What I did have was access to the box with the database still running and the associated key hierarchy still operational (symmetric keys and the like).

I’ve not done too much messing around with the database master key before, feeling it was best left well alone, however the need to migrate this DB was there and I needed to pull it across without loosing access to the encrypted data.

To prototype this activity out I created a database on my local DB server and utilized the services of another Sql Server 2008 Server elsewhere in the organization.

So, first off I needed to create the key hierarchy and a place to store my test encrypted data:

Create Master Key Encryption By Password = 'abc123!!!ORIGINAL';
Create Asymmetric Key AKey With Algorithm = RSA_2048;
Create Symmetric Key SKey With Algorithm = TRIPLE_DES_3KEY
    Encryption By Asymmetric Key AKey
Create Table dbo.ASaucerfulOfSecrets
    (
        TheSecret        VarBinary(MAX)
    )
Open Symmetric Key SKey Decryption By Asymmetric Key AKey;
Insert Into dbo.ASaucerfulOfSecrets Values
    ( EncryptByKey(Key_Guid('SKey'), N'Ssssh! This is a BIG secret!'
                                   , 1, 0x12345));
Close Symmetric Key SKey;

I confirmed that encryption was working as expected by simply pulling the data back:

Select *
From dbo.ASaucerfulOfSecrets
Open Symmetric Key SKey Decryption By Asymmetric Key AKey;
Select Cast(DecryptByKey(TheSecret, 1, 0x12345) As NVarChar(MAX))
  From dbo.ASaucerfulOfSecrets;
Close Symmetric Key SKey;

Which gave me the following results

TheSecret

0x00496C61F87C4941BF7CBE8C879146BA0100000043C4B3F8824C73EBF3C0…

(No column name)

Ssssh! This is a BIG secret!

Life so far was operating within the expected parameters. Now I backed up the DB and restored it to a different server.

Running the select again I got the expected exceptions raised due to the inability to open the Database Master Key:

(1 row(s) affected)

Msg 15581, Level 16, State 3, Line 3

Please create a master key in the database or open the master key in the session before performing this operation.

(1 row(s) affected)

Msg 15315, Level 16, State 1, Line 5

The key ‘SKey’ is not open. Please open the key before using it.

So, now came the exercise of correcting the issue. Given that we had supposedly lost the password to the original DB, it’s safe to assume that one would want to recreate it (and this time, write the bloody thing down somewhere!). So that’s the approach I took. Back on the source server I ran the following:

Alter Master Key Regenerate
    With Encryption By Password = 'abc123!!!New'

The Books OnLine warns that this can be an intensive process and I suppose it comes down to just how many keys you have defined in your hierarchy. For the purposes of this test I had but one key so I wasn’t worried. Now I had a Master Key password that I knew of so I performed another backup, moved the DB to the secondary server and restored it. Just for giggles I reran the select again and received (rather unsurprisingly) the same results.

Next I tried the select again but only after explicitly opening the Database Master Key (with the ‘new’ password):

Open Master Key Decryption By Password = 'abc123!!!New'
Select *
From dbo.ASaucerfulOfSecrets
Open Symmetric Key SKey Decryption By Asymmetric Key AKey;
Select Cast(DecryptByKey(TheSecret, 1, 0x12345) As NVarChar(MAX))
  From dbo.ASaucerfulOfSecrets;
Close Symmetric Key SKey;

This did indeed pull back the decrypted data. Now for the final action – adding the Service Master Key to the Database Master Key:

Open Master Key Decryption By Password = 'abc123!!!New';
Alter Master Key Add Encryption By Service Master Key;

This enabled the encryption to use either an explicitly opened master key, or use the service master key – which is exactly what I was after.

I was able to confirm the results by performing the select again (without opening the master key first) and this gave me my encrypted data back. Tada!

