0

Which are the correct steps to disable (not removing) TDE on a AlwaysOn database in an availability group?

I found steps for removing TDE but that involves removing the availability group and disabling the AlwaysOn relationship. I hope this is only for removing at all the TDE configuration.

  • just want to disable, with "set encryption off", in standalone configuration is enough and all TDE configuration can remain on server if in the future TDE on database must be anbled again. Want to know if is possible to disable without acting on group because the group contains other databases that are not the scope of TDE – merfe Aug 21 '18 at 9:42
  • Could you post the steps you found for removing TDE? – George.Palacios Aug 21 '18 at 9:45
  • you can find them at this link: social.msdn.microsoft.com/Forums/azure/en-US/… – merfe Aug 21 '18 at 9:54
0

To disable TDE you must first remove the candidate database from the Availability Group - the group itself however does not need to be dropped.

To do this, the following code is needed:

USE [master];
GO

ALTER DATABASE [YourDatabase] SET HADR OFF;
GO

Once this is complete, you may then disable TDE on the PRIMARY replica:

ALTER DATABASE [YourDatabase] SET ENCRYPTION OFF;

The process of decryption is asynchronous, and can be monitored by looking at the percent_complete column in the sys.dm_database_encryption_keys DMV

One thing to note, is that although the database itself is encrypted, if you aren't careful you can end up with part of the log file still encrypted - this is only a problem if you will be dropping the encryption certificates from the offending servers, or trying to take a backup and restore this database to a server that doesn't hold this encryption certificate.

| improve this answer | |
  • You don't have to take a database out of the Availability Group in order to disable the TDE. – Aart Hoevenberg Jan 17 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.