Use DPM to back up and restore VMware virtual machines

Supported VMware features

DPM provides the following features when backing up VMware virtual machines:

• Agentless backup: DPM doesn't require an agent to be installed on the vCenter or ESXi server to back up the virtual machine. Instead, just provide the IP address or fully qualified domain name (FQDN) and sign in credentials used to authenticate the VMware server with DPM.
• Cloud Integrated Backup: DPM protects workloads to disk, tape, and cloud. DPM's backup and recovery workflow help you manage long-term retention and offsite backup.
• Detect and protect VMs managed by vCenter: DPM detects and protects VMs deployed on a VMware server (vCenter or ESXi server). As your deployment size grows, use vCenter to manage your VMware environment. DPM also detects VMs managed by vCenter, allowing you to protect large deployments.
• Folder-level auto protection: vCenter lets you organize your VMs in VM folders. DPM detects these folders and lets you protect VMs at the folder level and includes all subfolders. When protecting folders, DPM not only protects the VMs in that folder, but also protects VMs added later. DPM detects new VMs on a daily basis and protects them automatically. As you organize your VMs in recursive folders, DPM automatically detects and protects the new VMs deployed in the recursive folders.
• DPM protects VMs stored on a local disk, network file system (NFS), or cluster storage.
• DPM protects VMs migrated for load balancing: As VMs are migrated for load balancing, DPM automatically detects and continues VM protection.
• DPM can recover files/folders from a Windows VM without recovering the entire VM, which helps recover necessary files faster.

Configure DPM to protect VMware

The following information details how to configure VMware for DPM protection. To establish communication between DPM and the VMware server, configure the VMware credentials and establish a secure connection between DPM and the VMware vCenter Server or VMware vSphere Hypervisor (ESXi) server. If you use both vCenter Server and ESXi server, configure only the vCenter Server to work with DPM. You don't need to add ESXi servers to DPM. To manage a VMware server, DPM needs valid credentials to access VMware servers.

Credential management

DPM doesn't use an agent to communicate with a VMware server. Instead, it uses a username and password credential to authenticate its remote communication with the VMware server. Each time DPM communicates with a VMware server, DPM must be authenticated. As it can be necessary to change credentials and a data center can have multiple vCenter servers requiring unique credentials, tracking these credentials can be a problem. However, DPM has a Manage VMware Credentials feature to securely store and manage credentials.

Remember the following details about credentials:

• One credential can be used to authenticate multiple VMware servers.
• Once credential details, such as Description, User name, and Password are updated, DPM uses these credentials to communicate with all VMware servers.
• A credential can be deleted only if it isn't being used to authenticate a VMware server.

Open the Manage VMware Credentials feature

1. In the DPM Administrator Console, select Management.

   

2. In the list of assets to manage, select Production Servers.

3. In the tool ribbon, select Manage VMware Credentials. The Manage Credentials page opens. Using the Manage Credentials page, you can add, update, or delete credentials.

   Select the required tab for detailed information on adding, updating, or deleting credentials:

Set up secure communication between DPM and a VMware server

DPM communicates with the VMware server securely over an HTTPS channel. To create the secure communication, install a trusted certificate on both the VMware server and the DPM server. If the connection to your vCenter isn't secure, you can secure it by installing a certificate on the DPM server. Use the same certificate to make a secure connection with the VMware server.

To verify if there's a secure communication channel between DPM and vCenter, open a browser on the DPM server and access the VMware server. If you're using Chrome and you don't have a valid certificate, you see the strikethrough in the URL, like this example:

If you're using Internet Explorer and you don't have a valid certificate, you see this message when you access the URL:

To fix the error, install a valid certificate on the DPM server and the VMware server. In the previous images, the DPM server has a valid certificate, but the certificate isn't in the trusted root certification authority store. To fix this situation, add the certificate to the VMware server.

1. On the Certificate page, on the Certification Path tab, select View Certificate.

   

2. In the new Certificate page, select the Details tab, and then select Copy to File to open the Certificate Export Wizard.

   

3. In the Certificate Export Wizard, select Next.

4. On the Export File Format screen, select DER encoded binary X.509 (.CER), and then select Next.

5. On the File to Export screen, enter a name for your certificate and select Next.

6. Select Finish to complete the Certificate Export Wizard.

7. Locate the exported certificate. Right-click the certificate and select Install Certificate.

   

8. In the Certificate Import wizard, select Local Machine and then select Next.

9. To find the location where you want to place the certificate, on the Certificate Store screen, select Place all certificates in the following store and select Browse.

