How to Upgrade CyberArk Self-Hosted PAM installation

This post is just to show some basic Upgrade steps and screenshots for my references. Just fyi, this is only for lab testing, and it is not exactly same as CyberArk Doc suggested. For regular formal production upgrading process, please strictly follow the guide from CyberArk engineer or document guide.

13.2 Upgrade : https://docs.cyberark.com/PAS/13.2/en/Content/PAS%20INST/Upgrading-the-Privileged-Account-Security-Solution.htm?tocpath=Installation%7CUpgrade%7C_____0

The upgrade procedure must be carried out in the following order to ensure that all the new features will be installed for each component.

Check CyberArk component compatibility to make sure all components can work together during the progress for installing the components. 

For 13.2.x version, it is complatible with most of components in 12.1+ version. In this case, we can test functionality after upgraded any component. You don’t have to upgrade all components at one time. 

Topology

Upgrade a Primary Vault: 

Upgrade Path: 
12.1 – > 12.2 (or 12.6) -> 13.2

1. Download and install VC_redist.x64.exe

2. Download and install VC_redist.x86.exe

3. Download and install ndp48-x86-x64-allos-enu.exe

4. Download and install Server-Rls-v12.2.15.zip

5. Download and install Server-Rls-v13.2.4.zip

PVWA

Upgrade Path:
12.1 – > 12.2 (or 12.6)-> 13.2

We might be able to directly go from 12.1 – > 13.2. 

1. Download and install VC_redist.x64.exe

2. Download and install VC_redist.x86.exe

3. Download and install ndp48-x86-x64-allos-enu.exe (Most likely it has been installed)

4. Download and install Password Vault Web Access-Rls-v12.2.15.zip

5. Download and install Password Vault Web Access-Rls-v13.2.4.zip

The upgrade procedure consists of the following tasks:

Backup Existing PVWA Configuration

CyberArk doc “Upgrade an existing PVWA”  explains well how to do an upgrade.  

Download PVWA Installer

Run Setup.exe to upgrade

• If you come across an error in locating the install path, click Browse and locate the CyberArk Password Vault Web Access Windows Installer. This can be found in the same folder as the setup application. 

• If the following prompt appears, click No. 

Upgrade Path: 
12.1  -> 13.2

1. Download and install VC_redist.x64.exe (Done before)

2. Download and install VC_redist.x86.exe (Done before)

3. Download and install ndp48-x86-x64-allos-enu.exe (Most likely it has been installed)

4. Download and install Central Policy Manager-Rls-v13.2.zip

The upgrade process consists of the following tasks:

Upgrade Path: 
12.1  -> 13.2

1. Download and install VC_redist.x64.exe (Done before)

2. Download and install VC_redist.x86.exe (Done before)

3. Download and install ndp48-x86-x64-allos-enu.exe (Most likely it has been installed)

4. Download and install Privileged Session Manager-Rls-v13.2.3.zip

1.

In the Vault, make sure the user who will upgrade the PSM is not an owner in the PSMUnmanagedSessionAccounts Safe.

3.

In the Privileged Session Manager installation package, run the Privileged Session Manager installation to begin the upgrade procedure:

■

Double-click Setup.exe

or,

■

On systems that are UAC-enabled, right-click Setup.exe, then select Run as Administrator.

The PSM installation wizard appears and displays a list of required features that it will install on your computer before it can install the PSM.

4.

Click Install to begin the upgrade procedure; the installation wizard detects the existing version of the PSM on your computer, then displays the Setup

5.

Click Next to begin the upgrade procedure.

6.

During the procedure, accept the default values to upgrade the existing environment,

or,

Specify different values to modify the existing environment.

7.

When the PSM environment is installed, the following window appears to enable you to complete the upgrade procedure.

8.

Click Finish. The upgrade process is complete, and the PSM has now been upgraded.

9.

Restart the PSM server. You can also restart the PSM server at a later stage. In any event, you must restart the PSM server before using the PSM.

10.

On the PVWA machine, run iisreset,

or,

Wait for the PVWA refresh configuration interval to pass.

References