KB #240140: Impact of Moving a VM on Encryptionizer

Type:

Information

Summary:

Encryptionizer is installed on a Virtual machine and you are moving hosts, or you have a physical machine you are converting to a virtual machine (P2V).  This article describes the possible impacts this can have on Encryptionizer.

Additional Information:

There are two possible ways that moving a virtual machine may affect Encryptionizer:

• Impact on the License which is tied to hardware
• Impact a UKMK, if set, or Security profile if the “Lock Key to Machine” option was selected.

Regarding the Software License Activation:

We have many clients in Virtual environments, and have not had issues when Virtual machines are floating across hosts within the same hosting environment. Once a license has been activated, provided no major changes to the overall configuration of the machine are made, the license remains active. Moving from one host to another generally has not caused issues, nor has changes on the host machines.

However, changing Host Providers (e.g. Rackspace to AWS) or performing a P2V conversion (physical to virtual machine) can result in inactivating the license software.

For Encryptionizer 2023 and later (2201.1.1), we recommend the following steps:

1. Download and install the latest version of Encryptionizer from your License portal onto the machine prior to moving.
2. Just prior to the move when no activity is being processed against the secured service or application, run the License Management module from the Main Menu (or nllicense4.exe in the NetLib install folder directly)
3. Choose Deactivate. Follow the instructions so that you may reclaim an activation once the machine is moved (see the License Management Guide for more information and instructions). Once deactivated, Encryptionizer no longer will function on machine, and the activation will be available to use once the machine has been moved. You can check your License Portal to confirm that you successfully reclaimed your activation.
4. On the moved machine, open the License Management screen from the Main Menu.
5. Activate using the same License ID and Activation password from the original machine. You can find this information in your License portal.  If you run into any trouble, use one of your Temporary licenses listed in the License Portal to get your machine up and running until you can reach out to NetLib Support for assistance.
6. Reboot the machine after activation to ensure that the license loads at boot time.
7. If you need the original copy of machine to continue running concurrently after the move, you can activate it with a new Temporary License. See your License Portal for a Temporary License you can use. If you need machines to run concurrently for a longer period of time, please contact NetLib Support.

For versions 2019.1210.31152 and earlier:

• We are no longer providing new activations for this older version or earlier. We recommend that you upgrade to the latest version of Encryptionizer from your License Portal  and activate using License ID and Activation password. If you are uncertain where to find the latest software or your licenses or have other questions regarding the older version, please contact NetLib Support.

If you anticipate that you are making a major move of a Virtual machine to a new host or hosting environment, we recommend that you reach out to our support team to request a Temporary License to have on hand.  Each year, after support renewal, our support team sends out an email with a new Temporary License information that you can use.

Regarding the “Lock to Machine” options:

For virtual machines, unrelated to the Software License activation – do not use “lock to machine” options when configuring Encryptionizer as that does seem to be impacted. This uses a stricter method of locking security profiles, intended for physical machines. If you have previously set a UKMK or secured an instance with the Lock Key to Machine option, moving a VM will likely impact access to the encrypted databases, because the machine will look different enough to Encryptionizer.

If you find that after a move, your software is active (based on the test above) but you are not able to access your encrypted data, you will need to resecure the instance.

If you have created a UKMK with a lock to machine option, go into the Set User Key Master key (UKMK) option from the Main Menu, clear the UKMK, and then add it again. It can even be the same value as before.

Then in the Administration Wizard, unsecure the SQL instance, and then relaunch and secure it again.

If you are not sure if you used the Lock to Machine options, you can run our support diagnostic and we can help determine it for you.

To run our support diagnostic, follow the instructions in our KnowledgeBase article:
KB #240068: How to run the Support Diagnostic

Related Topics:

240132: Test if your License/Activation is valid

240068: How to run the Support Diagnostic

240137: Requesting a Permanent Registration Key