This process could take several
minutes.
For detailed installation information or to verify the progress of an installation, you
can view the log file (called Install.log) in the Windows temporary installation
directory:
C:\Documents and Settings\administrator_userid\Local Settings\Temp
If the log is not in this directory, you can locate it by entering the following
command at the command prompt:
> echo %Temp%
12. On the System Validation Complete screen, you have the following options:
a. To enter additional license keys, click Add Keys.
b. To finish the installation but wait to configure NetBackup at another time,
remove the check next to Launch NetBackup Administration Console
now.
c. Click Finish if you are done with this part of the installation.
- 55 -

- 56 -

Installing NetBackup Client Software
This chapter discusses how to install NetBackup client software for NetBackup clients on
Microsoft Windows clients.
Installation Overview
The NetBackup client setup program for Microsoft Windows allows you to select
appropriate setup and installation options from a series of windows. Once the options
have been selected, the NetBackup client setup program displays a window that enables
you to verify your selections before continuing with the actual install.
While the installation is in progress, a dialog provides details of the installation and setup
progress. When complete, a final window indicates the results of the installation.
Note: You cannot install NetBackup client software on PCs that currently have NetBackup
server software installed. In these cases, you must first uninstall the NetBackup server
software.
User-Directed Operations for Windows Systems
On Windows 2003 Server systems, the Program Files folder, by default, is not writable by
users other than the administrator.
- 57 -

NetBackup writes log files and progress files to the Program Files\Veritas\NetBackup\Logs
folder, by default. Users without write permission to the Logs folder receive an error
message when attempting a backup or restore and the operation is aborted.
If users other than the administrator will be using the Backup, Archive, and Restore
interface to perform backups and restores, make sure they have write permission to the
Logs directory.
System Requirements
This section describes the hardware and software that is required for successful
installation of NetBackup software.
Windows Client Installation Requirements
To install NetBackup client software, the system must meet the following configuration
requirements.
� Microsoft Windows 2003 Server 32-bit
� An Intel Pentium or Itanium processor
� Internet Explorer 5.5 or later
� Any TCP/IP transport that is Windows Sockets Compliant. (Use of the TCP/IP
transport that comes with the server or operating system is recommended.)
� A network adapter supported by your TCP/IP transport.
NetBackup Server Requirements
The version of the NetBackup server software must be the same or newer than the
version you install on the client.
Installation Instructions
Follow these instructions to install the NetBackup client software on your Windows
system. You can stop the installation process at any time by clicking Cancel or clicking
Back to return to the previous window.
- 58 -

To install NetBackup client software
Steps:
1. Log on as Administrator on the server where you will be installing NetBackup.
2. Insert the NetBackup installation CD in the drive. On Windows systems with
AutoPlay enabled for CD-ROM drives, the Veritas NetBackup installation browser
starts automatically. If AutoPlay is disabled, run Launch.exe in the top-level
directory on the CD.
3. On the initial screen, select NetBackup Installation.
4. On the installation screen click Install Client Software.
The Welcome to Veritas NetBackup Wizard will appear. Click Next.
5. To proceed with the installation, you must check the I accept the terms of the
license agreement option. Click Next.
6. On the Installation Type screen, do the following:
a. Select Install to this computer only.
b. Select either a typical or custom installation.
If you choose a typical installation, NetBackup uses the default port numbers
and default service startup settings.
If you choose custom installation, you can select your service startup settings,
change port numbers, specify the installation location, and choose whether or
not to install NetBackup documentation, debug symbols, and VSP.
Click Next.
- 59 -

7. On the NetBackup System Names screen, provide the name of the client and the
master server, and any media servers with which this client should communicate.
Provide the media servers in the Additional servers box.
8. On the Ready to Install screen, click Install.
NetBackup installs the client on the local machine.
9. On the System Validation Complete screen, click Finish.
Note: You may need to reboot your PC for the changes to take effect.
NetBackup Client Configuration
You can further configure the NetBackup client after installation by performing one of the
following actions:
� To add servers or media servers, start the Backup, Archive, and Restore interface
and from the File menu choose Specify NetBackup Machines.
� To display and change the client properties, start the Backup, Archive, and Restore
interface and from the File menu, choose NetBackup Client Properties.
� To display and change the server properties, start the NetBackup Administration
Console. Expand Host Properties and click on Clients. In the right pane, rightclick
on the client, and choose Properties.
All NetBackup servers that require access to your Windows client must be listed on the
Servers tab in the above dialog.
- 60 -

A Note Regarding Service Packs
At this point, both the NetBackup 6.0 for Microsoft Exchange client and server nodes have
been installed. At the time of this printing, for this solution to function properly,
NetBackup 6.0 for Microsoft Exchange Maintenance Pack 2 (MP2) or later, must be
installed on both client and server nodes. This update can be found here:
http://support.Veritas.com/menu_ddProduct_NBUESVR_view_DOWNLOAD.htm
How to Configure NetBackup for Offhost Backup of
Microsoft Exchange
This section describes the steps necessary to configure NetBackup to perform an offhost
backup of a Microsoft Exchange server. This description assumes there are three hosts
involved:
1) NetBackup Master Server – named “afc”.
This host is the main administration host and performs scheduling and cataloging
of backup jobs.
2) NetBackup Media Server for Windows – named “Offhost”.
This host can access the snapshots of the Exchange volumes, and performs the
backup of those snapshots. (The offhost is not required to be a media server, but
this often yields better backup performance. Alternatively, the offhost can be a
NetBackup Client for Windows with the media server located elsewhere on the
network.)
3) NetBackup Client for Microsoft Exchange – named “ExServer”.
This host is the Exchange Server. Snapshots of Exchange volumes are taken on
this server and shared with the media server.
These steps are described in this section:
� How to make the master server recognize the media server
� How to define a disk storage unit on the media server for storing backup images
� How to create a policy and schedule for backup of Microsoft Exchange
� How to customize the policy for offhost backup
� How to perform a full backup
� How to perform a full restore
The descriptions within were developed for NetBackup version 6.0.
- 61 -

