Exporting the Backup Exec Database encryption key
Backup Exec stores sensitive information in the Backup Exec Database using encryption. When you install or upgrade Backup Exec, it automatically creates a database encryption key. The database encryption key is used to encrypt information such as login account credentials and the keys that are used for encrypted backup jobs, for example. It is stored in the Data folder in the Backup Exec installation directory.
You are required to provide the Backup Exec Database encryption key for each of the following scenarios:
-
Performing a manual disaster recovery of a Backup Exec server
-
Performing a disaster recovery of a Backup Exec server using Simplified Disaster Recovery (SDR)
-
Migrating Backup Exec from one computer to another computer
-
Resolving any situations in which the database encryption key on the Backup Exec server is corrupted or goes missing
Veritas recommends that you export the Backup Exec Database encryption key to a secure location so that you can access it later if it is needed. You should repeat the following procedure on each Backup Exec server in your environment, including the central administration server and each managed Backup Exec server in Central Admin Server feature (CAS) deployments.
Make sure that you export the database encryption key to a location that meets the following criteria:
-
The destination is either on a physical volume that is assigned to a drive letter or a network share that is specified by a UNC path (network shares that are mapped to drive letters are not supported)
-
The destination has enough disk space
-
The destination is accessible from the Backup Exec server
-
Backup Exec has permission to write to the destination
To export the Backup Exec Database encryption key
-
Click the Backup Exec button, select Configuration and Settings, and then click Backup Exec Settings.
-
In the left pane, select Database Maintenance and Security.
-
In the Path field, type the location to which you want to export the encryption key.
-
If you want Backup Exec to remember the path to which you exported the database encryption key, select Remember the export path. By clicking this check box, you consent to let Backup Exec retain and display the export path during import operations.
If you select this option, Backup Exec can attempt to automatically recover the database encryption key in the event that the key fails. If you do not select this option, you must manually import the database encryption key if it ever fails.
-
Click Export.
The key is exported to the location that you specified. The key is named with a unique hash value. Backup Exec uses the name to identify the key later. If you want to export the key to additional locations, repeat steps 3 through 5.
-
Click OK.
More Information
Related information