Unable to install DPM agent in the DC servers.

Rajshekhar K G 0 Reputation points
2026-08-31T16:52:59.91+00:00

Hi All,

We have completed MABS installation and are working on the DPM agent installation for the protected servers. We have successfully installed the agents for the few servers from the MABS console.

We are stuck at agent installation for the DC servers. We have tried both ways, and neither way is working.

  1. Push the agent from MABS console
  2. Install the agent manually and attach the agent
    run the below command to register the agent
    SetDpmServer.exe -dpmservername <Our DPM Server Name>

When we push the agent from the MABS console, we get the following error. None of the recommended troubleshooting actions in the below image helped to resolve the issue.
User's image

We have verified the following.

  1. Connection between MABS server and DC server -- connection is present
  2. firewall rules, ports – 5718 and 5719 ports are allowed.
  3. Account used for this task. - using the domain admin account.

Below are the MABS and DC server details.

MABS server OS version -- Windows server 2022
MABS version -- 14.0.46.0
DC servers version -- Windows Server 2025

Azure Backup
Azure Backup

An Azure backup service that provides built-in management at scale.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jose Benjamin Solis Nolasco 12,026 Reputation points Volunteer Moderator
    2026-08-31T18:58:10.31+00:00

    @Rajshekhar K G I hope you are doing well,

    Welcome to Microsoft Q&A,

    Installing protection agents on Domain Controllers frequently encounters Error 337 during console push due to AD hardening.

    To get your DCs protected cleanly, follow the manual installation and attachment method, which is the recommended approach for Domain Controllers:

    Step 1: Install the Agent Locally on the DC

    1. On your MABS/DPM server, navigate to:

    Plaintext

    C:\Program Files\Microsoft Azure Backup Server\DPM\DPM\ProtectionAgents\RA\14.0.46.0\amd64

    (or the equivalent DPM ProtectionAgents folder path).

    1. Copy DPMAgentInstaller.exe to the Domain Controller.
    2. Run an elevated Command Prompt on the DC and execute:

    DOS

    DPMAgentInstaller.exe

    Step 2: Configure the MABS Server Name & Firewall on the DC

    From the elevated Command Prompt on the DC, navigate to the DPM bin directory:

    DOS

    cd "C:\Program Files\Microsoft Data Protection Manager\DPM\bin"

    SetDpmServer.exe -dpmServerName <Your_MABS_Server_FQDN>

    (Make sure to use the FQDN of the MABS server, e.g., MABSSRV.domain.local).

    Step 3: Attach the Agent from the MABS Console

    1. Open the MABS / DPM Administrator Console.
    2. Go to Management > Agents > click Install in the ribbon.
    3. Select Attach agents (instead of "Install agents").
    4. Choose Computers in a trusted domain, enter the DC's FQDN and domain admin credentials, and complete the wizard.

    If Manual Attachment or Push Still Hits Access Denied:

    • DCOM Security Permissions on DC: Run dcomcnfg on the DC > expand Component Services > Computers > My Computer > Properties > COM Security tab. Ensure ANONYMOUS LOGON and Authenticated Users have Remote Access / Launch permissions.
    • Verify Admin$ Share Access: From the MABS server, verify you can access \DC2\Admin$ using the Domain Admin account without an access denied prompt.
    • Remote Registry & MSDTC Services: Verify that both Remote Registry and Microsoft Distributed Transaction Coordinator (MSDTC) services are running on the DC.

    References:

    If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-08-31T16:53:20.25+00:00

    For domain controllers, the most relevant fix is to re-run the DPM server registration on the DC and verify the DPM machine account membership that the agent setup depends on.

    1. On the domain controller, open an elevated Command Prompt.
    2. Run: 
         <drive letter>:\Program Files\Microsoft Data Protection Manager\bin\SetDpmServer.exe -dpmServerName <DPM server name>
      This re-creates the DPMRADmTrustedMachines and DPMRADCOMTrustedMachines groups in Active Directory if they were removed by a failed protection agent installation, and adds the DPM machine account to those groups and to Distributed COM Users.
    3. Verify that the DPM machine account is present in the required security groups on the protected server. Example: if the DPM server is DPM01 in domain Contoso, the machine account should appear as Contoso\DPM01.
    4. If the agent was installed manually before adding the server in MABS, attach it from the console:
      • Management > Production Servers > Add
      • Attach agents > Computer on a trusted domain
      • Select the DC, provide credentials for an account that is a member of the local Administrators group on the selected computer, then select Attach.
    5. If manual installation is being retried, install the agent from the DC using the MABS/DPM server FQDN: 
         DpmAgentInstaller_x64.exe <DPMServerFQDN>
      Specifying the server name automatically configures the security accounts, permissions, and firewall exceptions needed for communication.
    6. If push installation still fails with communication errors after the above, use these targeted checks:
      • If a firewall is enabled on the remote computer, run DPMAgentInstaller.exe on the remote computer before installation.
      • If antivirus is installed, temporarily disable it as a troubleshooting step. If that resolves the issue, update antivirus exclusions/settings accordingly.
    7. After any failed or changed installation state, refresh the agent information in the console:
      • Management > Agents > select the computer > Refresh information

    Given the reported scenario, the highest-value path is:

    • re-run SetDpmServer.exe -dpmServerName <DPM server name> on each DC,
    • confirm the DPM machine account is in the required groups,
    • then attach the manually installed agent from the MABS console.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.