How to Make the Master Server Recognize the Media Server
On the master server, open the NetBackup Administration Console and select Host
Properties in the left panel. Then, double-click on Master Server in the right panel to
open the Master Server Properties window.
- 62 -

Select Servers in the left panel. In the lower panel, use Add… to enter the name of the
offhost media server. In this example, the server Offhost was added. Select OK to
proceed.
At this point, this warning appears:
Select OK, and then exit the NetBackup Administration console.
- 63 -

How to Create a Disk Storage Unit on the Media Server
On the master server, open the NetBackup Administration Console and select Storage
Units in the left panel. Then, right-click and select New Storage Unit… in the pop-up
menu to open the New Storage Unit window.
- 64 -

Enter the properties for the new storage unit. Be sure to specify the correct Media
server (Offhost in this example), and the desired Absolute pathname to directory on
the media server where backup images will reside. Click OK to create the disk storage
unit.
- 65 -

How to Create a Backup Policy for Microsoft Exchange
On the master server, open the NetBackup Administration Console and open the Create
a Backup Policy wizard.
- 66 -

On the welcome page, click Next.
Enter a Policy name and select a MS-Exchange-Server policy type, and then click
Next.
- 67 -

Add the Exchange server as a backup client, ExServer in this example. Then click Next.
- 68 -

Click Add and then click the Directives button to open the Select Directive window.
Select the MS_Exchange_2000 directive set and the Microsoft Information Store:\
directive. This will backup all of the storage groups on the Exchange server.
Alternatively, edit the list to backup a single or multiple storage groups.
Click OK to add the directive and then Next to proceed.
- 69 -

Choose which backup operations are allowed. Full backups are required. Click Next.
Specify the backup frequency and retention for the backup operations. Click Next.
- 70 -

Select the times allowed for scheduled backups (full and incremental) to occur. Click
Next.
Click Finish to create the policy.
- 71 -

How to Customize the Backup Policy for Offhost Backups
On the master server, open the NetBackup Administration Console. Select Policies in
the left panel and select the new policy in the right panel (Exchange_Offhost in this
example). Right-click and select Change… in the pop-up menu to open the Change
Policy window.
- 72 -

- 73 -

On the Attributes tab, select the disk storage unit created earlier as the Policy
storage unit (disk in this example).
- 74 -

In the lower Advanced Client section on the Attributes tab,
� Check the Perform snapshot backups box
� Check the Perform offhost backup box
� Choose Use alternate client and
� Enter the media server name (Offhost in this example)
Then, click the Advanced Snapshot Options…to open the options window.
- 75 -

Choose VSS_Transportable as the Snapshot method and click OK.
This concludes the NetBackup configuration for offhost backup of Microsoft Exchange. If
needed, use the Change Policy window for further customization. Use the Schedules
tab to customize backup schedules, and the Backup Selections tab to customize which
Exchange storage groups are backed up.
Refer to the NetBackup System Administrators Guide for Microsoft Exchange for
additional details.
- 76 -

How to Perform a Manual Backup
Open the NetBackup Administration Console. Select Policies in the left panel and select
the policy in the right panel (Exchange_Offhost in this example). Right-click and select
Manual Backup…. In the pop-up window, select the schedule and client to backup, Full
and ExServer in this example. Click OK to start the backup.
- 77 -

How to Perform a Restore
Open the NetBackup Backup, Archive, and Restore console. From the File menu, select
Specify NetBackup Machines and Policy Type…
- 78 -

Enter the name of the master server and client (afc and ExServer respectively, in this
example). Also set MS-Exchange-Server as the Policy Type for restores. Click OK.
On the toolbar, click Select for Restore to display the available Exchange backup
images.
- 79 -

In the upper panel, select the image(s) you wish to use during the restore. In the lower
panels, check the objects you wish to restore to the client. Once your selections are
complete, from the Actions menu, choose Start Restore of Marked Files… which
opens the Restore Marked Files window.
WARNING: Performing a restore will overwrite/replace existing data on the
Exchange server. Make sure you are properly trained regarding Exchange and
NetBackup before performing a restore, especially when restoring to a production
environment.
On the Restore Marked Files tab, choose Restore everything to its original
location. On the Microsoft Exchange tab, set the options you require. Refer to
the NetBackup System Administrators Guide for Microsoft Exchange for details. To
execute the restore (see prior warning of overwriting data), click Start Restore.
- 80 -

