Skip to content

Latest commit

 

History

History
41 lines (33 loc) · 2.59 KB

encrypted-databases-with-always-on-availability-groups-sql-server.md

File metadata and controls

41 lines (33 loc) · 2.59 KB
title description author ms.author ms.reviewer ms.date ms.service ms.subservice ms.topic helpviewer_keywords
Add an encrypted database to an availability group
Learn the steps to add an encrypted (or recently decrypted) database to an Always On availability group.
MashaMSFT
mathoma
randolphwest
01/19/2024
sql
availability-groups
how-to
Transparent Data Encryption, AlwaysOn Availability Groups
Transparent Data Encryption, Always On Availability Groups
TDE, AlwaysOn Availability Groups
TDE, Always On Availability Groups
Availability Groups [SQL Server], interoperability

Add an encrypted database to an Always On availability group

[!INCLUDE SQL Server]

This article contains information about the using currently encrypted or recently decrypted databases with [!INCLUDE ssHADR] in [!INCLUDE ssnoversion].

Limitations

If a database is encrypted or even contains a database encryption key (DEK), you can't use the [!INCLUDE ssAoNewAgWiz] or [!INCLUDE ssAoAddDbWiz] to add the database to an availability group. Even if an encrypted database has been decrypted, its log backups might contain encrypted data. In this case, full initial data synchronization could fail on the database. This is because the restore log operation might require the certificate that was used by the database encryption keys (DEKs), and that certificate might be unavailable.

To make a decrypted database eligible to add to an availability group using the wizard:

  1. Create a full database backup of the primary database.
  2. Create a log backup of the primary database.
  3. Restore the database backup on the server instance that hosts the secondary replica.
  4. Restore the log backup on the secondary database.

Related content