Backup and restore SQL Always encrypted database

[winnie.xu]

Hi,

We are planning to enable SQL Always encrypted on databases. We would like to find out how Veeam Backup and Replication version 11 would handle the encryption? e.g. What are the configuration required from Veeam backup side to ensure the databases can be backedup and restored.

Thanks
Winnie

[HannesK]

Hello,
and welcome to the forums.

It just works because we use native SQL APIs for backup (post321557.html#p321557)

I remember situations where manual certificate export is needed https://www.veeam.com/kb2006

Best regards,
Hannes

[great_vc]

Hi,
Hannes, that is not the case for us.
we have a AG Cluster SQL with TDE and it fails with error: Error: VSSControl: Failed to freeze guest over network, wait timeout
Unable to release guest. Error: VSSControl: Failed to freeze guest over network, wait timeout

yes, i have change the registry entry, i'm prety sure it is not a timeout but the TDE cause i test this
Backup the same VM without application awareness and it completed successfully.
Once i enable application awareness and SQL i get that error after 5 minutes.

I see on the VCENTER the snapshot created in seconds and deleted in seconds.

Any more ideas ?

[PetrM]

Hi Vassilis,

It looks like a technical issue which must be investigated by our support team. At first sight, I'd say that it cannot be fixed at the level of our code as the error happens at the level of VSS which comes into action as per request of the backup application. Anyway, I'd let our support team to dig deeper into it. Please provide us with a support case ID. In the meantime, you may have a look at this KB and also check Windows application event logs on the SQL server.

Thanks!

[great_vc]

Yes, i believe a support ticket will be the next step first thing tomorrow.
As i manage to backup both disks C: and E: (which contains the databases) without Application Awareness so it is not the VSS.

thank you PetrM

[PetrM]

I'd say it's vice versa: VSS is not invoked without AAIP, that's why a job works with AAIP disabled. Anyway, let's wait for what our engineers can figure out.

Thanks!

[BassFisher]

I'm testing restoring an encrypted dB from one server to another and the restore is failing. I made sure the same MASTER KEY ENCRYPTION BY PASSWORD = 'XXXXXXX' is the same on both servers the and ENCRYPTION BY SERVER CERTIFICATE Veeam_SQL_Certificate was the same as well. I got the error message "Failed to restore databases: Cannot find server certificate with thumbprint Object"

Any ideas as to how and make restoring an encrypted dB to another server work?

[Dima P.]

Hello Mark,

Please check the solution described in this KB article: Restoring Encrypted Databases with VESQL. If that does not help please raise a support case and share your case ID with us. Thank you!

[BassFisher]

Ok Thanks. I'll take a look at it

[BassFisher]

So I would have to have Enterprise edition of Microsoft SQL Server installed ONLY on the staging server? or would it also be the Veeam SQL server? (or is it any server I want TDE)

Transparent Data Encryption requires the Enterprise edition of Microsoft SQL Server; this also applies to the staging server.

[Andreas Neufert]

Only on the staging server.