- 81 -

Using NetBackup for Microsoft Exchange with Advanced
Client
NetBackup for Microsoft Exchange Advanced Client combines the features of
NetBackup for Microsoft Exchange with the features of the NetBackup Advanced
Client. To use NetBackup for Microsoft Exchange Advanced Client, you must have
both NetBackup for Microsoft Exchange and NetBackup Advanced Client licensed and
installed.
NetBackup Advanced Client Overview
NetBackup Advanced Client, when used in conjunction with NetBackup for Microsoft
Exchange, enables you to back up and restore Exchange objects by taking snapshots
of the component files and then backing up the snapshot version to a tape or disk
storage unit. It is designed to allow the capturing of data at a particular instant,
while avoiding significant client downtime. It is designed to allow the resulting
capture or snapshot to be backed up without affecting the performance or availability
of the database.
A snapshot is a disk image of the client's data made almost instantaneously.
NetBackup backs up the data from the snapshot volume, not directly from the
client‟s original volume. This is designed to allow client operations and user access to
continue without interruption during the backup.
Advanced Client supports the Microsoft Volume Shadow Copy Service of Windows
2003 (VSS) for creating a snapshot image. The actual VSS Provider used is
dependent on your hardware and software environment. For a description of VSS
providers available for use with NetBackup for Microsoft Exchange, see the supported
platforms matrix on the Veritas support site.
Advanced Client for Exchange supports offhost alternate client backups. Alternate
client backups use a second or alternate client to perform the backup on behalf of
the primary client. Compared to local Advanced Client backups, this approach helps
reduce the backup I/O burden on the primary client.
Supported Platforms
NetBackup Advanced Client for Exchange is only supported for Exchange 2003 on
Windows 2003. A compatibility list for Advanced Client and Database Agents is
available from the Veritas support web site, as described below.
To access the supported platforms information
1 Go to the Veritas support web page: www.support.Veritas.com.
2 From the Select Product Family list, click NetBackup Products.
3 From the Select Product list in the right pane, click NetBackup Enterprise
Server.
4 Under Support Resources, click Compatibility and Reference.
5 In the list of documents, click NetBackup Enterprise Server (tm)/ Server x.x
Advanced Client OS and Database Agent Compatibility (updated date).
- 82 -

For x.x, look for the current release. For date, look for the most recent date.
6 Click on the link for the PDF document, which is a downloadable file that
enables you to view the supported database spreadsheet for this release.
7 Read the document and verify that the software in your environment is
compatible with the NetBackup and NetBackup for Microsoft Exchange
software.
How Does Advanced Client Work?
This section includes information on how NetBackup for Microsoft Exchange works
with the Advanced Client option.
Choosing a Backup Option
If you want to perform an Advanced Client backup, either automatically through the
master server, or manually from the client, you must configure a NetBackup for
Exchange policy that specifies the appropriate Advanced Client attributes. For details
on configuring policies, see “Configuring an Advanced Client Policy for NetBackup for
Microsoft Exchange”.
What Is Backed Up?
Advanced Client can back up the entire Information Store or individual storage
groups. All logs are backed up when using frozen image (VSS) methodology. With a
legacy non-frozen (non-VSS) backup, only required logs are backed-up. There will be
additional log backup options in NetBackup for Microsoft Exchange 6.5.
When performing Full backups, database files (.edb and .stm files) and transaction
log files are included in the snapshot. User-directed snapshot backups are supported
as long as a User backup type of schedule is included in a policy configured for
snapshot backups.
Note For Exchange 2003 pre-Service Pack 1, both full and user-directed backups
truncate log files. Incremental and differential types backups are not supported. For
Exchange 2003 with Service Pack 1, user-directed backups do not truncate logs files
and differential and cumulative backups are supported.
Backup types supported with Advanced Client for Exchange
Backup
Type
Exchange 2003 pre-
Service Pack 1
Supported? Logs
Truncated?
- 83 -
Exchange 2003 with
Service Pack 1
Supported? Logs
Truncated?
Full Yes Yes Yes Yes
User Yes Yes Yes No
Differential No N/A Yes Yes
Cumulative No N/A Yes No

Limitations
The following limitations exist when using NetBackup Advanced Client with
NetBackup for Microsoft Exchange.
� Snapshot backups are supported only for the full Information Store or storage
groups. The entire Information Store or a storage group must be selected for
backup. Individual databases cannot be selected for backup (However,
individual databases can be selected for restore).
� Snapshot backups are not supported for Exchange mailboxes, the Site
Replication Service (SRS), the Key Management Service (KMS), or public
folders.
� (Exchange 2003, pre-Service Pack 1) Differential and cumulative backups are
not supported.
� Data movers are not supported with offhost backups. Only alternate clients
are supported for offhost backups.
� When performing restores, mixing images from Advanced Client and Standard
Exchange backups is not supported.
Consistency Checks on Database and Log Files
For an Exchange VSS backup, Microsoft requires that each database file (.edb, but
not .stm) and each transaction log file required for the restore have a checksum
consistency check run against the files. This consistency check is accomplished by
running eseutil.exe with the proper options against the files which exist on the
snapshot. For alternate client backups, the consistency checks are run on the
alternate client rather than on the primary client.
If any of the files fail the consistency check, the backup will fail, the backup image
will be discarded, and the Exchange VSS Writer will be notified of the failure. When
this occurs, Exchange will not truncate log files.
Failure of the consistency check may be an indication of either database corruption
or a problem with the snapshot. The Exchange administrator should investigate the
reason for the failure by dismounting the Exchange database which caused the
failure, and running eseutil.exe against the database file to determine the cause of
the corruption.
Configuring a Snapshot Backup
Before configuring NetBackup for Exchange Server for snapshot backups, review the
configuration requirements and configuration steps in the following two sections.
Instructions for configuring snapshot policies are covered in “Configuring an
Advanced Client Policy for NetBackup for Exchange Server”.
Configuration Requirements
� The hardware and software required for the appropriate snapshot method is
installed and configured correctly. Refer to the NetBackup Advanced Client
System Administrator’s Guide. See the Veritas Technical Support Web site for
- 84 -

