How to fix Error 3099 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 3099 occurs when the BACKUP command includes WITH ENCRYPTION syntax while simultaneously targeting a media set that is already protected by a password or a different encryption configuration (such as MEDIAPASSWORD or PASSWORD). SQL Server 2025 strictly enforces that a backup media set cannot mix legacy password protection with native backup encryption keys/certificates. This conflict usually arises when a maintenance plan or script was updated to include encryption but was pointed at an existing .bak file or media set that retains old password metadata from a previous backup job.

Step-by-Step Resolution Guide

Step 1: Identify the Conflicting Backup Syntax

  • Open the T-SQL script or SQL Server Agent Job Step that triggered the error.
  • Look specifically for the coexistence of WITH ENCRYPTION (...) and PASSWORD = '...' or MEDIAPASSWORD = '...' in the same statement.
  • Note the target backup device path (e.g., D:\SQLBackups\MyDB.bak).

Step 2: Isolate the Backup Media Set

  • If encryption is required, ensure you are writing to a new backup file rather than appending to an existing media set.
  • Modify the script to use INIT instead of NOINIT, or specify a fresh file name:
  BACKUP DATABASE [MyDB] 
  TO DISK = N'D:\SQLBackups\MyDB_Encrypted_New.bak' 
  WITH INIT, 
  ENCRYPTION (ALGORITHM = AES_256, SERVER CERTIFICATE = MyBackupCert);
  • Avoid combining MEDIAPASSWORD with the ENCRYPTION clause in the same command.

Step 3: Verify Certificate or Key Availability

  • Confirm that the Encryptor (Certificate or Asymmetric Key) referenced in the script exists in the master database.
  • Run the following query to check the certificate status:
  SELECT name, pvt_key_encryption_type_desc, issuer_name 
  FROM sys.certificates 
  WHERE name = 'MyBackupCert';
  • If the certificate is missing, restore it from a secure backup location or create a new one using CREATE CERTIFICATE.

Step 4: Re-run the Backup Job

  • Update the SQL Server Agent Job or Maintenance Plan with the corrected syntax (removing the deprecated password parameter).
  • Execute the job manually via SQL Server Management Studio (SSMS) on the Windows Server 2025 host to confirm the syntax is accepted without throwing Error 3099.

Alternative or Verification Steps

  • Verification: Check the SQL Server Error Log (via EXEC sp_readerrorlog) immediately after the job runs to confirm the backup completed successfully without exception 3099.
  • Alternative: If legacy compatibility is required and native encryption is not strictly necessary, remove the ENCRYPTION clause entirely and rely solely on Transparent Data Encryption (TDE) at the database level, which encrypts the backup automatically without needing specific backup command flags.