0

Which are the correct steps to disable (not removing) TDE on a AlwaysOn database in an availability group?

I found steps for removing TDE but that involves removing the availability group and disabling the AlwaysOn relationship. I hope this is only for removing at all the TDE configuration.

  • 1
    I'm unclear as to what you mean by disable and not remove - do you want the data to be encrypted on disk or not? Also, what's the context? Why do you need to do this? – George.Palacios Aug 21 '18 at 9:37
  • just want to disable, with "set encryption off", in standalone configuration is enough and all TDE configuration can remain on server if in the future TDE on database must be anbled again. Want to know if is possible to disable without acting on group because the group contains other databases that are not the scope of TDE – merfe Aug 21 '18 at 9:42
  • I would suspect that you will need to drop those individual DB's from the AG, disable TDE and then reseed. This way the AG itself stays intact. – George.Palacios Aug 21 '18 at 9:44
  • Could you post the steps you found for removing TDE? – George.Palacios Aug 21 '18 at 9:45
  • you can find them at this link: social.msdn.microsoft.com/Forums/azure/en-US/… – merfe Aug 21 '18 at 9:54
0

To disable TDE you must first remove the candidate database from the Availability Group - the group itself however does not need to be dropped.

To do this, the following code is needed:

USE [master];
GO

ALTER DATABASE [YourDatabase] SET HADR OFF;
GO

Once this is complete, you may then disable TDE on the PRIMARY replica:

ALTER DATABASE [YourDatabase] SET ENCRYPTION OFF;

The process of decryption is asynchronous, and can be monitored by looking at the percent_complete column in the sys.dm_database_encryption_keys DMV

One thing to note, is that although the database itself is encrypted, if you aren't careful you can end up with part of the log file still encrypted - this is only a problem if you will be dropping the encryption certificates from the offending servers, or trying to take a backup and restore this database to a server that doesn't hold this encryption certificate.

  • thanks, all I need to know is that I can work only on the database on scope without touching the other databases in the group or the other groups. – merfe Aug 21 '18 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.