PowerProtect Data Manager: Reconfigure Agent-Based Backups After Data Domain Replacement

Summary: Replacing, reimaging, or changing credentials on a Data Domain causes PowerProtect Data Manager agent backups to fail. Errors such as ABA0002, ABA0008, ABF0005, ABG0004, or PKIX (Public-Key Infrastructure (X.509)) path building failed due to stale credentials, mismatched storage units, and certificate validation issues. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Backup Failure Symptoms

 
Error Code Symptom
ABA0002 "Unable to backup [ASSET_TYPE] asset on host [HOST] to storage target [SU] because of an agent issue"
ABA0008 "Unable to backup [ASSET_TYPE] because of a network connectivity issue"
ABF0005 "Unable to perform the backup because PowerProtect Data Manager was not able to connect to the PowerProtect Data Domain"
ABG0004 "Unable to backup generic application asset — unable to build backup payload"
PKIX path building failed "Unable to find valid certification path to the requested target"
Lockbox errors "Error adding credentials to lockbox" or "lockbox authentication failure"
sbtinit2/sbtbackup "Unable to initialize the PowerProtect DD Boost library" or "sbtbackup returned error"
Discovery failure "Unable to log in with the user account" after DD password change

 

Cause

When a DataDomain is replaced, reimaged, or its credentials certificates are changed, several PowerProtect Data Manager and agent‑side components retain stale information, leading to backup failures.

Component Impact of DD Change
DD credentials in PPDM Stored credentials no longer match the new DD.
Storage Unit configuration Storage unit may not exist or may have different naming on the new DD.
DD certificate in PPDM truststore Certificate fingerprint changes; TLS validation fails
Agent lockbox Agent‑side lockbox contains old DD credentials or storage unit references.
Agent host registration Agent host registration may reference an old DD hostname/IP.
DD ifgroups/interface configuration Network interfaces and hostnames may differ on the new DD.
Oracle RMAN/DDBoost library path Library paths or SBT configuration may reference old DD paths.

Resolution

Complete Reconfiguration Checklist.

Phase 1: PowerProtect Data Manager Server‑Side Configuration

Step Action Details
1.1 Update DD credentials in PowerProtect Data Manager Go to Infrastructure > Storage > [DD Name] > Edit. Update hostname/IP, username, and password to match the new DD. If the DD was reimaged, remove and readd it.
1.2 Accept the new DD certificate. When editing or readding the DD, PPDM prompts to accept the new certificate. Verify that the fingerprint matches the new DD before accepting.
1.3 Enable HA option for DD HA configurations. If the DD is configured in HA mode, ensure that the HA checkbox is selected when adding using the PPDM UI. This imports the root CA certificate into the extserver truststore, preventing PKIX errors.
1.4 Verify storage units. Go to Infrastructure > Storage > [DD Name] > Storage Units. Confirm that all storage units referenced by protection policies exist on the new DD. Update policy names if they were renamed.
1.5 Run full discovery. Go to Infrastructure > Asset Sources. Select all relevant asset sources and click Discover. Wait for the discovery to complete successfully.

Phase 2: Agent‑Side Configuration (Per Host)

Step Action Details
2.1 Update the agent lockbox.

a. From the PPDM UI left navigation pane, select Protection -> Protection Policies
b. Select the protection policies that target the updated protection storage system, and then click Set Lockbox

NOTE: If the above fails, the agent lockbox can be updated manually with the new DD credentials.
On each Windows and Linux/AIX agent host run the following from the agent install directory:
ddutil -C -a STORAGE_HOSTNAME -u DD_USERNAME -p DD_PASSWORD -s STORAGE_UNIT_NAME

2.2 Verify agent host registration. Run register.bat (Windows) or register.sh (Linux/AIX) to re‑register the agent with PPDM. Verify that the agent status shows Registered in the PPDM UI under Infrastructure > Application Agents.
2.3 Update DD ifgroup (SQL AG/clustered environments) For SQL Always On Availability Group or clustered configurations, ensure that DD ifgroups contain the correct hostnames/IPs for all cluster nodes. Update ifgroups if hostnames have changed.
2.4 Verify that the agent service is running and listening Confirm the PowerProtect Agent Service is running: Windows - Get-Service "PowerProtect Agent Service". Linux/AIX - ps -ef | grep dpsagent.
2.5 Clear orphaned agent installations (AIX/Linux) If the agent was previously installed with a different DD configuration, perform a clean uninstall and reinstall: (1) Stop agent service, (2) Remove agent packages, (3) Rename/delete old install folders under /opt/dpsapps/, (4) Reinstall the agent matching the PPDM version, (5) Re‑register.

Phase 3: Application‑Specific Steps

Application Step Details
Microsoft SQL Update SQL credentials in protection policy If SQL backup credentials have changed, update them in the protection policy. Ensure the SQL login has sysadmin privileges.
Microsoft SQL AG Verify preferred node configuration. After DD replacement, rerun discovery and verify that the AG preferred node is correctly identified.
Oracle Update RMAN SBT configuration Verify the DDBoost library path in the RMAN script matches the path on the host. Ensure correct case sensitivity and update rmanagent.env if present.
Exchange Verify .ddbmcon.gatherinfo file. Confirm that the file exists in \Program Files\DPSAPPS\MSAPPAGENT\settings\ on all DAG nodes. Copy from a working node if missing.
SAP HANA Restart agent service. After DD replacement, restart the PowerProtect Agent Service on the SAP HANA host and rerun discovery.
PostgreSQL Verify lockbox and storage unit path. Update the lockbox with new DD credentials and, if needed, configure a different storage unit.

Phase 4: Validation

Step Action Details
4.1 Run a manual backup. Trigger a manual Full backup for each protection policy to verify end‑to‑end connectivity.
4.2 Verify backup completion in PPDM UI. Go to Jobs > Protection Jobs. Confirm all manual backups completed successfully.
4.3 Monitor scheduled backups. Observe the next two scheduled backup cycles to ensure policies run without errors.
4.4 Verify replication (if configured) If replication is configured, confirm that replicated copies are being created on the target DD.

Affected Products

Data Domain, PowerProtect Data Manager
Article Properties
Article Number: 000480289
Article Type: Solution
Last Modified: 03 يوليو 2026
Version:  1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.