In a single sql server instances, sensitive data like passwords in linked server and credentials are encrypted using the server master key.

The key or objects can be decrypted only by the sql service account or the local computer account.

However, in a FCI, on node 1 suppose I use the service account as domain/user1 and on node 2 suppose I use account domain/user2; then when there is a failover to node 2, then how will node 2 be able to access the key or decrypt the objects encrypted by the key?

  • It would not be a good practice to use different accounts to run the SQL service on different nodes of the FCI. You’d be introducing unneeded complexity, with no benefit. What would you be trying to accomplish by doing so? May 14 at 14:47
  • I'm just wondering whether there is any documentation to advise to not do so. I'm thinking and learning really.
    – variable
    May 14 at 15:37

1 Answer 1


There's only one instance in an FCI, so only one SMK. When the instance restarts on another node, it uses the same service account, and so is able to decrypt the SMK.

There's an informative thread here with answers from Lauentiu Cristofor from the SQL Server security dev team.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.