Make sure following four steps are carried out on the Enterprise Vault and target NTFS File server before running the EV FSA Archiving Task:
Step A: Allow Remote Administration
Step B: Open the DCOM Port
Step C: Add EVPlaceholder Server to Windows Firewall Exception List
Step D: Grant DCOM Remote Launch Permissions to VSA User
Step [A] Allow Remote Administration:
1. Click Start, click Run, type gpedit.msc, and then click OK.
2. Under Console Root, expand Computer Configuration, expand Administrative Templates, expand Network, expand Network Connections, expand Windows Firewall, and then click Domain Profile.
3. Right-click Windows Firewall: Allow remote administration exception, and then click Properties.
Note On Windows Server 2008, right-click Windows Firewall: Allow inbound remote administration exception, and then click Properties.
4. Click Enabled, and then click OK.
Note You need to run
gpupdate.exe from a command prompt to make sure above setting is applied.
Figure 1: Allow Remote Administration Exception
Step [B] Open the DCOM Port:
Before you enable ports in Windows Firewall, make sure that the Windows Firewall: Allow local port exceptions setting in Group Policy is enabled. To do this, follow these steps:
1. Click Start, click Run, type gpedit.msc, and then click OK.
2. Under Console Root, expand Computer Configuration, expand Administrative Templates, expand Network, expand Network Connections, expand Windows Firewall, and then click Domain Profile.
3. Right-click Windows Firewall: Allow local port exceptions, and then click Properties.
4. Click Enabled, and then click OK.
Note You need to run gpupdate.exe from a command prompt to make sure above setting is applied.
Note You can also use the Windows Firewall: Define port exceptions setting to configure local port exceptions. For Windows Server 2008, it's Windows Firewall: Define inbound port exceptions.
Figure 2: Allow Local Port Exception
To open the DCOM port, follow these steps: The DCOM port is TCP 135.
1. Click Start, and then click Control Panel.
2. Double-click Windows Firewall, and then click the Exceptions tab.
3. Click Add Port.
4. In the Name box, type DCOM_TCP135, and then type 135 in the Port number box.
5. Click TCP, and then click OK.
6. Click OK.
Note You can also type the following command at a command prompt to open a port:
netsh firewall add portopening [TCP/UDP][Port][Name]
Figure 3: Adding DCOM Port
Step [D] Add EVPlaceholder Service to the Windows Firewall Exceptions list
Before you define program exceptions in Windows Firewall, make sure that the Windows Firewall: Allow local program exceptions setting in Group Policy is enabled:
1. Click Start, click Run, type gpedit.msc, and then click OK.
2. Under Console Root, expand Computer Configuration, expand Administrative Templates, expand Network, expand Network Connections, expand Windows Firewall, and then click Domain Profile.
3. Right-click Windows Firewall: Allow local program exceptions, and then click Properties.
4. Click Enabled, and then click OK.
Note You can also use the Windows Firewall: Define program exceptions setting to configure local program exceptions. For Windows Server 2008, it's Windows Firewall: Define inbound program exceptions.
Note You need to run gpupdate.exe from a command prompt to make sure above setting is applied.
Figure 5: Allow Local Program Exception
To add a client application to the Windows Firewall Exceptions list, follow these steps:
1. Click Start, and then click Control Panel.
2. Double-click Windows Firewall, and then click the Exceptions tab.
3. Click Add Program.
4. Browse for EVPlaceholderService.exe application that you want to add, and then click OK.
5. Click OK.
Note You can also type the following command at a command prompt to add a program to the Windows Firewall Exception list:
netsh firewall add allowedprogram [\ProgramName] [ENABLE/DISABLE]
Figure 6: Add EV Placeholder Service to Exception List
Step [C] Grant DCOM Remote Launch Permissions to VSA User:
1. Click Start, click Run, type DCOMCNFG, and then click OK.
2. In the Component Services dialog box, expand Component Services, expand Computers, and then expand My Computer.
3. On the toolbar, click the Configure My Computer button. The My Computer dialog box appears.
4. In the My Computer dialog box, click the COM Security tab.
5. Under Launch and Activation Permissions, click Edit Limits.
6. In the Launch Permission dialog box, follow these steps if your Vault Service Account username or your group does not appear in the Groups or user names list:
a. In the Launch Permission dialog box, click Add.
b. In the Select Users, Computers, or Groups dialog box, add your Vault Service Account username and the group in the Enter the object names to select box, and then click OK.
c. In the Launch Permission dialog box, select your user and group in the Group or user names box. In the Allow column under Permissions for User, select Remote Launch, and then click OK.
Figure 4: Grant VSA User Remote Launch Permissions
Note:
Additional cases have been reported where the archiving of items is successful, but placeholder creation fails with the
Catastrophic failure, in these cases the solution was to set SPN for the Windows 2008 servers.
Setspn -a RPC\'servername' 'domain'\'enterprise vault service account'
Where 'servername' is the name of the Windows 2008 server, 'domain' is the domain name of the server, and 'enterprise vault service account' is the named account under which the Enterprise Vault services run.