Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm researchig into databnase encryption and whilst TDE seems to do exactly what it says on the tin, there seems to be no information on how to configure it up in a Microsoft failover SQL Cluster, or if there are any caveats about encryption in a cluster environment (beyond those that are listed on MSDN).

Trying to distill the information I have (mostly from here and here but from other random googles), I think the answer is that I have to do nothing and it just works. The master key and certificate are in the master database and the DMK is in the user database, so in a failover situation, everything exists in the MDF files for the failover node to run with (rather than any keys lurking in the registry which would need to be sync'd twixt nodes).

The problem is there's nothing that explicitly states this (or I've completely failed to read the sentance that says it), so I'm just seeking clarification that I'm not missing something obvious, that nothing special needs to be configured and it does "just work".

share|improve this question
up vote 3 down vote accepted

Yup, I have 2 clusters with TDE in both SQL 2008 R1 and SQL 2012 and nothing special was required. The master key is encrypted by the Windows DPAPl (I think that's the right acryonym) service, but then the generated key is in the Master DB that gets moved between nodes as you stated.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.