I'm new to TDE and wanted to clarify my confusion.
These are the steps/tsql I executed on my source machine:
3. Created a "Test" database
4. Ran CREATE MASTER KEY ENCRYPTION
5. Ran CREATE CERTIFICATE
6. Ran CREATE DATABASE ENCRYPTION KEY
7. Ran ALTER DATABASE Test SET ENCRYPTION ON
8. Ran BACKUP CERTIFICATE TO FILE WITH PRIVATE KEY
9. Ran BACKUP DATABASE Test
After that, I copied backup db and the certificate and private key to the target
machine to perform the restore.
I restored my "Test" TDE database successfully.
Here's the confusion I have:
I ran this tsql on the target machine:
SELECT
db_name(database_id) as DatabaseName,
Case
when encryption_state=0 then 'No Database Encryption'
when encryption_state=1 then 'Unencrypted'
when encryption_state=2 then 'Encryption In Progress'
when encryption_state=3 then 'Encrypted'
when encryption_state=4 then 'Key Change In Progress'
when encryption_state=5 then 'Decryption In Progress'
when encryption_state=6 then 'Protection Changes In Progress'
end as EncryptionState,
percent_complete
FROM sys.dm_database_encryption_keys
Only one row returned and it showed "tempdb".
However, If I do this:
right click on my Test db -> Properties -> Options -> scroll down and I saw this
Encryption Enabled = True
So I am seeing conflicting results. When I ran the above tsql, it only showed "tempdb"
but the db properties page says "Encryption Enabled=True".
Is my restored Test TDE db on the target still TDE enabled??
Do I need to run "CREATE DATABASE ENCRYPTION KEY" on the target machine?
