Tag Info

New answers tagged

0

I've used TDE in production many times and it in no way affects Windows/SQL Server patching unless there's some horrific bug or something of the sort; which has not yet happened. TDE simply uses the Windows DPAPIs to generate a cert in Master that then is used to make other certs which can encrypt/decrypt the remaining DB data at rest. Heads up though, ...


0

TDE only encrypts the data at rest. If they have the access to connect to the server and query the database then they can get to the data. But I don't think the person running the patch (CU or Service Pack) needs permissions to the database proper, just permissions on the server. The only way to separate the job functions as you seem to want would be to ...


0

Used an empty SQL 2012 test instance, restored SMK from Server2, and restored db2 (my symmetric key admin_key and certificate admin_cert were included by default in the backup/restore). BACKUP SERVICE MASTER KEY TO FILE = 'path\prod.SMK' ENCRYPTION BY PASSWORD = pass RESTORE SERVICE MASTER KEY FROM FILE = 'path\prod.SMK' DECRYPTION BY PASSWORD = pass ...


4

Server1 running SQL Server 2012 with Service Master Key A, db1 with Database Master Key 1, symmetric key and certificate available. I assume that the db1 master key is encrypted with the SMK. This makes everything encrypted by the database master key 'available' to applications, w/o having to explicitly open the database master key. What you need to do ...



Top 50 recent answers are included