---
title: Upgrade from DS 7.4.0
description: If the deployment includes a DS 7.4.0 server with data encryption using default settings, follow the procedures in this page.
component: pingds
version: 7.4
page_id: pingds:upgrade-guide:from-740
canonical_url: https://docs.pingidentity.com/pingds/8.1/upgrade-guide/from-740.html
llms_txt: https://docs.pingidentity.com/pingds/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2024-01-15T08:20:21Z
keywords: ["LDAP", "Upgrade"]
superseded_by: https://docs.pingidentity.com/pingds/8.1/upgrade-guide/from-740.html
section_ids:
  the_problem: The problem
  the_solution: The solution
---

# Upgrade from DS 7.4.0

If the deployment includes a DS 7.4.0 server with [data encryption](../security-guide/data.html) using default settings, follow the procedures in this page.

If the deployment has no DS 7.4.0 servers or does not use data encryption, skip this page.

## The problem

Due to an issue (OPENDJ-10211) in the way DS 7.4.0 encrypts data on disk when using the default `cipher-transformation: AES/GCM/NoPadding` setting, the backend or changelog data on disk and encrypted with 7.4.0 is incompatible with all other DS versions.

If the deployment is configured with non-default `cipher-transformation` settings that do not use the AES algorithm and GCM mode, the problem doesn't affect the deployment. In this case, skip this page.

Otherwise, the directory data on disk uses incompatible encryption. Any binary backups of the backend data are also affected. You can't use the `upgrade` command to upgrade a DS server to 7.4.0 from earlier versions or from 7.4.0 to later versions.

## The solution

You *can* upgrade by adding new DS servers; follow these steps:

1. Upgrade by [adding new servers](add-new-servers.html), leaving existing 7.4.0 servers in operation during the upgrade.

   When initializing new servers, *do not use backup files*, as they use incompatible encryption. Instead, either [initialize data over the network](../config-guide/repl-init.html#init-repl-online) or [initialize from plaintext LDIF](../config-guide/repl-init.html#init-repl-ldif).

2. Change the [bootstrap replication servers](../config-guide/repl-bootstrap.html) for each server to stop using the DS 7.4.0 servers.

3. If you use backup files, create them from the new servers with compatible encryption.

4. Stop directing client application traffic to the DS 7.4.0 servers.

5. Wait until the replication purge delay has elapsed (default: 3 days) and retire the DS 7.4.0 servers.