IT36033: CONFIGURATION SECURITY SETTINGS FOR EXCHANGE ITEM LEVEL RESTORE WHEN USING REMOTE MMC NEED CLARIFICATION

APAR status

• Closed as documentation error.

Error description

• When using the IBM Spectrum Protect Plus MMC GUI on a remote
  host to restore individual Exchange items with granular
  restore, clarification is needed for the required security
  settings.
  The guide  "Granular restore. Remote management feature." needs
  to be updated to set "allow remote fresh delegation" using
  Microsoft gpedit.msc on the Exchange server and the host where
  the MMC is running on. When the security settings are not
  correct, the error message below will be seen when following
  step 6b in the instructions. The command needs to run on the
  application server and the remote server and the error can be
  seen on either of them.
  
   #PS> Invoke-Command -ComputerName $remote_server_host_name
  -ScriptBlock { pwd } -Credential $creds -Authentication CredSsp
  [remote server name]
  
   Connecting to remote server <remote server name> failed with
  the following error message :
   The WinRM client cannot process the request. CredSSP
  authentication is currently disabled in the client
  configuration.
  Change the client configuration and try the request again.
  CredSSP authentication must also be enabled in the server
  configuration. Also, Group Policy must be edited to allow
  credential delegation to the target computer. Use gpedit.msc and
   look at the following policy: Computer Configuration ->
  Administrative Templates -> System -> Credentials Delegation ->
  Allow Delegating Fresh Credentials. Verify that it is enabled
  and configured with an SPN appropriate for the target computer.
  For example, for a target computer name "myserver.domain.com",
  the SPN can be one of the following: WSMAN/myserver.domain.com
  or WSMAN/*.domain.com For more information, see the
  about_Remote_Troubleshooting Help topic.
   + CategoryInfo : OpenError: (remote server name:String)
  [], PSRemotingTransportException
   + FullyQualifiedErrorId : -2144108126,PSSessionStateBroken
  
  
  IBM Spectrum Protect Plus Versions Affected
  IBM Spectrum Protect Plus 10.1.3 and newer
  
  Initial Impact: Medium
  
  Additional Keywords: SPP, SPPlus, TS004715327
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus 10.1.3 and higher                  *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in IBM Spectrum Protect Plus 10.1.8.   *
  * Note that this is subject to change at the discretion of     *
  * IBM.                                                         *
  ****************************************************************
  

Problem conclusion

• The IBM Spectrum Protect Plus readme for granular restore remote
  management, section  ?Configure remote connection between the
  remote server and Application server? has been updated.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels