Upgrade Guide BES12. Version 12.1

Upgrade Guide BES12 Version 12.1

Published: 2015-02-25 SWD-20150413111718083

Contents Supported upgrade environments...4 Upgrading from BES12 version 12.0 to BES12 version 12.1...5 Preupgrade tasks...5 Backing up the BES12 database... 5 Performing a test upgrade of the BES12 database...5 Verifying database permissions to upgrade the BES12 database...8 Upgrading the BES12 database... 8 Updating perpetual licenses... 9 Prerequisites: Upgrading BES12... 9 Upgrade BES12...10 Postupgrade tasks... 10 Best practice: Running BES12... 10 Configuring database permissions using Microsoft SQL Server roles...11 Upgrading from BES10 to BES12...12 Upgrading from BES5 to BES12...13 Preparing a BES5 database for an upgrade to BES12... 13 BES5 software version... 13 BES5 database compatibility... 13 BES5 database backup...13 BES5 roles...14 Prerequisites: Upgrading BES5... 14 Upgrade from BES5 to BES12... 14 Troubleshooting BES5 roles... 16 The setup application detected incompatible roles in the BES5 database... 16 The setup application could not complete the role compatibility check on the BES5 database... 17

Supported upgrade environments Supported upgrade environments 1 The supported upgrade paths to BES12 are as follows: You can use the setup application to upgrade BES12 to the latest version of BES12. You can use the setup application to upgrade from BES5 to BES12. You can install BES12 and migrate IT policies, profiles, groups, users, and devices from BES10 to BES12. When you upgrade BES12 to the latest version, you upgrade the management console and the BES12 database. After you upgrade, existing users are active and no additional administrative actions are required. When you upgrade from BES5 to BES12, distributed BES5 components remain in place and continue to perform the same functions for the BlackBerry OS devices as they did before the upgrade. For more information, see the BES12 Planning Guide. 4

Upgrading from BES12 version 12.0 to BES12 version 12.1 Upgrading from BES12 version 12.0 to BES12 version 12.1 2 The BES12 version 12.1 setup application upgrades the BES12 software and database to BES12 version 12.1. Preupgrade tasks You must prepare your organization's environment before you upgrade to BES12 version 12.1. Backing up the BES12 database Back up the BES12 database so that you can restore it if the BES12 upgrade process does not complete. The setup application automatically backs up the database as part of the upgrade process. You can also use the backup and restore tools that are a part of Microsoft SQL Server to back up and, if necessary, restore the BES12 databases. For more information, see the Microsoft documentation for Microsoft SQL Server. Performing a test upgrade of the BES12 database You can perform a test upgrade of the BES12 database to help you identify and address issues that might occur during the database upgrade without affecting your production environment. You can also find out how long it takes to upgrade the BES12 database. When you perform a test upgrade of the BES12 database, you: 1. Back up the BES12 database. 2. Restore the backup version of the BES12 database to a database server that does not host the BES12 database. 3. Run CreateDB using the command prompt window. Perform a test upgrade of the BES12 database This task should be performed by a database administrator with the appropriate permissions to back up, restore, and upgrade the BES12 database. Note: If you do not want to run CreateDB on the database server, you must run it on a computer where BES12 is installed. The computer must be able to connect to the computer that hosts the database server that you want to perform a test upgrade of the BES12 database on. 5

