CAVaultManager

CAVaultManager CreateDB 

This command will create a new Vault database.

CAVaultManager SecureDB  /MasterPassword <Password> RndBaseFileName <Filename> /DBEmergencyPasswordFileName <Filename>

This command secures the Vault database using the master password and the initial entropy file, then creates and stores an encrypted password in an emergency password file which enables access to the Vault database.

For example:

CAVaultManager SecureDB /MasterPassword mstrpwd123 /RndBaseFileName C:\rndbasefile.dat /DBEmergencyPasswordFileName C:\VaultEmergency.pass

The above example will secure the Vault database, using the Master password mstrpwd123 and the initial entropy file stored in c:\rndbasefile.dat, then will create and encrypt an emergency password and store it in C:\VaultEmergency.pass.

This command secures the files that contain either the Radius or LDAP secret.

CAVaultManager SecureSecretFiles 
[/SecretType <Type>] [/Secret <Secret>] [/SecuredFileName <Filename>] 
[/FileSectionName <SectionName>]

Example 1:

CAVaultManager SecureSecretFiles /SecretType Radius /Secret VaultSecret /SecuredFileName c:\RadiusSecret.txt

The above example will create a file called c:\RadiusSecret.txt that contains the encrypted Radius secret, VaultSecret.

Example 2:

CAVaultManager SecureSecretFiles /SecretType LDAP /Secret LDAPSecret /SecuredFileName “c:\Program Files\ PrivateArk\Server\LDAP \Directories\ ActiveDirectory.ini” /FileSectionName LDAPHost2

The above example will open an existing file called c:\Program Files\ PrivateArk\Server\LDAP\Directories\ ActiveDirectory.ini that contains the encrypted LDAP secret, LDAPSecret. This command will secure the section called LDAPHost2 in the specified file by inserting the encrypted secret into the secured section.

This command identifies corrupted Vault users for all authentication types with invalid user keys or with invalid database references.

CAVaultManager DeletePartialUsers

The command returns two outputs:

1. The number of users with invalid user keys.
2. A list of users with invalid database references.

If there are any affected users, you are prompted to enter YES to delete these users.

CAVaultManager SecureEntropyFile [/RndBaseFileName <Filename>]

This command will create the Vault’s entropy file with the initial entropy file and secure it using the server key.

For example:

CAVaultManager SecureEntropyFile /RndBaseFileName c:\rndbasefile.dat

The above example will create the Vault’s entropy file with the initial entropy file stored in c:\rndbasefile.dat and then secure it with the server key.

This command configures the Vault for optimal performance, by optimizing the database structure and reclaiming unused database space.

This command creates a folder in D:\PrivateArk\Safes\Metadata OptimizeDB Backups especially for backup files that are created when this command is run. The name of the backup file is comprised of the date and time of the backup.

Although this command creates its own backup, before running this command, perform a full backup of the Vault database.

1. Shut down the Vault server.

2. In the PrivateArk\Server\Database\Conf folder, backup the my.ini configuration file.

3. Open the my.ini configuration file and make the following changes:

   innodb_flush_log_at_trx_commit=0  # Default is 1

   Comment log-bin=mysql-bin

4. In HA implementations only, in the Cluster Administration Utility, set the PrivateArk Database resource to offline, and manually start this service.

5. Run the following command:

   CAVaultManager.exe OptimizeDB

This command does not require any parameters.

6. Change the settings in the my.ini configuration file back to how they were before you changed them in step 3. Use the backup file that you created in step 2 for reference.

7. Restart the PrivateArk Database service in order to apply the initial values.

8. In HA implementations only, in the Cluster Administration Utility, set the PrivateArk Database resource to online.

9. Restart the Vault machine.

CAVaultManager UpgradeDB

This command will upgrade the Vault database in future versions of the CyberArk Vault.

CAVaultManager DeleteDB

This command will delete all the information from the Vault database.

CAVaultManager RecoverDBPassword [/DBEmergencyPasswordFileName <Filename>] [/DBNewPassword <Password>]

This command recovers the password that is used to access the Vault database. It uses the password specified in the emergency password file to retrieve the emergency database password which enables access to the Vault database, then generates a new database password and stores it in the file specified in the DatabaseConnectionPasswordFile parameter in DBParm.ini. The new password can either be specified by the user or a random password can be generated.

For example:

CAVaultManager RecoverDBPassword /DBEmergencyPasswordFileName C:\VaultEmergency.pass

The above example will retrieve the emergency password stored in C:\VaultEmergency.pass then generate a new random database password and store it in the password file specified in the DatabaseConnectionPasswordFile parameter in DBParm.ini.

CAVaultManager RecoverDBPassword /DBEmergencyPasswordFileName C:\VaultEmergency.pass /DBNewPassword NewDBPwd

The above example will retrieve the emergency password stored in C:\VaultEmergency.pass then encrypt the new specified password, NewDBPwd, and store it in the password file specified in the DatabaseConnectionPasswordFile parameter in DBParm.ini.

CAVaultManager LDAPVerify /ConfOnly /Verbose

This command carries out an integrity check on the LDAP configuration files and will check the connection with the LDAP component, and will display a detailed status report.

The /ConfOnly parameter will carry out an integrity check on the LDAP configuration files only, but will not check the connection status to the LDAP component.

CAVaultManager SynchronizeDB [/SafePattern <Pattern>] /FilesSyncOnly /QuotaSyncOnly /Update /Force

This command synchronizes the Vault database after the backup files have been transferred to the Vault from backup data. It can synchronize only files or quotas in specific Safes, in the entire Vault or according to a Safe pattern. This command can either simulate synchronization or carry it out with or without confirmation from the user.

For example:

CAVaultManager SynchronizeDB /FilesSyncOnly /Update 

The above example will synchronize the backup files that were restored in the Vault (using the RestoreDB command) with the restored Metadata. This command will be carried out, rather than simulated, and will prompt the user for confirmation during the process.

CodeCAVaultManager RecoverBackupFiles [/BackupPoolName <BackupPoolName>]

This command uses the Vault’s Recovery Private Key to access all the backup files in the Restored Safes folder and re-encrypt them with a new backup key when the original backup key cannot be used.

For example:

CAVaultManager RecoverBackupFiles /BackupPoolName BkpSvr1 

The above example will recover the backup files from a Backup Pool called BkpSvr1, and re-encrypt them with a new accessible backup key.

CAVaultManager DiagnoseDBReport [/OutputFileName <FileName>]

This command compiles a diagnostics report for the Vault database.

For example:

CAVaultManager DiagnoseDBReport /OutputFileName c:\CompanyVaultDiagnostics.txt 

The above example will compile a diagnostics report of the Vault, and save the report in a text file called CompanyVaultDiagnostics stored in c:\.

CAVaultManager ReplaceLDAPDirectory /CurrentLDAPDirectory <old_directory> /NewLDAPDirectory <new_directory> [/Update]

This command changes references in directory maps, users and groups from a current directory to a different one.

For example:

CAVaultManager ReplaceLDAPDirectory /CurrentLDAPDirectory Directory_1 /NewLDAPDirectory Directory_2

The above example changes references in directory maps, users and groups that define how external users are managed in the Vault from Directory_1 to Directory_2.