Tag Info

Hot answers tagged

5

Since TDE relies on a certificate stored in master (which is used to encrypt the database encryption key), then this would work only work if you could restore the master database to another server in such a way that the certificate could be decrypted. This is the TDE encryption hierarchy: Service master key (protected by Windows; tied to the service ...


4

When you encrypt the first database in the instance, tempdb will also be encrypted. As per this reference on TDE: Transparent Data Encryption and the tempdb System Database The tempdb system database will be encrypted if any other database on the instance of SQL Server is encrypted by using TDE. This will be the case when you set ENCRYPTION ON ...


4

You will need to create a master key on the new server - if it does not exit already. USE MASTER; GO if not exists (select 1 from sys.symmetric_keys where name = '##MS_DatabaseMasterKey##') CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Strong_Password'; Then you have to restore your certificate: CREATE CERTIFICATE serverCert FROM FILE = ...


3

Well we have quite a mixed servers,using encryption, depending upon the need of business. For very critical we decided to upgrade to enterprise as it not only provides TDE but other benefits as well when it comes to performance or troubleshooting. Yes, TDE is quite effective and very good, but since it comes with a cost we decided for medium and low ...


3

Even if you configured RBS to use FILESTREAM, TDE does not apply to FILESTREAM: Transparent Data Encryption and FILESTREAM DATA FILESTREAM data is not encrypted even when TDE is enabled.


3

The files are stored in a blob in the sharepoint database and as TDE encrypts all the pages in the database all the files will be encrypted there within. It's important to notice that while the database is mounted on the server the database server will serve the files unencrypted to the Sharepoint application server and it's clients. The Sharepoint ...


3

Yup, I have 2 clusters with TDE in both SQL 2008 R1 and SQL 2012 and nothing special was required. The master key is encrypted by the Windows DPAPl (I think that's the right acryonym) service, but then the generated key is in the Master DB that gets moved between nodes as you stated.


3

Yes. Transparent Data Encryption doesn't change any of the internal processing of queries. Database pages are transparently encrypted/decrypted during I/O (i.e. when they are read from or written to disk). In-memory query processing is therefore unaffected, so indexes continue to function exactly as they did without TDE. TDE is designed to negate the need ...


2

1.If you want to restore a encrypted backup to another server as usual you encounter the following error Cannot find server certificate with thumbprint …... 2.Find the cert name : in this example vestacert SELECT * FROM sys.certificates 3.backup the cert from source server (Source encryptedserver) : BACKUP CERTIFICATE vestacert TO FILE = ...


2

Is there a way to decrypt TDE log files on disk for use with 3rd party software? The short answer is -- this cannot be done. Encryption of the database file is performed at the page level. The pages in an encrypted database are encrypted before they are written to disk and decrypted when read into memory. TDE does not increase the size of the encrypted ...


2

From my knowledge, you cannot have multiple encryption database encryption keys as the Server stores a Server Master key automatically when SQL Server is first installed. It will use this for decryption (among other things) of database keys. When you have created a database key (which is implicit) it will store a copy in the Master db, if you issue another ...


2

In the absence of any other input, here's what I was able to deduce. Short story: this appears to work fine. As far as I can see, enabling TDE for a database is a logged operation, but the actual data encryption is not logged (otherwise the transaction log would grow considerably, which it doesn't). I assume there's something like the differential change ...


2

If you are talking about the SQL service master key, then there is a rare occurrence where you really need to restore it. I'm thinking of a couple of scenarios where you need to restore the SMK... Somehow it got corrupted. You are rebuilding your SQL server and planning to restore every database including system databases from backup. Usually in ...


2

You can join on the certificate thumbprint: use master; go select database_name = d.name, dek.encryptor_type, cert_name = c.name from sys.dm_database_encryption_keys dek left join sys.certificates c on dek.encryptor_thumbprint = c.thumbprint inner join sys.databases d on dek.database_id = d.database_id; My sample output: database_name ...


2

You cannot do encryption with express edition but can you can do it by other way or file encryption only. For more reference follow http://sqlmag.com/database-security/sql-server-encryption-options.


1

Restoring the database to another server will not result in the data being unencrypted. However, you do need to: ...move the certificate or asymmetric key that is used to open the DEK. The certificate or asymmetric key must be installed in the master database of the destination server, so that SQL Server can access the database files. You must ...


1

The secondary databases are just "clones" of the primary, so you cannot enable it on just one node. The way to do it is actually to enable encryption on the primary, then it will replicate by itself if all is well (if you copied the certificate on the secondary nodes). However, you should really look into MSDN and practice in a virtual lab before doing ...


1

From the looks of this article, you would probably have to break the mirror first, setup TDE, and then setup the mirror again. Not ideal, but it would work.


1

1) If we can set up the transactional replication between server A of version 2014 and server B of version 2012. Tried to Google out but could not find the exact documents because may be am looking somewhere wrong. Please suggest if it can be set up? For your replication to work, the PUBLISHER and DISTRIBUTOR should be on same version. The subscriber ...


1

I've used TDE in production many times and it in no way affects Windows/SQL Server patching unless there's some horrific bug or something of the sort; which has not yet happened. TDE simply uses the Windows DPAPIs to generate a cert in Master that then is used to make other certs which can encrypt/decrypt the remaining DB data at rest. Heads up though, ...


1

TDE only encrypts the data at rest. If they have the access to connect to the server and query the database then they can get to the data. But I don't think the person running the patch (CU or Service Pack) needs permissions to the database proper, just permissions on the server. The only way to separate the job functions as you seem to want would be to ...


1

When you are moving a TDE database to a new instance, what you need to ensure is that the proper certificate (or asymmetric key) is also in the destination master's database. If you fail to do this, you'll receive the following error: Msg 33111, Level 16, State 3, Line 2 Cannot find server certificate with thumbprint ...



Only top voted, non community-wiki answers of a minimum length are eligible