Certain backup software may fail on Forefront Endpoint Protection database

Symptoms

Backup applications that rely on volume shadow copies, including EMC NetWorker, may fail to backup partitions containing the Forefront Endpoint Protection (FEP) database.

Cause

The Forefront Endpoint Protection volume shadow copy service (VSS) writer does not fully populate metadata for the restoration of the database. The absence of this metadata may cause errors in backup or restore software that use this information.

Workaround

To workaround this issue, disable the VSS writer. This does not present a loss of functionality as the database is backed up by the SQL VSS writer. You can disable the VSS writer by modifying the AgentComponents.xml located in the folder “%ProgramFiles%\Microsoft Forefront\Forefront Endpoint Protection” using the steps below. The new contents shown below use a XML comment to prevent the FepWriterManager component from being used.

1. Open the Services in Administrative Tools.

2. Stop the Forefront Endpoint Monitoring Service (FEPSrv).

3. Open Windows Explorer and browse to “%ProgramFiles%\Microsoft Forefront\Forefront Endpoint Protection”.

4. Make a copy of AgentComponents.xml, for example AgentComponents.xml.bak.

5. Using Notepad or other text editor, replace the entire content of the AgentComponents.xml so that it is the exact XML below.

6. Save AgentComponents.xml

7. In the services snap-in, start the Forefront Endpoint Monitoring Service (FEPSrv).
   

<?xml version='1.0' encoding='utf-8'?>
<Agent>
  <AgentComponentsData>
    <AgentComponents>
      <AgentComponentData>
        <ComponentId>DCE36B58-C9AF-4D02-ABCC-F8DD23F790DD</ComponentId>
        <Assembly>MetadataUpdater</Assembly>
        <ClassName>Microsoft.Forefront.EndpointProtection.MetadataManager</ClassName>
      </AgentComponentData>
      <AgentComponentData>
        <ComponentId>2887E727-D317-4f2b-B02A-EF8F955D4225</ComponentId>
        <Assembly>AlertsManager</Assembly>
        <ClassName>Microsoft.Forefront.EndpointProtection.AlertsManager.AlertsManager</ClassName>
      </AgentComponentData>
      <AgentComponentData>
        <ComponentId>58438CB1-012D-429f-BD74-E7C54DA8CE7A</ComponentId>
        <Assembly>SqmAgents</Assembly>
        <ClassName>Microsoft.Forefront.EndpointProtection.SqmAgents.SqmCollectorsManager</ClassName>
      </AgentComponentData>
      <!-- 
      <AgentComponentData>
        <ComponentId>DFB0D73F-1360-4C21-9825-F9C23CF9CBF5</ComponentId>
        <Assembly>FepWriterManager</Assembly>
        <ClassName>Microsoft.Forefront.EndpointProtection.FepWriterManager</ClassName>
      </AgentComponentData> 
      -->
    </AgentComponents>
  </AgentComponentsData>
</Agent>