Can't backup Windows Server 2008 R2 (X64 Enterprise) with BA client

[SpecialK]

I just tried to backup a Windows 2008 R2 (X64 Enterprise Edition) server using BA client 6.1.0.2 for the first time and it throws errors when trying to backup System State and stops.

Is 6.1.0.2 client supposed to be able to backup 2008 R2 ?

I tried using VSS and LVSA, neither worked.

GUI error:

Unknown system error. Please check the TSM Error Log for any additional information.

TSM (dsmerror.log)

09/18/2009 03:58:15 ANS1009W An error occurred processing the operating system include/exclude statements.
The error was detected while processing: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\BackupRestore\FilesNotToBackup\MS Distributed Transaction Coordinator. RC = 13.
09/18/2009 03:58:18 ANS1009W An error occurred processing the operating system include/exclude statements.
The error was detected while processing: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\BackupRestore\FilesNotToBackup\MS Distributed Transaction Coordinator. RC = 13.
09/18/2009 03:58:36 ANS1009W An error occurred processing the operating system include/exclude statements.
The error was detected while processing: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\BackupRestore\FilesNotToBackup\MS Distributed Transaction Coordinator. RC = 13.
09/18/2009 04:00:28 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined. The last error reported is '00000000'.
09/18/2009 04:00:29 ANS5250E An unexpected error was encountered.
TSM function name : GetFileSecurityInfo
TSM function : CreateFile() returned '123' for file '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\W indows\System32\Perfc???.dat'

TSM return code : 935
TSM file : ntfileio.cpp (9262)
09/18/2009 04:00:29 ANS5250E An unexpected error was encountered.
TSM function name : PrivObjEnumBack
TSM function : fioGetAttrib failed for file '\\w2008-64r2\c$\Windows\System32\Perfc???.dat'
TSM return code : 267
TSM file : incrdrv.cpp (9307)
09/18/2009 04:00:36 ANS5280E Object enumeration from a file set or file list failed.
09/18/2009 04:02:05 ANS1009W An error occurred processing the operating system include/exclude statements.
The error was detected while processing: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\BackupRestore\FilesNotToBackup\MS Distributed Transaction Coordinator. RC = 13.

[toxy13]

read: http://adsm.org/forum/showthread.php?t=14914

[SpecialK]

Yes, I've seen that post already.

This is "MS Distributed Transaction Coordinator" not "DRM" and the registry entry is correct in any case. I tried the fix anyway (just in case). But you still can't backup Windows 2008 R2 with BA client 6.1.0.2

[MartINC]

We got a similar issue on a windows 2008 64bit R2 server using TSM BA Client 6.1.0.2 ;


11/10/2009 15:16:30 ANS5250E An unexpected error was encountered.
TSM function name : GetFileSecurityInfo
TSM function : CreateFile() returned '123' for file '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\W indows\System32\Perfc???.dat'
TSM return code : 935
TSM file : ntfileio.cpp (9262)
11/10/2009 15:16:30 ANS5250E An unexpected error was encountered.
TSM function name : PrivObjEnumBack
TSM function : fioGetAttrib failed for file '\\ServerName\c$\Windows\System32\Perfc???.dat'
TSM return code : 267
TSM file : incrdrv.cpp (9307)
11/10/2009 15:16:32 ANS1999E Incremental processing of 'ServerName\SystemState\NULL\System State\SystemState' stopped.
11/10/2009 15:16:33 ANS5280E Object enumeration from a file set or file list failed.

It happens everytime we tried to backup the system state.

Any ideas / solutions yet ?

[Efim]

Hi
try to check registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\BackupRestore\FilesNotToBackup\MS Distributed Transaction Coordinator
the value must be (this is default)
C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\system32\MSDtc\trace\dtctrace.log
It can be for example: \system32\MSDtc\MSDTC.LOG if yes - correct it and try backup again.


For \\w2008-64r2\c$\Windows\System32\Perfc???.dat' - you can't use ? in Windows filename. You can search why file have unsupported name. You could try to create it

Efim

[SpecialK]

I'm trying BA client 6.1.2.0 at the moment and it is looking a lot better.

