PPDM: Adding Hyper‑V Asset Sources fails with HTTP 400 and "ZeroMQ error 11"

• HTTP 400 error when adding a Hyper‑V cluster as an asset source.

error: code=500, text=Unable to backup Hyper‑V VM '[HOSTNAME]': Unable to get response from the Dell PowerProtect Hyper‑V Protection Agent Service. Unable to get the response from hyperv agent for the readiness probe requests. Unable to sync the message. Unable to receive a message from the socket: ZeroMQ error 11: Resource temporarily unavailable

• WinRM HTTPS probe log:

Connection reached endpoint but was reset by remote host (expected for WinRM probe).

ghvdm.log:93330:2026-05-21T14:37:27.783Z INFO [] [monitoring-guardian-backup-supervisor-dispatcher-1696] [00000000-0000-4000-a000-000000000000][][][TRACE_ID:8b4ae105a4628a30;JOB_ID:86cf022e0f102abe][] [c.e.d.v.c.VProxyManager.reportComplete(1634)] - Session completed BackupHypervJobSession(state=Failure, id=8b6e0455-b3a7-46a9-851f-d3dfea7bd687, error: code=500, text=Unable to backup Hyper-V VM 'rc-lx3778': Unable to get response from the Dell PowerProtect Hyper-V Protection Agent Service. Unable to get the response from hyperv agent for the readiness probe requests. Unable to sync the message. Unable to receive a message from the socket: ZeroMQ error 11: Resource temporarily unavailable)

The failures were caused by a combination of mis‑configured WinRM listeners, incorrect or missing SSL certificate thumbprints, absent firewall rules for required ports, and the presence of Azure Arc‑enabled Azure Stack HCI clusters that are not supported in PPDM 20.1.

• WinRM listeners on port 5986 were either missing or using certificates that did not match the cluster FQDN, leading to connection resets.
• Firewall did not allow TCP 5986 (WinRM HTTPS) and TCP 5896 (agent communication), preventing agent registration.
• ZeroMQ error 11 indicated the Hyper‑V Protection Agent could not receive messages due to the above connectivity issues.

Complete the following steps to resolve the WinRM, certificate, firewall, and cluster‑group configuration issues. All procedures referenced below are documented in the Dell PowerProtect Data Manager 20.1 Hyper‑V Virtual Machine User Guide. The most recent versions of the product documentation are available for download on the PowerProtect Data Manager Drivers & Downloads page in PDF format. 

1. Configure WinRM HTTPS listeners
   • Create HTTPS WinRM listeners on port 5986 for every Hyper‑V node.
   • Ensure that each listener uses the correct certificate thumbprint and that the DNSNameList/SAN contains the cluster name.
   • Verify listeners with winrm enumerate and Invoke-WebRequest.
2. Deploy matching SSL certificates
   • Generate SSL certificates that match the cluster FQDN.
   • Deploy the certificates to all cluster nodes.
   • Update each node’s WinRM HTTPS listener to reference the new thumbprint.
3. Update firewall rules
   • Add inbound rules on every node to allow TCP 5986 (WinRM HTTPS) and TCP 5896 (agent communication).
4. Regenerate PowerProtect Data Manager access configuration
   • Run “Regenerate PPDM Access Config” on each node.
   • Confirm the FQDN, hostname, and certificate thumbprint match expected values.
5. Configure PowerProtect Data Manager cluster‑group
   • Add missing PowerProtect Data Manager cluster‑group entries for the two additional nodes in the six‑node Hyper‑V cluster.
6. Validate connectivity
   • Re‑add each Hyper‑V cluster as an asset source; verify all nodes connect.
   • Confirm data mover agents install and backup jobs run without 500‑code or ZeroMQ errors.