IT42450: UNABLE TO UPDATE ADMIN PASSWORDS AFTER SERVER MASTER ENCRYPTION KEY IS LOST

8.1.27.000-IBM-SPSRV-WindowsX64-162
8.1.27.000-IBM-SPSRV-Linuxx86_64-162
8.1.27.000-IBM-SPSRV-Linuxs390x-162
8.1.27.000-IBM-SPSRV-Linuxppc64le-162
8.1.27.000-IBM-SPSRV-AIX-162

APAR status

• Closed as program error.

Error description

• Issuing UPDATE ADMIN command to change an administrator's
  password after the server master encryption key has been lost
  fails with message ANR2032E.
  IBM Spectrum Protect:SERVER1>
  upd admin admin C0mPLexP#ssword
  ANR2017I Administrator SERVER_CONSOLE issued command: UPDATE
  ADMIN admin ?***?
  ANR2032E UPDATE ADMIN: Command failed - internal server error
  detected.
  ANR9999D Thread<245> issued message 2032 from:
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(outTextfTrFL+0x8b)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(UpdateAdmin+0x2375)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(AdmUpdateAdmin+0x61a)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(AdmUseExtCmdTab+0x79f)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(AdmCommandLocal+0x488)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(admCommand+0x186c)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(SmExecuteCommand+0x110)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(SmLocalConsoleSession+0x355)
  ANR9999D Thread<245>
  /opt/tivoli/tsm/server/bin/dsmserv(StartThread+0x93)
  ANR9999D Thread<245> /lib64/libpthread.so.0(*UNKNOWN*)
  ANR9999D Thread<245> /lib64/libc.so.6(clone+0x43)
  IBM Spectrum Protect:SERVER1>
  
  | MDVREGR 8.1.16.000-TIV_5698ISMSV |
  
  IBM Spectrum Protect Versions Affected: IBM Spectrum Protect
  Server 8.1.16 on all supported platforms
  
  Additional Keywords: TSM, Tivoli, TS011137279
  

Local fix

• Remove and re-add the admin user.
  
  
  Below example gives the steps to recreate the admin with
  system privileges. Verification of the required privileges
  before the removal of the admin user using 'query admin
  <adminname>' is recommended.
  
  
  1. remove admin <adminname>
  2. register admin <adminname> C0mPLexP#ssword
  3. grant auth <adminname> class=system
  
  
  Notes:
  
  - If the admin is part of a central config profile, it needs to
  be re-added to the profile after re-registering it.
  
  - If the admin is a managed admin on a managed server,
  unsubscribe the server from the profile, remove the admin from
  the server and re-subscribe to the profile so that the central
  config can re-register it for you.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All IBM Spectrum Protect server users.                       *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See error description.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in level 8.1.27. Note that this is     *
  * subject to change at the discretion of IBM.                  *
  ****************************************************************
  

Problem conclusion

• This problem was fixed.
  Affected platforms for reported release:  AIX, Linux, and
  Windows.
  Platforms fixed:  AIX, Linux, and Windows.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TSM SERVER

• Fixed component ID

  5698ISMSV

Applicable component levels