KB #240138: Upgrading Operating System on a machine with Encryptionizer installed (v2019.1210 or earlier)

Type:

Information

Summary:

You are upgrading the operating system of a machine in place, and have Encryptionizer installed. This article refers to earlier versions of Encryptionizer (NLEMSYS.sys version 2019.611.52 or earlier).

Note: Versions 2019.611.52 and earlier are obsolete and is no longer supported (except by special arrangement). We recommend that you upgrade to the latest version of Encryptionizer which will allow you to upgrade the OS without impact to the software.

Additional Information:

These instructions are specific to earlier versions of Encryptionizer using NLEMSYS.sys driver version 2019.611.52 or earlier, as this version uses a different license activation method than later versions. If you have an newer version of our software on your machine, please refer to KB 240150. To determine your driver version, refer to KB 240145.

An operating system in-place upgrade can interfere with an important Encryptionizer Windows registry entry, and in some cases has also inactivated our software.

Below are suggested steps when performing the in-place OS upgrade.  We generally recommend that you also update your Encryptionizer software to the latest version to ensure Operating System support.

1. Confirm that you know your encryption keys before proceeding. You can confirm them by taking a database offline, using the Encrypt/Decrypt Wizard, choose the Validate option and enter your key information to compare. Do not proceed until you confirm this information in the event you need to re-enter the encryption key later.
2. Apply a Temporary Registration Key to the machine. You typically receive one with any Permanent Registration Key that you have received. A Temporary Registration Key can used on any machine, and on more than one machine at the same time; however, once applied to a machine, the same Temporary Registration key cannot be applied again on that machine to extend the period. If you need a new Temporary Registration key or reminder of where you can download the latest software, please contact NetLib Support.
3. Perform your OS in-place update.
4. After the last reboot of the OS upgrade, perform an update of Encryptionizer software if necessary. You can install it over the existing version. If you had not yet applied a Temporary Registration key, apply it during the Encryptionizer installation. If you do not need to perform an Encryptionizer update, make sure that the Temporary Registration key is applied. Reboot the machine.
5. You will also need to import an important registry entry:
   • Download the following file which is a Zip file containing the registry import file:
     https://netlibsecurity.com/files/patches/nlem1402_tag.zip
   • Expand the file and rename the extension from .re_ to .reg
   •  Open Regedit and import the file (nlem1402_tag.reg)
   • Reboot
6. Ensure that the NetLib Encryptionizer Key Management Service is running (nlcbtask)
   • open a command window with the “Run as Administrator” option, and run the following:

     sc query nlcbtask

     This should return 4 : Running

7. Run the Administration Wizard from the NetLib Encryptionizer main menu (nlmain.exe)
8. Does the SQL instance say it is secured? If so, then no additional actions are necessary. Make sure that your encrypted databases are accessible.
9. If the Admin Wizard reports that the SQL instance is not secured, secure it once more with the same settings as previously used. The encryption key must match exactly.
10. Restart the SQL instance, and you should once more have access to your encrypted databases.
11. You will need a new Permanent Registration key for the machine. Follow the instructions in the following KnowledgeBase:
    KB #240137: Requesting a Permanent Registration Key
    In the comments section of the registration page, indicate the machine which you will be decommissioning. If you have the original Permanent Registration Key information from the machine you are decommissioning, you can paste it into the Comments section.
12. Within 1-2 business days, you will receive two emails. One will be a cancellation of the original Permanent Registration key. The second will be the new Permanent Registration key for the new machine. It will include information on how to apply it on the new machine.If you need to have both machines running for a transition period, you can request a longer Temporary Registration key for the new machine for testing, etc, and then choose to register about a week or so prior to the cutover.