How to configure the Windows Firewall to allow the restore agent to be deployed (4309058)

How to configure the Windows Firewall to allow the restore agent to be deployed

While trying to restore using the agent method you may receive this error:

"Failed to install the restore agent. Error description: Failed to create a remote object .The RPC server is unavailable."

This is due to the firewall on the remote domain controller blocking the restore agent from communicating to the Recovery Manager for Active Directory host.

RESOLUTION 1:

Create two inbound Windows Firewall rules based on the Program selection in the New Rule Wizard which explicitly allows the two .exe files to communicate. They may not exist in this location as they are copied during the restore process so the rule will need to be created manually by either copying the file to the location or selecting another file and then editing the location:

Recovery Agent (ERIAgent.exe)
%systemroot%\RecoveryManagerAD\EriAgent.exe

Recovery Agent (OnlineRestoreAdapter.exe)
%systemroot%\RecoveryManagerAD\OnlineRestoreAdapter.exe

RESOLUTION 2:

Create two inbound Windows Firewall rules which specifies the ports in which the restore agent needs to communicate through. Rule #1 would need local ports 135, 139, 389, and 445 opened. Rule #2 would need "Dynamic RPC" local ports opened. This can be chosen in the local port drop down menu during the custom "New Rule" wizard. Ports in both rules will need to be set to TCP.

RESOLUTION 3:

Turn off the Windows Firewall on the Domain Controller

TF00064234

In Server Core implementations of Windows Server 2008/2012, allowance of OnlineRestoreAdapter.exe and EriAgent.exe through Windows firewall may not be enough, an additional RPC dynamic firewall rule is necessary in order for Online Restore operations to work. Add the following rule to your firewall configuration in addition to the exe file rules: netsh advfirewall firewall add rule name="RMAD dynamic RPC port range" dir=in profile=any localip=any remoteip=any protocol=tcp localport=49152-65535 action=allow