The problem I was having was getting Sql Server to load an SSL certificate to encrypt communications between client and server on a clustered instance. No matter how many times I tried, Sql refused to run issuing a 0x8009030d error code when attempting to load the certificate. I was always getting the following logged in my ErrorLog:

Server The server could not load the certificate it needs to initiate an SSL connection. It returned the following error: 0x8009030d. Check certificates to make sure they are valid.

Server Error: 26014, Severity: 16, State: 1.

Server Unable to load user-specified certificate. The server will not accept a connection. You should verify that the certificate is correctly installed. See "Configuring Certificate for Use by SSL" in Books Online.

Server Error: 17182, Severity: 16, State: 1.

Server TDSSNIClient initialization failed with error 0×80092004, status code 0×80.

Server Error: 17182, Severity: 16, State: 1. 2011-10-26 07:26:42.75 Server TDSSNIClient initialization failed with error 0×80092004, status code 0×1.

Server Error: 17826, Severity: 18, State: 3.

Server Could not start the network library because of an internal error in the network library. To determine the cause, review the errors immediately preceding this one in the error log.

Server Error: 17120, Severity: 16, State: 1.

Server SQL Server could not spawn FRunCM thread. Check the SQL Server error log and the Windows event logs for information about possible related problems.

I’d come across a few posts that mentioned this error and that Sql was having issues with the Private Key but they suggested using commands from the Resource Kit to fix the issue – something I could not do. To make matters worse (as my previous post described) Checkpointing kept on getting in my way of removing the certificate, just to get Sql to start. I’d even tried things like adding the Service Account in the Administrators group in the vain hope that it was a permissions issue.

So after spending several days of tearing my hair out (and running out of time to get this fixed) I came to the conclusion I needed to bring in outside help – MS Support to the rescue!

And the answer? It was as simple as deleting the previously imported certificate then re-importing it using the domain account that runs Sql. Yup, it was that simple…

Thanks Gary!

In my situation I had added a certificate’s thumbprint to the SuperSocketNetLib key on a new cluster which, for some reason Sql took a total and utter dislike to.

I thought (in my apparent naïveté) that I could simple remove the thumbprint from the registry, restart Sql and I’d be off and running.

Not so fast though. Every time I’d restart Sql Server it would repopulate the thumbprint back into the Certificate value then fail to start as a result. No matter how many times I rebooted, took the value out of the registry and twisted on my left foot whilst swinging a chicken in the air, Sql Server stubbornly and abjectly refused to stop repopulating the value with the bad certificates thumbprint.

User baby_cheeses on SqlServerCentral.com was able to find the magic formula for stopping Sql Server from magically repopulating the registry.

I amended baby_cheeses answer slightly to fit my situation, and it is…

  1. Remove the Certificate’s thumbprint from the registry.

  2. Start Sql Server using a Net Start MSSqlServer.

  3. Check the registry again and ensure thumbprint hasn’t returned.

  4. Start up Sql Server from within Cluster Administrator

  5. Check registry a third time and remove the thumbprint from the Certificate value.

  6. Move the cluster to another node and watch it start normally.

Like I say, I can’t take credit for this discovery.

Original post is here.

UPDATE

Apparently what is happening here is known as Checkpointing, where a copy of the registry is stored on the Quorum. MS gives an official method of avoiding the problem here, although I still think baby_cheeses solution is simpler and involves far less hacking around!

We hit this error when trying to run a Estimated Query Plan on a users’ query. Didn’t make any sense since we’re SysAdmin’s on the server;  doubly-so since we could run a showplan elsewhere.

Turns out the offender in question was a call to msdb.dbo.sp_send_dbmail. Apparently bad funky things happen there if one tries a showplan on it. To solve it we simply commented out the call to the sendmail procedure out and then, the sky’s did doth part and our estimated query plan presented itself unto us..

Good to know…

They try hard hard – real hard. When an item’s in stock they not only tell you that but also which Aisle it’s in (or endcap thereof). Real nice and useful however a total FAIL when it comes to reliability.

