How to fix Error 3467 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 3467 occurs when a database using Always Encrypted with secure enclaves is restored, but the secure enclave (VBS-based or SGX-based) cannot access the column encryption keys needed to replay or roll back deferred transactions. This typically happens because the enclave attestation service is unreachable, the enclave was reset/rebooted after the backup was taken, or the column master key (CMK) provider does not have the enclave-enabled permissions required post-restore. Without a valid attestation handshake, SQL Server cannot decrypt the enclave-bound data needed to resolve the pending transactions.

Step-by-Step Resolution Guide

Step 1: Verify Attestation Service Connectivity

  • Confirm the Host Guardian Service (HGS) or Microsoft Azure Attestation (MAA) endpoint is reachable from the SQL Server instance.
  • Run Invoke-WebRequest -Uri "<attestation-url>/attest" from PowerShell on Windows Server 2025 to confirm a 200 response.
  • Check sys.dm_column_encryption_enclave_providers to confirm the attestation URL matches the server-level configuration (sp_configure 'column encryption enclave type').

Step 2: Re-establish the Enclave Session

  • Restart the SQL Server service to force a fresh enclave initialization: Restart-Service MSSQLSERVER.
  • If using VBS enclaves on Windows Server 2025, confirm Virtualization Based Security is enabled via msinfo32.exe (look for “Virtualization-based security: Running”).
  • Re-run the attestation policy check: Get-HgsAttestationBaselinePolicy (for HGS) to ensure the TPM baseline still matches the host.

Step 3: Resolve the Deferred Transactions Manually

  • Open SQL Server Management Studio (SSMS) and query sys.dm_tran_database_transactions to identify the deferred transaction IDs tied to the restored database.
  • Run DBCC OPENTRAN('YourDatabaseName') to confirm the oldest active transaction blocking resolution.
  • If the enclave keys are confirmed permanently inaccessible (e.g., CMK was deleted or rotated), use ALTER DATABASE SET ENCLAVE_COMPUTATIONS SUPPORTED = ON after re-provisioning the column master key via sp_configure and re-registering it in sys.column_master_keys.

Step 4: Rebuild the Column Master Key Enclave Bindings

  • Use PowerShell with the SqlServer module: Import-Module SqlServer then New-SqlColumnMasterKeySettings to recreate the enclave-compatible key metadata.
  • Re-run the original ALTER COLUMN ENCRYPTION KEY statement with the ENCLAVE_COMPUTATIONS clause to force SQL Server to regenerate the enclave session key.

Alternative or Verification Steps

  • To verify the fix, run DBCC OPENTRAN again — if it returns no active transactions, the deferred transactions have been successfully resolved.
  • If the enclave truly cannot be recovered (e.g., key material is permanently lost), restore from a backup taken before enclave encryption was enabled, then re-apply Always Encrypted with secure enclaves using a fresh CMK/CEK pair.