Upgrading from BES12 version 12.0 to BES12 version 12.1 Before you begin: Verify that you configured the correct permissions on the database server that you want to perform a test upgrade of the BES12 database on. 1. Log in to the computer that hosts the database server for the BES12 database. 2. Back up the BES12 database. 3. Log in to a computer that hosts a database server that you want to perform a test upgrade of the BES12 database on. 4. Restore the backup version of the BES12 database. 5. Copy the BES12 installation files to the computer. 6. Extract the contents to a folder on the computer. 7. Navigate to <extracted_folder>\tools\ext. 8. Double-click the jre.exe file. 9. In the Java Setup screen, click Install. 10. Click Close. 11. Navigate to <extracted_folder>\tools\ext\unlimitedjcepolicy. 12. Copy all of the files from the UnlimitedJCEPPolicy folder. 13. Navigate to <java_install_dir>\jre7\lib\security. 14. Paste all of the UnlimitedJCEPPolicy folder files in the security folder. 15. Navigate to <extracted_folder>\db. 16. Open the CreateDB.properties file in a text editor. 17. Change the file to include information that is specific to your organization's environment. 18. Save and close the file. 19. Open a command prompt window. 20. Change the directory to <extracted_folder>\db. 21. Type one of the following commands to create or upgrade to a BES12 database: Database configuration Create a BES12 database Upgrade to a BES12 database Steps Type CreateDB.bat install CreateDB.properties. Press ENTER. Type CreateDB.bat upgrade CreateDB.properties. Press ENTER. Related information CreateDB.properties file, 6

Upgrading from BES12 version 12.0 to BES12 version 12.1 CreateDB.properties file The following properties apply to the CreateDB.properties file, which contains configuration information for CreateDB. Property Database type Description This property specifies the type of database that integrates with BES12. By default, the database type property is "configuration.database.ng.type=sql_server". You should not modify this property as it is a default setting. Database server name This property specifies the database server name that hosts the database to create or upgrade to BES12. By default, the database server name property is "configuration.database.ng.server=localhost". Database instance name This property specifies the database instance name to create or upgrade to BES12. If you use a Microsoft SQL Server instance name; by default, the database instance name property is "configuration.database.ng.instance=microsoft_sql_server_instance name". Note: The default Microsoft SQL Server instance name in the CreateDB.properties file is BES. If you use another Microsoft SQL Server instance name than BES, configure the database instance name property to change BES to your Microsoft SQL Server instance name. If you do not use a Microsoft SQL Server named instance, verify that the Microsoft_SQL_Server_instance name value is deleted. Database port This property specifies the port that the database server uses. If you use a dynamic port configuration, verify that you have no ports listed for this property. By default, the database port property uses a dynamic port configuration and you do not need to configure this property. If you use a static port configuration, configure your database port as "configuration.database.ng.port=static_port_number". Note: If you specify a static port, leave the database instance name property blank. 7

Upgrading from BES12 version 12.0 to BES12 version 12.1 Property Authentication type Description This property specifies the authentication type as follows: Windows authentication - by default, configured as INTEGRATED in this properties file Microsoft SQL Server authentication - can be configured as USER in this properties file If you use Windows authentication, by default your authentication type is "configuration.database.ng.authenticationtype=integrated". Note: If you use Windows authentication, you do not need to configure a user and password in the createdb.properties file. If you use Microsoft SQL Server authentication, configure your authentication type as "configuration.database.ng.authenticationtype=user". Username and Password - Microsoft SQL Server authentication (USER) If you use Microsoft SQL Server database authentication, these properties specify the username and password for the database account that has database creator permissions. By default, the username property you configure for Microsoft SQL Server authentication (USER) is "configuration.database.ng.user=user_name". By default, the password property you configure for Microsoft SQL Server authentication (USER) is "configuration.database.ng.password=password". Verifying database permissions to upgrade the BES12 database BES12 connects to the BES12 database on the database server using the login information that you specified during the installation process (Windows authentication or Microsoft SQL Server authentication). If you want to use the setup application to upgrade the BES12 database, the service account or Microsoft SQL Server account must have permissions on the database server to upgrade the BES12 database. You can configure database permissions using Microsoft SQL Server roles. You must verify that the service account or Microsoft SQL Server account is a member of the dbcreator server role. Upgrading the BES12 database If your organization's security policies do not allow applications to have permissions to create or upgrade databases, you can run CreateDB on the database server to upgrade the BES12 database instead of using the setup application. After you upgrade the BES12 database using CreateDB, you can run the setup application using a service account that has minimum permissions on the database server. 8