details on the snapshot methods and platforms that are supported for your
agent.
� NetBackup Advanced Client is installed and configured correctly and the
license key for this option has been registered. Refer to the NetBackup
Advanced Client System Administrator’s Guide for details.
� If you wish to perform alternate client backups, perform any special
configuration that is required. See the NetBackup Advanced Client System
Administrator’s Guide for information.
� Databases need to be mounted for backup.
Configuration Tips for Exchange
Veritas recommends the following when configuring Advanced Client for Exchange.
� The volume(s) which contains the Exchange databases and log files should be
dedicated to Exchange only. Other types of databases (e.g., SQL) should not
reside on the volume(s). Only Exchange objects will be included in a snapshot
backup.
� Transaction logs should reside on a different volume than where the
Information Store resides.
� (Exchange 2003, pre-Service Pack 1) The Information Store should be
configured with only one database per storage group, since all databases in a
storage group must be restored at the same time prior to the committing the
transaction logs and mounting the databases. Committing transaction logs
takes place at a storage group level, rather than at a database level.
Configuration Steps
In order to perform an Advanced Client for Exchange Server backup, you must
perform the following configuration steps:
� Configure an MS-Exchange-Server policy that has the Advanced Client
attributes selected. See “Configuring an Advanced Client Policy for NetBackup
for Exchange Server” on page 91.
� Configure the snapshot volumes which will be used during the backup
process.
� Disable circular logging for all Exchange storage groups (this is the default).
Configuring an Advanced Client Policy for NetBackup for
Exchange Server
This section only covers what is necessary to configure snapshot backups for a MS-
Exchange-Server policy. For information on other policy attributes, creating
schedules, adding clients, and adding backup selections, see the “Configuration”
chapter earlier in this manual.
To configure an Advanced Client policy
1 Open the policy you wish to configure.
2 Click on the Attributes tab.
3 Select the MS-Exchange-Server policy type.
- 85 -

4 Select a Policy storage unit.
5 Select Perform snapshot backups.
6 Select Advanced Snapshot Options and from the Snapshot method for this
policy list select VSS.
7 Optional: If you wish to use an alternate client to reduce the processing load
on the client, perform the following steps:
a. The alternate client must be the client that shares the disk array. This
option may require additional configuration. Refer to the NetBackup
Advanced Client System Administrator’s Guide.
b. Select Perform offhost backup.
c. Select Use alternate client and enter the name of the alternate client.
Note Use data mover is not a supported option for NetBackup for Exchange
Server.
d. Select Advanced Snapshot Options and from the Snapshot method for
this policy list select VSS_Transportable.
8 Optional: If you wish to divide backups into multiple jobs, select Allow
multiple data streams.
9 To configure schedules, click on the Schedules tab.
Note A full or user-directed backup will snap the volumes which contain the
Exchange database, system, and log files. A differential or cumulative
incremental backup will snap the volumes which contain the Exchange system
and log files.
10 Use the Clients tab to specify clients to be backed up by this policy.
Refer to the “Configuration” chapter earlier in this manual for details on
- 86 -

adding clients to a policy.
Note For offhost backups, the client name should be the name of the primary
client.
10. Use the Backup Selections tab to enter the directives.
When configuring a Exchange snapshot backup policy, only the Exchange 2000
directive set is valid. The only valid directives are Microsoft Information Store:\(a
storage group can be appended) or NEW_STREAM.
The following are examples of valid entries:
� Backup Selections List 1, backs up the Information Store
Microsoft Information Store:\
� Backup Selections List 2, backs up only the desired storage groups
Microsoft Information Store:\storage_group_1
Microsoft Information Store:\storage_group_3
Microsoft Information Store:\storage_group_5
11. Click OK to close the dialog.
Performing User-Directed Backups of Exchange Server
In order to perform a user-directed snapshot backup, a policy must exist on the
server that is configured for snapshot backups and has a User schedule. The user
can back up the complete Information Store or a storage group. Transaction logs will
also be backed up.
To perform a user-directed snapshot backup of Exchange Server
objects
1 Mount any databases that will be backed up.
2 Open the Backup, Archive, and Restore interface.
3 To select the Advanced Client policy for this backup operation, choose
Actions > Specify Policy and Schedule. In the Backup Policy box,
type the name of the Advanced Client policy.
4 Choose File > Select Files and Folders to Backup.
The Backup window is displayed.
5 If you are in a cluster environment, specify the name of the Virtual
Exchange Server as described in “Specifying the Server, Client, and
the Policy Type”.
Browsing Exchange 2003 objects
- 87 -

6 In the All Folders pane, select the objects you wish to back up.
� To back up the entire Microsoft Information Store, select this node.
� To back up a storage group, expand the Microsoft Information Store, then
select the storage group to back up.
Note Databases cannot be backed up individually. Select only the entire Microsoft
Information Store or individual storage groups. An attempt to backup at the
database level will result in the backup job failing.
7 Choose Actions > Start Backup of Marked Files. The Specify
Backup Options dialog box is displayed.
8 Click Start Backup. A dialog box is displayed informing you that the
backup was successfully initiated.
9 If you want to view the progress of the backup, click Yes. If you do not
want to view the progress of the backup, click No.
Restoring Snapshot Images
This section describes how to restore backups performed with the Advanced Client
feature. Note the following when performing restores:
- 88 -

