6. Reversing the Implementation of TDE
It was once said that the only things certain in
life are death and taxes. It could be argued that change is another
certainty. You may find yourself in a situation where TDE has been
implemented, you have validated that it works, are ready for users to
begin using the newly-encrypted database and then, lo-and-behold, a
request to reverse TDE comes your way.
Boss: "I would like you to proceed with implementing TDE immediately ..."
DBA: "Cool, I'll get right on it."
(DBA Implements TDE)
Boss: "Hey, as I
was saying yesterday: I would like you to proceed with implementing TDE
next week after our presentation to the Technology Committee."
DBA: "No problem ... ah ..."
(Begin reversal process)
If, at the time this request comes your way, no
transactions have been performed on the encrypted database then you can
reverse the TDE implementation using the following steps:
Restore the backup file of the HomeLending database that was created before TDE was implemented.
Drop the certificate that was created in the Master
database. This should only be done if there are no other user databases
in the instance that have been TDE-enabled. If there are other user
databases in the instance that have TDE enabled, you will want to leave
the Master database items untouched.
Drop the database master key that was created in the Master
database. This should only be done if there are no other user databases
in the instance that have TDE enabled. Otherwise, you will want to
leave the Master database items untouched.
Restart the instance in which the HomeLending
database resides. If there are not any other user databases on the
instance that have TDE implemented, this action will force the
recreation of the TempDB database in an unencrypted format.
Listing 12 shows the code to implement these steps.
If the request to reverse the implementation of TDE
comes after transactions have occurred, or a copy of the pre-TDE backup
file is no longer available, the following steps can be performed:
Alter the HomeLending database to have the ENCRYPTION option set to the value of OFF.
Wait until the decryption process is complete. Use the sys.dm_database_encryption_keys DMV to determine its status. A value of "1" returned in the encryption_status column indicates that the decryption is complete.
Drop the database encryption key for the HomeLending database.
Restart the instance in which the HomeLending
database resides. If there are not any other user databases on the
instance that have TDE implemented, this action will force the
recreation of the TempDB database in an unencrypted format.
Listing 13 shows the code to implement these steps.
We will need to keep the certificate and database master key that was setup in the Master database, since there will remain some dependencies upon these keys that affect the recoverability of the database.
It is recommended to perform either of
these removal options while the database is not in use by other users.
In addition, it is always recommended that a backup be made of the
database, the database master key and certificate prior to reversing
TDE.