[obiwan2]

You're not alone.....we have nearly the same problem and didn't find a solution until now.
That's what we get whilst trying to backup the systemsate of a machine with Windows Server 2008 Enterprise R2 64 Bit:

11/11/2009 11:19:42 GetRootAttrib(): for root directory \\zdhcln\k$, Win32 rc=67
11/11/2009 11:19:42 GetRootAttrib(): for root directory \\zdhcln\k$, Win32 rc=67
11/11/2009 11:19:52 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined. The last error reported is '00000000'.
11/11/2009 11:19:52 GetRootAttrib(): for root directory \\zdhcln\k$, Win32 rc=67
11/11/2009 11:19:59 ANS5250E An unexpected error was encountered.
TSM function name : vssSaveManagedCapacityInfo
TSM function : Error Discovering Capacity
TSM return code : 124
TSM file : vssback.cpp (5554)
11/11/2009 11:19:59 ANS5250E An unexpected error was encountered.
TSM function name : vssSaveManagedCapacityInfo()
TSM function : can not save managed capacity
TSM return code : 124
TSM file : vssback.cpp (5145)
11/11/2009 11:19:59 ANS5250E An unexpected error was encountered.
TSM function name : baCreateLocalBackup
TSM function : VSS Create Local Backup Failed
TSM return code : 124
TSM file : backsnap.cpp (1905)
11/11/2009 11:19:59 ANS5250E An unexpected error was encountered.
TSM function name : baProcessRequest
TSM function : VSS Create Local Backup failed
TSM return code : 124
TSM file : incrdrv.cpp (6866)
11/11/2009 11:20:05 ANS1134E Drive ZDHN01\SystemState\NULL\System State\SystemState is an invalid drive specification

This system is the first node of a 2-Node-Cluster.....

I tried to save the systemsate with "wbadmin" and that works.....
-> wbadmin start systemstatebackup -backuptarget:xxxxxxxx....

Anyone knows about a solution with this problem in TSM ? We are using TSM BA-Client v6.1.2.0, because v5.5.2.1 was totally crashing...

[MartINC]

Thanks for the replies!

Upgrading TSM BA Client from 6.1.0.2 to 6.1.2.0 solved our issue.


Efim: The '?' caracters in the 'perfc???.dat' can be replaced by any caracters that matches. This is not really the filename itseft, but any files that matches, replacing '???' by any others caracters. If you browse the windows system32 folders, you can see a lot of them, with random caracters.

[obiwan2]

Strange...strange...strange...

I found the reason for the messages (see my post above).

When I do (within TSM) a "backup systemstate" and the node has ONLY his own systemdisk -> the backup is running as usual !!

When I move one or more shared cluster-disks to this node and try the same thing -> the backup-job will be interrupted !!!


Just to let you know...but still a very bad situation....

[MartINC]

Hello there!

I have the same exact error message that you got on a cluster server with TSM 6.1.2.0 ; when we tried to backup the system state, it fails with error messages about all the other cluster drives attached;

GetRootAttrib(): for root directory \\servername\f$, Win32 rc=53 , etc etc etc..

" " " same message for all the other drive attached.


VSS Create Local Backup failed

ANS1134E Drive is an invalid drive specification

Did you find out something to solve your issue ? Do you think that a clean install of tsm (uninstall / cleanup services / reinstall / reconfigure tsm cluster resssources ) will help ?

[obiwan2]

Hi,

no...the problem still exists.

My solution (for now):
Backing up the systemstate with wbadmin. This creates a .vhd-File. If a single file from this systemstate is needed, mount this file with vhdmount (you can google for it...) and you can access the whole virtual disk/files.

If the complete systemstate is needed...no problem. Can be restored with the Windows Server 2008 R2 built-in wbadmin-tool.

So far...so good. But not a very fine solution.

[MartINC]

Hi again!

I found out something interesting :

I was browsing the sched log / error log and it appears that all the errors related with the TSM System State backup are related to FSRM !

Only appears on the cluster node that have FSRM on it: Windows 2k3 R2, TSM Client 6.1.2.0, 32bit.