10. In the Select Certificate Store page, select Trusted Root Authority Certificate and select OK.

    

11. Select Next and then select Finish to import the certificate successfully.

12. Once you've added the certificate, sign in to your vCenter server to verify if the connection is secure.

    

Add a new user account in VMware server

DPM uses your user name and password as credentials for communicating and authenticating with VMware server. A vCenter user account has at least the following privileges, which are required for successfully protecting a VM.

The following table captures the privileges that you need to assign to the user account that you create:

The recommended steps for assigning these privileges:

Create a role, for example, BackupAdminRole

1. In the vSphere Web Client, from the Navigator menu, select Administration > Roles.
2. From the Roles provider dropdown menu, select the vCenter Server to which the role applies.
3. On the Roles pane, select '+' to open the Create Role dialog and create a role.
4. Name the role BackupAdminRole.
5. Select the privileges (identified in the preceding bulleted list) for the role and select OK.

Create a new user, for example, BackupAdmin

When you create a user, that user must be in the same domain as the objects you want to protect.

1. In the vSphere Web Client, on the Navigator menu, select Administration.
2. In the Administration menu, select Users and Groups.
3. To create a new user, on the Users tab, select '+' to open the New User page.
4. Provide a User name and password for the role. Use BackupAdmin as the User name. Additional information is optional.

Assign the role, BackupAdminRole, to the user, BackupAdmin

1. In the vSphere Web Client, on the Navigator menu, select Administration.
2. In the Administration menu, select Global Permissions.
3. On the Global Permissions pane, select the Manage tab.
4. On the Manage tab, select '+' to open the Add Permission page.
5. In the Add Permissions page, select Add.
6. In the Select Users/Groups page, choose the correct domain from the Domain menu, then in the User/Group column, select BackupAdmin and select Add. The user name appears in the Users field in the format: domain\BackupAdmin.
7. Select OK to return to the Add Permissions page.
8. In the Assigned Role area, from the dropdown menu, select the role BackupAdminRole and select OK. The new user and role association appear in the Manage tab.

Add a VMware server to DPM

1. In the DPM Administrator Console, select Management > Production Servers > Add to open the Production Server Addition Wizard.

   

2. On the Select Production Server type screen, select VMware Servers, and select Next.

3. On the Select Computers screen, provide the following information:

   • Server Name/IP Address: Enter the VMware server fully qualified domain name (FQDN) or IP address.
   • SSL Port: Select the SSL port number used to communicate with the VMware server. DPM uses Https to communicate with VMware servers over a secured connection. To successfully communicate with VMware servers, DPM requires the SSL port number configured for that VMware server. If the VMware servers aren't explicitly configured with different SSL ports, continue with default port, 443.
   • Specify Credential: Select the credential needed to authenticate with this VMware server. If the required credential hasn't yet been added to DPM, choose Add New Credential. Then, provide the Name, Description, User name, and Password for the credential. Once you've filled out the fields, select Add to add the server to the list of VMware Servers. If you would like to add more VMware servers to the list, repeat this step. If you're finished adding servers to the list, select Next.

4. On the Summary screen, select the server you want to add, and select Add. After adding the VMware servers to DPM, for information about the available methods of protection, see Configure Backup.

Disable secure communication protocol

If your organization doesn't want to use secure communication protocol (HTTPS), you can create a registry key to disable it. To create this registry key:

1. Copy and paste the following text into a .txt file.

   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Data Protection Manager\VMWare]
   
   "IgnoreCertificateValidation"=dword:00000001"
   

2. Save the file with the name, DisableSecureAuthentication.reg, to your DPM server.

3. Double-click the file to activate the registry entry.

Configure Backup

Once you've added the VMware server(s) to DPM, you're almost ready to start protection in DPM. However, before you begin protection, you need to allocate disk storage that DPM can use for short-term storage. For guidance on adding storage, see Adding Storage to DPM. Once you've added storage, you're ready to use the Create New Protection Group wizard to create a protection group for the VMware VMs.

Folder-level protection

VMware provides VM folders that let you organize VMs as you like.

DPM can protect individual VMs and cascading levels of folders that contain VMs. Once you select a folder for protection, all folders (and VMs) within this folder are automatically detected and protected. This is called folder-level protection. DPM detects and configures protection for the VMs at 12 AM (based on the DPM server's local time zone). When DPM detects that new VMs have been created, it configures protection by the end of that day.