Upgrading from BES12 version 12.0 to BES12 version 12.1 Note: If you do not want to run CreateDB on the database server, you must run it on a computer where BES12 is installed. The computer must be able to connect to the computer that hosts the database server that you want to upgrade the BES12 database on. Updating perpetual licenses Perpetual licenses are valid only for the version of BES12 for which they are issued. If a BES12 domain includes perpetual licenses that are covered by BlackBerry Software Assurance, which is included with technical support contracts, you must update the licenses to the latest version that BES12 supports. To update perpetual licenses, you can log in to myaccount and navigate to the Account Support > Software Assurance section to use the Software Assurance license update tool. After you update the required licenses, you must copy the new activation IDs and activate the licenses in BES12. It is recommended that you perform these actions before you upgrade BES12. For more information, visit www.blackberry.com/go/kbhelp to read KB36805. If you do not update perpetual licenses before you upgrade BES12 or the licenses are not covered by BlackBerry Software Assurance, the Licensing summary page in the management console displays the following message after you upgrade BES12: Unsupported license versions were found. If appropriate subscription licenses are available, BES12 assigns them to activated devices. If no appropriate licenses are available, BES12 starts a grace period to give you time to obtain and activate subscription licenses or valid perpetual licenses. Prerequisites: Upgrading BES12 Verify that you opened the necessary ports on your organization's firewall. Verify that you installed all required third-party applications. If you perform the upgrade process on a computer that has more than one NIC, verify that the production NIC is first in the bind order in the Windows network settings. If your organization uses a proxy server for Internet access, verify that you have the computer name, port number, and credentials for the proxy server. When you run the setup application, use only standard characters to specify values. Unicode characters are not supported. If you want to upgrade BES12 on the same computer as BES10, the setup application may identify that you must remove your static JRE version or install a newer, dynamic JRE version. Install the latest JRE 1.7 family version before you run the setup application. Verify that the BES12 service account has local administrator permissions on each computer. Do not add any files to the folder that contains the BES12 installation files. The setup application removes these files during the upgrade. 9

Upgrading from BES12 version 12.0 to BES12 version 12.1 Perpetual licenses are valid only for the version of BES12 that they are issued for. If your BES12 domain includes perpetual licenses, obtain and activate perpetual licenses for the version of BES12 that you are upgrading to. Upgrade BES12 If you have multiple instances of BES12, or the BlackBerry Router, upgrade one instance of BES12 first, then the other instances and theblackberry Router. 1. Log in to the computer using the service account that runs the BES12 services. 2. In the BES12 installation files, double-click setup.exe. If a Windows message appears and requests permission for setup.exe to make changes to the computer, click Yes. 3. Click Next to start the upgrade process. 4. In the Database information dialog box, type the Windows password and click Next. 5. In the Installation summary dialog box, click Install. 6. When the upgrade process completes, click Next, then Close. After you finish: Repeat the steps on each computer that hosts additional instances of BES12 or the BlackBerry Router. Postupgrade tasks After you upgrade to BES12 version 12.1, you may need to perform some tasks to complete the upgrade. Best practice: Running BES12 Best practice Do not change the startup type for the BES12 services. Description When you install or upgrade to BES12, the setup application configures the startup type for the BES12 services as either automatic or manual. To avoid errors in BES12, do not change the startup type for the BES12 services. Do not change the account information for the BES12 services. When you install or upgrade BES12, the setup application configures the account information for the BES12 services. Do not change the account information for BES12 unless the BES12 documentation specifies that you can. 10

Upgrading from BES12 version 12.0 to BES12 version 12.1 Best practice Do not manually restart the BlackBerry Work Connect Notification Service. Description You can manually restart the BlackBerry Affinity Manager service, which controls the restart of the BlackBerry Work Connect Notification Service. Configuring database permissions using Microsoft SQL Server roles The setup application requires the service account or Microsoft SQL Server account that it uses during the installation or upgrade process to have permissions on the database server to create or upgrade the BES12 database. After the installation or upgrade process completes, you can change the database permissions for the service account or Microsoft SQL Server account to the minimum permissions that BES12 requires to run. When you change the database permissions, you can use Microsoft SQL Server security to minimize the operations that the service account or Microsoft SQL Server account can perform on the BES12 database. The Microsoft SQL Server roles that are required by the setup application and BES12 are as follows: Database role db_owner Description The setup application or CreateDB automatically adds the account that you use to create the BES12 database to this role. This role contains the minimum permissions that the setup application or CreateDB requires to upgrade the BES12 database. Configure minimum database permissions for the service account or Microsoft SQL Server account You can configure minimum database permissions for the service account or Microsoft SQL Server account that BES12 uses to connect to the BES12 database. Before you begin: Add a different Windows account or Microsoft SQL Server account to the db_owner database role for the BES12 database. 1. Open the Microsoft SQL Server Management Studio. 2. Expand Microsoft SQL Server > Security > Logins. 3. Right-click the service account or Microsoft SQL Server account. Click Properties. 4. Click User Mapping. Select the BES12 database. 5. In the Users mapped to this login section, select bes. 6. Remove all other database role memberships except public. 7. Click OK. 11