Sched Log:
-------------------
11/27/2009 22:00:16 Incremental backup of volume 'SYSTEMSTATE'

11/27/2009 22:03:42 Performing a full, TSM backup of object 'COM+ REGDB Writer' component 'COM+ REGDB' using shadow copy.

11/27/2009 22:03:43 Performing a full, TSM backup of object 'Registry Writer' component 'Registry' using shadow copy.

11/27/2009 22:03:43 Performing a full, TSM backup of object 'System Writer' component 'System Files' using shadow copy.

11/27/2009 22:03:43 Performing a full, TSM backup of object 'Cluster Service Writer' component 'Cluster Database' using shadow copy.

11/27/2009 22:03:43 Performing a full, TSM backup of object 'Event Log Writer' component 'Event Logs' using shadow copy.

11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume F:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume G:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume H:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume I:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume J:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume T:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume U:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM configuration on volume W:\, including its quota configuration, file screen configuration, and file screen audit logs' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'FSRM Writer' component 'FSRM reports repository, including any scheduled, incident, and on-demand reports' using shadow copy.
11/27/2009 22:03:43 Performing a full, TSM backup of object 'WMI Writer' component 'Windows Managment Instrumentation' using shadow copy.

11/27/2009 22:11:09 ANS1134E Drive is an invalid drive specification
-------------------

Error Log:
-------------------
11/30/2009 22:03:28 GetRootAttrib(): for root directory \\servername\f$, Win32 rc=53
11/30/2009 22:03:38 GetRootAttrib(): for root directory \\servername\f$, Win32 rc=53
11/30/2009 22:03:48 GetRootAttrib(): for root directory \\servername\g$, Win32 rc=53
11/30/2009 22:03:58 GetRootAttrib(): for root directory \\servername\g$, Win32 rc=53
11/30/2009 22:04:09 GetRootAttrib(): for root directory \\servername\h$, Win32 rc=53
11/30/2009 22:04:19 GetRootAttrib(): for root directory \\servername\h$, Win32 rc=53
11/30/2009 22:04:29 GetRootAttrib(): for root directory \\servername\i$, Win32 rc=53
11/30/2009 22:04:39 GetRootAttrib(): for root directory \\servername\i$, Win32 rc=53
11/30/2009 22:04:49 GetRootAttrib(): for root directory \\servername\j$, Win32 rc=53
11/30/2009 22:04:59 GetRootAttrib(): for root directory \\servername\j$, Win32 rc=53
11/30/2009 22:05:09 GetRootAttrib(): for root directory \\servername\u$, Win32 rc=53
11/30/2009 22:05:20 GetRootAttrib(): for root directory \\servername\u$, Win32 rc=53
11/30/2009 22:05:30 GetRootAttrib(): for root directory \\servername\t$, Win32 rc=53
11/30/2009 22:05:40 GetRootAttrib(): for root directory \\servername\t$, Win32 rc=53
11/30/2009 22:05:50 GetRootAttrib(): for root directory \\servername\w$, Win32 rc=53
11/30/2009 22:06:01 GetRootAttrib(): for root directory \\servername\w$, Win32 rc=53
11/30/2009 22:07:04 GetRootAttrib(): for root directory \\servername\f$, Win32 rc=53
11/30/2009 22:07:14 GetRootAttrib(): for root directory \\servername\g$, Win32 rc=53
11/30/2009 22:07:24 GetRootAttrib(): for root directory \\servername\h$, Win32 rc=53
11/30/2009 22:07:35 GetRootAttrib(): for root directory \\servername\i$, Win32 rc=53
11/30/2009 22:07:47 GetRootAttrib(): for root directory \\servername\j$, Win32 rc=53
11/30/2009 22:07:57 GetRootAttrib(): for root directory \\servername\u$, Win32 rc=53
11/30/2009 22:08:09 GetRootAttrib(): for root directory \\servername\t$, Win32 rc=53
11/30/2009 22:08:20 GetRootAttrib(): for root directory \\servername\w$, Win32 rc=53
11/30/2009 22:08:33 ANS5250E An unexpected error was encountered.
TSM function name : vssSaveManagedCapacityInfo
TSM function : Error Discovering Capacity
TSM return code : 124
TSM file : vssback.cpp (5554)
11/30/2009 22:08:33 ANS5250E An unexpected error was encountered.
TSM function name : vssSaveManagedCapacityInfo()
TSM function : can not save managed capacity
TSM return code : 124
TSM file : vssback.cpp (5145)
11/30/2009 22:08:33 ANS5250E An unexpected error was encountered.
TSM function name : baCreateLocalBackup
TSM function : VSS Create Local Backup Failed
TSM return code : 124
TSM file : backsnap.cpp (1905)
11/30/2009 22:08:33 ANS5250E An unexpected error was encountered.
TSM function name : baProcessRequest
TSM function : VSS Create Local Backup failed
TSM return code : 124
TSM file : incrdrv.cpp (6866)
11/30/2009 22:08:52 ANS1134E Drive is an invalid drive specification
11/30/2009 22:08:52 ANS1512E Scheduled event 'Schedule_INC' failed. Return code = 12.
11/30/2009 22:08:52 Try mutex lock failed: 122.
11/30/2009 22:08:52 Try Mutex failed: .
11/30/2009 22:08:52 sessOpen: Session state transition error, sessState: sSignedOn.
11/30/2009 22:08:52 sessOpen: Transitioning: sSignedOn state ===> sTRANSERR state
-------------------