For me if your data’s not 100% correct it’s not worth pushing. And in Target’s case they seem to have an issue with the number of items on hand bit. Depending on whom we spoke to (wither store or via the phone) that figure could be 24 hours or even more out of date ; The web site continued to proudly inform us that our local Target had a particular item in stock even when it didn’t. Even checking over 24 hours later it still told us it was available even though it wasn’t.

This effect reminds me of a crowd I did some Sql Work for late in the last c. whilst I was still in the UK. Their name shall remain known only to me and them, however the story’s true. This crowd wanted an online system to punt their wares to Joe Consumer – all wizzywzggy flash driven utilizing Sql Server on the front and back end with replication to handle to the orders. Real nice right up to the point when there order’s then ended up on a printer somewhere awaiting an operator to actually input the order to the mainframe ‘at some later point’. This of course meant the at any point in time the inventory could could vary from accurate to ‘just a stab in the dark’.

I was reminded of this antiquated hand-cranked this system with my experience at Target; if you’re going to have an inventory indicator then it’d had better be accurate to, I don’t know, the last 60 minutes at least or else it devalues the web site forcing the consumer to have to resort to the phone to double check the inventory prior to (in our case) traipsing out in the bloody snow and cold).

We’ve been using Idera’s Sql Compliance Manager at work for some time to provide a good healthy audit trail of all user database changes, good or bad, on the production DB’s. As our use grew so did it’s unsuitability to the server it was located on (needed a TB more data than the few hundred GB currently on offer would allow!). So that led me to make the biggest move yet when I had to copy nearly a year’s worth of audit data (took about 24 hours across a 1GB pipe!), followed by a total reinstalled and repointing from the client DB Servers.

I’m extremely proud to report that throughout this downtime (nearly 2 days in total), Idera didn’t miss a beat and ALL activity that took place during the move was picked up as soon as the new server came online and within a day you’d have never known there had even been the potential of a blip.

Nice work Idera – Mark me down as extremely bloody impressed.

Since then we’ve moved on a little – Email’s it seems will be handled now by Outlook 2010 with a rather superb little program called GSyncIt to handle Google integration of Contacts and Calendars. Now, GSyncIt can do Tasks as well however Google Tasks are not well represented in the Android World.

When it comes down to Cloud task managers there seem to be three main contenders:

• Remember the Milk: Nice idea, kludgy interface, expensive annual price for not much more
• Producteev: Nice interface, very happily with Astrid. Makes tasks kinda fun again. Also has some nice Google Gadgets and Labs features.
• Toodledo: More inline with the GTD philosophy and as such a reasonable cloud replacement for Achieve (which I used to use a lot until they pulled a fast one and did a v2 that was still v1 with small amendments) (despite it’s one level of SubTasks). Works VERY well with Pocket Informant.

My first choice was Producteev : it beat Milk hands down on the user interface, had a very nice price (free for 2 people sharing) and felt very smooth – especially with it’s hooks into Astrid. However my decision was eventually made for me by WebIS’s PI. They had standardized on ToodleDo for their task synchronization, and now apparently I hear that Pure Calendar also talks to PI.

Granted Toodledo’s subtask feature takes it from free to $14.95, but that’s still cheaper than Milk Pro – and $14.95 per user more expensive than Producteev (sometimes it’s kinda tough to beat free).

I still like Producteev a lot and I really hate to move away from it – they’re a extremely competent offering and I recommended them a lot.. If it wasn’t for PI I probably wouldn’t have changed. However I’ve used Pocket Informant on mutiple platforms (I think they may have even had a Palm v3.0 edition at one point) and I have become a major fan of the software – task and event templates alone make it a worthwhile purchase.

Granted I could have stuck with something like Jorte and an Astrid\Producteev combo but I feel like I’m addicted to the Web IS offering – and I don’t want to give it up.

The final item that pushed me to the Toodledo camp was at least it had some level of Outlook synchronization with Chromatic Dragon’s offering (I swear I remember that domain from the late 90’s as a crowd who offered Windows Theming software). Producteev had spoken about the possibility of one way back in August but none was forthcoming).