� All databases in a storage group must be dismounted prior to starting a
restore.
� All of the images selected for restore must be from Advanced Client backups.
The following limitations exist when performing Advanced Client for Exchange
restores:
� Objects must be restored to the original location from which they were
backed up. If individual databases are restored to a different location
(Exchange 2003 SP1), Exchange will not allow the transaction logs to be
rolled forward if the database files have been moved.
� A restore to an Exchange Recovery storage group is not supported.
Restore Options
The following options are available when restoring an Advanced Client backup.
For Microsoft Exchange tab options for Advanced Client restores:
Option Description
The Delete Existing Transaction Logs
Prior To Restore
For Microsoft Exchange 2003:
- 89 -
Allows the user to retain or delete
existing transaction logs. Transaction
logs will be deleted only for the storage
group being restored.
When restoring a full or user-directed
backup, if the user wants to roll forward
all of the transaction log files, including
the log files that exist after the last
backup, the user should deselect this
option.
Temporary location for log and patch Not applicable for restores of snapshots.
files
Commit after restore completes Use this option if your selection contains
the last backup set to be restored. This
enables the restore operation to play
through log files and roll back any
uncompleted transactions. If this option
is not selected, the database will need to
be mounted manually.
Mount database after restore Mounts the database so that it is
available to users. Since committing after
the restore requires that the database be
mounted, the database will be mounted if
Commit after restore completes is
selected.

Performing a Snapshot Restore
To perform a snapshot restore
1 Log on as Administrator.
2 If restoring storage groups which contain databases, dismount all Exchange
databases.
3 Open the Backup, Archive, and Restore interface.
4 Choose File > Select Files and Folders to Restore > from Normal
Backup.
The Restore window is displayed.
5 Select the Exchange policy type. For more details see “Specifying the Server,
Client, and the Policy Type”. Once you have selected the policy type,
NetBackup displays Exchange Server backup images.
6 From the NetBackup History pane, select the image containing the objects
you wish to restore.
� (Exchange 2003 without SP1) From a full or user-directed backup, all of the
databases and the log file folder under a storage group must be restored at
the same time. Select the storage group to be restored.
� (Exchange 2003 with SP1). From a full or user-directed backup, individual
databases and the log file folder can be selected for restore.
� Mixing images from Advanced Client and Standard Exchange backups is not
supported. Select only images which were backed up with Advanced Client.
7 In the All Folders pane, select the objects you wish to restore.
- 90 -

� The Microsoft Information Store. To restore the entire content of the selected
backup image, select the checkbox next to the machine name or Microsoft
Information Store.
� Storage groups. Expand the Microsoft Information Store node and select the
storage group to restore.
� (Exchange 2003 with SP1) Databases. Expand the storage group and select
the database(s) and log files to be restored.
8 Choose Actions > Start Restore of Marked Files.
The Restore Marked Files dialog box is displayed.
For information on the restore options available on the Exchange tab, see
“Restore Options” on page.
Note A restore of Exchange Server files will always overwrite existing files
(if pub.edb already exists on the target machine, it will be replaced with the
copy from the backup). The database files (*.edb and *.stm) will always be
overwritten. The log files will not be overwritten if Delete Existing Transaction
Logs Prior To Restore is not selected.
- 91 -

9 Click Start Restore.
10 If you chose to restore storage groups and you did not select Commit after
restore completes, be sure to mount the storage group databases that were
restored. See the next section for instructions.
Manually Mounting a Database After a Restore
If you did not choose Commit after restore completes before performing the
restore, you need to manually mount the database after the restore is completed.
To manually mount a database after a restore
1 For the Exchange storage group that was restored, you may want to delete the
checkpoint file, E0n.chk, from the System Path folder.
In the absence of a checkpoint file, Exchange Server begins to replay the logs
from the lowest numbered log file that is available in the Transaction Logs
folder: the low anchor log. If the E0n.chk file exists, Exchange Server begins
replay at the checkpoint that is recorded in this file.
2 Mount all of the databases that were restored in the storage group.
3 If the mount fails, attempt a soft recovery (ignoring mismatched database
attachments) of the Exchange databases to bring the databases to a consistent
state.
eseutil /r E0n /i
4 Mount the databases again.
Redirecting a Restore to a Different Client
A restore of a snapshot backup can be redirected to a different client just as with a
standard backup, though additional limitations apply.
The following additional limitations apply when redirecting a restore of a snapshot
backup. Refer to “Redirecting a Restore to a Different Client” on page 83 for other
limitations of redirecting a restore to a different client.
� The log prefix (i.e., E00.log) must be the same for the storage group on the
target server as the original storage group. This may require the user to
create temporary storage groups so that the target storage group has the
required log prefix.
� The target storage group and databases must have the same path for the
Exchange database, transaction logs, and system files as the original storage
group and databases.
To redirect a restore to a different client
1 Follow the instructions in “Redirecting a Restore to a Different Client”.
- 92 -