Those 2 links shows different errors but with older TSM Client or Net Backup, all related with FSRM:

http://www-01.ibm.com/support/docvie...id=swg1IC52200

http://seer.entsupport.symantec.com/docs/286099.htm

I did a test and excluded this portion from the TSM system state backup and it worked! ( EXCLUDE.SYSTEMSERVICE "FSRM" ) No more complains about other cluster drives attached.

So I guess this TSM BA Client version contains old FSRM bugs ... I'll try to open a case at IBM if its possible.

[Efim]

Hi
I think it is Widows (cluster) configuration issue.
The system state backup can't depend on cluster resources.

As workaround you can create different schedule only for systemstate backup for both local nodes. One of them will be successful and other - failed (it valid only for active/passive cluster).

You can try to use VSSSDK (download from MS site) to test VSS operations without TSM
Just try to backup system state on both nodes.

Efim

[obiwan2]

@Efim
This is not a soluation ... this is only a workaround and is not acceptable in our case

@MartINC
You're right...it has something to do with FSRM. In our case only the 2 disks that are "quota-managed" by FSRM are the reason for the failing system-state backup.

Right now we are not the "one and only" customer with this problem...

Well......the 2nd-Level-Support and one (or more) of the TSM-programmers are working on it. Hopefully we will hear something (positives)...

[MartINC]

We did upgrade TSM BA Clients on every Windows Servers we have and the 'FSRM' vs TSM SystemState Backup problem appears on 2 windows 2003 R2 32bits clusters.

I also opened a PMR at IBM. They are now asking us to install some VSS Hotfixes for windows 2003 (not really related with the error we got, mostly related with dcom). I'm waiting for our System Admin to check what they can do with it. But since it's production servers, they are not very willing installing those hotfixes.

So I'm kinda stuck here for now..

Edit:
I just noticed that TSM BA Client 6.1.3.0 is available. We might give a try with this version after holidays.

[Macnbaish]

Having the exact same problem on a Server 2008 Enterprise R2 x64 Box:

12/22/2009 11:23:16 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined.  The last error reported is '00000000'. 
12/22/2009 11:27:03 psIsHardLink(): Could not open file <\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE> error code is <5>
12/22/2009 11:27:08 Access denied
12/22/2009 18:21:40 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined.  The last error reported is '00000000'. 
12/22/2009 18:25:29 psIsHardLink(): Could not open file <\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy13\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE> error code is <5>
12/22/2009 18:25:31 ANS1999E Backup processing of 'NEUROSERV4\SystemState\NULL\System State\SystemState' stopped.
12/22/2009 18:25:34 ANS4007E Error processing 'SystemState': access to the object is denied
12/22/2009 18:25:35 ANS1512E Scheduled event 'SCHED_PRI4_GRP1' failed.  Return code = 12.