Upgrading from BES10 to BES12 Upgrading from BES10 to BES12 3 You can install BES12 on the same computer as BES10 or on a separate computer. After you install BES12, you can migrate your existing BES10 IT policies, profiles, groups, users, and devices to BES12. For more information about upgrading from BES10 to BES12, see the BES12 Planning Guide. To install BES12, follow the instructions in the BES12 Installation Guide. To move BES10 IT policies, profiles, group names, users, and devices from BES10 to BES12, follow the instructions in the BES12 Configuration Guide. You use the BES12 management console to move BES10 data to BES12. 12

Upgrading from BES5 to BES12 Upgrading from BES5 to BES12 4 You can upgrade from BES5 to BES12 in an existing domain, or in a new domain. For more information, see the BES12 Planning Guide. CAUTION: After an upgrade from BES5 to BES12, you cannot roll back to the BES5 database. Before you begin an upgrade, back up the BES5 database. Preparing a BES5 database for an upgrade to BES12 You must prepare the BES5 database before you upgrade it to BES12. BES5 software version Before you upgrade from BES5 to BES12, make sure that the BES5 database is at version 5.0.4 MR10 or later. BES5 database compatibility The BES5 database must be compatible with the version of Microsoft SQL Server used for BES12. The compatibility level of the BES5 database must be 100 or higher. You can check and set the compatibility level using Microsoft SQL Server Management Studio: To check the compatibility level, type and run the following query in Microsoft SQL Server Management Studio: SELECT compatibility_level FROM sys.databases WHERE name = '<besdbname>'; If the compatibility level is less than 100, type and run the following query in Microsoft SQL Server Management Studio: ALTER DATABASE [<besdbname>] SET COMPATIBILITY_LEVEL = 100 Note: Replace <besdbname> with the name of the BES5 database. BES5 database backup Before you upgrade your BES5 environment to BES12, back up the BES5 databases. CAUTION: After an upgrade from BES5 to BES12, you cannot roll back to the BES5 database. 13

Upgrading from BES5 to BES12 BES5 roles After an upgrade, the roles from BES5 are available in BES12 and you can manage them using the BES12 management console. However, BES12 handles roles differently than BES5: BES12 allows only one role for each user. BES12 requires that an entire role to be assigned to one, some, or all groups. During an upgrade from BES5 to BES12, if a user has more than one role assigned, BES12 combines the roles. BES12 resolves the roles so that the permissions remain as close as possible to the original permissions in BES5. If there are conflicting permissions that BES12 cannot resolve, the setup application stops and you must resolve the conflict in BES5 manually. You should review role permissions in BES5 and resolve potential conflicts before you upgrade to BES12. Related information Troubleshooting BES5 roles, on page 16 Prerequisites: Upgrading BES5 Your environment and the computer you install BES12 on must meet the BES12 requirements. For more information, see the BES12 Planning Guide. BES5 must be at version 5.0.4 MR10 or later. To upgrade from BES5 to BES12 on a different computer, you require another SRP, an authentication key, and CALs. Upgrade from BES5 to BES12 When you run the setup application, use only standard characters to specify values. Unicode characters are not supported. Before you begin: Verify that the BES5 database is at BES5 version 5.0.4 MR10 or later. If you install BES12 behind a firewall, it cannot connect to the BlackBerry Infrastructure until you configure the proxy server. BES12 prompts you the first time you log in to the BES12 management console. Installing BES12 or specifying the location of BES12 log files to a mapped network drive is not supported. Note: Do not add any files to the folder that contains the BES12 installation files. The setup application removes these files during the upgrade. 1. Log in to the computer that you want to install BES12 on using the service account. 2. In the BES12 installation folder, double-click Setup.exe. If a Windows message appears and requests permission for Setup.exe to make changes to the computer, click Yes. 14

