How to fix Error 9641 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 9641 — Cryptographic Operation Failed

Why This Error Happens

Error 9641 occurs when SQL Server’s cryptographic provider (either the built-in Windows CNG/CAPI provider or an Extensible Key Management [EKM] module) fails to perform an encryption, decryption, or key-signing operation. This is typically caused by a corrupted or inaccessible Database Master Key (DMK), Service Master Key (SMK), or certificate, insufficient permissions on the key container in the Windows profile, or an underlying issue with the operating system’s cryptographic services (such as a corrupted key store or a disabled/misconfigured Cryptographic Services provider). It can also stem from a failed Windows Update or FIPS policy change that invalidated existing certificate-based encryption chains.

Step-by-Step Resolution Guide

Step 1: Review the SQL Server and Windows Event Logs

  • Open SQL Server Management Studio (SSMS) and navigate to Management > SQL Server Logs to locate the exact timestamp of Error 9641.
  • Cross-reference with the Windows Event Viewer under Windows Logs > Application and System for related CryptoAPI (Event ID 11) or Schannel errors.
  • Note any associated error (e.g., missing certificate thumbprint, key container not found) as this narrows down whether the issue is DMK, SMK, or a specific certificate.

Step 2: Verify and Repair the Service Master Key (SMK) and Database Master Key (DMK)

  • Run the following in a new query window to check SMK integrity:
  SELECT * FROM sys.key_encryptions;
  • If the SMK is suspected corrupted, restore it from a known good backup:
  RESTORE SERVICE MASTER KEY FROM FILE = 'C:\Backups\service_master_key'
  DECRYPTION BY PASSWORD = 'YourStrongPassword';
  • For a corrupted DMK on a specific database, open it manually to force regeneration:
  OPEN MASTER KEY DECRYPTION BY PASSWORD = 'YourStrongPassword';
  ALTER MASTER KEY REGENERATE WITH ENCRYPTION BY PASSWORD = 'YourStrongPassword';

Step 3: Check File System Permissions on the Key Container

  • Confirm the SQL Server service account (visible under SQL Server Configuration Manager) has read/write access to:
  C:\Users\<ServiceAccount>\AppData\Roaming\Microsoft\Crypto\RSA\
  C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\
  • Right-click the folder, select Properties > Security, and ensure the service account has Full Control.
  • Restart the SQL Server service after applying permission changes via services.msc or:
  Restart-Service -Name "MSSQLSERVER" -Force

Step 4: Validate Windows Cryptographic Services and Certificates

  • Ensure the Cryptographic Services Windows service is running (services.msc > Cryptographic Services > Status: Running).
  • If using EKM or TDE with a certificate, validate the certificate hasn’t expired:
  SELECT name, expiry_date FROM sys.certificates;
  • Re-import or renew any expired certificate, then re-encrypt the DMK/SMK referencing it.

Step 5: Apply Latest Cumulative Updates and Reboot

  • Confirm SQL Server 2025 is patched to the latest Cumulative Update (CU) via SSMS > Help > About.
  • Apply pending Windows Updates on Windows Server 2025 / Windows 11, particularly security and .NET Framework patches affecting cryptographic libraries.
  • Perform a full system reboot to ensure the updated crypto providers are loaded cleanly.

Alternative or Verification Steps

  • Run DBCC CHECKDB and attempt a test backup/restore cycle with encryption enabled to confirm the cryptographic chain is now functioning without triggering Error 9641.
  • If the error persists, isolate the issue by temporarily disabling TDE or EKM-dependent features (if non-production) to confirm whether the fault lies within SQL Server’s internal key management or an external HSM/EKM provider.