One of my clients contacted me in assistance to install SQL Server. Generally, this is straightforward, but sometimes there are problems. This time we received an error message and it was very interesting. Let us learn about error related to the XML Document.
SQL Server Setup has encountered the following error:
There was an error generating the XML document.
Error code 0x84B10001.
When we searched on the internet, we were asked to see more details in setup logs. In Summay.txt we were seeing below the messages.
HResult : 0x80090345
Stack:
at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope)
at Microsoft.SqlServer.Common.SqlSecureString.WriteXml(XmlWriter writer)
If we look at the start place of the error, it says System.Security.Cryptography.CryptographicException. This means that there are some issues while encryption of the data. And the real error message is “The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.”
When I searched with above two, then I found that this can happen when there is Read Only Domain Controller (RODC).
WORKAROUND/SOLUTION
To solve this, we created the registry entry DWORD Protection Policy and set to 1 to enable local backup of the MasterKey instead of requiring a RWDC in the following registry subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb
Setting this value to 1 causes DPAPI master keys to be backed up locally rather than using a domain backup. For more information about DPAPI you can read
This workaround is documented in https://support.microsoft.com/en-in/help/3000850/november-2014-update-rollup-for-windows-rt-8.1,-windows-8.1,-and-windows-server-2012-r2
Reference: Pinal Dave (http://blog.SQLAuthority.com)
3 Comments. Leave new
Can you give a quick description of how adding this registry key affects the security of the server? This fixes our inability to use SQL Logins locally, and it seems like it’d be pretty benign to me. However, I’m proably going to need to explain it to our network guys to push it out.
This:
https://support.microsoft.com/en-us/help/3000850/november-2014-update-rollup-for-windows-rt-8-1-windows-8-1-and-windows
(the link that helped me find this article) is more of a description of how the problem was introduced and how to get around it – it doesn’t say, “This makes your DPAPI more vulnerable to an attack, if…” which is what I’d really like to know!
I hope that helps clarify…
Hi Dave, I think the registry key should be ProtectionPolicy and not Protection Policy