How do I add a TDE encrypted database to availability group?
On each secondary replica instance, join the database to the availability group.
- Step One: Verify each secondary replica instance has a Database Master Key (DMK) in the master database – if not, create one.
- Step Two: On the primary replica instance, create a backup of the certificate used to TDE encrypt the database.
How to enable TDE on databases in an AlwaysOn scenario?
If there are multiple databases you can do so in the same step 6, just change the name of the database. Once you execute the above query, the SQL Server will begin encrypting the database. You will now need to monitor its completion. Run the below queries on both Primary and Secondary replicas. The data returned is explained here.
How to add a TDE database to an availability group?
How to add a TDE encrypted database to an Availability Group 1 Step One: Verify each secondary replica instance has a Database Master Key (DMK) in the master database – if not, create… 2 Step Two: On the primary replica instance, create a backup of the certificate used to TDE encrypt the database More
How to disable TDE on a candidate database?
To disable TDE you must first remove the candidate database from the Availability Group – the group itself however does not need to be dropped. To do this, the following code is needed: USE [master]; GO ALTER DATABASE [YourDatabase] SET HADR OFF; GO Once this is complete, you may then disable TDE on the PRIMARY replica:
Can a database be encrypted in AlwaysOn?
CASE 2: Database is encrypted on Primary Replica and is NOT part of the Availability Group or NOT on Secondary Replicas. The Add Database Wizard and New Availability Group Wizard for AlwaysOn Availability Groups, by default, do not show the databases that are already encrypted or even if the database contains a Database Encryption Key (DEK).