2 If you did not choose Commit after restore completes, manually mount
the database after the restore is completed. See the previous section
“Manually Mounting a Database after a Restore”.
Recommendations
In order to fully leverage the performance capabilities of the IBM DS8000, detailed
consideration needs to be given to the logical configuration of the unit. This is
particularly true with I/O intensive applications such as Exchange Server 2003, and
even more so when implementing VSS technology.
Volumes intended for VSS use should be created
� So that source & target volumes are in different ranks
� So that source & target volumes are on the same RIO loop
� So that source & target volumes are managed by different DA pairs
� So that overall system usage is balanced, eliminating „hot-spots‟
Minimizing application impact
� Host-based striping can further reduce latency
� Backup should occur when application is least active
� Volume creation & storage sizing for maximum Exchange performance should
follow published Microsoft guidelines. Contact Microsoft for further
information.
� For additional information on configuring your IBM DS8000 for maximum
performance, please refer to the IBM TotalStorage DS8000 Series:
Performance Monitoring and Tuning Redbook, which can be found at
http://www.redbooks.ibm.com/abstracts/sg247146.html?Open
Restrictions
The initial release of NBU v6.0 supports, but does not recommend, simultaneous
restores of multiple Exchange 2003 Storage Groups, as additional, manual steps are
required. In cases where a restore of multiple Storage Groups is required, Veritas
recommends performing those restores serially. Automated support of simultaneous
Storage Groups may be an enhancement in a future Maintenance Pack. Contact
Veritas for further information.
During an Advanced Client Exchange restore, the following two Volume Shadow Copy
Services (VSS) Writer messages are not logged in the Application Event log: 9618, &
9620. Though this does not impact functionality, it does impact troubleshooting and
supportability. Please reference the following Veritas KB article for additional
information:
http://seer.support.Veritas.com/docs/282363.htm
Conclusion
The system configurations described here, constructed jointly by IBM and Veritas,
and reviewed by Microsoft, are designed to address demanding enterprise
requirements for highly available email servers running Microsoft Exchange.
- 93 -

Microsoft VSS technology is designed to enable consistent point-in-time copies of
Exchange databases, while Transportable Shadow Copies affords the benefit of
shifting the task of executing Eseutil consistency checking to another server. Both of
these features help reduce the traditional backup load on production Exchange
servers. IBM servers and storage systems are designed to provide the processing
throughput and storage needed for large user populations. Veritas NetBackup
software is designed to support true fault- and disaster- tolerance. The combination
forms a high availability platform for mission critical email servers.
Appendix
Solution component information
Hardware Configuration
Host Configuration
Exchange 2003 Servers
Server type: 4 x Intel XeonMP 2.8 GHz 4096 MB RAM
Operating System: Microsoft Windows 2003 Enterprise Edition SP1
Exchange Client
Server type: 2 x Intel XeonDP 3.2 GHz 2048 MB RAM
Operating System: Microsoft Windows 2003 Enterprise Edition SP1
NetBackup Server
Server type: 1 x Intel XeonDP 2.4 GHz 2048 MB RAM
Operating System: Microsoft Windows 2003 Enterprise Edition SP1
IBM DS CIM Server (ICAT)
Server type: 1 x Intel Pentium D dual-core 3.0 GHz 2048 MB RAM
Operating System: Microsoft Windows 2003 Enterprise Edition SP1
HBA Configuration
The Exchange 2003 Servers contained one dual-port Qlogic 2342 HBAs:
Driver version: SCSI miniport 9.0.2.60
Bios: 1.47
Firmware: 3.03.13
The NetBackup Backup Server contained one dual-port Qlogic 2342 HBAs:
Driver version: SCSI miniport 9.0.2.60
Bios: 1.47
Firmware: 3.03.13
Storage Subsystem Configuration
IBM TotalStorage DS8100 Disk Subsystem configuration
Current configuration
- 94 -

DS8000 Microcode Bundle Level: 6.1.0.34
Logical configurations
dscli> lsrank
Date/Time: February 27, 2006 4:19:55 PM PST IBM DSCLI Version: 5.1.0.297 DS:
IBM.2107-75ALAA1
ID Group State datastate Array RAIDtype extpoolID stgtype
====================================================
======
R0 0 Normal Normal A0 10 P0 fb
R1 1 Normal Normal A1 10 P1 fb
R2 1 Normal Normal A2 10 P3 fb
R3 0 Normal Normal A3 10 P2 fb
R4 1 Normal Normal A4 10 P5 fb
R5 1 Normal Normal A5 10 P9 fb
R6 1 Normal Normal A6 10 P7 fb
R7 0 Normal Normal A7 5 P6 fb
Name extpool Cap. (GB) Comments
ExLog1 P0 30.0 Exchange tran. log
Quorum P0 10.0 Cluster Quorum
SMTP P0 20.0 Exchange SMTP Queue
Bkdata P6 452.0 NetBackup backup vol.
VSS_Log_Data1 P2 30.0 flashcopy target for log
VSS_Log_Data2 P2 30.0 flashcopy target for log
VSS_Log_Data3 P2 30.0 flashcopy target for log
VSS_Log_Data4 P2 30.0 flashcopy target for log
ExData P1 258.0 Exchange SG1 vol.
VSS_Data1 P5 258.0 flashcopy target SG1
VSS_Data2 P7 258.0 flashcopy target SG1
VSS_Data3 P9 258.0 flashcopy target SG1
dscli> lsarray
Date/Time: February 27, 2006 4:45:29 PM PST IBM DSCLI Version: 5.1.0.297 DS:
IBM.2107-75ALAA1
Array State Data RAIDtype arsite Rank DA Pair DDMcap (10^9B)
====================================================
================
A0 Assigned Normal 10 (3x2+2S) S1 R0 2 73.0
A1 Assigned Normal 10 (4x2) S2 R1 2 73.0
A2 Assigned Normal 10 (3x2+2S) S3 R2 2 73.0
A3 Assigned Normal 10 (4x2) S4 R3 2 73.0
A4 Assigned Normal 10 (4x2) S5 R4 2 73.0
A5 Assigned Normal 10 (4x2) S6 R5 2 73.0
A6 Assigned Normal 10 (4x2) S7 R6 2 73.0
A7 Assigned Normal 5 (7+P) S8 R7 2 73.0
Switch Configuration
Switch Type: IBM 2109 F16
- 95 -

