Moving the Microsoft SQL Server Database to Another Machine

This topic only applies to Secret Server On-Premises.
This article only applies if your MS SQL Server database is only for Secret Server.

Follow the steps below for moving MS SQL Server database for Secret Server.

Task 1: Backing up and Restoring the Database

To back up your Secret Server installation:

  1. Enable the maintenance mode.

  2. Stop the Secret Server site in Internet Information Server (IIS) to prevent any changes to the database.

  3. Navigate to the directory where Secret Server is installed.

  4. Copy the folder (holding the application) to your back up location.

  5. Open your SQL Server Management Studio.

  6. Right click the database your Secret Server is running on, and select Tasks > Backup.

  7. Click the Add button. You are prompted to enter a file path for the .bak file. This can be the final destination (not recommended) or a temporary one (for later moving to a back up location).

  8. Make sure SQL Server has permissions for this location. That is, create (if needed) and or grant access to the account that will access the database (see the Installation for account creation instructions). See Running the IIS Application Pool As a Service Account (Task 2) for details.

  9. Copy the resulting database backup file (.bak) to your backup location.

You can also automate steps 2-4 using the command: osql -S myserver\SQLEXPRESS -E - Q "BACKUP DATABASE SECRETSERVER TO DISK = 'c:\backup\ss.bak'.
We recommend taking the old database offline after all steps are complete.

See Restoring Secret Server from a Backup for restoring instructions.

Task 2: Connecting Secret Server to the New Database

Use one of the following methods, depending on whether Secret Server can still reach the old database.

The connection settings are stored in C:\inetpub\wwwroot\Secretserver\database.config. You can back that file up to revert, or return to the pages below to reset the connection again. See the Privilege Manager documentation if you need to change its configuration too.

If You Can Still Log On (Old Database Still Online)

  1. Restart your Secret Server website in IIS.

  2. Log on Secret Server as a local admin with the Administer Configuration role permission.

  3. Search for Database to open the Database Configuration page.

  4. Click the Edit button. The page becomes editable.

  5. Type your new SQL Server location (server name) and database.

  6. Click the Save Database Connection Settings button. Secret Server recycles its application pool and connects to the new database.

For details, see Changing SQL Server Connection Parameters.

If Secret Server Cannot Reach the Old Database

If the old database is already offline, you cannot log on. Secret Server instead shows the Unable to access database page.

  1. On the web server, open a browser and navigate to Secret Server using localhost, such as http://localhost/secretserver. The Unable to access database page opens. This page must be opened from the web server itself.

  2. Click Configure database. The Configure database page (/app/#/install/configure-database) opens.

  3. In Server name and Database name, type the new SQL Server location and database.

  4. Under SQL Authentication, select the same method you used before. If you use SQL Server authentication, enter the Username and Password. For the options, see Installing and Configuring SQL Server.

  5. Click Save connection information. Secret Server applies the settings and reloads.

The Unable to access database page also provides a Legacy connect link at the bottom, which opens the previous Database Configuration page at /Setup/Database. Use it if the Configure database page cannot complete.

After Reconnecting

Your site is now pointing to the new database. Reactivate your licenses by going to the Licenses page. Secret Server license activation requires both the license and the Secret Server database, so changing the database connection details requires a new activation. If you do not reactivate, Secret Server goes into limited mode: you can still view passwords, but many other features are disabled, such as creating secrets, editing secrets, changing permissions, and using web services. For details, including offline activation for environments without outbound access to delinea.com, see the License Activation FAQ.

To roll back changes and restore the original database, complete both tasks again to move the database back to the original database server.
If you are also moving the Secret Server application to another server, see Moving Secret Server to Another Machine for more information.

The steps in Task 2 should be performed for each web node in a deployment. Making the change on one node only will not propagate to the other nodes.