You may need to disable Oracle Database Vault to perform upgrade tasks or correct erroneous configurations.

You can reenable Oracle Database Vault after you complete the corrective tasks.

To find the enablement and configuration status of Oracle Database Vault, see Verifying That Database Vault Is Configured and Enabled.

The following situations require you to disable Oracle Database Vault:

• You must install any of the Oracle Database optional products or features, such as Oracle Spatial, by using Database Configuration Assistant (DBCA).

• If you did not configure backup DV_OWNER and DV_ACCTMGR accounts when you registered Oracle Database Vault, and these accounts are inadvertently locked or their passwords forgotten. Note that if your site only has one DV_OWNER user and this user has lost his or her password, you will be unable to disable Oracle Database Vault. However, if your site's only DV_ACCTMGR user has lost the password, you can disable Database Vault. As a best practice, you should grant the DV_OWNER and DV_ACCTMGR roles to new or existing user accounts, and use the Database Vault Owner and Account Manager accounts that you created when you registered Database Vault as back-up accounts. (See Backup Oracle Database Vault Accounts for a guideline for avoiding this problem in the future.)

• If you want to register Oracle Internet Directory (OID) using Oracle Database Configuration Assistant (DBCA).

Be aware that after you disable Oracle Database Vault, Oracle Label Security, which is required to run Database Vault, is still enabled.

1. In SQL*Plus, log in as the Oracle Database Owner (DV_OWNER) account, and then disable Oracle Database Vault.

   sqlplus psmith
   Enter password: password
   
   EXEC DBMS_MACADM.DISABLE_DV;
   

2. In a multitenant environment, connect to the appropriate pluggable database (PDB).

   For example:

   CONNECT psmith@hrpdb
   Enter password: password
   

   To find the available PDBs, query the DBA_PDBS data dictionary view. To check the current PDB, run the show con_name command.

3. Restart the database.

   CONNECT SYS AS SYSOPER -- Or, CONNECT SYS@hrpdb AS SYSOPER
   Enter password: password
   
   SHUTDOWN IMMEDIATE
   STARTUP
   

4. For Oracle RAC installations, repeat these steps for each node on which the database is installed.

At this stage, Oracle Database Vault is disabled and you can perform the required tasks.

You can enable Oracle Database Vault and Oracle Label Security from SQL*Plus.

1. In SQL*Plus, connect as the Oracle Database Owner (DV_OWNER) account, and then enable Database Vault.

   If you are enabling Database Vault from a non-multitenant environment or from a PDB:

   CONNECT psmith -- Or, CONNECT psmith@hrpdb for a PDB
   Enter password: password
   
   EXEC DBMS_MACADM.ENABLE_DV;
   

   If you are enabling Database Vault from the CDB root, for example:

   CONNECT c##sec_admin_owen 
   Enter password: password
   

   Select from one of the following settings:

   EXEC DBMS_MACADM.ENABLE_DV (strict_mode => 'n');
    -- For regular mode
   EXEC DBMS_MACADM.ENABLE_DV (strict_mode => 'y');
    -- For strict mode

2. Check if Oracle Label Security is enabled.

   SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Oracle Label Security';
   

   Oracle Label security must be enabled before you can use Database Vault. If it is not enabled, then this query returns FALSE.

3. If Oracle Label Security is not enabled, then enable it.

   CONNECT SYS AS SYSDBA -- Or, CONNECT SYS@hrpdb AS SYSDBA
   Enter password: password
   
   EXEC LBACSYS.CONFIGURE_OLS;
   EXEC LBACSYS.OLS_ENFORCEMENT.ENABLE_OLS;
   

4. Restart the database.

   CONNECT SYS AS SYSOPER -- Or, CONNECT SYS@hrpdb AS SYSOPER
   Enter password: password
   
   SHUTDOWN IMMEDIATE
   STARTUP
   

5. For Oracle RAC installations, repeat these steps for each node on which the database is installed.