Should I bother opening a PMR? I have already upgraded to the 6.1.2 client and the behavior remains.

This server is not a cluster node.

[JonRoenick]

Having the exact same problem on a Server 2008 Enterprise R2 x64 Box:

12/22/2009 11:23:16 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined.  The last error reported is '00000000'. 
12/22/2009 11:27:03 psIsHardLink(): Could not open file <\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE> error code is <5>
12/22/2009 11:27:08 Access denied
12/22/2009 18:21:40 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined.  The last error reported is '00000000'. 
12/22/2009 18:25:29 psIsHardLink(): Could not open file <\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy13\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE> error code is <5>
12/22/2009 18:25:31 ANS1999E Backup processing of 'NEUROSERV4\SystemState\NULL\System State\SystemState' stopped.
12/22/2009 18:25:34 ANS4007E Error processing 'SystemState': access to the object is denied
12/22/2009 18:25:35 ANS1512E Scheduled event 'SCHED_PRI4_GRP1' failed.  Return code = 12.

Should I bother opening a PMR? I have already upgraded to the 6.1.2 client and the behavior remains.

This server is not a cluster node.

I had (still have) that EXACT problem on our server we use for Secure FTP. I just had to exclude that one tftp.exe file and it is flawless. No idea why that file gets stupid when it backs up though.

[Macnbaish]

I have opened a PMR with IBM on this.. turns out Windows Server Backup fails during the Systemstate backup with the exact same error. So it is not a Tivoli problem. I've opened a case with Microsoft now so I'll report back what I find out.

[cjhood]

Having the exact same problem on a Server 2008 Enterprise R2 x64 Box:

12/22/2009 11:23:16 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined.  The last error reported is '00000000'. 
12/22/2009 11:27:03 psIsHardLink(): Could not open file <\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy11\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE> error code is <5>
12/22/2009 11:27:08 Access denied
12/22/2009 18:21:40 ANS5269E The Microsoft Volume Shadow Copy Services writer 'Task Scheduler Writer' current state (VSS_WS_STABLE) is not valid for the current operation or cannot be determined.  The last error reported is '00000000'. 
12/22/2009 18:25:29 psIsHardLink(): Could not open file <\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy13\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE> error code is <5>
12/22/2009 18:25:31 ANS1999E Backup processing of 'NEUROSERV4\SystemState\NULL\System State\SystemState' stopped.
12/22/2009 18:25:34 ANS4007E Error processing 'SystemState': access to the object is denied
12/22/2009 18:25:35 ANS1512E Scheduled event 'SCHED_PRI4_GRP1' failed.  Return code = 12.

Should I bother opening a PMR? I have already upgraded to the 6.1.2 client and the behavior remains.

This server is not a cluster node.

I'm seeing the same issue on a Domain Controller. Have upgraded to 6.1.3.0 client with no joy, and are also looking at opening a case with Microsoft. If there's any progress I'll update this thread.

[Macnbaish]

Microsoft did a LiveMeeting today to see the problem firsthand.. they are escalating to level two now...

[Macnbaish]

It appears this was being caused by McAfee AntiVirus... Removed McAfee and the backup completed successfully. I plan to speak with McAfee about this so they can add a global exclusion.

[JonRoenick]

10-4, thanks for the update

[Macnbaish]

