Install DPM Agent in untrusted Workgroup…

To install the DPM Agent on computers running outside the DPM domain is a little bit tricky – hopefully the steps below are helping to describe this procedere:

first find the agent setup files on DPM server – to do this locate the agent setup directory with the newest version – on DPM Server browse to C:\Program Files\Microsoft System Center 2012 R2\DPM\DPM\agents\RA

inside this folder copy the appropriate OS version – ie. amd64 for the 64-bit agent:

paste this on the computer where you want to install the agent – ie. C:\Temp\DPM\Agent:

on the computer where you want to install the agent, open a CMD with admin rights and change to the directory where you copied the setup files – ie. C:\Temp\DPM\agent\amd64\1033

DPM agent needs the FQDN of the DPM server – check nslookup if name resolution working correctly or edit Hosts file to have a local name resolution

HINT: for DPM the fqdn name and NETBIOS name are two different things (!) – if you enter fqdn here, you have to enter also the fqdn on DPM SERVER side while adding the agent…

to install the agent with showing a progress bar – enter the following command:

to install completely silent – enter:

(KBxxxx reference to the newest version of agent – in this case DPM agent 2012R2CU10…)

HINT: ..if you get a 0x80070005 “Access is denied” error – try to start the DPMAgentInstaller without parameters!

confirm the “Restart message” and change to the new install dir of agent:

enter the following command:

…choose a password and DPM is creating a local user account with the name you choose – you can check this with Computer Management->Local User and Groups->Users

Agent setup also creates the following three groups:

  • DPMRADCOMTrustedMachines
  • DPMRADmTrustedMachines
  • DPMRATrustedDPMRAs

…the new account is member in the first two groups..

On DPM server do the following:

click on Management->Add -> Windows Servers:

…be careful here to enter the correct values – FQDN must resolvable from DPM server – username is in format <new_created_local_account_before> (don’t use <DOMAIN>\<accountname> here !)

click attach:

..agent should be attached with status “Success” – you have to restart the agent Computer to finish the agent Installation…

Install DPM Agent on a Domain Controller in a untrusted Domain/Workgroup…

Installing a DPM Agent on a domain controller is unfortunately not so easy as installing a dpm agent in a untrusted workgroup (dpm agent installer wants to create a local user…)

Tasks to do on DPM agent computer:

  • install Agent (ie. DPMAgentInstaller_AMD64.exe <fqdn_of_DOM_server>
  • open cmd Shell with admin rights
  • change to DPM directory (c:\Program Files\Microsoft Data Protection Manager\DPM\bin)
  • call setup:

  •  enter a new Password for DPM Agent/Server communication

Since the DPM agent computer is a domain controller of other domain, setup is creating a domain account called <new_name_for_dpm_agent>:

  • Add the agent account to the following groups on the domain controller:
    • DPMRADCOMTrustedMachines$…
    • DPMRADmTrustedMachines$…

Tasks to do on DPM server computer:

open Computer Management on DPM server to add the <new_name_for_dpm_agent> account to the following groups:

  • DPMRADCOMTrustedMachines
  • DPMRADmTrustedMachines
  • MSDPMTrustedMachines
  • Distributed COM Users

  • (only necessary if you have added this agent before) – open DPM ManagementShell with admin rights and change to DPM\bin directory – enter:

  • add agent on DPM server as usual
  • a few minutes later the new agent should appear as “Agent Status” – OK in DPM console…



Installing Highly Available SystemCenter VMM 2016 – HowTo…


if you want to install a highly available VMM you need two VM´s (to create a VMM cluster) and a extra HA SQL Server (ideally two SQL 2016 core Nodes with AlwaysOn – for installing this SQL nodes see

  • Create two VMs with a OS vhdx (optional one additional Data drive if you want to split OS and VMM in two different drives), 2 vCPUs and at minimum 4096 MB Memory (if you want to use Dynamic RAM, set Startup value to 4096MBs or more and Minimum RAM to 2048 or more, otherwise setup check will fail…) – see SystemCenter requirements:
  • Create a cluster with this two VMs, no cluster disks necessary, don’t forget to create a witness (my preferred FileShare or Cloud Witness)

  • create a AlwaysOn Listener on your SQL cluster (you can deploy VMM in a “Common” Instance with other databases or you prefer a dedicated instance for VMM – collation should be: SQL_Latin1_General_CP1_CI_AS

  • Install ADK on both VMM nodes with the following options:
    • DeploymentTools
    • Windows Preinstallation Environment

…copy downloaded ADKSetup Files to both VMM nodes and install with GUI or unattended:

…after a few minutes check c:\temp\install.txt – the last entry should be “…Exit code 0…”:

  • Install the SQL tools in GUI mode or unattended:

