--- description: "sys.dm_database_encryption_keys (Transact-SQL)" title: "sys.dm_database_encryption_keys (Transact-SQL) | Microsoft Docs" ms.custom: "" ms.date: 03/27/2019 ms.prod: sql ms.prod_service: "database-engine, sql-database" ms.reviewer: "" ms.technology: system-objects ms.topic: "reference" f1_keywords: - "sys.dm_database_encryption_keys" - "sys.dm_database_encryption_keys_TSQL" - "dm_database_encryption_keys" - "dm_database_encryption_keys_TSQL" dev_langs: - "TSQL" helpviewer_keywords: - "sys.dm_database_encryption_keys dynamic management view" ms.assetid: 56fee8f3-06eb-4fff-969e-abeaa0c4b8e4 author: WilliamDAssafMSFT ms.author: wiassaf monikerRange: "=azuresqldb-current||>=sql-server-2016||>=sql-server-linux-2017||=azuresqldb-mi-current" --- # sys.dm_database_encryption_keys (Transact-SQL) [!INCLUDE [SQL Server SQL Database](../../includes/applies-to-version/sql-asdb.md)] Returns information about the encryption state of a database and its associated database encryption keys. For more information about database encryption, see [Transparent Data Encryption (TDE)](../../relational-databases/security/encryption/transparent-data-encryption.md). |Column Name|Data Type|Description| |-----------------|---------------|-----------------| |database_id|**int**|ID of the database.| |encryption_state|**int**|Indicates whether the database is encrypted or not encrypted.

0 = No database encryption key present, no encryption

1 = Unencrypted

2 = Encryption in progress

3 = Encrypted

4 = Key change in progress

5 = Decryption in progress

6 = Protection change in progress (The certificate or asymmetric key that is encrypting the database encryption key is being changed.)| |create_date|**datetime**|Displays the date (in UTC) the encryption key was created.| |regenerate_date|**datetime**|Displays the date (in UTC) the encryption key was regenerated.| |modify_date|**datetime**|Displays the date (in UTC) the encryption key was modified.| |set_date|**datetime**|Displays the date (in UTC) the encryption key was applied to the database.| |opened_date|**datetime**|Shows when (in UTC) the database key was last opened.| |key_algorithm|**nvarchar(32)**|Displays the algorithm that is used for the key.| |key_length|**int**|Displays the length of the key.| |encryptor_thumbprint|**varbinary(20)**|Shows the thumbprint of the encryptor.| |encryptor_type|**nvarchar(32)**|**Applies to**: [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] ([!INCLUDE[ssSQL11](../../includes/sssql11-md.md)] through [current version](/troubleshoot/sql/general/determine-version-edition-update-level)).

Describes the encryptor.| |percent_complete|**real**|Percent complete of the database encryption state change. This will be 0 if there is no state change.| |encryption_state_desc|**nvarchar(32)**|**Applies to**: [!INCLUDE[sql-server-2019](../../includes/sssql19-md.md)] and later.

String that indicates whether the database is encrypted or not encrypted.

NONE

UNENCRYPTED

ENCRYPTED

DECRYPTION_IN_PROGRESS

ENCRYPTION_IN_PROGRESS

KEY_CHANGE_IN_PROGRESS

PROTECTION_CHANGE_IN_PROGRESS| |encryption_scan_state|**int**|**Applies to**: [!INCLUDE[sql-server-2019](../../includes/sssql19-md.md)] and later.

Indicates the current state of the encryption scan.

0 = No scan has been initiated, TDE is not enabled

1 = Scan is in progress.

2 = Scan is in progress but has been suspended, user can resume.

3 = Scan was aborted for some reason, manual intervention is required. Contact Microsoft Support for more assistance.

4 = Scan has been successfully completed, TDE is enabled and encryption is complete.| |encryption_scan_state_desc|**nvarchar(32)**|**Applies to**: [!INCLUDE[sql-server-2019](../../includes/sssql19-md.md)] and later.

String that indicates the current state of the encryption scan.

NONE

RUNNING

SUSPENDED

ABORTED

COMPLETE| |encryption_scan_modify_date|**datetime**|**Applies to**: [!INCLUDE[sql-server-2019](../../includes/sssql19-md.md)] and later.

Displays the date (in UTC) the encryption scan state was last modified.| ## Permissions On [!INCLUDE[ssNoVersion_md](../../includes/ssnoversion-md.md)], requires `VIEW SERVER STATE` permission. On SQL Database Basic, S0, and S1 service objectives, and for databases in elastic pools, the [server admin](/azure/azure-sql/database/logins-create-manage#existing-logins-and-user-accounts-after-creating-a-new-database) account or the [Azure Active Directory admin](/azure/azure-sql/database/authentication-aad-overview#administrator-structure) account is required. On all other SQL Database service objectives, the `VIEW DATABASE STATE` permission is required in the database. ## See Also [Security-Related Dynamic Management Views and Functions (Transact-SQL)](../../relational-databases/system-dynamic-management-views/security-related-dynamic-management-views-and-functions-transact-sql.md) [Transparent Data Encryption (TDE)](../../relational-databases/security/encryption/transparent-data-encryption.md) [SQL Server Encryption](../../relational-databases/security/encryption/sql-server-encryption.md) [SQL Server and Database Encryption Keys (Database Engine)](../../relational-databases/security/encryption/sql-server-and-database-encryption-keys-database-engine.md) [Encryption Hierarchy](../../relational-databases/security/encryption/encryption-hierarchy.md) [ALTER DATABASE SET Options (Transact-SQL)](../../t-sql/statements/alter-database-transact-sql-set-options.md) [CREATE DATABASE ENCRYPTION KEY (Transact-SQL)](../../t-sql/statements/create-database-encryption-key-transact-sql.md) [ALTER DATABASE ENCRYPTION KEY (Transact-SQL)](../../t-sql/statements/alter-database-encryption-key-transact-sql.md) [DROP DATABASE ENCRYPTION KEY (Transact-SQL)](../../t-sql/statements/drop-database-encryption-key-transact-sql.md)