Documentation Guide – PAM Application Upgrade Procedure

V1.0
Table of Contents

1. Download Upgrade/Fix Source Version ............................................................................................ 1

1.1 IBM Fix Central Portal: ........................................................................................................................ 1
1.2 Download PAM upgrade/fix version. .................................................................................................. 1
2. Enable Maintenance Mode and Preform Backup. ............................................................................. 3
2.1 Enable Maintenance Mode. ................................................................................................................ 4
2.2 Preform Backup for Secret Server application and database. ............................................................ 5
3.1 Upload Upgrade Files .......................................................................................................................... 7
3.2 Install Upgrade Files. ........................................................................................................................... 8
3. Upgrade PAM Secret Server & Privilege Manager ........................................................................... 10
3.1 Copy Secret Server and TMS folder .................................................................................................. 10
3.2 Recycle IIS application pool............................................................................................................... 12
4. Checking PAM Application after Upgrade (Health Check) ............................................................... 15
1. Download Upgrade/Fix Source Version
 Before Beginning (High Importance)
• Ensure that you have account credentials information and access for the server hosting
SS and the SQL Server instance hosting your SS database.
• Have a recent backup of the application files and database available.
• If you use clustering, stop the application pools on all of the servers, except the one that
is currently the primary

1.1 IBM Fix Central Portal:

 Open IBM Fix Central URL

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli&product=ibm/Tivoli/IBM+
Security+Secret+Server&release=All&platform=Windows&function=all

1.2 Download PAM upgrade/fix version.

 From the right panel Select installed version and platform.

IT System Security IC2 Page | 1

 Select the required upgrade/fix version that need to be downloaded.

 Download Selected upgrade/fix version.

IT System Security IC2 Page | 2

2. Enable Maintenance Mode and Preform Backup.
 Open PAM Application URL Click on admin located left-down Select See All Menu.

 Select Setup & System Maintenance Upgrade Secret Server.

IT System Security IC2 Page | 3

2.1 Enable Maintenance Mode.

 Putting secret server in read only mode to avoid losing any data during upgrade.

IT System Security IC2 Page | 4

2.2 Preform Backup for Secret Server application and database.

 Backup Secret Server and Database.

 Edit backup configuration and set folder path for Secret Server application and database.

IT System Security IC2 Page | 5

 Verify last backup successfully by reviewing backup date & time and checkmark box
checked.

 Then click on checkmark box of “the secret server database and application folder has
been backed up” and continue to proceed.

IT System Security IC2 Page | 6

3. Upgrade PAM Secret Server & Privilege Manager

3.1 Upload Upgrade Files

 Click on “Advanced” “Browse”.

 Then Select The required package to upgrade.

 Then click “Upload Upgrade Files”.

IT System Security IC2 Page | 7

3.2 Install Upgrade Files.

 Click Install this Version.

 Click “I Agree and Accept the License” then Upgrade.

IT System Security IC2 Page | 8

 CONGRATULATIONS! Installation is complete

IT System Security IC2 Page | 9

3. Upgrade PAM Secret Server & Privilege Manager
 Important:

• Never overwrite or delete encryption.config and databaseDefults.config Secret Server

files.
• Never overwrite or delete connectionstrings.config TMS files.
• Back up your SS folder and database before performing the upgrade.

 Before Beginning
• Ensure that you have account credentials information and access for the server hosting
SS and the SQL Server instance hosting your SS database.
• Have a recent backup of the application files and database available.
• If you use clustering, stop the application pools on all of the servers, except the one that
is currently the primary

 Note: You do not need to download the installer or setup.exe.

3.1 Copy Secret Server and TMS folder

 Copy installation files of Secret Server and TMS form the Master node to cluster mode

IT System Security IC2 Page | 10

 KEEP (DON’T DELETE OR OVERRIDE) Encryption.config and databaseDefults.config files on
cluster Secret Servers

This PC New Volume Letter inetpub wwwroot SecretServer”.

 KEEP (DON’T DELETE OR OVERRIDE) connectionstrings.config file on cluster TMS folder

IT System Security IC2 Page | 11

3.2 Recycle IIS application pool

 Recycle application pool for “TMS, TMS Agent, and TMS Worker”,
Open Start Menu Type IIS

 Point to Application Pools

TMS Right Click Then Recycle.

TMS Agent Right Click Then Recycle.
TMS Worker Right Click Then Recycle.

IT System Security IC2 Page | 12

 Checking all nodes are upgraded successfully.

IT System Security IC2 Page | 13

IT System Security IC2 Page | 14
4. Checking PAM Application after Upgrade (Health
Check)
 As per vendor recommendations, we should check PAM after upgrade using the below
steps:

 Secret Server is accessible - you are able to login and see all the secrets.
 Remote Password change and Heartbeat is working correctly manually and on schedule.
 Discovery (if configured) is discovering machines and accounts correctly.
 The health check for the system is showing the system healthy.
(https://yoursecretserverurl/healthcheck.aspx).
 If Distributed Engine / Rabbit MQ is used there are no errors reported by these (verify
this in the appropriate logs).
 No errors are reported under System Logs and Secret Server Logs.
 Remote Launchers are working correctly after upgrade.

End of Document

IT System Security IC2 Page | 15