  • do this on both vm nodes and restart the servers
Login Purpose Permission
DOMAIN\_svc_vmmservice SCVMM Service Account Local admin rights on VMM nodes
DOMAIN\_svc_vmmrunas Service Account for manageging Hyper-V Hosts Local admin rights on Hyper-V servers/nodes
(optional) DOMAIN\_svc_vmm2scom SCVMM to SCOM connector account SCOM Admin and SCVMM Admin role
(optional) DOMAIN\_svc_vmmtemplate Account used in templates to join Domain and run scripts while deployment you can use delegate control in AD for this account – Computer Objects/Reset Password/Validated write to DNS host name/Validated write to service principal name/Read/Write Account Restrictions (This object and all descendant objects – Create/Delete Computer Objects)
Name Members Scope Permission
gg_VMMAdmins your account/_svc_vmmservice/_svc_vmmrunas Global -
lg_VMMAdmins gg_VMMAdmins Local Put this group in local admins group on VMM nodes
AD container:

if you install VMM in HA mode you must create a container in AD to allow VMM to store their key´s. See

open ADSIEdit.msc and connect to the domain partition of the active directory domain:

…double click on “Default namin context…” and right click on domain context:

..give it a name (ie. VMMDKM – “Virtual Machine Manager Distributed Key Management”)

…refresh the console:

…click on domain -> your container -> and check your if your container is created successfully:


…close ADSIEdit and open “Active Directory Users and Computers” – click View -> Advanced Features:

…open Properties of your container:

…add VMM service account with R/W/Create child permissions:

…click Advanced and chance permissions to all descendant objects:


In a VMM HA install the FileShare for Library must be created outside of VMM servers – you have to create a fileshare on a MS fileserver or fileservercluster (NAS or other CIFS components are not possible because VMM installing his own VMM agent on the fileserver for management purposes…)


you can choose between nonGUI and GUI VMM setup – even on server core edition:

Server core install:

change to your VMM setup path and edit the file VMserver.ini (ie: C:\VMMSetup\amd64\Setup\VMserver.ini)

call the setup with the following parameter:

check the VMMLog in C:\ProgramData\VMMLogs

Installation in GUI mode:

..start setup – choose install, click VMM server and next:

Server name -> Name of you AlwaysOn Listener

Port -> Listener Port

Instance name -> name of SQL instance

use your vmm-service account -> see “Accounts” above and the Distinguished Name of the container you created in AD before (see container above)

HINT: ..normally everything should ok – if you get an error like me (see text in screenshot) regarding the SCP in AD – maybe you have moved your Nodes in AD in another OU and forget to give the ClusterObject the permission to create Computer Objects within this OU! – see: or see: my case i manually create the computer object (same OU as FC object) and give the failoverclusterobject Full-rights on this new object – after that i run the configurescptool.exe command (see text above) again and voila – in Cluster Manager the Role can be started with success…

On second node:

start setup (vmmsetup recognize that it runs in a cluster and that a “primary” vmm node exist):

…if you click on VMM management server in next screen you will get the following message:

…enter registration informations again:

…settings for database are greyed-out because setup reads this info from primary installed node:

…reeenter password for vmm-service:

accept all other with next and click install:

…after a while setup should finished with success:

Last step in HA install is to make the VMM DB highly-available – we installed it with the AlwaysOn Listener but the DB itself must be switched to HA with the SQL AlwaysOn Wizard – open the SQL Studio and connect to your AO Database:

…standard SQL setup for join a single DB to AO group – change recovery mode/make backup/add db to ao group:

…right click on AOgroup and select “Add Database…”:

HINT: in SQL Alvailability group dont forget to keep your SQL users on the database in sync (!) – see: since every works perfekt until the first failover of the DB – then VMM service failed to start, because the (ie. _svc_vmmservice) user does not exist on the failover target server.

FINISH: now you have a fully highly available SCVMM installation – test it with failover of DB (nothing should happen) – and failover of VMM (an open VMM console should simple reconnecting after a few seconds)

Installing SQL Server 2016 Core on Windows Server 2016 Core



as a best practice you should create two (domain) accounts for running the sql service and the sql agent:

Login Description
_svc_sqldb SQL Server Service Account – is NOT local Admin on SQL Servers
_svc_sqlagent SQL Server Agent Account – is NOT local Admin on SQL Servers

…in addition i create a global domain and local domain group in AD for SQL Admins – put Members to the global domain group, put global domain group into local domain group (local group gets the permission for sql server –> see sql.ini file…)

Name Description
_gg_SQLAdmins Global Group – All SQL Administrators
_lg_SQLAdmins Local Group – All Glocal SQL Admin Groups

best practice for SQL servers is to put Data, Log and Temp Files in different harddrives (in physical word in different raid configs) – i prefer this also in virtual environments even if i have a config that puts all vDisks on the same physical drives – per SQL VM create 4 vDisks:

Filename Description
SystemOS.vhdx Boot Disk with OS
SQL-Data.vhdx Shared SQL Components and Instance Dirs
SQL-Temp.vhdx Drive for SQL Temp DB's
SQL-Log.vhdx Drive for SQL Log's

(see sql.ini for configuring the different drive letters and paths…)

if you want to manage your harddrives remotely by mmc plugin – you have to enable the appropriate firewall-rules on server core AND your workstation machine (if you not enable on your workstation machine you will get the error “RPC server unavailable):

check if the rules for remote disk management are enabled:


