Restoring Repositories and Recovering from Disasters

You must review the following steps when restoring, moving, or rebuilding a DRM environment that uses installation-specific key and entropy files.

To Restore Repositories, perform the following steps:

  1. Install or restore DRM on the target host.

    Use the same DRM release or the target release you plan to run. In the EPM update workflows, the product is installed first and then configured on the target machine.

  2. Stop DRM services before you restore files.

    Stop all DRM-related services so the database and configuration files are not in use during recovery. However, even for the update workflow, you must require stopping all the DRM services before applying changes.

  3. Restore the DRM repository database.

    Restore the repository backup to the same host or to the replacement host, depending on the scenario.

  4. Restore the matching DRM configuration files.

    Bring back the configuration files from the same environment backup as the repository database.

  5. Restore the matching secret-protection files, if available.

    Restore both of these files when they exist in the backup:

    • drm-portable-encryption.key
    • drm-dpapi-entropy.key

  6. Verify file permissions.

    Make sure the DRM service identities can read the restored files.

  7. Start the DRM services.

    The startup workflow is to start the product services after configuration and restoration.

    NOTE: The services can be started with the standard startup scripts or a single start script.

  8. Run Apply Updates for the restored repository.

    After restoring an older repository into a fixed environment, run Apply Updates so DRM can migrate eligible protected secrets to the current format.

    The update workflow includes running the apply-update configuration steps after installation.

  9. Re-enter or reset any protected values that cannot be decrypted.

    If the original key or entropy files are missing, re-enter affected passwords, connection strings, or other protected settings through supported DRM screens or tools.

  10. Verify the restored environment.

    Confirm that the following works:

    • Repository or Database connection

    • External connections

    • EPM or CSS configuration

    • SMTP configuration

    • Imports and Exports that use stored credentials

    • Scheduled jobs and Integrations

    • Note:

      It is highly recommended to check the deployment after startup and update tasks are complete.

Common Restore Scenarios

The following table summarizes recommended recovery procedures:

Table 18-2 Multiple Use Cases for Restoring DRM Environments

Restoring Scenarios Recommended Actions Expected Outcomes
Restore repository on the same host

Restore repository, DRM configuration, and matching encryption files before starting services.

Host restored.
Restore repository on a replacement host

Restore repository and matching configuration/encryption files. Verify file permissions before starting services.

Host replaced.
Move DRM to a new server

Copy repository, configuration, and matching key/entropy files from the source environment.

DRM migrated.
Rebuild a DRM server after failure

Restore the complete DRM environment, including configuration and encryption files.

DRM rebuilt.
Pre-release (11.2.26.000) repository restore

Restore repository, then run Apply Updates to migrate protected secrets to the current format.

Secrets migrated.
Refresh a test or development environment from production

Restore repository and matching configuration/encryption files. If unavailable, re-enter protected credentials afterward.

Environment refreshed.

Troubleshooting Tips

What Happens When Encryption Files are Missing?

If the restored repository does not match the available configuration or encryption files, DRM may experience one or more of the following issues:

  • Protected value decryption errors

  • Unknown encryption format errors

  • Failed external connection tests

  • Failed EPM/CSS authentication

  • Failed SMTP authentication

  • Repository connection failures

  • DRM service startup failures if required protected values cannot be decrypted

Recovering from Decryption Failures

If DRM cannot decrypt protected values:

  1. Determine whether the matching encryption files from the original installation are available.

  2. If available:

    • Restore the matching key and entropy files.

    • Verify that the DRM service account has permission to read them.

    • Restart the DRM services.

  3. If the original files are unavailable:

    Re-enter or reset the affected passwords and connection strings using the supported DRM configuration screens or tools.

  4. NOTE: Do not manually modify encrypted values stored in the DRM repository database. If needed then you can contact My Oracle Support.