#13 - CyberArk Privilege Cloud | Switch CPM From Primary To DR Connector

Introduction

This tutorial guides you through the process of switching the CyberArk Privilege Cloud's Central Policy Manager (CPM) from a primary environment to a disaster recovery (DR) connector. It covers necessary upgrades, the new sync component utility, and how to troubleshoot common issues. This information is crucial for maintaining the security and functionality of your CyberArk environment.

Step 1: Remove ApiKeyManager.exe

• Starting with CPM version 14.2 and above, the ApiKeyManager.exe utility has been removed.
• Ensure you are aware of this change as it affects the management of API keys within the CPM.

Step 2: Upgrade CPM from Version 14.0 to 14.2

• Download the latest version of CPM (14.2) from the CyberArk website.
• Follow these steps for a successful upgrade:
  1. Back up your current configuration and data.
  2. Stop the CPM service on your primary server.
  3. Run the installer for CPM 14.2.
  4. Follow the on-screen prompts to complete the installation.
  5. Restart the CPM service and verify the upgrade.

Step 3: Utilize the New CPM Sync Component Utility

• The Sync Component Utility is crucial for maintaining synchronization between your primary and DR connectors.
• To use this utility:
  1. Access the SyncComponentUsers utility as documented in CyberArk’s official guide.
  2. Follow the instructions to ensure all user settings are properly synced.

Step 4: Move CPM from CON1 to CON2

• Use this procedure to switch your CPM from the primary connector (CON1) to the disaster recovery connector (CON2):
  1. Ensure that the DR environment is fully operational.
  2. Navigate to the CPM configuration settings.
  3. Change the connection settings to point to CON2.
  4. Save the changes and restart the CPM service.
  5. Verify the connection using the CyberArk interface.

Step 5: Test CPM and Fix PluginManagerUser Issue

• After moving to CON2, perform the following tests:
  1. Check the functionality of the CPM by running a few tests on policy execution.
  2. If you encounter issues with the PluginManagerUser, verify the user permissions and roles.
  3. Adjust the settings as necessary and re-test the CPM functionality.

Step 6: Move CPM from CON2 Back to CON1

• If you need to revert from CON2 back to CON1, follow these steps:
  1. Ensure that CON1 is ready and operational.
  2. Change the CPM settings to connect back to CON1.
  3. Save the configuration and restart the CPM service.
  4. Confirm that the connection is re-established and everything is functioning as expected.

Conclusion

In this tutorial, you learned how to switch the CyberArk Privilege Cloud's CPM from a primary to a disaster recovery environment, including necessary upgrades and troubleshooting. Remember to regularly check for updates and changes in CyberArk documentation to ensure your environment remains secure and efficient. For further assistance, refer to CyberArk's documentation or community forums.