So, my life is now complete. I can use Outlook, the web or my Droid Incredible to handle all my PIM needs. And I’m now fully in the folds of David Allens GTD world!

I should probably add here that before I settled on iDrive I had also briefly auditioned Mozy but quickly threw that idea out.

So at this juncture I was left with iDrive ion the SO’s PC, Carbonite on mine and Genie Timeline on both performing local backups. Trouble is, I’m a control freak and none of this was giving me the confidence that all was really well on both PC’s – yet alone my Linux Mint (yeah, I switched back to Mint!) Netbook which was left swinging in the wind with a collection of important files on there left from various vacations (which is when the Netbook get’s pressed into action the most).

Crashplan made it’s presence known through the strongest advertising I’d seen myself. Every time I flicked on Evernote there was a prod to try it out (I used Evernote a lot). Then the pushed through their Thanksgiving Cyber-Monday sale which I still refused to take a bite out (mainly because it didn’t address at the time there sudden disappearance of Crashplan+), even through the short term sale of a 3 years 3 PC offer seemed tempting.

Now, what made me make the jump was the sales structure AFTERWARDS. Sure the 3 year (for the price of 2 years) 3 PC deal had vanished but in it’s place was a 4 Year ‘All you can eat’ plan. This was indeed tempting – so much so that I quickly installed a copy on my PC as a 30 day trial and began thro throw more and more at it.

Here’s what I liked so much:

• Multiple PC’s in the same household are all covered
• Windows, Linux or Mac makes no odds – still covered.
• Backup to cloud, local drive or another PC – snap (no more need for Genie Timeline 2.0)
• Email and Twitter both utilized for alerting of failed backups.
• Multiple backup sets (e.g. my AppData stuff I backup only to a local drive and another PC)
• Single source backup – no mo longer need third party applications to backup outside of the cloud.

So after auditioning it myself (I dogfood pretty much everything before it get’s put on my wife’s PC) – I came out a true believer. We checked the budget, confirmed we had the cash for a 4 year upfront payment and set the ball rolling

I then threw the kitchen sink at it. All my original sized pictures, MP3’s AppData – the whole shebang and it ate it all up with aplomb and gusto.It finished the wife’s full backup to the cloud a few days ago which means that I know can finally shut off the iDrive and Genie spigots.

My backup’s still running, but only because my 50GB MP3 collection has been set to backup during the night time only – I still have 3 months of Carbonite subscription left on my PC so I’m not so worried about getting it done ASAP – ‘sides, I do like my bandwidth!

So now I’m happy – less to maintain and more completeness – what a combo!

However I will have to admit that in terms of providing a unified cloud for governing ones life (email, documents, tasks, calendar etc) then they do have more than an edge on their competitors. Granted Microsoft has their Office Live and Windows Live sites however it doesn’t do much for you on the email front unless you’re an educational establishment – and I needed a total a solution as I could get.

My spouse and I have both been long time Outlook users and I’ve been using Outlook 2010 for the last 2-3 months, however given the fact that we’re both wanting more ‘anywhere anytime’ access to our data and the fact we’re both getting into more social networking, it fell upon my shoulders to find a solution that would make both of us happy.

Where Microsoft has Live and Outlook then, Google has Thunderbird (or Evolution or any other application that does IMAP – including Outlook). And being a bit of a control freak (in other words I like to have a central ‘command’ console whenever possible) Google Apps Standard seemed to fit the bill for myself and ‘she who must be obeyed’.

Currently we use 1&1 for our email handling – I also use it to host all the images etc. in this blog, in addition to allowing other family members to use it for their web needs as well). Being paranoid buggers, neither myself, nor my better half like using single email addresses for everyone. So instead we generate email random addresses for each company we contact – that way when an address should somehow find its way onto a Spam list (as 4-5 have these last 2 years) we can simple blow that address away and we’re back to a spam free existence. So given our investment already in 1&1 I was loath to drop it – so I didn’t and instead incorporated it into my overall solution and ended up simply forwarded emails to the new address (which was especially nice since it allowed me to run both systems side by side for a while).

