Password Recovery Service

MSP360 Managed Backup offers a tool that allows to recover backup passwords (encryption passwords for backup plans). Without this service lost or forgotten encryption passwords cannot be recovered so encrypted backups cannot be restored.

Password recovery management is available only at the provider level. This feature requires Two-Factor Authentication (2FA). All actions must be confirmed by two-factor verification codes.

Password Recovery Service can be enabled by provider in Management Console. The provider owns the private password recovery key to recover backup encryption passwords. Thus, if a backup password is lost, an administrator contacts the provider for assistance.

If provider loses their private encryption keys generated for the password recovery service, this key cannot be anyhow recovered. In this regard, be as careful as possible with the private encryption key and keep it in a safe place.

Password Recovery Considerations

To manage password recovery, Two-Factor Authentication must be enabled and an associated authenticator application should be available.

Recovery Key Pair

The provider's password recovery key pair is generated in the Management Console at the moment the password recovery service is enabled.

The public recovery key is kept in Managed Backup in the provider settings and is transmitted to the Backup Agent via API tools.

The private recovery key at the time of generation will be displayed in the Management Console only once. The private key can be copied to the clipboard or saved as a text file. Managed Backup does not keep private keys: private keys must be kept by the provider. The provider will not be able to recover backup encryption passwords without the private recovery key.

Enable Password Recovery Service

To enable the Backup Password Recovery service, proceed as follows:

1. Open Management Console and log in as the provider.
2. In the Settings menu, select Password Recovery.
3. On the Backup Password Recovery side pane, enable the Backup Password Recovery service.

4. Save the private password recovery key to a text file or copy it using a clipboard. In the latter case, it is recommended to add a timestamp to the file name to identify the recovery key.
5. Once you saved the key to a safe place, select I acknowledge that I will not be able to recover encryption passwords without the recovery key... check box, then click Enable.
6. Enter the 2FA verification code to confirm this action. Taking into account that any operations with passwords pose an increased risk, all actions must be confirmed with two-factor authentication codes.

Recover Backup Password in Management Console

To recover the backup encryption password for restore purposes, proceed as follows:

1. Open Management Console and log in as a provider.
2. In the Computers menu, select Remote Management.
3. Find the required computer, then click the gear icon.
4. Select Show Plans.

6. Click +.
7. In the Restore group, select the restore plan type.
8. On the Encryption Options step, click Password Recovery.

9. Enter the 2FA verification code to confirm this action.
10. Enter the requested recovery key. The recovered password appears in the Encryption password field.

Disable Password Recovery Service

To disable the Backup Password Recovery service, proceed as follows:

1. Open Management Console and log in as the provider.
2. In the Settings menu, select Password Recovery.
3. On the Backup Password Recovery side pane, turn off the Backup Password Recovery service.
4. Confirm the disabling of the Backup Password Recovery service.
5. Enter the 2FA verification code to confirm this action.