How to fix Error 3072 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 3072 – Backup Encryption Incompatible with File Snapshot Backup

Why This Error Happens

Error 3072 occurs because SQL Server 2025’s file snapshot backup feature requires Transparent Data Encryption (TDE) to be enabled when backup encryption is also specified, as snapshot-based backups rely on the database’s own encryption layer rather than applying encryption at the backup stream level. Without TDE active on the database, the backup engine has no underlying encrypted state to reference during the VSS/VDI snapshot process, causing a conflict between the requested backup encryption and the snapshot method. This typically happens when administrators configure WITH ENCRYPTION on a backup command targeting a non-TDE database while using a storage provider that supports file snapshot backups (such as SAN or Azure-based snapshot storage).

Step-by-Step Resolution Guide

Step 1: Verify Current TDE Status on the Database

  • Run the following query to check encryption state:
SELECT db.name, dm.encryption_state 
FROM sys.dm_database_encryption_keys dm 
JOIN sys.databases db ON dm.database_id = db.database_id;
  • An encryption_state of 0 or 1 confirms TDE is not currently enabled.
  • Confirm this matches the database referenced in your failed backup job.

Step 2: Enable Transparent Data Encryption (TDE)

  • Create a master key if one does not exist:
USE master;
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'StrongP@ssw0rd!';
  • Create a certificate and database encryption key, then enable TDE:
CREATE CERTIFICATE TDECert WITH SUBJECT = 'TDE Certificate';
USE [YourDatabase];
CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_256 ENCRYPTION BY SERVER CERTIFICATE TDECert;
ALTER DATABASE [YourDatabase] SET ENCRYPTION ON;
  • Confirm the certificate is backed up immediately to C:\SQLBackups\Certificates\ to avoid future recovery issues.

Step 3: Reconfigure the Backup Command for Compatibility

  • If TDE cannot be enabled due to business constraints, remove the WITH ENCRYPTION clause from your backup script and rely solely on TDE-based protection instead:
BACKUP DATABASE [YourDatabase] 
TO DISK = 'C:\SQLBackups\YourDatabase.bak' 
WITH FILE_SNAPSHOT;
  • Alternatively, disable file snapshot backup and use standard backup encryption if TDE is not an option:
BACKUP DATABASE [YourDatabase] 
TO DISK = 'C:\SQLBackups\YourDatabase.bak' 
WITH ENCRYPTION 
(ALGORITHM = AES_256, SERVER CERTIFICATE = BackupCert);

Step 4: Restart SQL Server Service and Re-run Backup Job

  • Open Services.msc on Windows Server 2025 and restart the SQL Server (MSSQLSERVER) service to ensure encryption settings are fully applied.
  • Re-trigger the backup job via SQL Server Agent or manually through SSMS.

Alternative or Verification Steps

  • Confirm success by checking sys.dm_database_encryption_keys again — encryption_state should now show 3 (encrypted), and the backup job should complete without Error 3072.
  • If enabling TDE is not feasible in your environment, avoid file snapshot backups entirely and use traditional streaming backups with encryption, as this bypasses the snapshot/TDE dependency altogether.