Upgrading from BES5 to BES12 3. In the Java Setup screen, click Install. 4. Click Close. 5. In the BES12 setup application screen, click Next. 6. In the License agreement dialog box, perform the following actions: a. Select your country or region. b. Read the license agreement. To accept the license agreement, select I accept the terms of the license agreement. c. Click Next. 7. In the Installation requirements dialog box, you can check to see if your computer has met the requirements to install BES12. Click Next. The setup application may display a warning that indicates that Microsoft.NET Framework 4.5 or OpenVPN TAP-Windows are not installed. You can ignore this warning and proceed with the installation. The setup application automatically installs Microsoft.NET Framework 4.5 and OpenVPN TAP-Windows for you if it is not detected on your computer. 8. In the Setup type dialog box, select Use an existing domain. 9. Click Next. 10. In the Database information dialog box, enter the Windows password. The setup application automatically completes the fields in the Database information dialog box. 11. In the Folder locations dialog box, perform the following actions: a. Specify the location of the installation folder and log file folder. b. If you receive a message saying there is not enough space remaining, create extra space to install BES12 on your computer. c. If you receive a message asking you to create the installation and logs folder locations, click Yes. 12. Click Next. 13. In the Installation summary dialog box, click Install to install BES12. 14. When the installation is complete, in the Installing dialog box, click Next. 15. In the Console addresses dialog box, click Close. After you finish: Note: Do not create a shared folder within the installation directory after installing BES12. Restart the BES5 BlackBerry Administration Service - Application Server service. Review the BES5 roles. 15

Upgrading from BES5 to BES12 Troubleshooting BES5 roles Because BES12 handles roles differently from BES5, you may need to troubleshoot BES5 roles after you upgrade from BES5 to BES12. The setup application detected incompatible roles in the BES5 database Description You may see this error message in the setup application after you click Next on the Database information screen. Possible cause The BES5 database contains one or more roles that have permissions assigned to more than one group. Possible solution Navigate to the BES5UpgradeRoleCheck.txt log file located in C:\Program Files\BlackBerry\BES\Logs\deployment\. The file lists the names of the roles that contain conflicts. Using the BlackBerry Administration Service, go to BlackBerry solution management > Role > Manage roles. For each role listed in the log file, make sure that its permissions are either granted to all groups, or that the listed groups are the same for each permission. Save the changes. Return to the BES12 setup application and click Next to continue the installation. If a BES5 user has more than one role assigned, when BES12 combined those roles into one role for that user, the new role has permissions assigned to different groups. For example, one BES5 role has the View a group permission assigned to Group A, and the other role has the Edit a device permission assigned to Group B. Navigate to the BES5UpgradeRoleCheck.txt log file located in C:\Program Files\BlackBerry\BES\Logs\deployment\. The file lists the names of the roles that contain conflicts. Using the BlackBerry Administration Service, go to BlackBerry solution management > Role > Manage roles. For each role listed in the log file, make sure that its permissions are either granted to all groups, or that the listed groups are the same for each permission. For all the roles assigned to a BES5 user, make sure that the permissions are granted to all groups, or that the listed groups are the same for each permission. Save the changes. Return to the BES12 setup application and click Next to continue the installation. 16

Upgrading from BES5 to BES12 The setup application could not complete the role compatibility check on the BES5 database Description You may see this error message in the setup application after you click Next on the Database information screen. Possible cause Insufficient user permissions Hardware errors Possible solution Verify that the account you are using has administrator permissions and run the BES12 setup application again. Replace the hardware or run the BES12 setup application on another computer. 17