How to fix Error 3466 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 3466 — Deferred Transactions Unresolved Due to Unavailable Enclave Keys

Why This Error Happens

This error occurs when SQL Server restores a database that uses Always Encrypted with secure enclaves, but the deferred transactions in the transaction log require encryption keys that are not currently loaded into the secure enclave. The enclave is typically reinitialized after a service restart, failover, or restore operation, which clears any previously cached column encryption keys. Until the required keys are resent to the enclave using sp_enclave_send_keys, SQL Server cannot finish replaying or rolling back these deferred transactions because it cannot decrypt the enclave-protected data or key material involved.

Step-by-Step Resolution Guide

Step 1: Verify Enclave Configuration and Status

  • Confirm that the database is configured to use a secure enclave by checking sys.column_encryption_keys and sys.column_master_keys for enclave-enabled key entries.
  • Run the following to check enclave type configuration:
  SELECT * FROM sys.database_scoped_configurations WHERE name = 'PREEMPTIVE_ENCLAVE_TYPE';
  • Ensure the enclave attestation URL (for VBS or SGX enclaves) is reachable from Windows Server 2025 / Windows 11.

Step 2: Resend Encryption Keys to the Enclave

  • Open a new query window connected to the affected instance with a client driver that supports Always Encrypted with secure enclaves (ODBC 17.3+ or newer ADO.NET).
  • Execute sp_enclave_send_keys to push the required column encryption keys back into the enclave:
  EXEC sys.sp_enclave_send_keys
      @column_encryption_key = 0x0123456789ABCDEF...,
      @column_encryption_key_database_name = N'YourDatabaseName';
  • Confirm the key values match those stored in sys.column_encryption_keys to avoid key mismatch errors.

Step 3: Resolve the Deferred Transactions

  • After keys are successfully sent, manually trigger recovery to resolve pending transactions:
  ALTER DATABASE YourDatabaseName SET ONLINE;
  • If the database remains in a “Recovery Pending” or “Suspect” state, run:
  DBCC CHECKDB (YourDatabaseName) WITH NO_INFOMSGS;
  • Monitor SQL Server error logs (ERRORLOG in C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\) for confirmation that deferred transactions have cleared.

Step 4: Restart the Enclave Host Process (If Required)

  • If keys fail to load even after sp_enclave_send_keys, restart the SQL Server service to reinitialize the VBS/SGX enclave host process.
  • Use PowerShell as Administrator:
  Restart-Service -Name 'MSSQLSERVER' -Force
  • Re-run Step 2 immediately after the service comes back online, since enclave state is cleared on every restart.

Alternative or Verification Steps

  • Verify resolution by querying sys.dm_tran_database_transactions to confirm no transactions remain in a deferred state for the affected database.
  • If the issue persists, consider performing a clean restore from a backup taken after the enclave keys were properly provisioned, avoiding partial or mid-transaction backup points.