12.3 Vault Backup Operations with PAReplicate & Safe Recovery

12.3 Vault Backup Operations with PAReplicate & Safe Recovery

Quick Answer: Backing up a CyberArk Digital Vault using virtual machine (VM) snapshots, SAN volume snapshots, or third-party backup agents installed on the Vault host is strictly unsupported because it breaks transactional database integrity and violates OS hardening. Backups must be performed using the dedicated PAReplicate.exe utility running on an external, dedicated backup server. PAReplicate connects to the Vault over TCP port 1858, pulling database metadata and Safe files in their native encrypted format. If an individual Safe is accidentally deleted or corrupted, administrators use PARestore.exe to restore only that specific Safe directly into the live Vault without rolling back the entire database.

---

Why Hardened Vaults Prohibit Standard Backup Methods

Enterprise backup teams frequently attempt to protect Digital Vault servers using standard corporate backup tools—such as VM snapshots, Volume Shadow Copy Service (VSS) writers, SAN volume mirroring, or third-party backup software (e.g., Commvault, Veeam). In a CyberArk environment, these approaches are strictly unsupported and prohibited.

1. Database Inconsistency & State Corruption

The Digital Vault uses an embedded relational database coupled with flat-file Safe payload directories on the storage volume (D:\PrivateArk\Safes\). When transactions occur, database metadata and file-system objects are updated in an orchestrated sequence:

• Raw VM or SAN snapshots capture non-quiesced, crash-consistent images.
• Reverting to snapshots or copying raw database files leaves database pointers referencing non-existent safe object files, resulting in unrecoverable database index corruption.

2. Violation of Operating System Hardening

The Vault hardening process disables non-essential Windows services, including VSS, RPC listeners, SMB sharing, and remote registry services:

• Third-party backup software relies on local client agents running under the local SYSTEM account, listening on dynamic ports, and executing background discovery.
• Installing third-party software on a hardened Vault violates Tier 0 isolation, introduces foreign vulnerabilities, and opens unauthorized firewall ports.

3. Cryptographic State & Audit Invalidation

Restoring a snapshot rolls back account version counters, transaction logs, and initialization vectors. If target systems have already rotated passwords through CPM automation, reverting the Vault database breaks credential synchronization enterprise-wide.

---

PAReplicate Architecture & Execution Framework

CyberArk provides the PrivateArk Replicate utility (PAReplicate.exe) to deliver auditable, non-disruptive backups without compromising Vault security.

Dedicated Backup Server Topology

PAReplicate runs on a separate, dedicated Windows host known as the Backup Server:

• Network Connection: Communicates with the Vault host exclusively over TCP port 1858 using the PrivateArk protocol.
• Firewall Whitelisting: The Backup Server IP must be explicitly listed in the BackupServers whitelist parameter in DBParm.ini on the Vault. Connections from unlisted IPs are dropped immediately.
• Authentication Identity: Authenticates using the built-in Backup Vault user identity (or an identity with Backup All Safes permissions), with credentials encrypted in a local user.ini file created via CreateCredFile.

Preservation of Data-at-Rest Encryption

Data is never decrypted during backup:

• PAReplicate pulls encrypted database records and encrypted Safe files across the TLS-secured TCP 1858 tunnel.
• Files written to the Backup Server disk remain encrypted with Vault server keys.
• If the Backup Server or storage media is compromised, attackers cannot read credentials without the Vault root keys.

---

Backup Types, Scheduling & PAReplicate Configuration

PAReplicate is governed by initialization files (PAReplicate.ini and Vault.ini) on the Backup Server:

[Replication]
ServerVaultName=EnterpriseVault
BackupType=Full
Safes=.*
TargetFolder=D:\CyberArkBackups\Daily
Compression=Yes

Full vs. Incremental Backups

• Full Backup (BackupType=Full): Copies the entire Vault relational database, all Safe metadata, and every file object within targeted Safes. Executed weekly or monthly during maintenance windows.
• Incremental Backup (BackupType=Incremental): Evaluates the backup repository against the live Vault, synchronizing only database transaction deltas and Safe objects modified since the last replication run. Scheduled hourly or daily.

Scope Optimization & Off-Site Archiving

PSM recordings Safes (PSMRecordings) consume substantial storage. To optimize backup windows, regular expressions filter Safes:

• All Safes: Safes=.*
• Exclude Recordings Safes: Safes=^(?!PSMRecordings).*$ (backs up credential Safes while excluding video recordings, which are archived separately).

Once PAReplicate.exe synchronizes files to the Backup Server, enterprise backup agents (e.g., Veeam, Commvault) running on that server can safely ingest the directory and copy encrypted data to tape or cloud object storage (Amazon S3 Glacier, Azure Blob Storage).

---

Granular Safe Recovery with PARestore.exe

In operational environments, accidental Safe deletion or corruption is more common than total hardware failure.

PADR vs. PARestore

• PADR (Disaster Recovery): Designed for site-level failover. Cannot recover a deleted Safe because deletion events replicate to the DR Vault immediately.
• PARestore (Backup Restoration): The PARestore.exe utility extracts an individual Safe from a PAReplicate backup archive and restores it directly into a running Digital Vault.

Safe Restoration Workflow

1. Locate the backup archive containing the healthy target Safe on the Backup Server.
2. Execute PARestore.exe targeting the active Vault:

   PARestore.exe Vault.ini /Safe Corp_Domain_Admins /TargetSafe Corp_Domain_Admins_Restored /User Administrator
   

3. Restoring to Alternate Name: Restoring to an alternate name (TargetSafe=Safe_Restored) allows administrators to inspect recovered accounts, compare credentials against production, and selectively move accounts without overwriting live data.
4. Online Execution: PARestore operates online; the Digital Vault remains fully operational throughout the restore process.

---

Disaster Recovery (PADR) vs. Vault Backup (PAReplicate) Comparison

---

Decrypting a PAReplicate Backup with the Recover Utility

PAReplicate deliberately pulls Safe files in their native encrypted form, which is what makes it safe to hand those files to an ordinary enterprise backup product. The consequence is that the backup set on the replication server is unreadable on its own — there is no live Vault there to decrypt it. When you must read a Safe's contents directly from a backup, for example because both the Production and DR Vaults are unrecoverable, you use the Recover utility.

The Recover utility recovers information from a Safe's external files in case of loss or corruption of that Safe, decrypting them and saving them as readable files. Its command form is:

Recover [in_file_name] [out_directory_name] [key_path] [Safe_recoverkey_path]

Recover c:\temp\my_data_file\ d:\restored c:\keys

The example above recovers the files of a Safe and stores them unencrypted in D:\restored, using the Recovery key from the Master digital keys folder.

Why the Master Keys Folder Matters

Section 1.3 covered key custody; recovery is where that custody becomes operationally decisive. PAKeyGen generates the keys into two folders with deliberately different contents:

recpub.key encrypts data for emergency use; recprv.key is the private key that decrypts data in case of emergency, and it exists only in the Master folder. That is precisely why the Master keys are stored offline in physical custody: anyone holding recprv.key plus a copy of the replicated Safe files can decrypt Vault contents with no Vault, no authentication, and no audit trail. Running Recover against a test backup file is also the standard way to prove the Master key set is intact and readable before you need it in a real disaster.

Recover vs. PARestore vs. CAVaultManager