Fabric OS: v3.1.2a
Made on: Wed Mar 31 21:16:31 PST 2004
Flash: Wed Mar 31 21:17:22 PST 2004
BootProm: Tue Oct 30 10:24:38 PST 2001
Zoning Configuration
config: vss_exchange
zone: ports0_7
2, 0
2, 1
2, 2
2, 3
2, 4
2, 5
2, 6
2, 7
zone: ports8_15
2, 8
2, 9
2, 10
2, 11
2, 12
2, 13
2, 14
2, 15
Software Configuration
Exchange 2003 Configuration
The version of Exchange 2003 application used was 2003 Enterprise Edition version
6.5.7638.2, service pack 2. The Microsoft Exchange Server 2003 Load Simulator
was version 6.5.7618.0.
Veritas NetBackup Client Software Configuration
The Veritas NetBackup Client software, version 6.0 with MP2, was installed on
Exchange Server Cluster nodes and NetBackup Server.
Veritas NetBackup Server Configuration
The Veritas NetBackup backup application used was version 6.0 with MP2.
VDS/VSS Provider Configuration
Provider name: 'IBM Hardware Provider for VSS'
Provider type: Hardware
Provider Id: {d90dd826-87cf-42ce-a88d-b32caa82025b} version: 2.4.2.0116
- 96 -

SDD Configuration
SDD version 1.6.0.7-1 was installed on Exchange Cluster nodes and NetBackup
server.
DS8000 DSCLI Configuration
DS8000 DSCLI command line interface software version 5.1.0.276 was installed on
the IBM CIM server.
IBM DS CIM (ICAT) Configuration
DS Open API CIM Agent for Windows 2000 version 5.1.0.17
Hotfixes
The following hotfixes were applied to Exchange Cluster nodes and NetBackup
server: KB841561 and KB891957.
Exchange 2003 Server installed patches
Computer name: VTEST\NODE1
IP address: 10.10.10.1
Security report name: VTEST - NODE1 (3-3-2006 5-45 PM)
Scan date: 3/3/2006 5:45 PM
Scanned with MBSA version: 2.0.5029.2
Security update catalog: Microsoft Update (offline)
Catalog synchronization date: 2006-03-01T19:20:00Z
Security assessment: Severe Risk
Security Updates Scan Results
Issue: Windows Security Updates
Score: Check failed (critical)
Result: 21 security updates are missing. 1 service packs or update rollups
are missing.
Security Updates
MS05-036 | Missing | Security Update for Windows Server 2003 (KB901214)
| Critical
MS05-039 | Missing | Security Update for Windows Server 2003 (KB899588)
| Critical
MS05-040 | Missing | Security Update for Windows Server 2003 (KB893756)
| Important
MS05-033 | Missing | Security Update for Windows Server 2003 (KB896428)
| Moderate
MS05-026 | Missing | Security Update for Windows Server 2003 (KB896358)
| Critical
MS05-042 | Missing | Security Update for Windows Server 2003 (KB899587)
| Moderate
MS05-032 | Missing | Security Update for Windows Server 2003 (KB890046)
| Moderate
- 97 -

MS05-041 | Missing | Security Update for Windows Server 2003 (KB899591)
| Moderate
MS05-045 | Missing | Security Update for Windows Server 2003 (KB905414)
| Moderate
MS05-051 | Missing | Security Update for Windows Server 2003 (KB902400)
| Important
MS05-046 | Missing | Security Update for Windows Server 2003 (KB899589)
| Important
MS05-048 | Missing | Security Update for Windows Server 2003 (KB901017)
| Important
MS05-049 | Missing | Security Update for Windows Server 2003 (KB900725)
| Important
MS05-053 | Missing | Security Update for Windows Server 2003 (KB896424)
| Critical
MS05-050 | Missing | Security Update for Windows Server 2003 (KB904706)
| Critical
MS05-054 | Missing | Cumulative Security Update for Internet Explorer for
Windows Server 2003 (KB905915) | Moderate
MS06-001 | Missing | Security Update for Windows Server 2003 (KB912919)
| Critical
MS06-002 | Missing | Security Update for Windows Server 2003 (KB908519)
| Important
MS06-008 | Missing | Security Update for Windows Server 2003 (KB911927)
| Moderate
MS06-006 | Missing | Security Update for Windows Media Player Plug-in
(KB911564) | Important
MS06-007 | Missing | Security Update for Windows Server 2003 (KB913446)
| Important |
Update Rollups and Service Packs
890830 | Missing | Windows Malicious Software Removal Tool - February
2006 (KB890830)
Current Update Compliance
MS05-027 | Installed | Security Update for Windows Server 2003
(KB896422) | Critical
889101 | Installed | Windows Server 2003 Service Pack 1
MS06-009 | Installed | Security Update for Windows Server 2003
(KB901190) | Important
Operating System Scan Results
Administrative Vulnerabilities
Issue: Local Account Password Test
Score: Check passed
Result: Some user accounts (1 of 6) have blank or simple passwords, or
could not be analyzed.
Detail:
User | Weak Password | Locked Out | Disabled |
Guest | Weak | - | Disabled
SUPPORT_388945a0 | - | - | Disabled
- 98 -

