-
Title
Active Roles upgrade warning: Unable to retrieve the Active Roles data encryption key from the source database. -
Description
During Active Roles upgrade the import completes successfully with the following message:
Unable to retrieve the Active Roles data encryption key from the source database. If you have a backup of the encryption key for the source database, then, after data import is complete, you can use Restore-AREncryptionKey to restore the key from the backup to the destination database.
The following warning may also be present after attempting an upgrade:
Unable to create a backup copy of the database encryption key for this Administration Service.Details: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
-
Cause
Defects 315646 and 405222.
-
Resolution
STATUSThis is resolved in Active Roles 8.2.For earlier versions of Active Roles, try the following workarounds:
WORKAROUND 1
If another Active Roles Administration Service is already running and using the same configuration database that this service is joining, and the new service starts normally, then this warning can be ignored.
WORKAROUND 2
Run the below cmdlets to restore the encryption key:$AREncryptionKeyPwd = Read-Host -AsSecureString -Prompt "Enter the existing password for the Active Roles Encryption Key"
Restore-AREncryptionKey -DatabaseServer "<SQL Server>" -DatabaseName "<ARS DB>" -RestoreFromFile "<AREncryptionKey>" -Password $AREncryptionKeyPwd
If there was no encryption key password set use this command:
Restore-AREncryptionKey -DatabaseServer "<SQL Server>" -DatabaseName "<ARS DB>" -RestoreFromFile "c:\temp\AREncryptionKey.bin"
NOTE: To ensure that the correct encryption key is used, use the Backup-AREncryptionKey cmdlet on a working instance of the old Active Roles version (if possible).Backup-AREncryptionKey -BackupFile "c:\temp\AREncryptionKey.bin" -
Change Request
315646 / 405222