Free EditionADSelfService Plus comes bundled with a PostgreSQL database server to store basic user attributes and enrollment data. It also allows you to migrate from the built-in PostgreSQL to MS SQL. This article walks you through the database server migration process.
Note: These elevated privileges are required only for the initial migration; see Appendix B for how to reduce them afterward.
Refer to Appendix A for configuring prerequisites 1, 2, and 3. Refer to Appendix B for configuring prerequisite 4.
If you're installing ADSelfService Plus for the first time and don't have any data to back up, skip this step and proceed to the next step. However, if you want to backup the data, follow the steps given below:
Note: By default, ADSelfService Plus is installed in: C:\Program Files\ManageEngine\ADSelfService Plus
Note: If an error shows up while running the backupDB file, make sure the product has been stopped before proceeding.
The Auto Backup option is only available when using the built-in PostgreSQL database. After migrating to MS SQL, use native MS SQL Server backup tooling instead.
Note: It's important to make sure you stop the ADSelfService Plus console/service before this process.
Note: The links in the table below will redirect you to the main Microsoft SQL feature pack page. Install the corresponding SQL Native Client or command line utilities as per the MS SQL Server version and CPU type of the machine where ADSelfService Plus is installed. The command line utilities have the term SQLCMD in them, and the native client file can be found under the name sqlncli.
| SQL Server Version | Command Line Utilities | Native Client | ODBC Driver (x86) | ODBC Driver (x64) |
| 2014 | Download | Not Applicable | Download | Download |
| 2016, 2017, and 2019 | Download | Not Applicable | Download | Download |
| 2022 | Download | Not Applicable | Download | Download |
| 2025 | Download | Download | Download * | Download |
* Microsoft has deprecated the x86 ODBC driver for SQL Server 2025. The Native Client has been superseded by MSOLEDBSQL, which can be downloaded using the link.
Note: To ensure that bcp.exe's dependencies are installed correctly, open Command Prompt in <ADSelfService Plus installation directory>\bin and run bcp.exe /v. If the bcp.exe file's version is displayed, the dependencies are properly installed.
Note: If the specified database does not exist, it will be created automatically, provided the account has the required permissions to do so.
Note: This step is only relevant if your MS SQL Server is part of an Always On Availability Group (AG) — a high-availability setup where the database is automatically handed off to a standby server if the primary server goes down. If you are using a regular standalone MS SQL instance, skip this step.
The AG Listener is a single, stable address that always points to whichever SQL Server node is currently active. Even if the database fails over to a different server, the Listener address stays the same, so ADSelfService Plus stays connected without any manual intervention.
Before connecting ADSelfService Plus, make sure the following are already configured in your SQL Server AG setup:
These are MS SQL Server configurations. If you need help setting them up, refer to Microsoft's documentation on Always On Availability Groups.
When running the Database Setup Wizard in Step 2, the only difference from a regular MS SQL setup is what you enter in the Host Name field:
Everything else in the wizard — port, instance, database name, authentication, and the Migrate Data From Existing Server checkbox — works exactly the same as a regular MS SQL setup.
Note: Unlike standalone named instances, the SQL Server Browser service does not always advertise the port for an AG Listener. Enter the Listener's port number manually in the Port field in the wizard. Do not rely on it being auto-populated.
Once configured, ADSelfService Plus will automatically reconnect to the new primary node through the Listener if a failover occurs.
If you already have a functional MS SQL Server instance, this step is not required. Follow the steps below to configure a freshly installed MS SQL Server instance.
Note: SQLEXPRESS is the instance name provided while configuring MS SQL Server in general; however, it can be changed. SQLEXPRESS will be used in this document hereafter.
To complete the migration process, you need a database admin account for the MS SQL connection. If ADSelfService Plus is already running as a Windows service, you can use its service account as the MS SQL database admin account. Ensure the account has the required privileges. If there is no such account in MS SQL, follow the steps below to create a new user account and assign the required permissions.
For details about user roles, refer to the following:
In general, the configured account needs one of these three sets of privileges to complete the migration process successfully:
| Required Database Role | Required Permissions | |
| Set 1 | db_datareader, db_datawriter, db_ddladmin, db_backupoperator |
Not required |
| Set 3 | db_ddladmin | ALTER ANY TABLE, ALTER ANY AGGREGATE, ALTER ANY DEFAULT, ALTER ANY FUNCTION, ALTER ANY PROCEDURE, ALTER ANY QUEUE, ALTER ANY RULE, ALTER ANY SYNONYM, ALTER ANY TYPE, ALTER ANY VIEW, ALTER ANY XML SCHEMA COLLECTION, ALTER ANY REFERENCES, CONTROL ON CERTIFICATE::[ZOHO_CERT] TO [user], CONTROL ON SYMMETRIC KEY::[##MS_DatabaseMasterKey##] TO [user], CONTROL ON SYMMETRIC KEY::[ZOHO_SYMM_KEY] TO [user] |
Important: You must have the db_owner permission while migrating PostgreSQL to MS SQL for the first time. After a successful migration, you can revoke the db_owner permission for the account and provide Set 2 or Set 3 permissions instead.
To revoke sysadmin after a successful migration: In SQL Server Management Studio, navigate to Machine Name > SQLEXPRESS > Security > Logins. Right-click the account > Properties > Server Roles. Uncheck sysadmin and click OK.
Need further assistance? Fill this form, and we'll contact you rightaway.
Allow Active Directory users to self-service their password resets and account unlock tasks, freeing them from lengthy help desk calls.
Get seamless one-click access to 100+ cloud applications. With enterprise single sign-on, users can access all their cloud applications using their Active Directory credentials.
Intimate Active Directory users of their impending password and account expiry via email and SMS notifications.
Synchronize Windows Active Directory user passwords and account changes across multiple systems automatically, including Microsoft 365, Google Workspace, IBM iSeries, and more.
Strong passwords resist various hacking threats. Enforce Active Directory users to adhere to compliant passwords by displaying password complexity requirements.
Enable Active Directory users to update their latest information themselves. Quick search features help admins scout for information using search keys like contact numbers.