ASPNET | - | - | -
Administrator | - | - | -
IUSR_NODE1 | - | - | -
IWAM_NODE1 | - | - | -
Issue: File System
Score: Check passed
Result: All hard drives (5) are using the NTFS file system.
Detail:
Drive Letter | File System
C: | NTFS
J: | NTFS
L: | NTFS
Q: | NTFS
S: | NTFS
Issue: Password Expiration
Score: Check failed (non-critical)
Result: Some user accounts (2 of 6) have non-expiring passwords.
Detail:
User
Administrator
Guest
ASPNET
IUSR_NODE1
IWAM_NODE1
SUPPORT_388945a0
Issue: Guest Account
Score: Check passed
Result: The Guest account is disabled on this computer.
Issue: Autologon
Score: Check passed
Result: Autologon is not configured on this computer.
Issue: Restrict Anonymous
Score: Check passed
Result: Computer is properly restricting anonymous access.
Issue: Administrators
Score: Check passed
Result: No more than 2 Administrators were found on this computer.
Detail:
User
Administrator
VTEST\Administrator
Issue: Windows Firewall
- 99 -

Score: Best practice
Result: Windows Firewall is not installed or configured properly, or is not
available on this version of Windows.
Issue: Automatic Updates
Score: Check passed
Result: Updates are automatically downloaded and installed on this
computer.
Issue: Incomplete Updates
Score: Best practice
Result: No incomplete software update installations were found.
Additional System Information
Issue: Windows Version
Score: Best practice
Result: Computer is running Windows 2000 or greater.
Issue: Auditing
Score: Best practice
Result: Logon Success auditing is enabled, however Logon Failure auditing
should also be enabled.
Issue: Shares
Score: Best practice
Result: 9 share(s) are present on your computer.
Detail:
Share | Directory | Share ACL | Directory ACL
ADMIN$ | C:\WINDOWS | Admin Share | BUILTIN\Users - RX,
BUILTIN\Power Users - RWXD, BUILTIN\Administrators - F, NT
AUTHORITY\SYSTEM - F
Address | C:\Program Files\Exchsrvr\address | Everyone - R, Administrators
- F, VTEST\NODE1$ - F | BUILTIN\Users - RX, BUILTIN\Power Users -
RWXD, BUILTIN\Administrators - F, NT AUTHORITY\SYSTEM - F, NT
AUTHORITY\TERMINAL SERVER USER - RWXD
C$ | C:\ | Admin Share | BUILTIN\Administrators - F, NT
AUTHORITY\SYSTEM - F, BUILTIN\Users - RX, Everyone - RX
EXVSERVER1.LOG | J:\EXCHSRVR\EXVSERVER1.log | Administrators - F |
BUILTIN\Administrators - F, NT AUTHORITY\SYSTEM - F, BUILTIN\Users -
RX
J$ | J:\ | Admin Share | BUILTIN\Administrators - F, NT
AUTHORITY\SYSTEM - F, BUILTIN\Users - RX, Everyone - RX
L$ | L:\ | Admin Share | BUILTIN\Administrators - F, NT
AUTHORITY\SYSTEM - F, BUILTIN\Users - RX, Everyone - RX
- 100 -

Q$ | Q:\ | Admin Share | BUILTIN\Administrators - F, NT
AUTHORITY\SYSTEM - F, BUILTIN\Users - RX, Everyone - RX
Resources$ | C:\Program Files\Exchsrvr\res | Everyone - R, Administrators -
F, VTEST\NODE1$ - F | BUILTIN\Users - RX, BUILTIN\Power Users -
RWXD, BUILTIN\Administrators - F, NT AUTHORITY\SYSTEM - F, NT
AUTHORITY\TERMINAL SERVER USER - RWXD
S$ | S:\ | Admin Share | BUILTIN\Administrators - F, NT
AUTHORITY\SYSTEM - F, BUILTIN\Users - RX, Everyone - RX
Issue: Services
Score: Best practice
Result: Some potentially unnecessary services are installed.
Detail:
Service | State
Simple Mail Transfer Protocol (SMTP) | Running
World Wide Web Publishing Service | Running
Internet Information Services (IIS) Scan Results
Administrative Vulnerabilities
Issue: Sample Applications
Score: Check passed
Result: IIS sample applications are not installed.
Issue: IISAdmin Virtual Directory
Score: Check passed
Result: IISADMPWD virtual directory is not present.
Issue: Parent Paths
Score: Check passed
Result: Parent paths are not enabled.
Issue: MSADC and Scripts Virtual Directories
Score: Check passed
Result: The MSADC and Scripts virtual directories are not present.
Issue: IIS Lockdown Tool
Score: Check passed
Result: The IIS Lockdown tool was developed for IIS 4.0, 5.0, and 5.1, and
is not needed for new Windows Server 2003 installations running IIS 6.0.
Additional System Information
Issue: Domain Controller Test
Score: Best practice
Result: IIS is not running on a domain controller.
Issue: IIS Logging Enabled
- 101 -

Score: Best practice
Result: All web and FTP sites are using the recommended logging options.
SQL Server Scan Results
SQL Server and/or MSDE is not installed on this computer.
Desktop Application Scan Results
Administrative Vulnerabilities
Issue: IE Zones
Score: Check passed
Result: Internet Explorer zones have secure settings for all users.
Issue: IE Enhanced Security Configuration for Administrators
Score: Check passed
Result: The use of Internet Explorer is restricted for administrators on this
server.
Issue: IE Enhanced Security Configuration for Non-Administrators
Score: Check passed
Result: The use of Internet Explorer is restricted for non-administrators on
this server.
Issue: Macro Security
Score: Check not performed
Result: No Microsoft Office products are installed
i rgmuelle@us.ibm.com, IBM Center for Microsoft Technologies
ii kswalin@us.ibm.com, IBM Center for Microsoft Technologies
iii dhartma@us.ibm.com, IBM Systems & Technology Group
iv rob_wilde@Veritas.com, Veritas Corporation
- 102 -