PowerProtect Data Manager: Reconfigure Agent-Based Backups After Data Domain Replacement

Summary: Replacing, reimaging, or changing credentials on a Data Domain causes PowerProtect Data Manager agent backups to fail. Errors such as ABA0002, ABA0008, ABF0005, ABG0004, or PKIX (Public-Key Infrastructure (X.509)) path building failed due to stale credentials, mismatched storage units, and certificate validation issues. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Backup Failure Symptoms

Error Code Symptom
ABA0002 Unable to backup [ASSET_TYPE] asset on host [HOST] to storage target [SU] because of an agent issue
ABA0008 Unable to backup [ASSET_TYPE] because of a network connectivity issue
ABF0005 Unable to perform the backup because PowerProtect Data Manager was not able to connect to the PowerProtect Data Domain
ABG0004 Unable to backup generic application asset or unable to build backup payload
PKIX path building failed Unable to find valid certification path to the requested target
Lockbox errors Error adding credentials to lockbox or lockbox authentication failure
btinit2/sbtbackup Unable to initialize the PowerProtect DD Boost library or sbtbackup returned error
Discovery failure Unable to log in with the user account after DD password change

Cause

When a Data Domain is replaced, reimaged, or its credentials certificates are changed, several PowerProtect Data Manager and agent‑side components retain stale information, leading to backup failures.

Component Impact of Data Domain Change
Data Domain credentials in PowerProtect Data Manager Stored credentials no longer match the new Data Domain.
Storage Unit configuration Storage unit may not exist or may have different naming on the new Data Domain.
Data Domain certificate in PowerProtect Data Manager truststore Certificate fingerprint changes; TLS validation fails
Agent lockbox Agent‑side lockbox contains old Data Domain credentials or storage unit references.
Agent host registration Agent host registration may reference an old Data Domain hostname or IP.
Data Domain ifgroups or interface configuration Network interfaces and hostnames may differ on the new Data Domain.
Oracle RMAN or DD Boost library path Library paths or SBT configuration may reference old Data Domain paths.

Resolution

Complete Reconfiguration Checklist.

Phase 1: PowerProtect Data Manager Server‑Side Configuration

Step Action Details
1.1 Update Data Domain credentials in PowerProtect Data Manager Go to Infrastructure > Storage > [Data Domain Name] > Edit. Update hostname or IP, username, and password to match the new Data Domain. If the Data Domain was reimaged, remove and readd it.
1.2 Accept the new Data Domain certificate. When editing or readding the Data Domain, PowerProtect Data Manager prompts to accept the new certificate. Verify that the fingerprint matches the new Data Domain before accepting.
1.3 Enable HA option for Data Domain HA configurations. If the Data Domain is configured in HA mode, ensure that the HA checkbox is selected when adding using the PowerProtect Data Manager UI. This imports the root CA certificate into the extserver truststore, preventing PKIX errors.
1.4 Verify storage units. Go to Infrastructure > Storage > [Data Domain Name] > Storage Units. Confirm that all storage units referenced by protection policies exist on the new Data Domain. Update policy names if they were renamed.
1.5 Run full discovery. Go to Infrastructure > Asset Sources. Select all relevant asset sources and click Discover. Wait for the discovery to complete successfully.

Phase 2: Agent‑Side Configuration (Per Host)

Step Action Details
2.1 Update the agent lockbox.

a. From the PowerProtect Data Manager UI left navigation pane, select Protection > Protection Policies
b. Select the protection policies that target the updated protection storage system, and then click Set Lockbox

NOTE: If the above fails, the agent lockbox can be updated manually with the new Data Domain credentials.
On each Windows and Linux or AIX agent host run the following from the agent install directory:
ddutil -C -a STORAGE_HOSTNAME -u DD_USERNAME -p DD_PASSWORD -s STORAGE_UNIT_NAME

2.2 Verify agent host registration. Run register.bat (Windows) or register.sh (Linux or AIX) to re‑register the agent with PowerProtect Data Manager. Verify that the agent status shows Registered in the PowerProtect Data Manager UI under Infrastructure > Application Agents.
2.3 Update Data Domain ifgroup (SQL AG/clustered environments) For SQL Always On Availability Group or clustered configurations, ensure that Data Domain ifgroups contain the correct hostnames or IPs for all cluster nodes. Update ifgroups if hostnames have changed.
2.4 Verify that the agent service is running and listening Confirm the PowerProtect Agent Service is running: Windows - Get-Service "PowerProtect Agent Service". Linux/AIX - ps -ef | grep dpsagent.
2.5 Clear orphaned agent installations (AIX/Linux) If the agent was previously installed with a different Data Domain configuration, perform a clean uninstall and reinstall: (1) Stop agent service, (2) Remove agent packages, (3) Rename or delete old install folders under /opt/dpsapps/, (4) Reinstall the agent matching the PowerProtect Data Manager version, (5) Re‑register.

Phase 3: Application‑Specific Steps

Application Step Details
Microsoft SQL Update SQL credentials in protection policy If SQL backup credentials have changed, update them in the protection policy. Ensure that the SQL login has sysadmin privileges.
Microsoft SQL AG Verify preferred node configuration. After Data Domain replacement, rerun discovery and verify that the AG preferred node is correctly identified.
Oracle Update RMAN SBT configuration Verify the DD Boost library path in the RMAN script matches the path on the host. Ensure that correct case sensitivity and update rmanagent.env if present.
Exchange Verify .ddbmcon.gatherinfo file. Confirm that the file exists in \Program Files\DPSAPPS\MSAPPAGENT\settings\ on all DAG nodes. Copy from a working node if missing.
SAP HANA Restart agent service. After Data Domain replacement, restart the PowerProtect Agent Service on the SAP HANA host and rerun discovery.
PostgreSQL Verify lockbox and storage unit path. Update the lockbox with new Data Domain credentials and, if needed, configure a different storage unit.

Phase 4: Validation

Step Action Details
4.1 Run a manual backup. Trigger a manual Full backup for each protection policy to verify end‑to‑end connectivity.
4.2 Verify backup completion in PowerProtect Data Manager UI. Go to Jobs > Protection Jobs. Confirm all manual backups completed successfully.
4.3 Monitor scheduled backups. Observe the next two scheduled backup cycles to ensure policies run without errors.
4.4 Verify replication (if configured) If replication is configured, confirm that replicated copies are being created on the target Data Domain.

Affected Products

Data Domain, PowerProtect Data Manager
Article Properties
Article Number: 000480289
Article Type: Solution
Last Modified: 23 يوليو 2026
Version:  2
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.