How to fix Error 13173 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 13173 – Database Master Key Issues

Why This Error Happens

Error 13173 in SQL Server 2025 typically occurs when the Database Master Key (DMK) cannot be decrypted or located, often because the master key is missing, corrupted, or the Service Master Key (SMK) encryption chain has been broken. This commonly happens after a database is restored or attached to a different server instance than the one on which it was originally encrypted, causing a mismatch between the SMK and the DMK. Additionally, missing ENCRYPTION BY PASSWORD credentials or an absent backup of the master key can prevent SQL Server from opening the key automatically.

Step-by-Step Resolution Guide

Step 1: Verify the Master Key Exists in the Database

  • Run the following query to check if a master key is present:
  SELECT * FROM sys.symmetric_keys WHERE name = '##MS_DatabaseMasterKey##';
  • If no rows are returned, the master key does not exist and must be created using:
  CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'StrongPassword!123';

Step 2: Open the Master Key Manually

  • If the key exists but cannot be decrypted automatically, force it open with:
  OPEN MASTER KEY DECRYPTION BY PASSWORD = 'StrongPassword!123';
  • If this fails, it confirms the key is corrupted or the password is incorrect/unknown.

Step 3: Restore the Master Key from Backup

  • Locate your master key backup file, typically stored at:
    C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Backup\
  • Restore it using:
  RESTORE MASTER KEY FROM FILE = 'C:\Backup\DatabaseMasterKey.key'
  DECRYPTION BY PASSWORD = 'OriginalBackupPassword'
  ENCRYPTION BY PASSWORD = 'NewStrongPassword!123';
  • Ensure the SQL Server service account has read permissions on this backup file path in Windows 11/Server 2025 file security settings.

Step 4: Re-Encrypt the Master Key with the Service Master Key

  • To ensure automatic decryption on server restart, run:
  ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY;
  • This re-establishes the encryption chain so SQL Server can open the key without manual intervention.

Step 5: Back Up the Master Key Immediately

  • Once the key is restored or recreated, create a fresh backup to prevent future 13173 errors:
  BACKUP MASTER KEY TO FILE = 'C:\Backup\DatabaseMasterKey_New.key'
  ENCRYPTION BY PASSWORD = 'SecureBackupPassword!456';
  • Store this file securely outside the SQL Server directory structure.

Alternative or Verification Steps

  • Verify the fix by restarting the SQL Server 2025 service via services.msc and confirming the database opens without triggering Error 13173 in the SQL Server Error Log.
  • If the issue persists, check for Extensible Key Management (EKM) module conflicts or validate that the Service Master Key itself is intact using DBCC CHECKDB and SMK backup/restore procedures.