Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Deduplication Guide
  3. Configuring deduplication
  4. About MSDP Encryption using NetBackup Key Management Server service
  5. Enabling KMS encryption for a local LSU
NetBackup™ Deduplication Guide

Enabling KMS encryption for a local LSU

You can enable the KMS encryption for a local LSU by using the nbdevconfig command.

To enable KMS encryption for a local LSU

  1. Create a configuration file with a name of your preference in the following format. For example, sample_config.txt
    V7.5 "operation" "set-local-lsu-kms-property" string
    V7.5 "encryption" "1" string
    V7.5 "kmsenabled" "1" string
    V7.5 "kmsservertype" "0" string
    V7.5 "kmsservername" "xxxxxx" string
    V7.5 "keygroupname" "xxxxx" string 
    

    Configuration setting

    Description

    V7.5 "operation" "set-local-lsu-kms-property" string

    You can only update the KMS status from disabled to enabled.

    V7.5 "encryption" "1" string

    Specifies the encryption status. This value must be 1.

    V7.5 "kmsenabled" "1" string

    Specifies the KMS status. This value must be 1.

    V7.5 "kmsservertype" "0" string

    Specifies the KMS server type. This value must be 0.

    V7.5 "kmsservername" "" string

    KMS server name that is shared among all LSUs.

    V7.5 "keygroupname" "" string

    The key group name must include the following valid characters.

    • A-Z

    • a-z

    • 0-9

    • Underscore (_)

    • Hyphen (-)

    • Colon (:)

    • Period (.)

    • Space

  2. Run the following command to enable the KMS encryption:

    nbdevconfig -setconfig -storage_server <storage server host name> -stype PureDisk -configlist <configuration file name>

Note:

All encrypted LSUs in one storage server must use the same keygroupname and kmsservername. KMS server must be configured. Key group and Key exist in the KMS server.

Feedback

Was this page helpful?
Previous

About MSDP Encryption using NetBackup Key Management Server service

Next

Upgrading KMS for MSDP

Feedback

Was this page helpful?