Hi Jon and Bingo,

Please be very careful when using nsradmin, especially when you run it with the -d, as that will run directly against the configuration DB.

Jon, if you are going to follow those steps 2 points:

1.- IMPORTANT, take a copy of your res folder (or at least of your /res/nsrdb) before doing any changes

2.- Please note that you will need to stop NW services to be able to run nsradmin -d

Thank you.

Carlos.

Re: stopping NW. Didn't know that anything worked without NW services alive.

What do you mean? You can run nsradmin (to work against NW server configurations) or nsradmin -p (to work against NW client configurations) with the services up, but the -d option requires the services to be stopped, as the DB will be in use (locked).

Thank you.

Carlos.

Re: folder backup, good idea, I didn't know that that would work.

Re: stopping NW. Didn't know that anything worked without NW services alive. Thanks.

My impression, then, is that nsrpush is a data trap: you can check in clients, but you can't check them out.

When I am deleting duplicate peer certificates (due to rolling out a golden image on PCs) via nsradmin -p nsrexec, I haven't shut down services. The document  (ref: esg117071 5/22/2012) never mentioned it. Should I be stopping services first?

Hi Jon,

No, as I mentioned in my last post, only nsradmin -d requires services to be stopped.

All other nsradmin commands work fine with services up.

Thank you.

Carlos.

Oops. I saw your warning about "-d" and brain erroneously interpreted it

as "delete something." I'm on board now. Thanks.

--

Jonathan M. Prigot

Brigham and Women's Hospital

Sorry for not mentioning the backup before one does a manipulation. Of course you are right.

I assume that an untrained admin will run a copy of his files as a precaution because he might need to recover from potential failures.

I also assume that a trained admin ...

- ... will do it anyway.

- remember that ..\nsr\res will be part of the boostrap which is backed up at least once a day.

- remember that he can recover (part of) the res directory from a boostrap SS

- will run a test on a test machine before he is manipulating the production environment.

By doing that he will also discover that

- it is in fact not necessary (even for "nsradmin -d") to stop the daemon.

- When he is accessing the cpdb directory, it might well be that he exited the Software Admin Wizard ... which will automatically end the controlling daemon nsrcpd.