Utilizing 1&1’s domain DNS management features (it allowed me to easily modify the MX records and CNames as required) and free sub-domains I was able to set up a new sub-domain for all my mobile communications need and attach that to Google apps. This allowed me to set up friendly URL’s to each service (Mail, Calendar etc).

Then came configuring GMail accounts for us both making sure we kept as much of our existing Outlook functionality as possible (shared calendars and tasks using Sync2Pst) whilst gaining more functionality (unified view of the data, regardless of which OS, PC or mobile device we use). This necessitated using Thunderbird (I did try Evolution which ran OK on my Ubuntu box but failed miserably to work on the Windows port) using a handful of addons (Lightening, Google Calendar Provider for Lightening and the rather excellent although still in beta (for v3 anyway) gContactSync) to name but three. With this in hand I was able to achieve my first directive from the boss – no duplication of work – in other words should she delete an email using (the soon to arrive) Droid Incredible she wanted it gone everywhere. Equally if she updated a contact in Thunderbird, she’d expect to see the same update on her phone. The sharing of calendars was the easiest bit using Google’s direct calendar sharing facilities.

This still leaves us with some holes which we’ve either got a workaround for (tasks are Calendar entries) or no solution (sharing contacts between us) however I continue to look for answers as and when they should transpire.

Google apps also gives us access to several other shared applications what we can use a single sign on for which makes the deal even better including a HelpDesk app which allows her to get me to fix computer issues without nagging me every 5 minutes!

Now, this is not perfect I’ll admit, however given the alternatives (or lack thereof) it’s the best solution (especially given that we’re both about to get Droid’ed).

I’m also hoping that Google do begin to migrate Picasa soon to Google Apps since that would make handling our pictures easier and please Google, bring out an API for tasks!

Linux Mint I heard, was meant to be the most user friendly version of Linux one could get. However I myself found it kludgy and it felt just a tad bit hostile. Configuring and installing Software packages I found somewhat counter-intuitive – first of all I did like the idea that one has to select packages and libraries, just to say, grab a copy of Evolution. Secondly I found it surprising that the installation would then sit there with a rather obscure ‘waiting for lock’ message. It took me a while to realize the lock was the package browser (or whatever it’s called).

Compiz had it’s own challenges and I was forced to spend some time surfing the web to find out what it could – and couldn’t do. Cute effects but still a bit of a pain to configure. Also, not helping Mint was the failure to launch the UFW GUI from the main GUI window. Had to again surf the web to find out how to launch it manually.

And all this concerns me; I’ve been a long time Windows user at home (and predominantly at work). The Windows 7 install was simple and I found everything worked out the box. Dialog boxes were informative and well designed and I found it so much easier to navigate. Mint felt like a major step backwards and I was going to be hard pushed to convince my partner to allow me to put Mint on the family Asus 1008 eeE PC netbook.

This however is not the end of my return to Linux. Last night I decided to download a Live CD copy of Ubuntu 10.04 LTS onto a wee lil’ USB Stick and did a Live Boot of that onto the netbook (which currently still runs the default XP O/S).

What a difference it felt like! Right from the Get Go I felt welcomed into Ubuntu’s warm embrace – this was a Linux distro that seemed to wanted me as a friend. I was happy to see many of the standard applications were pre-installed and ready to rock and within just a few minutes I’d already had Evolution configured and syncing to my Google Calendar (yeah, I know it all get’s blown away when I reboot, but this was a PoC test only).

I’ll be interested to see if this feeling translates to a full-blown laptop install. I hope so because I’m seriously considering putting Ubuntu on the Netbook this weekend (if the other [and more important] half gives me the go-ahead). However in the meantime I think I’ll be replacing Mint with Ubuntu on the laptop to see how well it goes there.

In the meantime I’ve left Ubuntu running on the Asus and let my partner test drive it for a few days to see how she feels about it.

Fingers crossed!