How to configure NetBackup for Microsoft Exchange Server Granular Restore Technology (GRT) backups

Description

Everything you need to know to get NetBackup for Microsoft Exchange Server GRT backups to work using an MS-Exchange-Server policy.

This article does not address protecting Exchange using VMware policy backup.

1. NetBackup Versions vs. Exchange versions.

See ' Application/Database Agent Compatibility List' under 'NetBackup Compatibility List for all Versions' for more details: 

https://www.veritas.com/support/en_US/article.100040093 

2. Disks supported - Granular backups MUST go to disk 

a. Basic Disk  - Disk must appear as locally attached.

b. Advanced Disk - Disk must appear as locally attached.

c. PDDO/MSDP

To achieve optimal backup performance on a PureDisk/MSDP configured storage unit, the default fragment size should be decreased to a size of 15GB. 

d. Approved OST devices - Check the Hardware and Cloud Storage Compatibility List for your NetBackup version.

To achieve optimal backup performance on an OST (such as Data Domain, ExaGrid, etc.) configured storage unit, the default fragment size should be decreased to a size of 10GB.

3. OS compatibility
Check the Application / Database Compatibility List.

4. Permissions - Configure Exchange credentials in the client host properties for each mailbox server, using an account with the following conditions:

a. The account must be a member of Domain Admins or Organization Management, or otherwise have at least the minimum traits described in the NetBackup for Exchange administration guide. (If the account is not a member of Domain Admins or Organization Management, you cannot back up passive copies of databases.)

b. The account has a mailbox in the Exchange environment with

i.  a unique name.

ii.  a mailbox that is NOT hidden in the Global Address List.

iii.  a mailbox that is Active - verify that mail can be sent TO and FROM the account's mailbox.

c. The account must have the right to "Replace a process level token." The method to add that right varies with your Windows OS version and whether the server is a domain controller (not recommended).  To grant "Replace a process level token" on each of the Exchange servers in the DAG, select "Administrative Tools > Local Security Policy"  Highlighted "Security Settings > Local Policies > User Rights Assignments ", and add the account "domain\account"

d.  For ALL Exchange servers as well as the DAG, add the account "domain\account name" and password in NetBackup Admin Console under "Host Properties > Clients | Exchange server name > Windows Client | Exchange" and enter the "Domain\account" with the corresponding password. 

NOTE:  If a mailbox server does not appear under NetBackup Admin Console under "Host Properties | Clients | Exchange server name", from the Menu select "Actions | Configure Client" and enter the name of the Exchange server.

NOTE:  If the DAG is IP Less, adding the "Domain\account" under DAG's "Host Properties > Clients | <DAG name > Windows Client | Exchange" is not possible.

e. Update the Distributed Application Restore Mapping for the master server if this is a DAG.

Go to, "Host properties > Master Servers > Properties of Master Server " and select  Distributed Application Restore Mapping.

Provide the name of the application host and the name of the component host, as follows:

Application host                       Component host
DAG name                              Mailbox server name 1
DAG name                              Mailbox server name 2
DAG name                              Mailbox server name 3
 

5. NFS configuration

NetBackup uses the NFS protocol to communicate between nbfs client on the mailbox server with nbfsd daemon on the media server. The Windows Media Server needs the 'Server for NFS' service installed and disabled. Each Exchange Mailbox Server needs 'Client for NFS' service installed and running under Local Service account. 

a. The method for installing the NFS features varies with the Windows OS version. See the NetBackup for Exchange admin guide for instructions.

b. If the media server is Linux or UNIX, no additional configuration is required - check the Software Compatibility List to make sure it is a supported platform. 

c. If firewall is used, open ports 7394 and 111 from the Exchange servers to the Media server.

6. Policy

a. Attributes
       Policy Type should be MS-Exchange-Server.
       Policy Storage should be a supported disk pool See #2 for more information.
       Check the "Enable granular Recovery".
       Check "Perform snapshot backups" and specify VSS under options.
       If this is a DAG, specify the database backup source. The default value is "Passive copy and if not available the active copy."
   b. Schedules -
       Full schedule only - Granular backups do not support Incremental or Differential backups.
   c. Client -
       DAG name or Exchange Server name
   d. Backup Selection -
       Stand-alone Exchange server (not a DAG), use "Microsoft Information Store:\".
       DAG, use "Microsoft Exchange Database Availability Groups:\"
       Alternatively, you can click "Browse" to select one or more individual databases.

7. Additional notes

a. NetBackup must be installed on all servers in Exchange. In a DAG, use the mailbox server name rather than the DAG name when installing the NetBackup Client Software.

c. If you are duplicating the GRT backups to tape or a non-supported disk (e.g., OST plug-in) to store the image, you must duplicate back to a supported disk location for the granular restore.