You also must have the credentials for the service account. What this obviously means is that your server must be on the same domain as the old server (or at least another domain that is trusted). Setting up a new SQL instance using the same service account as the old instance Let’s go into each of these steps in a little more detail. Once you’ve got that, I would go back to the steps in the previous post on recovering your TDE protected database(s). So, I’m only suggesting you use this so you can recover the certificate. My personal opinion is that it’s not the greatest of ideas to restore the master database from one instance onto a new one and expect everything to work okay.

Backup your certificate and private key – and don’t lose them this time!.

Reboot your new server – that’s the whole server, not just SQL.

Restore your backup of master from the old instance onto the new instance.

Setting up a new SQL instance using the same service account as the old instance.

If the service account is a domain account though then we should be able to use it. The first copy is only going to be of any use to us if we can recover the old machine (and its account) directly from backups, but we’ve already ruled that out.

Once encrypted by the keys associated with the SQL Server service account.

One encrypted by the keys associated with the machine account.

That includes the certificate and associated keys, the Database Master Key (DMK) and the Service Master Key (SMK). The reason you are going to be okay is that all the objects in the SQL Server Encryption Hierarchy that sit above the Database Encryption Key (that exists in your TDE database) are stored in the master database.

The previous instance used a domain account as its service account.

You have a backup of the master database from the previous instance.

If the two following things are true though then you can still recover your database: I’m going to assume you don’t have the possibility to recover your old server from a complete file system backup – if you do then you can do that and access all the keys you require. There is one scenario where you have a way out. If you don’t have the backups of the certificate and private key from the old server, as well as the password used to encrypt the private key backup then you could be in a lot of trouble.

Backup service master key