Recently, I setup an availability group with 3 nodes. The 2 synchronous nodes are on the same domain, "domain 1". The third asynchronous (DR) node is on a different domain, "domain 2". I have a new requirement, to encrypt all databases using TDE on the third (DR) node only. Will this be possible?

I'm assuming that it is possible, but I want to ask your expert opinion and what will be the impact of this setup?

  • What database are you using? Did you mean to tag this "SQL Server" (a database engine) rather than "SQL" (a programming language)? Jan 19, 2015 at 6:02
  • MS SQL Server 2012 SP2 CU2 to be specific.
    – Marvin
    Jan 19, 2015 at 11:35

1 Answer 1


The secondary databases are just "clones" of the primary, so you cannot enable it on just one node.

The way to do it is actually to enable encryption on the primary, then it will replicate by itself if all is well (if you copied the certificate on the secondary nodes).

However, you should really look into MSDN and practice in a virtual lab before doing anything on production. It could be easy to get into an otherwise avoidable situation.

  • Thanks Bogdan, this is really appreciated. Actually, I already sent my recommendation yesterday to the management that it's not advisable to encrypt just the DR NODE base on microsoft practice. But, your answer give me peace of mind and really helpful. Thanks!
    – Marvin
    Jan 21, 2015 at 11:33
  • No problem. By the way, you could probably enable Bitlocker on the DR node, but it would have a different effect.
    – Bogdan G.
    Jan 22, 2015 at 11:01
  • Yup, but I think it is not recommended using AlwaysOn. It is possible if the setup is shared clustered "all drives" because I believe bitlocker use to encrypt drive and volume level.. Again, thanks Bogdan for this reply...
    – Marvin
    Jan 22, 2015 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.