Scale out protection of clustered VMware servers

In large VMware deployments, a single vCenter server can manage thousands of VMs. DPM supports scale-out protection of VMware server clusters. The new scale-out feature removes the limit of a one-to-one relationship between a VMware cluster and a DPM server. You can add a VM to a protection group on any of the recognized DPM servers. Multiple DPM servers can be used to protect VMs managed by a single vCenter server. However, only one DPM server can protect a VM or folder at any given time. VMs and folders that are already protected by one DPM server can't be selected by another DPM server. To deploy scale-out protection, there must be a minimum of two DPM servers. In the following example graphic, D1 and D2 are visible to all virtual machines hosted on nodes N1, N2, N3, and N4. When protection groups on D1 or D2 are created, any virtual machine can be added.

Back up virtual machines to a disk, tape, or cloud

DPM can back up VMware VMs to disk, tape, and Azure cloud. You can specify the protection method while creating the new Protection Group.

For all operational recovery scenarios like accidental deletion or corruption scenarios, back up to disk. For long-term retention or offsite backup requirements, back up to tape or cloud.

DPM provides application-consistent backups of Windows VMs and file-consistent backups of Linux VMs (provided you install VMware tools on the guest).

Back up virtual machine to Tape

For long-term retention on VMware backup data on-premises, you can now enable VMware backups to tape. The backup frequency can be selected based on the retention range (which will vary from 1-99 years) on tape drives. The data on tape drives could be both compressed and encrypted. DPM 2019 and later supports both OLR (Original Location Recovery) and ALR (Alternate Location Recovery) for restoring the protected VM.

Use the following procedure:

1. In the DPM Administrator console, select Protection > Create protection group to open the Create New Protection Group wizard.
2. On the Select Group Members page, select the VMware VMs you want to protect.
3. On the Select Data Protection Method page, select I want long-term protection using tape.
4. In Specify Long-Term Goals > Retention range, specify how long you want to keep your tape data (1-99 years). In Frequency of backup, select the backup frequency you want.
5. On the Select Tape and Library Details page, specify the tape and library that will be used for backup of this protection group. You can also specify whether to compress or encrypt the backup data.

Create a Protection Group for VMware VMs

1. In the Administrator Console, select Protection.

2. On the tool ribbon, select New to open the Create New Protection Group wizard.

3. In the Select Protection Group Type screen, select Servers and then select Next.

   

4. In the Select Group Members screen, expand the Available members folders and select the folders to protect and select Next. Once you select a folder, the member is added to the Selected members list. Items already protected by a DPM server can't be selected again. View the DPM server that protects an item by hovering over the item in the Available members list.

   

5. On the Select Data Protection Method screen, enter a Protection group name and then select the protection method. For protection method, you can choose: short-term protection to a hard drive, long-term backup to tape, or online protection to the cloud. Once you've selected your protection method, select Next.

   If you've a standalone tape or tape library connected to the DPM server, you'll be able to select I want long-term protection using tape.

6. On the Specify Short-Term Goals screen, for the Retention Range, specify the number of days your data is kept on disk. If you want to change the schedule when application recovery points are taken, select Modify. On the Express Full Backup tab, choose a new schedule for the time(s) and days of the week when Express Full Backups are taken. The default is daily at 8 PM local time for the DPM server. When you've the short-term goals you like, select Next.

7. If you want to store data on tape for long-term storage in Specify long-term goals, indicate how long you want to keep tape data (1-99 years). In Frequency of backup, specify how often backups to tape should run. The frequency is based on the retention range you've specified:

   • When the retention range is 1-99 years, you can select backups to occur daily, weekly, bi-weekly, monthly, quarterly, half-yearly, or yearly.
   • When the retention range is 1-11 months, you can select backups to occur daily, weekly, biweekly, or monthly.
   • When the retention range is 1-4 weeks, you can select backups to occur daily or weekly.

   On a standalone tape drive, for a single protection group, DPM uses the same tape for daily backups until there's insufficient space on the tape. You can also collocate data from different protection groups on tape.

   On the Select Tape and Library Details page, specify the tape/library to use and whether data should be compressed and encrypted on tape.

8. On the Review Disk Allocation screen, recommended disk allocations are displayed. Recommendations are based on the retention range, the type of workload, and the size of the protected data. Select Next.

