How to fix Error 3095 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3095 — Backup Encryption/Media Format Mismatch

Why This Error Happens

This error occurs when SQL Server attempts to append an encrypted backup to an existing media set that was originally formatted without encryption (or with a different, incompatible encryption configuration). SQL Server backup media sets store structural metadata on the first write, and encryption settings cannot be mixed or altered on an existing media set — they must be consistent across all backup sets within that media family. This typically happens when a backup script or maintenance plan is updated to include WITH ENCRYPTION without first accounting for pre-existing .bak or .trn files on disk or tape.

Step-by-Step Resolution Guide

Step 1: Identify the Conflicting Media Set

  • Check the backup command or job step that triggered the error — look for WITH ENCRYPTION combined with NOINIT or APPEND options in the T-SQL script.
  • Run RESTORE HEADERONLY FROM DISK = 'C:\Backups\YourDB.bak' in SSMS to inspect existing media set properties and confirm it was not originally encrypted.
  • Note the file path and name of the existing backup media causing the conflict.

Step 2: Format a New Media Set Instead of Appending

  • Modify your backup T-SQL statement to use WITH FORMAT, INIT instead of NOINIT when encryption is required, since you cannot append encrypted backups to non-encrypted media.
  • Example corrected syntax:
  BACKUP DATABASE [YourDB]
  TO DISK = 'C:\Backups\YourDB_Encrypted.bak'
  WITH FORMAT, INIT,
  ENCRYPTION (ALGORITHM = AES_256, SERVER CERTIFICATE = YourBackupCert);
  • Save this as a new file name to avoid overwriting historical backups unintentionally.

Step 3: Verify Certificate or Asymmetric Key Availability

  • Confirm the encryption certificate or asymmetric key referenced in the backup command exists in the master database by running SELECT name, pvt_key_encryption_type_desc FROM sys.certificates;.
  • If missing, create or restore the certificate using CREATE CERTIFICATE before re-running the backup job.
  • Ensure the certificate has a valid, non-expired status and that you have a backed-up copy of the certificate and private key stored securely offsite.

Step 4: Update Maintenance Plans or Automation Scripts

  • Navigate to SQL Server Agent → Jobs (in SSMS) and edit any scheduled backup job steps that reference the old media set path.
  • Update the destination path in the job step to point to the newly formatted, encrypted backup file established in Step 2.
  • Re-enable the job schedule and monitor the next automated run in the Job Activity Monitor.

Alternative or Verification Steps

  • Run the new backup command manually in SSMS and confirm it completes without Error 3095; then verify integrity with RESTORE VERIFYONLY FROM DISK = 'C:\Backups\YourDB_Encrypted.bak'.
  • If encryption is not strictly required, remove the ENCRYPTION clause entirely and continue appending to the original non-encrypted media set as a quick workaround.