KB #240154: Upgrade Operating System on a machine with EKM installed (v2018.1204.32022.1181)

Type:

Information

Summary:

You are upgrading the operating system of a machine in place, and have the Encryptionizer Key Manager installed  version: 2018.1204.32022.1181

Additional Information:

An operating system in-place upgrade can interfere with an important Encryptionizer Windows registry entry, and in some cases has also inactivated our software.

Below are suggested steps when performing the in-place OS upgrade.

1. Before OS upgrade, Backup your Key database on the machine you are upgrading and Export the RSA certificate and save both to a location on another machine.
2. If  the EKM server is a virtual machine, shut down the machine and take a snapshot/checkpoint.
3. Apply a Temporary Registration Key to the machine (request one from NetLib Support prior to planned OS upgrade).
4. Stop NLMServer and MSSQL$EEM01
   open a command window with the “Run as Administrator” option, and run the following:

   net stop nlmserver
   net stop mssql$eem01

5. Perform your OS in-place update.
6. After the upgrade is complete, you will also need to import an important registry entry:
   • Download the following file which is a Zip file containing the registry import file:
     https://netlibsecurity.com/files/patches/nlem1402_tag.zip
   • Expand the file and rename the extension from .re_ to .reg
   •  Open Regedit and import the file (nlem1402_tag.reg)
7. Set the MSSQL$EEM01 SQL instance to Automatic (Delayed) in the Services control panel.
8. Reboot
9. Ensure that the NetLib Encryptionizer Key Management Service is running (nlcbtask).
   open a command window with the “Run as Administrator” option, and run the following:

   sc query nlcbtask

   This should return 4 : Running

10. Ensure that the EEM SQL instance is running
11. open a command window with the “Run as Administrator” option, and run the following:

    sc query mssql$eem01

    This should return 4 : Running

12. Wait a few minutes to allow automatic processing within the
13. Run the Encryptionizer Key Manager Menu to confirm that your keys are still accessible.
14. You will need a new Permanent Registration key for the machine. Follow the instructions in the following KnowledgeBase:
    KB #240137: Requesting a Permanent Registration Key
    In the comments section of the registration page, indicate that you had performed an OS upgrade.
15. Within 1-2 business days, you will receive two emails. One will be a cancellation of the original Permanent Registration key. The second will be the new Permanent Registration key as replacement.