The Customization Tool available for 5.7.1, 5.8.x, and 5.9.x can be downloaded here:
Overview
Licensing
Using a license from a previous version
Telephone verification license
Starling 2FA license
RADIUS Two-Factor Authentication
How to obtain a new license key
Upgrading
Upgrade considerations
Secure Password Extension
Password Policy Manager
Configuration
Reinitialization
Reports
Starling 2FA
Customizations
Troubleshooting
Is it possible to upgrade the Password Manager servers first and then the SPE (Secure Password Extension) at a later time?
Is it possible to roll back after the upgrade?
Does Password Policy Manager have to be upgraded on the Domain Controllers?
Upgrading from Password Manager 5.5.3 or later versions
Upgrading the Secure Password Extension
To remove the existing and assign a latest-version package
To remove an assigned MSI package
To deploy and configure Secure Password Extension
Upgrading Offline Password Reset
How to enable logging
To enable logging for Password Manager service
To enable logging for a stand-alone server
To enable logging for the Secure Password Extension (SPE)
To enable Password Policy Manager (PPM) logging:
How to move the Password Manager database
Changing the Password Manager service account
Workflow design considerations
Customization tool
Troubleshooting
Troubleshooting
After you upgrade, there is a possibility that the Local.storage file changes the value of “role” from “Primary” to “Secondary” if it detects any existing Service Connection Points in Active Directory.
This issue can happen in these scenarios: One Identity Password Manager
- If you have an old Service Connection Point from a previous version (such as 4.7 or 5.0.3) and it was not cleaned up/removed from Active Directory
- If you have more than one Password Manager server instance in the same domain and you upgraded both. They may both default to “Secondary” as a precaution
Please keep in mind that if you have multiple Password Manager servers, one of these must be “Primary” and all others “Secondary” for the same domain (realm) instances.
If you fall into either of the aforementioned scenarios, please check the settings in the following file after you finish the overall upgrade process:
C:\ProgramData\One Identity\Password Manager\Local.storage
The setting is located near the top of the file:
<setting name=”role” value=”Secondary” />
Ensure only one Password Manager server has this setting:
<setting name=”role” value=”Primary” />
|
|
NOTE: If no servers are set to "Primary", designate one of your choosing and update it. After the file is updated and saved, restart the Password Manager service on that server only. |
How to enable logging
Logging is a valuable resource in troubleshooting issues with Password Manager. When working with One Identity Support, Verbose logging is required as it provides more details for troubleshooting issues.
|
|
Caution: One Identity does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support: http://support.microsoft.com/default.aspx?kbid=256986. |
