000026963 - How to back up and restore user accounts in RSA NetWitness Platform

It is possible to back up the internal and external users in the NetWitness (NW) UI in order to restore them in a new instance and/or a new appliance. 
To perform this procedure, follow the steps below.

1. Connect to the NW server appliance via SSH.
2. Navigate to the home directory by issuing the following command:  cd ~/
3. Retrieve the H2 Java tools and place them on the NW server appliance by issuing the following command:  wget http://repo1.maven.org/maven2/com/h2database/h2/1.2.147/h2-1.2.147.jar
4. Copy down all Active Directory configurations from the External Mappings and Settings tabs under Administration -> System -> Security in the NW UI, as these will not be backed up and will need to be re-added manually.
5. Navigate to the H2 platform database directory by issuing the following command:  cd /var/lib/netwitness/uax/db
6. Stop the Jetty service by issuing the following command: stop jettysrv
7. Backup the H2 platform database by issuing the following command:  java -cp ~/h2-1.2.147.jar org.h2.tools.Backup -file ~/h2_platform_db_backup.zip
8. Pull the newly created zip file from the NW server appliance and store it in a secure location.

After rebuilding the current NW server appliance or installing the new appliance, follow the steps below to restore the users that were previously backed up into the NW UI.

1. Copy the H2-1.2.147.jar file retrieved in Step 3 into the root's home directory on the new NW server instance or new appliance.
2. On the new instance or appliance, stop the Jetty service by issuing the following command:  stop jettysrv
3. Navigate to the H2 platform database directory by issuing the following command:  cd /var/lib/netwitness/uax/db
4. Back up the current H2 platform database with the following command:  java -cp ~/h2-1.2.147.jar org.h2.tools.Backup -file ~/h2_platform_db_backup_orig.zip
5. Copy the original H2 platform database backup to the new NW server appliance in the root's home directory.
6. Restore the H2 platform database by issuing the following command:  java -cp ~/h2-1.2.147.jar org.h2.tools.Restore -file ~/h2_platform_db_backup.zip
7. Start the Jetty service while tailing the logs by issuing the following command:  start jettysrv && tail -f /var/lib/netwitness/uax/logs/sa.log
8. Once you see entries relating to Live or CMS you will know that the service has been fully initialized.
9. Log into the NW UI and confirm that the user accounts have been restored.
10. Navigate to the External Mappings and Settings tabs under Administration -> System -> Security and enter the Active Directory configurations as necessary.