Protect your database data - Activate Transparent Data Encryption TDE - SQL Server - Step by Step

How to implement/activate/setup Transparent Data Encryption (TDE) on a database in SQL Server.

This video shows how to activate TDE and how to Restore a TDE encrypted database, and how to remove TDE and its components from an SQL Server and database.

Hide your data from hackers. At some point in time there is a good chance your database will be accessed by un-authorized external or internal sources. You should have sensitive data encrypted so un-authorized users cannot read the data.

[bawoademinokan]

This is by far the BEST tutorial on TDE I have seen anywhere online. YOu are such a great instructor and you just WON OVER a NEW

[MonarkenRTV]

0:41 Explaining TDE Process (Create master key, creating certificate via the master key, creating database encryption key via certificate, then encrypting the database via the DEK)
6:17 Creating the Certificate via T-SQL
10:34 Explaining what will be encrypted.
13:28 Backing up the certificate

[JonH]

This was an amazing video, thank you!

For anybody wondering about time to encrypt like I was, I have a 43.6GB DB that took exactly an hour to encrypt.

[andrewan]

Great video. clearly explained. Just need a bigger fonts with lower screen resolution that will make it perfect. Could please you also do a video for adding encrypted database into Alwayson availability group? I found your logic and explaination in better than others.

[dawitbelay]

the best tutorial on data encryption. Thank you

[aminehamdi]

Thank you so much! you did things simply and step by step, it was easy to follow, thanks!

[TheJoshdimples]

Thanks, OdinTree.
Just what I needed to set up a TDE on SQL 2019.

[manfreddusold]

Thank you very much. It was a nice initial section for TDE.

[taichi]

Thank you very much Sir for this great step by step video! I was a little bit confused on the step to backup the Certificate. I thought it needs the private key in order to backup the certificate. I realized later that the private key was also being backup at the same time.

[lindagilcruz]

This was a great overview, really appreciate it. Thank you very much.

[monaethanes]

Very smooth and broad description! I liked the subtle sense of humor as well. :) Thank you.
A quick hassle: What happens if we want to apply TDE on a database in Azure SQL Server?! since there's no Master in the database in Azure! I stumbled in the first step.

[jobycheriyan]

Thank you very much. It was a nice section for TDE

[Lutfullah_Aslami]

Thank you man . you are explaining very clear .

[austinpeterv]

Good video.. Nicly explained.. just to ask one thing, will we get same certificate error if we copy the mdf and ldf to another server and attach the database? Assume the new server doesnt have any keys and certs

[nazman]

A quick question if I may :-). In the end, you deleted the Master Key. Does this need to be deleted? I presume this key resides at the Instance level and if so, do you only need this to be created once and then it is used here on when creating the certificate? If you have multiple databases in the instance, I presume every database will have it's own certificate and it's own database encryption key? Excellent video and I was able to replicate the whole exercise without issues. Thank you

[BiffTastic]

That was a great video, thanks OdinTree. One question that was already asked below but I would like clarification on. Is backing up the masterkey not necessary? Since you created a new master key on SERVER2 with a new password is backing up that not required?

[sensok]

Hi, thanks for the demonstration. Can I know if the encrypted database can be restored to sql server express edition?

[renewaltracker]

Good evening. I was able to follow all your steps and everything worked but I have a few questions since I have several different databases. For the first step of creating the master key, is this done once at the server level or master database level only and can be used for several databases? Or, is this master key encryption step done for each database? Next, creating the database encryption key with the algorithm by server certificate, is that again done once and used for any database or is this this a database specific step and should be done for each database? Lastly, alternating a specific database and turning on encryption is obviously specific to each database so no response needed for this really. I hope you can provide me an answer as I did not know how to contact you directly.

[salvadorpinedacarrillo]

Will this encription need an access key to read / update data from an application? Or this encryption is only for just in case someone gets a copy so they can't restore it???

[chicagoimran]

This was a great overview, really appreciate it. What is the purpose of the password on the master key (in your case 'Access999')? It was never used after the master key was created, nor was it backed up, used for the restore, or even used to remove encryption from the database.