After speaking with our McAfee administrator I decided to instead just add a global exclude for that file on the TSM server. I thought I had it right... but it's not working.. the backup still fails while attempting to access that file for the systemstate. Can anybody see what I did wrong? Here's the result of a "query inclexcl" on the Client:

tsm> query inclexcl
*** FILE INCLUDE/EXCLUDE ***
Mode Function  Pattern (match from top down)  Source File
---- --------- ------------------------------ -----------------
Excl Directory *\...\.TsmCacheDir             TSM
Excl Directory c:\Windows\system32\microsoft\protect Operating System
Excl Directory C:\Windows\winsxs              Operating System
Excl Directory C:\Windows\Vss\Writers         Operating System
Excl Directory C:\Windows\tasks               Operating System
Excl Directory C:\Windows\system32\wbem\repository Operating System
Excl Directory C:\Windows\system32\tasks      Operating System
Excl Directory C:\Windows\System32\Microsoft\Protect Operating System
Excl Directory C:\Windows\system32\LogFiles\WMI\RtBackup Operating System
Excl Directory C:\Windows\system32\DriverStore\FileRepository Operating System
Excl Directory C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE
} Operating System
Excl Directory C:\Windows\system32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE
} Operating System
Excl Directory C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295E
E} Operating System
Excl Directory C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295E
E} Operating System
Excl Directory C:\Windows\servicing\packages  Operating System
Excl Directory C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microso
ft\SoftwareProtectionPlatform Operating System
Excl Directory C:\Windows\Registration        Operating System
Excl Directory C:\Windows\assembly            Operating System
Excl Directory C:\ProgramData\Microsoft\Network\Downloader Operating System
Excl Directory C:\programdata\Microsoft\Crypto\RSA\MachineKeys Operating System
Excl Directory C:\adsm.sys                    Operating System
Exclude All       *\...\TFTP.EXE                 Server
Exclude All       *\...\Program Files\System Center Operations Manager 2007\Heal
th Service State\Health Service Store\tmp.edb Server
Exclude All       *\...\Program Files\System Center Operations Manager 2007\Heal
th Service State\Health Service Store\edbtmp.log Server
Exclude All       *\...\Program Files\System Center Operations Manager 2007\Heal
th Service State\Health Service Store\edb.log Server
Exclude All       *\...\Program Files\System Center Operations Manager 2007\Heal
th Service State\Health Service Store\HealthServiceStore.edb Server
Exclude All       *\windows\system32\spool\*.*   Server
Exclude All       *\quarantine\*.*               Server
Exclude All       *\...\program files\IBM\Director\data\*.* Server
Exclude All       *\...\i386\...\*               Server
Exclude All       *\...\_date*.dat               Server
Exclude All       *\...\network associates\...\* Server
Exclude All       *\...\perflib*.dat             Server
Exclude All       *\...\Usrclass.dat.log         Server
Exclude All       *\...\Usrclass.dat             Server
Exclude All       *\...\*.mdf                    Server
Exclude All       *\...\*.ldf                    Server
Exclude All       *\...\io.sys                   Server
Exclude All       *\msdos.sys                    Server
Exclude All       *\ibmdos.com                   Server
Exclude All       *\ibmio.com                    Server
Exclude All       *\microsoft uam volume\...\*   Server
Exclude All       *\...\Temporary Internet Files\* Server
Exclude All       *\...\recycler\*               Server
Exclude All       *\...\cache\*                  Server
Exclude All       *\...\temp\...\*               Server
Exclude All       *\...\ntuser.dat.log           Server
Exclude All       *\...\ntuser.dat               Server
Exclude All       *\...\system32\config\...\*    Server
Exclude All       *\...\netlogon.chg             Server
Exclude All       *\...\pagefile.sys             Server
Exclude Archive   *\dsmthreshmig.bin             Operating System
Exclude Archive   *\dsmrecon.bin                 Operating System
Exclude All       *\dsmthreshmig.bin             Operating System
Exclude All       *\dsmrecon.bin                 Operating System
Exclude All       C:\Windows\usrclass.dat.log    Operating System
