ProcessManager Console Fails to Launch When Redirecting a New Workflow Installation to an Existing ProcessManager database

Products

• IT Management Suite
• Client Management Suite

Issue/Introduction

After a clean install of Symantec Workflow 8.7.3 (with a new database created during setup), attempting to redirect the new 8.7.3 server to an existing production Workflow 8.5 RU4 ProcessManager database using standard connection string redirection steps (e.g., "Moving Workflow SQL database to a new server" (KB 172481)) causes the ProcessManager console to fail to launch on the new server.

1. Error Observed: If customErrors mode is set to Off in web.config  ( default location ; C:\Program Files\Symantec\Workflow\ProcessManager\web.config )  , errors such as Padding is invalid and cannot be removed occur during decryption (e.g., decrypting SMTP server passwords or database credentials in Master Agent Settings).
   
   
   
   
2. Error in the Log:

   System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it [::1]:443
      at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
      at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
      --- End of inner exception stack trace ---
      at LogicBase.Framework.DynamicProxy.GetServiceDescription()
      at LogicBase.Framework.DynamicProxy.AddMethod(DynamicWebMethod WebMethod)

   
   
   

Environment

Workflow 8.7.3

Cause

• Missing KMS Encryption Key: Each Workflow server installation generates its own KMS encryption key used to encrypt/decrypt sensitive database values (SMTP passwords, database credentials, system accounts). If a new Workflow instance points to an existing database without importing the original server's KMS key during setup, it cannot decrypt existing database records.

• Post-Installation Redirection Limitation: Connecting an existing installation to an "alien" database by manually updating connection strings in configuration files (web.config, setup.xml, etc.) does not transfer or migrate the required KMS encryption keys. Importing KMS keys and running schema updates is only supported during the initial installation wizard ("Show Import Key Page").

• Database Schema & Version Mismatch: Running two different versions of Workflow (e.g., 8.5 RU4 and 8.7.3) against the same database causes failures due to schema expectations and object caching inconsistencies.

Resolution

To connect a new 8.7.3 Workflow server to an existing production 8.5 RU4 ProcessManager database, the KMS key must be exported from the source server and imported during a clean reinstallation on the target server.

Step 1: Export the KMS Key from the Source Server

1. Open Command Prompt as Administrator on the old 8.5 RU4 Workflow server.

2. Navigate to C:\Program Files\Symantec\Workflow\Tools.  
   
   (Note: Path may vary depending on the custom installation path of your environment).

3. Run the following command:

   lbutil.exe -exportKmsKey -kmsFileLocation <full_path_to_file.kms> -password <protection_password>
   

Step 2: Clean and Prepare the Target (8.7.3) Server

1. Stop the Symantec Workflow Server service on the target 8.7.3 server.

2. Uninstall the existing Workflow 8.7.3 instance.

3. Manually remove remaining installation directories per "Error "Failed to write to an IPC Port: The pipe is being closed." seen in the logs" (KB 152290) to prevent IPC port binding conflicts during reinstall.

Step 3: Reinstall Workflow and Import the KMS Key

1. Launch the Workflow Installation Wizard on the new server.

2. At the Maintenance step, check the box for Show Import Key Page.
   
   

3. When prompted, import the .kms key file exported in Step 1.

4. On the Database Configuration page, point to the existing ProcessManager SQL database.

   1. Make sure your Service Account is DBO on the ProcessManager SQL database.

5. Complete the installation.

Step 4: Post-Migration Check

1. Ensure the Symantec Workflow Server service on the old 8.5 RU4 server is stopped to prevent dual-writing to the database.

2. Confirm the key status in the Windows Registry on the new server: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TransparentLogic.com\WorkflowServer\

3. Open the ProcessManager console and verify successful login.

Additional Information

For latest version of Workflow 8.7.3 with point fixes (8.7.4022.0), download “Workflow_8_7_3_PF_v1_02May2025.zip” from CUMULATIVE POST ITMS 8.7.3 POINT FIXES