9. On the Choose Replica Creation Method screen, specify how the initial replication of data in the protection group is performed. If you choose to replicate over the network, we recommend you choose an off-peak time. For large amounts of data or less than optimal network conditions, consider replicating the data offline using removable media.

10. On the Consistency Check Options screen, select how you want to automate consistency checks. You can enable a check to run only when replica data becomes inconsistent or according to a schedule. If you don’t want to configure automatic consistency checking, you can run a manual check. To run a manual check, right-click the protection group in the Protection area of the DPM console and select Perform Consistency Check.

11. On the Specify Online Protection Data screen, select the data source(s) that you want to protect.

12. On the Specify Online Backup Schedule screen, specify how often you want to take a backup from the disk backup to Azure. A recovery point is created each time a backup is taken.

13. On the Specify Online Retention Policy screen, specify how long you want to retain your data in Azure. For more information on backing up DPM to Azure, see Backup DPM workloads with Azure Backup.

14. On the Choose Online Replication screen, choose your method for creating your initial backup copy. The default choice is to send the initial backup copy of your data over the network. However, if you've a large amount of data, it might be more timely to use the Offline Backup feature. For more information, including a step-by-step walkthrough, see Offline Backup with Azure.

15. On the Summary screen, review the settings. If you're interested in optimizing the performance of the protection group, see Optimizing DPM operations that affect performance. Once you're satisfied with all the settings for the protection group, select Create Group to create the protection group and trigger the initial backup copy.

The Status screen appears and gives you an update on the creation of your protection group and the state of your initial backup.

Restore VMware virtual machines

This section explains how to use DPM to restore VMware VM recovery points. For an overview on using DPM to recover data, see Recover protected data. In the DPM Administrator Console, there are two ways to find recoverable data: search or browse. When recovering data, you might or might not want to restore data or a VM to the same location. For this reason, DPM supports these three recovery options for VMware VM backups.

• Original location recovery (OLR) - Use OLR to restore a protected VM to its original location. You can restore a VM to its original location only if no disks have been added or deleted since the backup occurred. If disks have been added or deleted, you must use alternate location recovery.
• Alternate location recovery (ALR) - When the original VM is missing or you don't want to disturb the original VM, recover the VM to an alternate location. To recover a VM to an alternate location, you must provide the location of an ESXi host, resource pool, folder, and the storage datastore and path. To help differentiate the restored VM from the original VM, DPM appends -Recovered to the name of the VM.
• Individual file location recovery (ILR) - If the protected VM is a Windows Server VM, individual files/folders inside the VM can be recovered using the ILR capability of the DPM. To recover individual files, see the procedure later in this article.

Restore a recovery point

1. In the DPM Administrator Console, select Recovery view.

2. Using the Browse pane, browse or filter to find the VM you want to recover. Once you select a VM or folder, the Recovery points for pane displays the available recovery points.

   

3. In the Recovery points for field, use the calendar and dropdown menus to select a date when a recovery point was taken. Calendar dates in bold have available recovery points.

4. On the tool ribbon, select Recover to open the Recovery Wizard.

5. Select Next to advance to the Specify Recovery Options screen.

6. On the Specify Recovery Options screen, if you want to enable network bandwidth throttling, select Modify. To leave network throttling disabled, select Next. No other options on this wizard screen are available for VMware VMs. If you choose to modify the network bandwidth throttle, in the Throttle page, select Enable network bandwidth usage throttling to turn it on. Once enabled, configure the Settings and Work Schedule.

7. On the Select Recovery Type screen, choose whether to recover to the original instance or to a new location, and select Next.

   • If you choose Recover to original instance, you don't need to make any more choices in the wizard. The data for the original instance is used.
   • If you choose Recover as virtual machine on any host, then on the Specify Destination screen, provide the information for ESXi Host, Resource Pool, Folder, and Path.

8. On the Summary screen, review your settings and select Recover to start the recovery process. The Recovery status screen shows the progression of the recovery operation.

Restore an individual file from a VM

Name - FailbackToCrashConsistentBackup DWORD = 1
Path- SOFTWARE\\MICROSOFT\\MICROSOFT DATA PROTECTION MANAGER\\VMWare

PS C:\Program Files\Microsoft System Center\DPM\DPM\bin> ./ExcludeDisk.ps1 -Datasource $vmDsInfo[2] -Remove "[datastore1] TestVM4/TestVM4\_1.vmdk"