Symptoms

The NetWorker server was migrated to a new hardwarensrdr was performed to bring back the NetWorker configurationpassword was assigned to fields of some NetWorker resourcesIn the NMC UI, the pop-up displays when clicking on some of the NetWorker resources.

Cause

"Unable to decrypt: BAD_DATA" error can occur when there is a lockbox issue, whether due to a corruption in the lockbox or when the NetWorker server was migrated, moved or reinstalled and the lockbox was not copied over /restored. The current lockbox does not have the passwords stored that match the user/password in the nsrdb, hence the BAD_DATA error.

Resolution

To resolve the BAD_DATA error pop-up from NMC, replace the current lockbox with the original lockbox from the NetWorker server prior to an nsrdr or migration.. On a Linux Networker server, export the original lockbox using the nsr_prep_lb command. Refer to the NetWorker Security Configuration Guide for instructions on how to export the lockbox.If importing the original lockbox is not possible, reset all password fields in the NetWorker resource(s) to blank.How to reset the passwords in nsrdb1) Create an input file with the names of passwords that need to be cleared in nsrdb. Create a file called "pass.txt" that contains the following lines:update password: ;yupdate management password: ;yupdate NAS management password: ;yupdate NAS file access password: ;yupdate Authentication Key: ;yupdate VMWS user password: ;yupdate EBR Password: ;yupdate REST Services Password: ;yupdate vCenter Password: ;yupdate Privacy Key: ;yupdate datazone pass phrase: ;y2) Stop NetWorker services.On Linux: systemctl stop networkerOn Windows: Stop the NetWorker Backup and Recover Server Service and NetWorker Remote Exec Service3) Make a copy of nsrdb. Call this nsrdb.beforepassclean.4) Run nsradmin command with the input file pass.txt.On LInux: # nsradmin -i pass.txt -d /nsr/res/nsrdbOn Windows:C:> nsradmin -i pass.txt -d "C:\Program Files\EMC Networker\nsr\res\nsrdb"5) Make another copy of the modified nsrdb. Call this nsrdb_passwordblank. Rename the dbg folder under nsrdb if there is any.6) On a Windows environment, follow the procedure Change the ownership of nsrdb below before proceeding to step 7.7) Start the NetWorker service.8) Launch NMC. At this point, re-enter the password that was assigned to the NetWorker resource(s)..Change the ownership of nsrdbOn a Windows NetWorker server the ownership of the modified nsrdb files will be changed from Administrators (the group) to whatever user is currently logged in as. This will cause NetWorker to corrupt modified entries after restart, moving these files in the dbg folder. This is why before starting the NetWorker services on Windows, set all files' permissions under nsrdb to be owned by the group Administrators (not the user, but the group). Click on "C:\Program Files\EMC Networker\nsr\res\nsrdb" from the File Explorer and set the ownership for all files and child objects to Administrators.a) On the File explorer, right click on the C:\Program Files\EMC NetWorker\nsr\res\nsrdb folderb) Select properties.c) Click the "Security" tab.d) Click "Advanced"e) In Owner, click "Change"f) In the "Enter the object name to select" box, type: Administrators, then click on "Check Names". (Sometimes you need to use the computer name, like AMER\Administrators).g) Click OK h) Put a check mark in the "Replace all child object permission entries..." and "Replace owner on subcontainers and objects" box.i) Click "Apply", then click "Yes" for "Do you wish to continue?" box.j) Click "OK"

Support Cases