Password Manager 5.7.1 - Administration Guide

Upgrading Password Policy Manager

Password Policy Manager ensures that all passwords in the organization comply with the password policies established by the Password Manager administrator. Password Policy Manager is necessary to enforce password policies configured in Password Manager in such cases, when users change their passwords using tools other than Password Manager. For example, when a user presses Ctrl+Alt+Delete to change password, the password policies configured in Password Manager will not be enforced, unless Password Policy Manager is installed. Skip this section if you do not use domain password policies assigned in Password Manager.

Both removal and installation of Password Policy Manager (PPM) requires computer restart. Upgrade PPM on all domain controllers in sequential order. Perform the upgrade during off-peak hours to cause minimal impact to your organization’s operations.

To guarantee that all the passwords in your organization comply with the established policies, Password Policy Manager must be deployed on all domain controllers in the managed domain.

To upgrade from Password Policy Manager version 4.x

1. Remove the previous version of Password Policy Manager from a domain controller and restart the computer when prompted. For more information on uninstalling PPM, see Uninstalling Password Policy Manager.
2. Install the new version of Password Policy Manager on that domain controller and restart the computer when prompted. For more information on installing PPM, see Installing Password Policy Manager.
3. Repeat the steps 2 and 3 for each domain controller in the managed domain.

If the previous version of Password Policy Manager has been deployed through Group Policy, it should be uninstalled by removing the previously assigned MSI package from the Software installation list. For more information, see Uninstalling Password Policy Manager. After the previous version is removed from the domain controllers, the new version may be deployed to those DCs through Group Policy.

Password policy settings are not deleted when you uninstall Password Policy Manager version 4.x and picked up by newer versions of PPM.

Exporting Configuration Settings from Password Manager 4.x

To export configuration settings from Password Manager 4.x, you must use the One Identity Password Manager Migration wizard 5.6.3.

The Migration wizard 5.6.3 can be used to perform the following tasks when performing an upgrade:

1. Export configuration settings from Password Manager 4.x.
2. Import configuration settings to Password Manager 5.6.3.
3. Convert users’ Q&A profiles to make them compatible with Password Manager 5.6.3.

When exporting configuration settings, the Migration wizard 5.6.3 creates a configuration file that must be used to import the settings to Password Manager 5.6.3. You can export and import the configuration settings several times using the Migration wizard 5.6.3. This allows you to review the results of the configuration settings import in Password Manager 5.6.3, change export settings if necessary and repeat the procedure of importing configuration settings.

Note, that not all configuration settings can be exported. The following settings cannot be exported from Password Manager 4.x and have to be manually configured in Password Manager 5.6.3:

• User email notifications
• Administrator email notifications
• Email notification templates
• Profile update policy
• User enforcement settings
• Password expiration notifications
• SQL Server and Report Server settings
• Integration with One Identity Quick Connect Sync Engine, Defender, QESSO

Integration with QESSO is available in Password Manager starting from version 5.0.2

To export configuration settings from Password Manager 4.x

1. On the computer where Password Manager 4.x is installed, run the Migration Wizard 5.6.3 from the Password Manager CD autorun window. It is recommended to run the Migration Wizard 5.6.3 under the Password Manager Service account.
2. On the Welcome page, select the Export configuration settings task.
3. On the next page, select the managed domains whose user scopes you want to export into a single Management Policy, enter the Management Policy name, and click Next.
4. Choose one domain from the list of domains you specified on the previous page from the Select domain drop-down list. Settings from this domain will be used to configure the self-service and helpdesk workflows and general settings for the specified Management Policy. Click Next.
5. From the Select language drop-down list, select the language of secret questions from the domain you selected on the previous page and click Next. This language will be used to define the Q&A policy for the specified Management Policy. The Q&A policy consists of secret questions in the default and additional languages, and Q&A profile options, such as the number of questions required to register with Password Manager, minimum length of answers, and others.
6. If there are managed domains that have not been included in the specified Management Policy, you will be prompted to export their user scopes and settings on the Select domains to create another Management Policy page. If you want to create another Management Policy, click Export, then click Next, and repeat steps 3-5. If you do not want to create another Management Policy, click Do not export, click Next, and proceed to the following step.
7. Specify the file to which the configuration settings will be exported. In the Password field, enter the password to protect the file. Click Export.

   IMPORTANT: Remember the password that is generated while exporting the configuration file. You should enter this password when importing the configuration file to 5.6.3 instance.

8. On the status page, review the results and click View the report for detailed information to view a detailed account of the exported settings.
9. Click Finish to close the wizard.

You can perform the Export configuration settings task multiple times, by adjusting the export options you can receive different configuration files.

Installing Password Manager 5.x.x

On a computer other than the computer where Password Manager 4.7 is installed, install Password Manager 5.6.3. When installing Password Manager 5.6.3, you can specify whether you want to install all Password Manager components on a single server or install the Self-Service and Helpdesk sites on separate servers.

For more information on installing Password Manager, see Steps to Install Password Manager.

Importing Configuration Settings to Password Manager 5.6.3

To import configuration settings to Password Manager 5.6.3, you must use the One Identity Password Manager Migration wizard 5.6.3.

To import configuration settings to Password Manager 5.6.3

1. Stop the Password Manager Service on the computer where Password Manager 5.6.3 is installed.
2. On the computer where Password Manager 5.6.3 is installed, run the Migration Wizard 5.6.3 from the Password Manager autorun window. It is recommended to run the Migration Wizard 5.6.3 under the Password Manager Service account.
3. On the Welcome page, select the Import configuration settings task.
4. Browse for the file to which you exported settings from a previous version of Password Manager. Enter the password and click Next.
5. On the status page, click Finish to close the wizard.
6. Start the Password Manager Service.