Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Deduplication Guide
  3. Appendix C. Encryption Crawler
  4. Updating the KMS configuration
  5. Migrating the KMS vendor
NetBackup™ Deduplication Guide

Migrating the KMS vendor

Best practice is to perform KMS vendor migration during a maintenance window.

To migrate the KMS vendor

  1. List the current KMS service to determine the KMS service priority.

    /usr/openv/netbackup/bin/nbkmscmd -listKMSConfig

  2. Update the priority on the current KMS service to greater than 0.

    /usr/openv/netbackup/bin/nbkmscmd -updateKMSConfig -name configuration_name [-server primary_server_name] [-priority priority_of_KMS_server]

  3. Set up the new KMS service with the same key group name the current KMS service is using.
  4. Create an active KMS key in the new KMS service.
  5. Configure new KMS service in NetBackup with priority of 0.
  6. Verify that NetBackup reports both KMS services on the primary server.

    /usr/openv/netbackup/bin/nbkmscmd -listKMSConfig

  7. Update the priority of the new KMS service to a priority greater than the priority that is set on the previous KMS service.

    /usr/openv/netbackup/bin/nbkmscmd -updateKMSConfig -name configuration_name [-server primary_server_name] [-priority priority_of_KMS_server]

  8. Start the KMS vendor migration process in MSDP.

    /usr/openv/pdde/pdcr/bin/crcontrol --migratekmsprovider

  9. Use kek_tag_reporting tool to verify the kms_key_tag in the most recent entry matches the "Key ID" reported by nbkmscmd for active key in the new KMS service.

    /usr/openv/pdde/pdcr/bin/kek_tag_reporting.py -r

    /usr/openv/netbackup/bin/nbkmscmd -listKeys -name nbkms

Feedback

Was this page helpful?
Previous

Performing the KEK rotation

Next

Index

Feedback

Was this page helpful?