Which are the correct steps to disable (not removing) TDE on a AlwaysOn database in an availability group?

I found steps for removing TDE but that involves removing the availability group and disabling the AlwaysOn relationship. I hope this is only for removing at all the TDE configuration.

  • just want to disable, with "set encryption off", in standalone configuration is enough and all TDE configuration can remain on server if in the future TDE on database must be anbled again. Want to know if is possible to disable without acting on group because the group contains other databases that are not the scope of TDE
    – merfe
    Aug 21, 2018 at 9:42
  • Could you post the steps you found for removing TDE? Aug 21, 2018 at 9:45
  • you can find them at this link: social.msdn.microsoft.com/Forums/azure/en-US/…
    – merfe
    Aug 21, 2018 at 9:54

1 Answer 1


To disable TDE you must first remove the candidate database from the Availability Group - the group itself however does not need to be dropped.

To do this, the following code is needed:

USE [master];


Once this is complete, you may then disable TDE on the PRIMARY replica:


The process of decryption is asynchronous, and can be monitored by looking at the percent_complete column in the sys.dm_database_encryption_keys DMV

One thing to note, is that although the database itself is encrypted, if you aren't careful you can end up with part of the log file still encrypted - this is only a problem if you will be dropping the encryption certificates from the offending servers, or trying to take a backup and restore this database to a server that doesn't hold this encryption certificate.

  • You don't have to take a database out of the Availability Group in order to disable the TDE. Jan 17, 2020 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.