You’re offline. This is a read only version of the page.
139
Hello CRM Community,
I am in the process of migration 3 applications from Dynamics 2015 v7 on premise to Dynamics 365 v9 on premise. Ive been through the threads on lost or missing encryption keys and still not finding anything to help resolve my specific issue.
Heres what ive done for each application:
Out of these 3 Orgs i have on the v9 Dynamics platform, only 1 has allowed me to activate data encryption with same source key! The other 2 give me the "doesn’t match the original encryption key". Its really confusing to me only this 1 has allowed me when I know for a fact what the source keys are!
I have the source Orgs, DBs, and Config DB from the 2015 v7 platform. Each Org had Encryption Enabled to where I can pull them straight from CRM UI. Ive done the SQL to query them from MSCONFIG db and used a C# Console App to decrypt it like here: https://szczepan.net/?p=152 It generates the same ones ive pulled manually.
Ive tried different copy and pasting methods too!
I would rather avoid making new encryption keys because Im not too sure what all that might impact as ive never messed with this.
Any help would be appreciated!
The encryption key is stored in mscrm_config so if an organization is moved to another deployment, then the key reference will be missing.
In this case a new key can be created (HTTPS needs to be enabled).
Changing password won’t have any impact, but only if HTTPS is already enabled.
Step 1:
use MSCRM_CONFIG
Delete from OrganizationProperties where Id = '<ORG ID>' and ColumnName IN('SymmetricKeyPassword' , 'SymmetricKeySource')
(NOTE: Get <ORG ID> from the MSCRM_CONFIG with:
SELECT Id FROM Organization WHERE UniqueName = 'YourCRMOrgName'
)
Step2:
--Remove key from DB
use <<YourCRMOrgName>>_MSCRM
drop symmetric key CrmSymmetricKey1
Step3:
--Reset all values to null in your CRM organisation DB:
USE <<YourCRMOrgName>>_MSCRM
Update EmailServerProfileBase set IncomingPassword = null, OutgoingPassword = null
Update MailBoxBase set Password = null
Update queuebase set emailpassword = null
Update usersettingsbase set emailpassword = null
update LocalConfigStoreBase set Value=null where Value is not null
update ServiceEndpointBase set SASKey=null where SASKey is not null
update ServiceEndpointBase set SASToken=null where SASToken is not null
Above 3 steps needs to run in same order and one-by-one, check for errors before proceeding between steps.
These fields will be set to null, but the first 4 values can be re-entered (re-configured in CRM) and the last 3 will be automatically set once you activate the new key.
(Also, if you are not using server side sync, then you don’t have to re-enter the first 4, they are only used for server side sync.)
Hi Protim,
I followed your steps and they seemed to have worked.
I never got the "Current Encryption Key" field to be active or editable and it still had encryption status "Inactive", but I put the source key in the "Activate Encryption Key" field and it activated after the SQL and IIS reset!
Thanks for the help!
Hi,
Thank you for your query.
In some rare instances the previously saved Encryption does not work as the system fails to identify the key and you see the error below,
"Data encryption can't be activated because the encryption key doesn't match the source encryption key used to encrypt the data. If you contact support, please provide the technical details."
In this case, in order to remove the Previously saved usernames and passwords associated with the prior Exchange Server-Side Synchronization setup you can execute the script below on the CRM Database,
1. Make a backup of the CRM organization database.
2. Execute the Script below,
USE LegacyCRMOrg_MSCRM // <Replace the "LegacyCRMOrg_MSCRM" with te DB name >
UPDATE EmailServerProfile SET IncomingPassword=null
UPDATE EmailServerProfile SET OutgoingPassword=null
UPDATE Mailbox SET Password=null
UPDATE Queue SET EmailPassword=null
UPDATE UserSettings SET EmailPassword=null
3. Restart IIS
- Open elevated Command Prompt (Run as Administrator).
- Execute command "IISRESET".
4. Sign in to Microsoft Dynamics 365 as a user with the system administrator security role.
a. Go to Settings > Data Management.
b. Click Data Encryption.
- The "Current Encryption Key" box should be available now.
- Enter the Previously saved Original Encryption key.
- Click "Activate"
You're all set.
Hello CRM Community,
I am in the process of migration 3 applications from Dynamics 2015 v7 on premise to Dynamics 365 v9 on premise. Ive been through the threads on lost or missing encryption keys and still not finding anything to help resolve my specific issue.
Heres what ive done for each application:
Out of these 3 Orgs i have on the v9 Dynamics platform, only 1 has allowed me to activate data encryption with same source key! The other 2 give me the "doesn’t match the original encryption key". Its really confusing to me only this 1 has allowed me when I know for a fact what the source keys are!
I have the source Orgs, DBs, and Config DB from the 2015 v7 platform. Each Org had Encryption Enabled to where I can pull them straight from CRM UI. Ive done the SQL to query them from MSCONFIG db and used a C# Console App to decrypt it like here: https://szczepan.net/?p=152 It generates the same ones ive pulled manually.
Ive tried different copy and pasting methods too!
I would rather avoid making new encryption keys because Im not too sure what all that might impact as ive never messed with this.
Any help would be appreciated!
Stay up to date on forum activity by subscribing. You can also customize your in-app and email Notification settings across all subscriptions.
#1
André Arnaud de Cal...
291,151
Super User 2024 Season 2
#2
Martin Dráb
229,963
Most Valuable Professional
#3
nmaenpaa
101,156
Share
Report
All responses (
Answers (