8

I have an application that is running on a device that has two partitions: C and D. The application runs off of C while D contains the SQL Server database (mdf file). In addition, D is also encrypted using BitLocker.

We are using the code-first approach where the database is created on the fly, based on the specified entities within our code. If the database has not yet been created and I turn BitLocker on, the application cannot create the DB and I get a 'Directory lookup exception', with the message 'This drive is locked by BitLocker'. Though, as soon as I turn off BitLocker, it gets created as expected and everything is fine. I turn on BitLocker again, and this time I get a different exception, 'the login failed for user sa'. Once again, this works when I turn BitLocker off. Is there something different that I need to do since we are using the SQL sa user to login?

According to Using SQL Server 2012 Standard with Bitlocker

I need to make sure that the SQL Server Service account is the one used for turning BitLocker on. I've changed the account (Services -> Sql Server -> Properties -> LogOn) to the user account I used for turning BitLocker on, but that does not seem to do the trick.

Improve this question
3
  • 1
    How are you enabling bitlocker? Through the gui or through enable-bitlocker? Which account are you using to enable it? Also, as an aside, any changes to sql server for the service account should be done through sql server configuration manager.
    – Sean Gallardy
    Apr 9, 2015 at 18:25
  • 1
    @SeanGallardy I am enabling BitLocker via ControlPanel -> System and Security -> BitLocker Drive Encryption. I am using the Administrator account, but SQL Server is connecting using the SA account (I believe this might me where the problem is). Also, I am using Windows Services to change the SQL server service account, I will look into using the config. manager.
    – d.moncada
    Apr 13, 2015 at 16:34
  • Don't change the service account for sql server through "services", use the sql server configuration manager instead. msdn.microsoft.com/en-us/ms345578.aspx
    – Tom V
    Jun 13, 2015 at 7:38

3 Answers 3

Reset to default
1

I agree with Jithin R and ensuring the SQL Server "service" account (what you have set in the services.msc for the login as, and ensuring it has at least MODIFY or FULL permissions at the NTFS folder level where the MDF and LDF files are created when they code dynamically creates the DB).

It sure sounds like an NTFS permission issue with whatever security context is being used to created the LDF and MDF files does NOT have permission on the disk partition to create the DB files when initiated.

The security context will need at least LIST to traverse all folders and subfolders to the level of the folder where the DB files will be created, and where those files are created, it'll need MODIFY or FULL permissions there but MODIFY access should suffice.

I'm not sure why BitLocker being enabled or disabled on this disk would have an effect on this but perhaps BitLocker enabling in your configuration changes the NTFS permissions of the folders where the DB is being created.

Improve this answer
1

I had a similar situation and it turned out to be that the "Turn on Auto Unlock" option was disabled.

Right click drive/manage bitlocker/click turn on auto unlock

Improve this answer
-2

disable bit-locker from the drive which has .mdf,.ldf,.ndf files. Give permission to those files ie right click-> security -> add -> full permission(read,write,exec,etc.) for that system . I hope you will be get rid of your problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.