Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Deduplication Guide
  3. Appendix C. Encryption Crawler
  4. Updating the KMS configuration
  5. Performing the KEK rotation
NetBackup™ Deduplication Guide

Performing the KEK rotation

This process may run concurrently with normal NetBackup operations such as backups and restores. However, best practice is to perform KEK rotation during a maintenance window. Rotation may take a very long time to complete since it depends on the amount of data that needs KEK rotation.

To perform the KEK rotation

  1. Reset the encryption crawler if it was used previously.

    /usr/openv/pdde/pdcr/bin/crcontrol --encconvertreset

  2. Run the following command to start the KEK rotation process in MSDP.

    /usr/openv/pdde/pdcr/bin/crcontrol --kekconverton

  3. Monitor the KEK rotation.

    /usr/openv/pdde/pdcr/bin/crcontrol --encconvertstate 2

Feedback

Was this page helpful?
Previous

Performing the KMS key rotation

Next

Migrating the KMS vendor

Feedback

Was this page helpful?