TDE Disabled – Oh! Not Really2 min read


Recently, I was forwarded a request from our Product Support team to prepare the database for a third party application to be sent to the vendor for troubleshooting.  This particular database has TDE enabled, so I figured that is easy, let me knock that out.

So I proceeded to restore the database to one of our non-production systems that had the storage space to accommodate the database.  That took 90 minutes.  Then I proceeded to run my query.

Now I wait.  I monitor the progress of the decryption with this query.

Six hours later Encryption state was Unencrypted and Percent Complete was 0.

Time to back this sucker up and SFTP it over to the vendor.


Two days later I get an e-mail from my boss,  We sure TDE was off on these? . Duh!!!

So I proceed to look at the error message.

Wait, what???  I disabled TDE, why would the restore be looking for this certificate.  So I do a little research and find that to actually fully disable TDE you have to drop the key as well.

So this little bit of knowledge and code put me in my place.


I recommend that if it is your first time performing an action and you are sure you know the steps, do a little research.  This helps identify if there are any little things that might come back to bite you.

Leave a Reply

Your email address will not be published. Required fields are marked *