Symptoms
Backup applications that rely on volume shadow copies, including EMC NetWorker, may fail to backup partitions containing the Forefront Endpoint Protection (FEP) database.
Cause
The Forefront Endpoint Protection volume shadow copy service (VSS) writer does not fully populate metadata for the restoration of the database. The absence of this metadata may cause errors in backup or restore software that use this information.
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Microsoft regularly releases software updates to address specific bugs. If Microsoft releases a software update to resolve this bug, this article will be updated with additional information.
Workaround
To workaround this issue, disable the VSS writer. This does not present a loss of functionality as the database is backed up by the SQL VSS writer. You can disable the VSS writer by modifying the AgentComponents.xml located in the folder “%ProgramFiles%\Microsoft Forefront\Forefront Endpoint Protection” using the steps below. The new contents shown below use a XML comment to prevent the FepWriterManager component from being used.
-
Open the Services in Administrative Tools.
-
Stop the Forefront Endpoint Monitoring Service (FEPSrv).
-
Open Windows Explorer and browse to “%ProgramFiles%\Microsoft Forefront\Forefront Endpoint Protection”.
-
Make a copy of AgentComponents.xml, for example AgentComponents.xml.bak.
-
Using Notepad or other text editor, replace the entire content of the AgentComponents.xml so that it is the exact XML below.
-
Save AgentComponents.xml
-
In the services snap-in, start the Forefront Endpoint Monitoring Service (FEPSrv).
<?xml version='1.0' encoding='utf-8'?>
<Agent>
<AgentComponentsData>
<AgentComponents>
<AgentComponentData>
<ComponentId>DCE36B58-C9AF-4D02-ABCC-F8DD23F790DD</ComponentId>
<Assembly>MetadataUpdater</Assembly>
<ClassName>Microsoft.Forefront.EndpointProtection.MetadataManager</ClassName>
</AgentComponentData>
<AgentComponentData>
<ComponentId>2887E727-D317-4f2b-B02A-EF8F955D4225</ComponentId>
<Assembly>AlertsManager</Assembly>
<ClassName>Microsoft.Forefront.EndpointProtection.AlertsManager.AlertsManager</ClassName>
</AgentComponentData>
<AgentComponentData>
<ComponentId>58438CB1-012D-429f-BD74-E7C54DA8CE7A</ComponentId>
<Assembly>SqmAgents</Assembly>
<ClassName>Microsoft.Forefront.EndpointProtection.SqmAgents.SqmCollectorsManager</ClassName>
</AgentComponentData>
<!--
<AgentComponentData>
<ComponentId>DFB0D73F-1360-4C21-9825-F9C23CF9CBF5</ComponentId>
<Assembly>FepWriterManager</Assembly>
<ClassName>Microsoft.Forefront.EndpointProtection.FepWriterManager</ClassName>
</AgentComponentData>
-->
</AgentComponents>
</AgentComponentsData>
</Agent>