WID Service Master Key Could Not Be Force Regenerated

Started getting this error on Server 2012 R2, after installing the Remote Desktop Gateway service (part of Windows Server Essentials). I believe this is the first app to use the Windows Internal Database. No WSUS on this server.

Log Name:      Application
Source:        MSSQL$MICROSOFT##WID
Date:          12/21/2019 10:39:06 AM
Event ID:      5601
Task Category: Server
Level:         Error
Keywords:      Classic
User:          N/A
Description:
The service master key could not be force regenerated as requested by the -F startup option. The error number is 33094.

As I posted in this thread:

Granting “Log on as a service” user right to the “NT SERVICE\MSSQL$MICROSOFT##WID” account did not help:  the error recurred as soon as I restarted the Windows Internal Database service. Note that NT SERVICE\ALL SERVICES already has this user right, so that probably covers the WID user (see MSKB 2832204). Also, I have Server 2016 Essentials machine running RD Gateway without issues and that right is not present.

Here are the more detailed messages from C:\Windows\WID\Log\error.log:

2019-11-23 14:46:21.28 spid15s     Error: 33094, Severity: 16, State: 1.
2019-11-23 14:46:21.28 spid15s     An error occurred during Service Master Key encryption
2019-11-23 14:46:21.28 spid15s     Error: 5601, Severity: 16, State: 1.
2019-11-23 14:46:21.28 spid15s     The service master key could not be force regenerated as requested by the -F startup option. The error number is 33094.
2019-11-23 14:46:21.28 spid15s     Server local connection provider is ready to accept connection on [ \\.\pipe\MICROSOFT##WID\tsql\query ].

There is no -F parameter specified on the command line or in the registry. Maybe the error message is misleading–it needs the -F parameter because it can’t regenerate the key?

There is a way to regenerate the key in T-SQL (Stack Overflow post) but I’m reluctant to mess with that in the WID.

I haven’t found any other solutions. So far, I don’t think this is inhibiting functionality (though we’re not using the Remote Desktop Gateway yet).

Leave a Reply

Your email address will not be published. Required fields are marked *

Notify me of followup comments via e-mail. You can also subscribe without commenting.

This site uses Akismet to reduce spam. Learn how your comment data is processed.