…not enabled by default – type:

…and check again: image

…if you prefer the GUI – Server Manager from Admin Workstation is great – you can use it to manage disks remotely (change disk label,…)

Hotfixes, CUs, SPs and Patches:

..while setup is running, it can implement existing updates – copy all updates in a directory named i.e C:\SQLSetup\Updates\… and refer this path in your SQL.ini

i.e. for SQL Server 2016 RTM – download CU2:


…if you do not created a ini file before, you can copy this sample sql.ini and edit for your own:

Install: CMD Shell on server core type:



HINT: see troubleshooting section for a bug in the setup routine – you have to add permissions on your backup dir, if you install additional instances…

after setup is finish – you have to manually create the firewall rule for accessing your instance:


per server:

per instance:

per listener (if you use alwayson):

older versions SERVER2012R2/SQL2012 (other Profile Parameter and SQL Path):

per server:

per instance:

per listener (if you use alwayson):

you can check if everything is ok with management studio – connect to the sql server\instance name and version number should be 13.0.2164 (SQL2016 with CU2) – see version numbers:

AlwaysOn config:

…if you want to create a AlwaysOn SQL Infra – do exact the same on a second server (don’t forget to create cluster first…)

Enable AlwaysOn:

Open PowerShell with Admin Rights (if you have a fresh install and not reopened your powershell window – no SQL cmdlet will be found (!) – so don´t forget to logoff and logon before start PS)


…do this on ALL sql nodes…

HINT – AlwaysOn: if you create a AvailabilityGroup and want to use it for i.e. SystemCenter VMM – see: don´t forget that AlwaysOn does NOT sync user logins on SQL automatically – so if you install VMM every works perfect until the first SQL Failover – after that VMM services crashes, because it can not connect to your database.

Good way to keep the user´s in sync, is a great tool named dbatools – it´s free of charge and you can find it via:

Installation is very simple via PSGallery on your SQL server – open powershell and type:

..aswer the following questions about NuGet and so on with Yes (you need a internet connection from your server..)

Test the connection to the server you logged in and the other sql server nodes that part of your Availability Group with:

Keep users in sync type:

i will do this in a scheduled task so have a perfect solution to keep all sql user logins on all sql servers in sync.


you can find any error or information in the SQL Setup log file located in C:\Program Files\MicrosoftSQL Server\130\Setup Bootstrap\Log\ – see the reference article:

HINT: …i found a  bug in the sql setup – if you install the instances with a unattended .ini file and point every instance to backup their databases to ie. E:\backup directory – the setup process create only for the FIRST instance the appropriate permissions for this directory (ie: NT Service\MSSQL$COMMON has Full permission to E:\Backup NOT other instances ie. NT Service\MSSQL$SCVMMDB…..) – to solve this open a Admin CMD Shell on every SQL node and enter:

you can check the correct permissions with:

if you have 2 instances (COMMON and SCVMMDB) it should look like this:

Initialize additional Disk on Server Core

…to get the number of the new disk enter:






Get-Disk –Number 1 | Set-Disk –IsOffline $false

Get-Disk –Number 1 | Set-Disk –IsReadOnly $false

Get-Disk –Number 1 | Initialize-Disk –PartitionStyle GPT

Get-Disk –Number 1 | New-Volume –FriendlyName “Data” –FileSystem ReFS –DriveLetter “D”


…if you want to change the drive letter of other drives before:



select volume x    (list volume –> to get volumes with driveletters)

assign letter=y


Lability – Add Server 2016 RTM as Custom Media


Lability can download the ISO file (jump directly to “Register-Media” section) for you or if you want to download manually – you find it on the MS Eval Site:

After downloading the ISO file, you need the exact image names within the install.wim of iso file – you can get this with the following powershell cmds:

You get a output like this:

Imagelndex : windows server 2016 SERVERSTANDARXORE ImageName Imageoescription • . windows server 2016 SERVERSTANDARXORE ImageSi ze . 8.840. 650.521 bytes Imagelndex ImageName Imageoescription : ImageSi ze Imagelndex ImageName Imageoescription : ImageSi ze Imagelndex ImageName Imageoescription : ImageSi ze . Wi ndows Server Wi ndows Server : 14.858. 983.050 . Wi ndows Server Wi ndows Server 2016 SERVERSTANDARD 2016 SERVERSTANDARD byt es 2016 SERVERDATACENTERCORE 2016 SERVERDATACENTERCORE . 8.905. 611.811 bytes . Wi ndows Server Wi ndows Server : 14.857. 373.611 2016 SERVERDATACENTER 2016 SERVERDATACENTER byt es

…you need the values in the Field “ImageName” – Dismount the Image with:


Register Media:

Now you can register the new ISO and ImageNames with:


Do the same with the other three imagenames:

Change your Lability Config file:

Change the media name in your lability config file (.psd1) i.e:

…your vLab is now ready to deploy with the new OS..