How to migrate a Windows Policy Model Database (PMDB) in Privileged Access Manager Server Control (PAMSC)

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

You need to migrate a top-tier Policy Model Database (PMDB) from one Windows server to another Windows server while maintaining existing subscriber configurations.

Environment

Privileged Access Manager Server Control (PAMSC) 14.1 on Windows.

Resolution

To migrate your PMDB successfully from ####-SOURCE to ####-DESTINATION machine, perform the following steps.
Ensure you replace ####-SOURCE and ####-DESTINATION with the actual hostnames of your servers, and replace ####-PMD with your specific PMDB name.

1. Check existing subscriber status
   On the source server (####-SOURCE), run the following command to verify the current status:
       sepmd -L ####-PMD
   Confirm that the source machine is listed as the subscriber without errors.

2. Back up the PMDB
   On the source server (####-SOURCE), back up the PMDB:
  sepmd -bh ####-PMD <destination_directory> ####-DESTINATION

3. Transfer the backup
   Copy the entire backup directory created in step 2 from the source server to the destination server (####-DESTINATION).

4. Restore the PMDB
   On the destination server (####-DESTINATION), where the PMD has not yet been created, run the restore command:
      sepmd -restore ####-PMD -source <path_to_backup_directory>

5. Verify status on the destination
   On the destination server, check the subscriber status to ensure the restoration was successful:
      sepmd -L ####-PMD
   Confirm the source machine is listed as the subscriber without errors.

6. Update the parent PMD setting
   On the source server, update your local endpoint database to point to the new location:

   • Open selang.
   • Run
         env pmd
   • Run
  PAMSC(pmd)> subspmd parentpmd(####-PMD@####-DESTINATION)

Testing the Migration

1. On the source server, connect to the migrated PMDB via the selang prompt:
   host ####-PMD@####-DESTINATION
2. Create a test rule to verify communication:
         er FILE C:\Temp\test123 owner(nobody) defacc(a) audit(a)
3. On the destination server, confirm there are no errors:
         sepmd -e ####-PMD
4. On the source server, launch a new selang session and search for the test rule to ensure it has been successfully pushed:
   find FILE