|
| 1 | +--- |
| 2 | +description: "MSSQLSERVER_15581" |
| 3 | +title: MSSQLSERVER_15581 |
| 4 | +ms.custom: "" |
| 5 | +ms.date: 09/03/2020 |
| 6 | +ms.prod: sql |
| 7 | +ms.reviewer: ramakoni1, pijocoder, suresh-kandoth, Masha, VenCher |
| 8 | +ms.technology: supportability |
| 9 | +ms.topic: "language-reference" |
| 10 | +helpviewer_keywords: |
| 11 | + - "15581 (Database Engine error)" |
| 12 | +ms.assetid: |
| 13 | +author: suresh-kandoth |
| 14 | +ms.author: ramakoni |
| 15 | +--- |
| 16 | +# MSSQLSERVER_15581 |
| 17 | + [!INCLUDE [SQL Server](../../includes/applies-to-version/sqlserver.md)] |
| 18 | + |
| 19 | +## Details |
| 20 | + |
| 21 | +|Attribute|Value| |
| 22 | +|---|---| |
| 23 | +|Product Name|SQL Server| |
| 24 | +|Event ID|15581| |
| 25 | +|Event Source|MSSQLSERVER| |
| 26 | +|Component|SQLEngine| |
| 27 | +|Symbolic Name|SEC_NODBMASTERKEYERR| |
| 28 | +|Message Text|Please create a master key in the database or open the master key in the session before performing this operation.| |
| 29 | +|| |
| 30 | + |
| 31 | +## Explanation |
| 32 | + |
| 33 | +Error 15581 is raised when [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] is not able to recover a database that is enabled for transparent data encryption (TDE). An error message like the following is logged in the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] error log |
| 34 | + |
| 35 | +> 2020-01-14 22:16:26.47 spid20s Error: 15581, Severity: 16, State: 3. |
| 36 | +2020-01-14 22:16:26.47 spid20s Please create a master key in the database or open the master key in the session before performing this operation. |
| 37 | + |
| 38 | +## Possible cause |
| 39 | + |
| 40 | +This issue occurs when service master key encryption for the database master key in the master database is removed when the following command is run: |
| 41 | + |
| 42 | +```sql |
| 43 | +Use master |
| 44 | +go |
| 45 | +alter master key drop encryption by service master key |
| 46 | +``` |
| 47 | + |
| 48 | +The service master key is used to encrypt the certificate that is used by the database master key. Any attempt to use the TDE-enabled database requires access to the database master key in the master database. A master key that is not encrypted by the service master key must be opened by using the [OPEN MASTER KEY (Transact-SQL)](/sql/t-sql/statements/open-master-key-transact-sql) statement together with a password on each session that requires access to the master key. Because this command cannot be run on system sessions, recovery cannot be completed on TDE-enabled databases. |
| 49 | + |
| 50 | +## User action |
| 51 | + |
| 52 | +To resolve the issue, enable automatic decryption of the master key. To do this, run the following commands: |
| 53 | + |
| 54 | +```sql |
| 55 | +Use master |
| 56 | +go |
| 57 | +open master key DECRYPTION BY PASSWORD = 'password' |
| 58 | +alter master key add encryption by service master key |
| 59 | +``` |
| 60 | + |
| 61 | +Use the following query to determine whether automatic decryption of the master key by the service master key was disabled for the master database: |
| 62 | + |
| 63 | +```sql |
| 64 | +select is_master_key_encrypted_by_server from sys.databases where name = 'master' |
| 65 | +``` |
| 66 | + |
| 67 | +If this query returns a value of 0, automatic decryption of the master key by the service master key was disabled. |
| 68 | + |
| 69 | +## More information |
| 70 | + |
| 71 | +In some cases, the instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] may appear unresponsive. If you query `sys.dm_exec_requests` dynamic management view, you notice that the `LogWriter` thread and other threads that are performing DML operations are waiting indefinitely with WRITELOG wait_type. Other sessions may also be waiting while they try to obtain locks. |
0 commit comments