Exclude All       C:\Windows\usrclass.dat        Operating System
Exclude All       C:\Windows\system32\NtmsData\...\* Operating System
Exclude All       C:\Windows\system32\MSDtc\trace\dtctrace.log Operating System
Exclude All       C:\Windows\system32\MSDtc\MSDTC.LOG Operating System
Exclude All       C:\Windows\system32\LogFiles\WMI\RtBackup\*.* Operating System
Exclude All       c:\windows\system32\driverstore\infcache.* Operating System
Exclude All       c:\windows\system32\driverstore\*.dat Operating System
Exclude All       C:\Windows\system32\config\system.log Operating System
Exclude All       C:\Windows\system32\config\system Operating System
Exclude All       C:\Windows\system32\config\software.log Operating System
Exclude All       C:\Windows\system32\config\software Operating System
Exclude All       C:\Windows\system32\config\security.log Operating System
Exclude All       C:\Windows\system32\config\security Operating System
Exclude All       C:\Windows\system32\config\sam.log Operating System
Exclude All       C:\Windows\system32\config\sam Operating System
Exclude All       C:\Windows\system32\config\default.log Operating System
Exclude All       C:\Windows\system32\config\default Operating System
Exclude All       C:\Windows\system32\config\components.log Operating System
Exclude All       C:\Windows\system32\config\components Operating System
Exclude All       C:\Windows\System32\Bits.log   Operating System
Exclude All       C:\Windows\System32\Bits.bak   Operating System
Exclude All       C:\Windows\softwaredistribution\...\*.* Operating System
Exclude All       C:\Windows\serviceprofiles\networkservice\ntuser.dat.log Opera
ting System
Exclude All       C:\Windows\serviceprofiles\networkservice\ntuser.dat Operating
 System
Exclude All       C:\Windows\serviceprofiles\localservice\ntuser.dat.log Operati
ng System
Exclude All       C:\Windows\serviceprofiles\localservice\ntuser.dat Operating S
ystem
Exclude All       C:\Windows\netlogon.chg        Operating System
Exclude All       C:\Windows\Minidump\...\*      Operating System
Exclude All       C:\Windows\memory.dmp          Operating System
Exclude All       c:\windows\inf\setupapi.ev*    Operating System
Exclude All       C:\Users\cmmc223\AppData\Local\Temp\...\* Operating System
Exclude All       C:\Users\cmmc223\...\index.dat Operating System
Exclude All       C:\System Volume Information\SRM\Rules\*.xml Operating System
Exclude All       C:\System Volume Information\SRM\Reports\*.xml Operating Syste
m
Exclude All       C:\System Volume Information\SRM\Properties\*.xml Operating Sy
stem
Exclude All       C:\System Volume Information\SRM\Modules\*.xml Operating Syste
m
Exclude All       C:\System Volume Information\SRM\FileManagementTasks\*.xml Ope
rating System
Exclude All       C:\StorageReports\Scheduled\*.* Operating System
Exclude All       C:\StorageReports\Interactive\*.* Operating System
Exclude All       C:\StorageReports\Incident\*.* Operating System
Exclude All       C:\ProgramData\Microsoft\Windows\WER\...\* Operating System
Exclude All       C:\ProgramData\Microsoft\RAC\Temp\* Operating System
Exclude All       C:\ProgramData\Microsoft\RAC\StateData\* Operating System
Exclude All       C:\ProgramData\Microsoft\RAC\PublishedData\* Operating System
Exclude All       C:\ProgramData\Microsoft\RAC\Outbound\* Operating System
Exclude All       C:\ProgramData\Microsoft\RAC\* Operating System
Exclude All       C:\ProgramData\Microsoft\Network\Downloader\* Operating System
Exclude All       *\System Volume Information\MountPointManagerRemoteDatabase Op
erating System
Exclude All       *\System Volume Information\...\*{3808876B-C176-4e48-B7AE-0404
6E6CC752} Operating System
Exclude All       *\System Volume Information\*.{7cc467ef-6865-4831-853f-2a4817f
d1bca}DB Operating System
Exclude All       *\System Volume Information\*.{7cc467ef-6865-4831-853f-2a4817f
d1bca}ALT Operating System
Exclude All       *\Pagefile.sys                 Operating System
Exclude All       *\hiberfil.sys                 Operating System
No DFS include/exclude statements defined.
tsm>

I bolded the relevant line.. so it is getting picked up.. but I guess there is something wrong with my syntax.. I thought that statement would exclude any and all files named "tftp.exe" no matter where they are. Is that not the case?

[JonRoenick]

Maybe just try it as Exclude.File to see if it makes a difference?